elastic · TinaHeiligers · Feb 3, 2021 · Feb 3, 2021 · Feb 3, 2021 · Feb 4, 2021
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
@@ -21,6 +21,7 @@ readonly links: {
             readonly installation: string;
             readonly configuration: string;
             readonly elasticsearchOutput: string;
+            readonly elasticsearchModule: string;
             readonly startup: string;
             readonly exportedFields: string;
         };
@@ -29,6 +30,10 @@ readonly links: {
         };
         readonly metricbeat: {
             readonly base: string;
+            readonly configure: string;
+            readonly httpEndpoint: string;
+            readonly install: string;
+            readonly start: string;
         };
         readonly enterpriseSearch: {
             readonly base: string;

diff --git a/docs/maps/connect-to-ems.asciidoc b/docs/maps/connect-to-ems.asciidoc
@@ -86,7 +86,7 @@ endif::[]
 
 [cols="2*<"]
 |===
-| [[ems-hostname]]`hostname`
+| [[ems-host]]`host`
  | Specifies the host of the backend server. To allow remote users to connect, set the value to the IP address or DNS name of the {hosted-ems} container. *Default: _your-hostname_*. <<server-host,Equivalent {kib} setting>>.
 
 | `port`
@@ -199,7 +199,7 @@ TIP: The available basemaps and boundaries can be explored from the `/maps` endp
 [[elastic-maps-server-kibana]]
 ==== Kibana configuration
 
-With {hosted-ems} running, add the `map.emsUrl` configuration key in your <<settings, kibana.yml>> file pointing to the root of the service. This setting will point {kib} to request EMS basemaps and boundaries from {hosted-ems}. Typically this will be the URL to the <<ems-hostname,hostname and port>> of {hosted-ems}. For example, `map.emsUrl: https://my-ems-server:8080`. 
+With {hosted-ems} running, add the `map.emsUrl` configuration key in your <<settings, kibana.yml>> file pointing to the root of the service. This setting will point {kib} to request EMS basemaps and boundaries from {hosted-ems}. Typically this will be the URL to the <<ems-host,host and port>> of {hosted-ems}. For example, `map.emsUrl: https://my-ems-server:8080`. 
 
 
 [float]

diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
@@ -306,10 +306,11 @@ the `polling` method could be used enabling that option. *Default: `false`*
 suppress all logging output. *Default: `false`*
 
 | `logging.timezone`
- | Set to the canonical time zone ID
+ | Optional. Set to the canonical time zone ID
 (for example, `America/Los_Angeles`) to log events using that time zone.
 For possible values, refer to
-https://en.wikipedia.org/wiki/List_of_tz_database_time_zones[database time zones]. *Default: `UTC`*
+https://en.wikipedia.org/wiki/List_of_tz_database_time_zones[database time zones]. When not set,
+ log dates will be in the {kib} host timezone.
 
 | [[logging-verbose]] `logging.verbose:` {ess-icon}
  | Set to `true` to log all events, including system usage information and all

