From 9b3529a2a1d2185336f0d11defe0c80e237edc05 Mon Sep 17 00:00:00 2001
From: Dzmitry Lemechko <dzmitry.lemechko@elastic.co>
Date: Wed, 20 Oct 2021 14:19:42 +0200
Subject: [PATCH 1/6] [ftr] update webdriver dependency to 4.0 (#115649)

* [ftr] update webdriver dependency to 4.0

* [ftr] cast options on assign

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 package.json                                 |   4 +-
 test/functional/services/remote/webdriver.ts | 124 +++++++++----------
 yarn.lock                                    |  59 ++++-----
 3 files changed, 87 insertions(+), 100 deletions(-)

diff --git a/package.json b/package.json
index f4706b5afe7cd..7c915f2f12228 100644
--- a/package.json
+++ b/package.json
@@ -598,7 +598,7 @@
     "@types/reduce-reducers": "^1.0.0",
     "@types/redux-actions": "^2.6.1",
     "@types/seedrandom": ">=2.0.0 <4.0.0",
-    "@types/selenium-webdriver": "^4.0.9",
+    "@types/selenium-webdriver": "^4.0.15",
     "@types/semver": "^7",
     "@types/set-value": "^2.0.0",
     "@types/sinon": "^7.0.13",
@@ -780,7 +780,7 @@
     "rxjs-marbles": "^5.0.6",
     "sass-loader": "^10.2.0",
     "sass-resources-loader": "^2.0.1",
-    "selenium-webdriver": "^4.0.0-alpha.7",
+    "selenium-webdriver": "^4.0.0",
     "serve-static": "1.14.1",
     "shelljs": "^0.8.4",
     "simple-git": "1.116.0",
diff --git a/test/functional/services/remote/webdriver.ts b/test/functional/services/remote/webdriver.ts
index 7d629ee817252..82a9f9b7d3f27 100644
--- a/test/functional/services/remote/webdriver.ts
+++ b/test/functional/services/remote/webdriver.ts
@@ -71,6 +71,60 @@ export interface BrowserConfig {
   acceptInsecureCerts: boolean;
 }
 
+function initChromiumOptions(browserType: Browsers, acceptInsecureCerts: boolean) {
+  const options = browserType === Browsers.Chrome ? new chrome.Options() : new edge.Options();
+
+  options.addArguments(
+    // Disables the sandbox for all process types that are normally sandboxed.
+    'no-sandbox',
+    // Launches URL in new browser window.
+    'new-window',
+    // By default, file:// URIs cannot read other file:// URIs. This is an override for developers who need the old behavior for testing.
+    'allow-file-access-from-files',
+    // Use fake device for Media Stream to replace actual camera and microphone.
+    'use-fake-device-for-media-stream',
+    // Bypass the media stream infobar by selecting the default device for media streams (e.g. WebRTC). Works with --use-fake-device-for-media-stream.
+    'use-fake-ui-for-media-stream'
+  );
+
+  if (process.platform === 'linux') {
+    // The /dev/shm partition is too small in certain VM environments, causing
+    // Chrome to fail or crash. Use this flag to work-around this issue
+    // (a temporary directory will always be used to create anonymous shared memory files).
+    options.addArguments('disable-dev-shm-usage');
+  }
+
+  if (headlessBrowser === '1') {
+    // Use --disable-gpu to avoid an error from a missing Mesa library, as per
+    // See: https://chromium.googlesource.com/chromium/src/+/lkgr/headless/README.md
+    options.headless();
+    options.addArguments('disable-gpu');
+  }
+
+  if (certValidation === '0') {
+    options.addArguments('ignore-certificate-errors');
+  }
+
+  if (remoteDebug === '1') {
+    // Visit chrome://inspect in chrome to remotely view/debug
+    options.headless();
+    options.addArguments('disable-gpu', 'remote-debugging-port=9222');
+  }
+
+  if (browserBinaryPath) {
+    options.setChromeBinaryPath(browserBinaryPath);
+  }
+
+  const prefs = new logging.Preferences();
+  prefs.setLevel(logging.Type.BROWSER, logging.Level.ALL);
+  options.setUserPreferences(chromiumUserPrefs);
+  options.setLoggingPrefs(prefs);
+  options.set('unexpectedAlertBehaviour', 'accept');
+  options.setAcceptInsecureCerts(acceptInsecureCerts);
+
+  return options;
+}
+
 let attemptCounter = 0;
 let edgePaths: { driverPath: string | undefined; browserPath: string | undefined };
 async function attemptToCreateCommand(
@@ -86,55 +140,10 @@ async function attemptToCreateCommand(
   const buildDriverInstance = async () => {
     switch (browserType) {
       case 'chrome': {
-        const chromeOptions = new chrome.Options();
-        chromeOptions.addArguments(
-          // Disables the sandbox for all process types that are normally sandboxed.
-          'no-sandbox',
-          // Launches URL in new browser window.
-          'new-window',
-          // By default, file:// URIs cannot read other file:// URIs. This is an override for developers who need the old behavior for testing.
-          'allow-file-access-from-files',
-          // Use fake device for Media Stream to replace actual camera and microphone.
-          'use-fake-device-for-media-stream',
-          // Bypass the media stream infobar by selecting the default device for media streams (e.g. WebRTC). Works with --use-fake-device-for-media-stream.
-          'use-fake-ui-for-media-stream'
-        );
-
-        if (process.platform === 'linux') {
-          // The /dev/shm partition is too small in certain VM environments, causing
-          // Chrome to fail or crash. Use this flag to work-around this issue
-          // (a temporary directory will always be used to create anonymous shared memory files).
-          chromeOptions.addArguments('disable-dev-shm-usage');
-        }
-
-        if (headlessBrowser === '1') {
-          // Use --disable-gpu to avoid an error from a missing Mesa library, as per
-          // See: https://chromium.googlesource.com/chromium/src/+/lkgr/headless/README.md
-          chromeOptions.headless();
-          chromeOptions.addArguments('disable-gpu');
-        }
-
-        if (certValidation === '0') {
-          chromeOptions.addArguments('ignore-certificate-errors');
-        }
-
-        if (remoteDebug === '1') {
-          // Visit chrome://inspect in chrome to remotely view/debug
-          chromeOptions.headless();
-          chromeOptions.addArguments('disable-gpu', 'remote-debugging-port=9222');
-        }
-
-        if (browserBinaryPath) {
-          chromeOptions.setChromeBinaryPath(browserBinaryPath);
-        }
-
-        const prefs = new logging.Preferences();
-        prefs.setLevel(logging.Type.BROWSER, logging.Level.ALL);
-        chromeOptions.setUserPreferences(chromiumUserPrefs);
-        chromeOptions.setLoggingPrefs(prefs);
-        chromeOptions.set('unexpectedAlertBehaviour', 'accept');
-        chromeOptions.setAcceptInsecureCerts(config.acceptInsecureCerts);
-
+        const chromeOptions = initChromiumOptions(
+          browserType,
+          config.acceptInsecureCerts
+        ) as chrome.Options;
         let session;
         if (remoteSessionUrl) {
           session = await new Builder()
@@ -169,19 +178,10 @@ async function attemptToCreateCommand(
 
       case 'msedge': {
         if (edgePaths && edgePaths.browserPath && edgePaths.driverPath) {
-          const edgeOptions = new edge.Options();
-          if (headlessBrowser === '1') {
-            // @ts-ignore internal modules are not typed
-            edgeOptions.headless();
-          }
-          // @ts-ignore internal modules are not typed
-          edgeOptions.setEdgeChromium(true);
-          // @ts-ignore internal modules are not typed
-          edgeOptions.setBinaryPath(edgePaths.browserPath);
-          const options = edgeOptions.get('ms:edgeOptions');
-          // overriding options to include preferences
-          Object.assign(options, { prefs: chromiumUserPrefs });
-          edgeOptions.set('ms:edgeOptions', options);
+          const edgeOptions = initChromiumOptions(
+            browserType,
+            config.acceptInsecureCerts
+          ) as edge.Options;
           const session = await new Builder()
             .forBrowser('MicrosoftEdge')
             .setEdgeOptions(edgeOptions)
diff --git a/yarn.lock b/yarn.lock
index 375e748564283..8d174464d0a92 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6985,10 +6985,10 @@
   resolved "https://registry.yarnpkg.com/@types/seedrandom/-/seedrandom-2.4.28.tgz#9ce8fa048c1e8c85cb71d7fe4d704e000226036f"
   integrity sha512-SMA+fUwULwK7sd/ZJicUztiPs8F1yCPwF3O23Z9uQ32ME5Ha0NmDK9+QTsYE4O2tHXChzXomSWWeIhCnoN1LqA==
 
-"@types/selenium-webdriver@^4.0.9":
-  version "4.0.9"
-  resolved "https://registry.yarnpkg.com/@types/selenium-webdriver/-/selenium-webdriver-4.0.9.tgz#12621e55b2ef8f6c98bd17fe23fa720c6cba16bd"
-  integrity sha512-HopIwBE7GUXsscmt/J0DhnFXLSmO04AfxT6b8HAprknwka7pqEWquWDMXxCjd+NUHK9MkCe1SDKKsMiNmCItbQ==
+"@types/selenium-webdriver@^4.0.15":
+  version "4.0.15"
+  resolved "https://registry.yarnpkg.com/@types/selenium-webdriver/-/selenium-webdriver-4.0.15.tgz#03012b84155cf6bbae2f64aa9dccf2a84c78c7c8"
+  integrity sha512-5760PIZkzhPejy3hsKAdCKe5LJygGdxLKOLxmZL9GEUcFlO5OgzM6G2EbdbvOnaw4xvUSa9Uip6Ipwkih12BPA==
 
 "@types/semver@^7":
   version "7.3.4"
@@ -18808,10 +18808,10 @@ jsts@^1.6.2:
     array-includes "^3.1.2"
     object.assign "^4.1.2"
 