diff --git a/rfcs/images/api_doc_pick.png b/rfcs/images/api_doc_pick.png
diff --git a/rfcs/images/api_doc_tech.png b/rfcs/images/api_doc_tech.png
diff --git a/rfcs/images/api_doc_tech_compare.png b/rfcs/images/api_doc_tech_compare.png
diff --git a/rfcs/images/api_docs.png b/rfcs/images/api_docs.png
diff --git a/rfcs/images/api_docs_package_current.png b/rfcs/images/api_docs_package_current.png
diff --git a/rfcs/images/api_info.png b/rfcs/images/api_info.png
diff --git a/rfcs/images/current_api_doc_links.png b/rfcs/images/current_api_doc_links.png
diff --git a/rfcs/images/new_api_docs_with_links.png b/rfcs/images/new_api_docs_with_links.png
diff --git a/rfcs/images/repeat_primitive_signature.png b/rfcs/images/repeat_primitive_signature.png
diff --git a/rfcs/images/repeat_type_links.png b/rfcs/images/repeat_type_links.png
diff --git a/rfcs/text/0014_api_documentation.md b/rfcs/text/0014_api_documentation.md
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
@@ -39,6 +39,7 @@ export class DocLinksService {
           base: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}`,
           installation: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-installation-configuration.html`,
           configuration: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/configuring-howto-filebeat.html`,
+          elasticsearchModule: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-module-elasticsearch.html`,
           elasticsearchOutput: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/elasticsearch-output.html`,
           startup: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-starting.html`,
           exportedFields: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/exported-fields.html`,
@@ -53,6 +54,10 @@ export class DocLinksService {
         },
         metricbeat: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/beats/metricbeat/${DOC_LINK_VERSION}`,
+          configure: `${ELASTIC_WEBSITE_URL}guide/en/beats/metricbeat/${DOC_LINK_VERSION}/configuring-howto-metricbeat.html`,
+          httpEndpoint: `${ELASTIC_WEBSITE_URL}guide/en/beats/metricbeat/${DOC_LINK_VERSION}/http-endpoint.html`,
+          install: `${ELASTIC_WEBSITE_URL}guide/en/beats/metricbeat/${DOC_LINK_VERSION}/metricbeat-installation-configuration.html`,
+          start: `${ELASTIC_WEBSITE_URL}guide/en/beats/metricbeat/${DOC_LINK_VERSION}/metricbeat-starting.html`,
         },
         heartbeat: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/beats/heartbeat/${DOC_LINK_VERSION}`,
@@ -116,6 +121,7 @@ export class DocLinksService {
         addData: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/connect-to-elasticsearch.html`,
         kibana: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/index.html`,
         elasticsearch: {
+          mapping: `${ELASTICSEARCH_DOCS}mapping.html`,
           remoteClusters: `${ELASTICSEARCH_DOCS}modules-remote-clusters.html`,
           remoteClustersProxy: `${ELASTICSEARCH_DOCS}modules-remote-clusters.html#proxy-mode`,
           remoteClusersProxySettings: `${ELASTICSEARCH_DOCS}modules-remote-clusters.html#remote-cluster-proxy-settings`,
@@ -193,8 +199,11 @@ export class DocLinksService {
           alertsKibanaDiskThreshold: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/kibana-alerts.html#kibana-alerts-disk-usage-threshold`,
           alertsKibanaJvmThreshold: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/kibana-alerts.html#kibana-alerts-jvm-memory-threshold`,
           alertsKibanaMissingData: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/kibana-alerts.html#kibana-alerts-missing-monitoring-data`,
+          metricbeatBlog: `${ELASTIC_WEBSITE_URL}blog/external-collection-for-elastic-stack-monitoring-is-now-available-via-metricbeat`,
           monitorElasticsearch: `${ELASTICSEARCH_DOCS}configuring-metricbeat.html`,
           monitorKibana: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/monitoring-metricbeat.html`,
+          monitorLogstash: `${ELASTIC_WEBSITE_URL}guide/en/logstash/${DOC_LINK_VERSION}/monitoring-with-metricbeat.html`,
+          troubleshootKibana: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/monitor-troubleshooting.html`,
         },
         security: {
           apiKeyServiceSettings: `${ELASTICSEARCH_DOCS}security-settings.html#api-key-service-settings`,
@@ -257,6 +266,7 @@ export interface DocLinksStart {
       readonly installation: string;
       readonly configuration: string;
       readonly elasticsearchOutput: string;
+      readonly elasticsearchModule: string;
       readonly startup: string;
       readonly exportedFields: string;
     };
@@ -265,6 +275,10 @@ export interface DocLinksStart {
     };
     readonly metricbeat: {
       readonly base: string;
+      readonly configure: string;
+      readonly httpEndpoint: string;
+      readonly install: string;
+      readonly start: string;
     };
     readonly enterpriseSearch: {
       readonly base: string;

diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
@@ -474,6 +474,7 @@ export interface DocLinksStart {
             readonly installation: string;
             readonly configuration: string;
             readonly elasticsearchOutput: string;
+            readonly elasticsearchModule: string;
             readonly startup: string;
             readonly exportedFields: string;
         };
@@ -482,6 +483,10 @@ export interface DocLinksStart {
         };
         readonly metricbeat: {
             readonly base: string;
+            readonly configure: string;
+            readonly httpEndpoint: string;
+            readonly install: string;
+            readonly start: string;
         };
         readonly enterpriseSearch: {
             readonly base: string;

diff --git a/src/core/server/legacy/integration_tests/logging.test.ts b/src/core/server/legacy/integration_tests/logging.test.ts
@@ -87,7 +87,7 @@ describe('logging service', () => {
         const loggedString = getPlatformLogsFromMock(mockConsoleLog);
         expect(loggedString).toMatchInlineSnapshot(`
           Array [
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][INFO ][test-file] handled by NP",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][INFO ][test-file] handled by NP",
           ]
         `);
       });
@@ -131,9 +131,9 @@ describe('logging service', () => {
 
         expect(getPlatformLogsFromMock(mockConsoleLog)).toMatchInlineSnapshot(`
           Array [
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][INFO ][test-file] info",
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][WARN ][test-file] warn",
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][ERROR][test-file] error",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][INFO ][test-file] info",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][WARN ][test-file] warn",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][ERROR][test-file] error",
           ]
         `);
 
@@ -162,9 +162,9 @@ describe('logging service', () => {
 
         expect(getPlatformLogsFromMock(mockConsoleLog)).toMatchInlineSnapshot(`
           Array [
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][INFO ][test-file] info",
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][WARN ][test-file] warn",
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][ERROR][test-file] error",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][INFO ][test-file] info",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][WARN ][test-file] warn",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][ERROR][test-file] error",
           ]
         `);
 
@@ -199,9 +199,9 @@ describe('logging service', () => {
 
         expect(getPlatformLogsFromMock(mockConsoleLog)).toMatchInlineSnapshot(`
           Array [
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][INFO ][test-file] info",
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][WARN ][test-file] warn",
-            "[xxxx-xx-xxTxx:xx:xx.xxxZ][ERROR][test-file] error",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][INFO ][test-file] info",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][WARN ][test-file] warn",
+            "[xxxx-xx-xxTxx:xx:xx.xxx-xx:xx][ERROR][test-file] error",
           ]
         `);
 

diff --git a/src/core/server/logging/README.md b/src/core/server/logging/README.md
@@ -110,12 +110,12 @@ Example of `%meta` output:
 
 ##### date
 Outputs the date of the logging event. The date conversion specifier may be followed by a set of braces containing a name of predefined date format and canonical timezone name.
-Timezone name is expected to be one from [TZ database name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
+Timezone name is expected to be one from [TZ database name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). Timezone defaults to the host timezone when not explicitly specified.
 Example of `%date` output:
 
 | Conversion pattern                       | Example                                                          |
 | ---------------------------------------- | ---------------------------------------------------------------- |
-| `%date`                                  | `2012-02-01T14:30:22.011Z` uses `ISO8601` format by default      |
+| `%date`                                  | `2012-02-01T09:30:22.011-05:00` uses `ISO8601` format with timezone by default      |
 | `%date{ISO8601}`                         | `2012-02-01T14:30:22.011Z`                                       |
 | `%date{ISO8601_TZ}`                      | `2012-02-01T09:30:22.011-05:00`   `ISO8601` with timezone        |
 | `%date{ISO8601_TZ}{America/Los_Angeles}` | `2012-02-01T06:30:22.011-08:00`                                  |
@@ -410,22 +410,22 @@ loggerWithNestedContext.debug('Message with `debug` log level.');
 