-jszip@^3.2.2:
-  version "3.3.0"
-  resolved "https://registry.yarnpkg.com/jszip/-/jszip-3.3.0.tgz#29d72c21a54990fa885b11fc843db320640d5271"
-  integrity sha512-EJ9k766htB1ZWnsV5ZMDkKLgA+201r/ouFF8R2OigVjVdcm2rurcBrrdXaeqBJbqnUVMko512PYmlncBKE1Huw==
+jszip@^3.6.0:
+  version "3.7.1"
+  resolved "https://registry.yarnpkg.com/jszip/-/jszip-3.7.1.tgz#bd63401221c15625a1228c556ca8a68da6fda3d9"
+  integrity sha512-ghL0tz1XG9ZEmRMcEN2vt7xabrDdqHHeykgARpmZ0BiIctWxM47Vt63ZO2dnp4QYt/xJVLLy5Zv1l/xRdh2byg==
   dependencies:
     lie "~3.3.0"
     pako "~1.0.2"
@@ -21737,7 +21737,7 @@ os-shim@^0.1.2:
   resolved "https://registry.yarnpkg.com/os-shim/-/os-shim-0.1.3.tgz#6b62c3791cf7909ea35ed46e17658bb417cb3917"
   integrity sha1-a2LDeRz3kJ6jXtRuF2WLtBfLORc=
 
-os-tmpdir@^1.0.0, os-tmpdir@~1.0.1, os-tmpdir@~1.0.2:
+os-tmpdir@^1.0.0, os-tmpdir@~1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/os-tmpdir/-/os-tmpdir-1.0.2.tgz#bbe67406c79aa85c5cfec766fe5734555dfa1274"
   integrity sha1-u+Z0BseaqFxc/sdm/lc0VV36EnQ=
@@ -25397,13 +25397,6 @@ rimraf@^2.2.8, rimraf@^2.5.4, rimraf@^2.6.2, rimraf@^2.6.3:
   dependencies:
     glob "^7.1.3"
 
-rimraf@^2.7.1:
-  version "2.7.1"
-  resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.7.1.tgz#35797f13a7fdadc566142c29d4f07ccad483e3ec"
-  integrity sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==
-  dependencies:
-    glob "^7.1.3"
-
 rimraf@~2.4.0:
   version "2.4.5"
   resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.4.5.tgz#ee710ce5d93a8fdb856fb5ea8ff0e2d75934b2da"
@@ -25709,14 +25702,15 @@ select-hose@^2.0.0:
   resolved "https://registry.yarnpkg.com/select-hose/-/select-hose-2.0.0.tgz#625d8658f865af43ec962bfc376a37359a4994ca"
   integrity sha1-Yl2GWPhlr0Psliv8N2o3NZpJlMo=
 
-selenium-webdriver@^4.0.0-alpha.7:
-  version "4.0.0-alpha.7"
-  resolved "https://registry.yarnpkg.com/selenium-webdriver/-/selenium-webdriver-4.0.0-alpha.7.tgz#e3879d8457fd7ad8e4424094b7dc0540d99e6797"
-  integrity sha512-D4qnTsyTr91jT8f7MfN+OwY0IlU5+5FmlO5xlgRUV6hDEV8JyYx2NerdTEqDDkNq7RZDYc4VoPALk8l578RBHw==
+selenium-webdriver@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/selenium-webdriver/-/selenium-webdriver-4.0.0.tgz#7dc8969facee3be634459e173f557b7e34308e73"
+  integrity sha512-tOlu6FnTjPq2FKpd153pl8o2cB7H40Rvl/ogiD2sapMv4IDjQqpIxbd+swDJe9UDLdszeh5CDis6lgy4e9UG1w==
   dependencies:
-    jszip "^3.2.2"
-    rimraf "^2.7.1"
-    tmp "0.0.30"
+    jszip "^3.6.0"
+    rimraf "^3.0.2"
+    tmp "^0.2.1"
+    ws ">=7.4.6"
 
 selfsigned@^1.10.7:
   version "1.10.8"
@@ -27871,13 +27865,6 @@ title-case@^2.1.1:
     no-case "^2.2.0"
     upper-case "^1.0.3"
 
-tmp@0.0.30:
-  version "0.0.30"
-  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.0.30.tgz#72419d4a8be7d6ce75148fd8b324e593a711c2ed"
-  integrity sha1-ckGdSovn1s51FI/YsyTlk6cRwu0=
-  dependencies:
-    os-tmpdir "~1.0.1"
-
 tmp@^0.0.33:
   version "0.0.33"
   resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.0.33.tgz#6d34335889768d21b2bcda0aa277ced3b1bfadf9"
@@ -27885,7 +27872,7 @@ tmp@^0.0.33:
   dependencies:
     os-tmpdir "~1.0.2"
 
-tmp@~0.2.1:
+tmp@^0.2.1, tmp@~0.2.1:
   version "0.2.1"
   resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.1.tgz#8457fc3037dcf4719c251367a1af6500ee1ccf14"
   integrity sha512-76SUhtfqR2Ijn+xllcI5P1oyannHNHByD80W1q447gU3mp9G9PSpGdWmjUOHRDPiHYacIk66W7ubDTuPF3BEtQ==
@@ -30289,6 +30276,11 @@ write-pkg@^4.0.0:
     type-fest "^0.4.1"
     write-json-file "^3.2.0"
 
+ws@>=7.4.6, ws@^7.4.6:
+  version "7.5.5"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.5.tgz#8b4bc4af518cfabd0473ae4f99144287b33eb881"
+  integrity sha512-BAkMFcAzl8as1G/hArkxOxq3G7pjUqQ3gzYbLL0/5zNkph70e+lCoxBGnm6AW1+/aiNeV4fnKqZ8m4GZewmH2w==
+
 ws@^6.1.2, ws@^6.2.1:
   version "6.2.2"
   resolved "https://registry.yarnpkg.com/ws/-/ws-6.2.2.tgz#dd5cdbd57a9979916097652d78f1cc5faea0c32e"
@@ -30301,11 +30293,6 @@ ws@^7.2.3:
   resolved "https://registry.yarnpkg.com/ws/-/ws-7.4.6.tgz#5654ca8ecdeee47c33a9a4bf6d28e2be2980377c"
   integrity sha512-YmhHDO4MzaDLB+M9ym/mDA5z0naX8j7SIlT8f8z+I0VtzsRbekxEutHSme7NPS2qE8StCYQNUnfWdXta/Yu85A==
 
-ws@^7.4.6:
-  version "7.5.5"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.5.tgz#8b4bc4af518cfabd0473ae4f99144287b33eb881"
-  integrity sha512-BAkMFcAzl8as1G/hArkxOxq3G7pjUqQ3gzYbLL0/5zNkph70e+lCoxBGnm6AW1+/aiNeV4fnKqZ8m4GZewmH2w==
-
 x-is-function@^1.0.4:
   version "1.0.4"
   resolved "https://registry.yarnpkg.com/x-is-function/-/x-is-function-1.0.4.tgz#5d294dc3d268cbdd062580e0c5df77a391d1fa1e"

From 453d4bca3678669ecb6833bd4800d9cbfbd29354 Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Wed, 20 Oct 2021 15:26:22 +0300
Subject: [PATCH 2/6] [XY] Fixes the formatting on multiple axis (#115552)

* [XY] fixes the formatting on multiple axis

* Move mock data to its own file
---
 .../xy/public/config/get_config.test.ts       |  44 ++++
 .../vis_types/xy/public/config/get_config.ts  |  14 +-
 src/plugins/vis_types/xy/public/mocks.ts      | 223 ++++++++++++++++++
 3 files changed, 277 insertions(+), 4 deletions(-)
 create mode 100644 src/plugins/vis_types/xy/public/config/get_config.test.ts
 create mode 100644 src/plugins/vis_types/xy/public/mocks.ts