 And assuming logger for `server` context with `console` appender and `trace` level was used, console output will look like this:
 ```bash
-[2017-07-25T18:54:41.639Z][TRACE][server] Message with `trace` log level.
-[2017-07-25T18:54:41.639Z][DEBUG][server] Message with `debug` log level.
-[2017-07-25T18:54:41.639Z][INFO ][server] Message with `info` log level.
-[2017-07-25T18:54:41.639Z][WARN ][server] Message with `warn` log level.
-[2017-07-25T18:54:41.639Z][ERROR][server] Message with `error` log level.
-[2017-07-25T18:54:41.639Z][FATAL][server] Message with `fatal` log level.
-
-[2017-07-25T18:54:41.639Z][TRACE][server.http] Message with `trace` log level.
-[2017-07-25T18:54:41.639Z][DEBUG][server.http] Message with `debug` log level.
+[2017-07-25T11:54:41.639-07:00][TRACE][server] Message with `trace` log level.
+[2017-07-25T11:54:41.639-07:00][DEBUG][server] Message with `debug` log level.
+[2017-07-25T11:54:41.639-07:00][INFO ][server] Message with `info` log level.
+[2017-07-25T11:54:41.639-07:00][WARN ][server] Message with `warn` log level.
+[2017-07-25T11:54:41.639-07:00][ERROR][server] Message with `error` log level.
+[2017-07-25T11:54:41.639-07:00][FATAL][server] Message with `fatal` log level.
+
+[2017-07-25T11:54:41.639-07:00][TRACE][server.http] Message with `trace` log level.
+[2017-07-25T11:54:41.639-07:00][DEBUG][server.http] Message with `debug` log level.
 ```
 
 The log will be less verbose with `warn` level for the `server` context:
 ```bash
-[2017-07-25T18:54:41.639Z][WARN ][server] Message with `warn` log level.
-[2017-07-25T18:54:41.639Z][ERROR][server] Message with `error` log level.
-[2017-07-25T18:54:41.639Z][FATAL][server] Message with `fatal` log level.
+[2017-07-25T11:54:41.639-07:00][WARN ][server] Message with `warn` log level.
+[2017-07-25T11:54:41.639-07:00][ERROR][server] Message with `error` log level.
+[2017-07-25T11:54:41.639-07:00][FATAL][server] Message with `fatal` log level.
 ```
 
 ### Logging config migration
@@ -488,7 +488,7 @@ logging.root.level: all
 
 #### logging.timezone
 Set to the canonical timezone id to log events using that timezone. New logging config allows
-to [specify timezone](#date) for `layout: pattern`.
+to [specify timezone](#date) for `layout: pattern`. Defaults to host timezone when not specified.
 ```yaml
 logging:
   appenders:
@@ -530,7 +530,7 @@ TBD
 
 | Parameter       | Platform log record in **pattern** format  | Legacy Platform log record **text** format |
 | --------------- | ------------------------------------------ | ------------------------------------------ |
-| @timestamp      | ISO8601 `2012-01-31T23:33:22.011Z`         | Absolute `23:33:22.011`                    |
+| @timestamp      | ISO8601_TZ `2012-01-31T23:33:22.011-05:00` | Absolute `23:33:22.011`                    |
 | context         | `parent.child`                             | `['parent', 'child']`                      |
 | level           | `DEBUG`                                    | `['debug']`                                |
 | meta            | stringified JSON object `{"to": "v8"}`     | N/A                                        |

diff --git a/src/core/server/logging/__snapshots__/logging_system.test.ts.snap b/src/core/server/logging/__snapshots__/logging_system.test.ts.snap
diff --git a/src/core/server/logging/layouts/__snapshots__/pattern_layout.test.ts.snap b/src/core/server/logging/layouts/__snapshots__/pattern_layout.test.ts.snap