diff --git a/src/plugins/vis_types/xy/public/config/get_config.test.ts b/src/plugins/vis_types/xy/public/config/get_config.test.ts
new file mode 100644
index 0000000000000..d046ac17c2b27
--- /dev/null
+++ b/src/plugins/vis_types/xy/public/config/get_config.test.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getConfig } from './get_config';
+import { visData, visParamsWithTwoYAxes } from '../mocks';
+
+// ToDo: add more tests for all the config properties
+describe('getConfig', () => {
+  it('identifies it as a timeChart if the x axis has a date field', () => {
+    const config = getConfig(visData, visParamsWithTwoYAxes);
+    expect(config.isTimeChart).toBe(true);
+  });
+
+  it('not adds the current time marker if the param is set to false', () => {
+    const config = getConfig(visData, visParamsWithTwoYAxes);
+    expect(config.showCurrentTime).toBe(false);
+  });
+
+  it('adds the current time marker if the param is set to false', () => {
+    const newVisParams = {
+      ...visParamsWithTwoYAxes,
+      addTimeMarker: true,
+    };
+    const config = getConfig(visData, newVisParams);
+    expect(config.showCurrentTime).toBe(true);
+  });
+
+  it('enables the histogram mode for a date_histogram', () => {
+    const config = getConfig(visData, visParamsWithTwoYAxes);
+    expect(config.enableHistogramMode).toBe(true);
+  });
+
+  it('assigns the correct formatter per y axis', () => {
+    const config = getConfig(visData, visParamsWithTwoYAxes);
+    expect(config.yAxes.length).toBe(2);
+    expect(config.yAxes[0].ticks?.formatter).toStrictEqual(config.aspects.y[1].formatter);
+    expect(config.yAxes[1].ticks?.formatter).toStrictEqual(config.aspects.y[0].formatter);
+  });
+});
diff --git a/src/plugins/vis_types/xy/public/config/get_config.ts b/src/plugins/vis_types/xy/public/config/get_config.ts
index 13c9a6c275f8e..d2a3b9ad2a103 100644
--- a/src/plugins/vis_types/xy/public/config/get_config.ts
+++ b/src/plugins/vis_types/xy/public/config/get_config.ts
@@ -50,10 +50,16 @@ export function getConfig(table: Datatable, params: VisParams): VisConfig {
     params.dimensions.x?.aggType === BUCKET_TYPES.DATE_HISTOGRAM
   );
   const tooltip = getTooltip(aspects, params);
-  const yAxes = params.valueAxes.map((a) =>
-    // uses first y aspect in array for formatting axis
-    getAxis<YScaleType>(a, params.grid, aspects.y[0], params.seriesParams)
-  );
+  const yAxes = params.valueAxes.map((a) => {
+    // find the correct aspect for each value axis
+    const aspectsIdx = params.seriesParams.findIndex((s) => s.valueAxis === a.id);
+    return getAxis<YScaleType>(
+      a,
+      params.grid,
+      aspects.y[aspectsIdx > -1 ? aspectsIdx : 0],
+      params.seriesParams
+    );
+  });
   const enableHistogramMode =
     (params.dimensions.x?.aggType === BUCKET_TYPES.DATE_HISTOGRAM ||
       params.dimensions.x?.aggType === BUCKET_TYPES.HISTOGRAM) &&
diff --git a/src/plugins/vis_types/xy/public/mocks.ts b/src/plugins/vis_types/xy/public/mocks.ts
new file mode 100644
index 0000000000000..bb74035485723
--- /dev/null
+++ b/src/plugins/vis_types/xy/public/mocks.ts
@@ -0,0 +1,223 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import type { Datatable } from '../../../expressions/public';
+import type { VisParams } from './types';
+
+export const visData = {
+  type: 'datatable',
+  columns: [
+    {
+      id: 'col-0-2',
+      name: 'timestamp per 12 hours',
+      meta: {
+        type: 'date',
+        field: 'timestamp',
+        index: 'kibana_sample_data_logs',
+      },
+    },
+    {
+      id: 'col-1-3',
+      name: 'Average memory',
+      meta: {
+        type: 'number',
+        field: 'memory',
+        index: 'kibana_sample_data_logs',
+      },
+    },
+    {
+      id: 'col-2-1',
+      name: 'Average bytes',
+      meta: {
+        type: 'number',
+        field: 'bytes',
+        index: 'kibana_sample_data_logs',
+      },
+    },
+  ],
+  rows: [
+    {
+      'col-0-2': 1632603600000,
+      'col-1-3': 27400,
+      'col-2-1': 6079.305555555556,
+    },
+    {
+      'col-0-2': 1632646800000,
+      'col-1-3': 148270,
+      'col-2-1': 6164.056818181818,
+    },
+    {
+      'col-0-2': 1632690000000,
+      'col-1-3': 235280,
+      'col-2-1': 6125.469387755102,
+    },
+    {
+      'col-0-2': 1632733200000,
+      'col-1-3': 206750,
+      'col-2-1': 5362.68306010929,
+    },
+  ],
+} as Datatable;
+
+export const visParamsWithTwoYAxes = {
+  type: 'histogram',
+  addLegend: true,
+  addTooltip: true,
+  legendPosition: 'right',
+  addTimeMarker: false,
+  maxLegendLines: 1,
+  truncateLegend: true,
+  categoryAxes: [
+    {
+      type: 'category',
+      id: 'CategoryAxis-1',
+      show: true,
+      position: 'bottom',
+      title: {},
+      scale: {
+        type: 'linear',
+      },
+      labels: {
+        filter: true,
+        show: true,
+        truncate: 100,
+      },
+    },
+  ],
+  labels: {
+    type: 'label',
+    show: false,
+  },
+  thresholdLine: {
+    type: 'threshold_line',
+    show: false,
+    value: 10,
+    width: 1,
+    style: 'full',
+    color: '#E7664C',
+  },
+  valueAxes: [
+    {
+      type: 'value',
+      name: 'LeftAxis-1',
+      id: 'ValueAxis-1',
+      show: true,
+      position: 'left',
+      axisType: 'value',
+      title: {
+        text: 'my custom title',
+      },
+      scale: {
+        type: 'linear',
+        mode: 'normal',
+        scaleType: 'linear',
+      },
+      labels: {
+        type: 'label',
+        filter: false,
+        rotate: 0,
+        show: true,
+        truncate: 100,
+      },
+    },
+    {
+      type: 'value',
+      name: 'RightAxis-1',
+      id: 'ValueAxis-2',
+      show: true,
+      position: 'right',
+      title: {
+        text: 'my custom title',
+      },
+      scale: {
+        type: 'linear',
+        mode: 'normal',
+      },
+      labels: {
+        filter: false,
+        rotate: 0,
+        show: true,
+        truncate: 100,
+      },
+    },
+  ],
+  grid: {
+    categoryLines: false,
+  },
+  seriesParams: [
+    {
+      type: 'histogram',
+      data: {
+        label: 'Average memory',
+        id: '3',
+      },
+      drawLinesBetweenPoints: true,
+      interpolate: 'linear',
+      lineWidth: 2,
+      mode: 'stacked',
+      show: true,
+      showCircles: true,
+      circlesRadius: 3,
+      seriesParamType: 'histogram',
+      valueAxis: 'ValueAxis-2',
+    },
+    {
+      type: 'line',
+      data: {
+        label: 'Average bytes',
+        id: '1',
+      },
+      drawLinesBetweenPoints: true,
+      interpolate: 'linear',
+      lineWidth: 2,
+      mode: 'stacked',
+      show: true,
+      showCircles: true,
+      circlesRadius: 3,
+      valueAxis: 'ValueAxis-1',
+    },
+  ],
+  dimensions: {
+    x: {
+      type: 'xy_dimension',
+      label: 'timestamp per 12 hours',
+      aggType: 'date_histogram',
+      accessor: 0,
+      format: {
+        id: 'date',
+        params: {
+          pattern: 'YYYY-MM-DD HH:mm',
+        },
+      },
+      params: {
+        date: true,
+      },
+    },
+    y: [
+      {
+        label: 'Average memory',
+        aggType: 'avg',
+        params: {},
+        accessor: 1,
+        format: {
+          id: 'number',
+          params: {},
+        },
+      },
+      {
+        label: 'Average bytes',
+        aggType: 'avg',
+        params: {},
+        accessor: 2,
+        format: {
+          id: 'bytes',
+          params: {},
+        },
+      },
+    ],
+  },
+} as unknown as VisParams;

From d9f80133ad5b7aed5468c7ab634ebb2c5411c4f1 Mon Sep 17 00:00:00 2001
From: Byron Hulcher <byronhulcher@gmail.com>
Date: Wed, 20 Oct 2021 09:23:07 -0400
Subject: [PATCH 3/6] [App Search] Improve visual design of Promoted Documents
 panel (#115683)

---
 .../curation/documents/hidden_documents.tsx   | 29 ++++----
 .../curation/documents/organic_documents.tsx  | 47 +++++++------
 .../documents/promoted_documents.scss         |  7 ++
 .../curation/documents/promoted_documents.tsx | 66 ++++++++++--------
 .../curation/results/add_result_flyout.tsx    | 67 ++++++++++---------
 .../curation/results/curation_result.tsx      | 21 +++---
 .../components/data_panel/data_panel.tsx      | 10 ++-
 7 files changed, 133 insertions(+), 114 deletions(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.scss

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/hidden_documents.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/hidden_documents.tsx
index 519808940fa1b..5e6123efa988e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/hidden_documents.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/hidden_documents.tsx
@@ -52,19 +52,22 @@ export const HiddenDocuments: React.FC = () => {
       isLoading={hiddenDocumentsLoading}
     >
       {hasDocuments ? (
-        documents.map((document, index) => (
-          <CurationResult
-            key={document.id}
-            result={convertToResultFormat(document)}
-            index={index}
-            actions={[
-              {
-                ...SHOW_DOCUMENT_ACTION,
-                onClick: () => removeHiddenId(document.id),
-              },
-            ]}
-          />
-        ))
+        <EuiFlexGroup direction="column" gutterSize="s">
+          {documents.map((document, index) => (
+            <EuiFlexItem key={index}>
+              <CurationResult
+                result={convertToResultFormat(document)}
+                index={index}
+                actions={[
+                  {
+                    ...SHOW_DOCUMENT_ACTION,
+                    onClick: () => removeHiddenId(document.id),
+                  },
+                ]}
+              />
+            </EuiFlexItem>
+          ))}
+        </EuiFlexGroup>
       ) : (
         <EuiEmptyPrompt
           titleSize="s"
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/organic_documents.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/organic_documents.tsx
index 166cce9029489..ff7d64b59ec33 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/organic_documents.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/organic_documents.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 
 import { useValues, useActions } from 'kea';
 
-import { EuiLoadingContent, EuiEmptyPrompt } from '@elastic/eui';
+import { EuiLoadingContent, EuiEmptyPrompt, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
@@ -46,27 +46,30 @@ export const OrganicDocuments: React.FC = () => {
       }
     >
       {hasDocuments ? (
-        documents.map((document: Result, index) => (
-          <CurationResult
-            result={document}
-            index={index}
-            key={document.id.raw}
-            actions={
-              isAutomated
-                ? []
-                : [
-                    {
-                      ...HIDE_DOCUMENT_ACTION,
-                      onClick: () => addHiddenId(document.id.raw),
-                    },
-                    {
-                      ...PROMOTE_DOCUMENT_ACTION,
-                      onClick: () => addPromotedId(document.id.raw),
-                    },
-                  ]
-            }
-          />
-        ))
+        <EuiFlexGroup direction="column" gutterSize="s">
+          {documents.map((document: Result, index) => (
+            <EuiFlexItem key={index}>
+              <CurationResult
+                result={document}
+                index={index}
+                actions={
+                  isAutomated
+                    ? []
+                    : [
+                        {
+                          ...HIDE_DOCUMENT_ACTION,
+                          onClick: () => addHiddenId(document.id.raw),
+                        },
+                        {
+                          ...PROMOTE_DOCUMENT_ACTION,
+                          onClick: () => addPromotedId(document.id.raw),
+                        },
+                      ]
+                }
+              />
+            </EuiFlexItem>
+          ))}
+        </EuiFlexGroup>
       ) : organicDocumentsLoading ? (
         <EuiLoadingContent lines={5} />
       ) : (
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.scss b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.scss
new file mode 100644
index 0000000000000..59346b66af607
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.scss
@@ -0,0 +1,7 @@
+.promotedDocuments {
+  &--results {
+    border-radius: $euiSizeM;
+    border: $euiBorderWidthThick solid $euiColorPrimary;
+    background-color: tintOrShade($euiColorPrimary, 90%, 70%); // Copied from @elastit/eui/src/global_styling/variables/_panels.scss
+  }
+}
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.tsx
index c953fb210c03d..ab5bf2876ef0b 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/documents/promoted_documents.tsx
@@ -31,6 +31,8 @@ import { PROMOTED_DOCUMENTS_TITLE } from '../constants';
 import { CurationLogic } from '../curation_logic';
 import { AddResultButton, CurationResult, convertToResultFormat } from '../results';
 
+import './promoted_documents.scss';
+
 export const PromotedDocuments: React.FC = () => {
   const { curation, isAutomated, promotedIds, promotedDocumentsLoading } = useValues(CurationLogic);
   const documents = curation.promoted;
@@ -89,36 +91,42 @@ export const PromotedDocuments: React.FC = () => {
     >
       {hasDocuments ? (
         <EuiDragDropContext onDragEnd={reorderPromotedIds}>
-          <EuiDroppable droppableId="PromotedDocuments" spacing="m">
-            {documents.map((document, index) => (
-              <EuiDraggable
-                index={index}
-                key={document.id}
-                draggableId={document.id}
-                customDragHandle
-                spacing="none"
-                isDragDisabled={isAutomated}
-              >
-                {(provided) => (
-                  <CurationResult
-                    key={document.id}
+          <EuiDroppable
+            droppableId="PromotedDocuments"
+            spacing="m"
+            className="promotedDocuments--results"
+          >
+            <EuiFlexGroup direction="column" gutterSize="s">
+              {documents.map((document, index) => (
+                <EuiFlexItem key={index}>
+                  <EuiDraggable
                     index={index}
-                    result={convertToResultFormat(document)}
-                    actions={
-                      isAutomated
-                        ? []
-                        : [
-                            {
-                              ...DEMOTE_DOCUMENT_ACTION,
-                              onClick: () => removePromotedId(document.id),
-                            },
-                          ]
-                    }
-                    dragHandleProps={provided.dragHandleProps}
-                  />
-                )}
-              </EuiDraggable>
-            ))}
+                    draggableId={document.id}
+                    customDragHandle
+                    spacing="none"
+                    isDragDisabled={isAutomated}
+                  >
+                    {(provided) => (
+                      <CurationResult
+                        index={index}
+                        result={convertToResultFormat(document)}
+                        actions={
+                          isAutomated
+                            ? []
+                            : [
+                                {
+                                  ...DEMOTE_DOCUMENT_ACTION,
+                                  onClick: () => removePromotedId(document.id),
+                                },
+                              ]
+                        }
+                        dragHandleProps={provided.dragHandleProps}
+                      />
+                    )}
+                  </EuiDraggable>
+                </EuiFlexItem>
+              ))}
+            </EuiFlexGroup>
           </EuiDroppable>
         </EuiDragDropContext>
       ) : (
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/add_result_flyout.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/add_result_flyout.tsx
index 9d341cc2f5520..4c5ba8f1447fd 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/add_result_flyout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/add_result_flyout.tsx
@@ -19,6 +19,8 @@ import {
   EuiSpacer,
   EuiFieldSearch,
   EuiEmptyPrompt,
+  EuiFlexGroup,
+  EuiFlexItem,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
@@ -76,38 +78,41 @@ export const AddResultFlyout: React.FC = () => {
           <EuiSpacer />
 
           {searchResults.length > 0 ? (
-            searchResults.map((result) => {
-              const id = result.id.raw;
-              const isPromoted = promotedIds.includes(id);
-              const isHidden = hiddenIds.includes(id);
+            <EuiFlexGroup direction="column" gutterSize="s">
+              {searchResults.map((result, index) => {
+                const id = result.id.raw;
+                const isPromoted = promotedIds.includes(id);
+                const isHidden = hiddenIds.includes(id);
 
-              return (
-                <CurationResult
-                  key={id}
-                  result={result}
-                  actions={[
-                    isHidden
-                      ? {
-                          ...SHOW_DOCUMENT_ACTION,
-                          onClick: () => removeHiddenId(id),
-                        }
-                      : {
-                          ...HIDE_DOCUMENT_ACTION,
-                          onClick: () => addHiddenId(id),
-                        },
-                    isPromoted
-                      ? {
-                          ...DEMOTE_DOCUMENT_ACTION,
-                          onClick: () => removePromotedId(id),
-                        }
-                      : {
-                          ...PROMOTE_DOCUMENT_ACTION,
-                          onClick: () => addPromotedId(id),
-                        },
-                  ]}
-                />
-              );
-            })
+                return (
+                  <EuiFlexItem key={index}>
+                    <CurationResult
+                      result={result}
+                      actions={[
+                        isHidden
+                          ? {
+                              ...SHOW_DOCUMENT_ACTION,
+                              onClick: () => removeHiddenId(id),
+                            }
+                          : {
+                              ...HIDE_DOCUMENT_ACTION,
+                              onClick: () => addHiddenId(id),
+                            },
+                        isPromoted
+                          ? {
+                              ...DEMOTE_DOCUMENT_ACTION,
+                              onClick: () => removePromotedId(id),
+                            }
+                          : {
+                              ...PROMOTE_DOCUMENT_ACTION,
+                              onClick: () => addPromotedId(id),
+                            },
+                      ]}
+                    />
+                  </EuiFlexItem>
+                );
+              })}
+            </EuiFlexGroup>
           ) : (
             <EuiEmptyPrompt
               body={i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/curation_result.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/curation_result.tsx
index f0086e771234b..8e55e775218bf 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/curation_result.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/results/curation_result.tsx
@@ -10,8 +10,6 @@ import { DraggableProvidedDragHandleProps } from 'react-beautiful-dnd';
 
 import { useValues } from 'kea';
 
-import { EuiSpacer } from '@elastic/eui';
-
 import { EngineLogic } from '../../../engine';
 import { Result } from '../../../result';
 import { Result as ResultType, ResultAction } from '../../../result/types';
@@ -30,16 +28,13 @@ export const CurationResult: React.FC<Props> = ({ actions, dragHandleProps, resu
   } = useValues(EngineLogic);
 
   return (
-    <>
-      <Result
-        result={result}
-        actions={actions}
-        isMetaEngine={isMetaEngine}
-        schemaForTypeHighlights={schema}
-        dragHandleProps={dragHandleProps}
-        resultPosition={typeof index === 'undefined' ? undefined : index + 1}
-      />
-      <EuiSpacer size="m" />
-    </>
+    <Result
+      result={result}
+      actions={actions}
+      isMetaEngine={isMetaEngine}
+      schemaForTypeHighlights={schema}
+      dragHandleProps={dragHandleProps}
+      resultPosition={typeof index === 'undefined' ? undefined : index + 1}
+    />
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/data_panel/data_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/data_panel/data_panel.tsx
index 8dc43d08e5e09..d199d2a6d3edd 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/data_panel/data_panel.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/data_panel/data_panel.tsx
@@ -20,12 +20,13 @@ import {
   EuiTitle,
   EuiTitleProps,
 } from '@elastic/eui';
+import { _EuiPanelDivlike } from '@elastic/eui/src/components/panel/panel';
 
 import { LoadingOverlay } from '../../../shared/loading';
 
 import './data_panel.scss';
 
-interface Props {
+type Props = Omit<_EuiPanelDivlike, 'title'> & {
   title: React.ReactElement; // e.g., h2 tag
   titleSize?: EuiTitleProps['size'];
   subtitle?: React.ReactNode;
@@ -33,10 +34,9 @@ interface Props {
   action?: React.ReactNode;
   responsive?: boolean;
   filled?: boolean;
-  hasBorder?: boolean;
   isLoading?: boolean;
   className?: string;
-}
+};
 
 export const DataPanel: React.FC<Props> = ({
   title,
@@ -46,7 +46,6 @@ export const DataPanel: React.FC<Props> = ({
   action,
   responsive = false,
   filled,
-  hasBorder,
   isLoading,
   className,
   children,
@@ -58,12 +57,11 @@ export const DataPanel: React.FC<Props> = ({
 
   return (
     <EuiPanel
-      {...props}
       color={filled ? 'subdued' : 'plain'}
-      hasBorder={hasBorder}
       className={classes}
       hasShadow={false}
       aria-busy={isLoading}
+      {...props}
     >
       <EuiFlexGroup justifyContent="spaceBetween" alignItems="center" responsive={responsive}>
         <EuiFlexItem>

From 85719272b91ab512f81d56413cd58af045052c5d Mon Sep 17 00:00:00 2001
From: Devon Thomson <devon.thomson@hotmail.com>
Date: Wed, 20 Oct 2021 10:02:02 -0400
Subject: [PATCH 4/6] [Reporting / Dashboard] Use Unsaved State in Report URL
 (#114331)

* All dashboard state keys taken from unsaved changes for share
---
 ...nel_map.ts => convert_dashboard_panels.ts} |  11 +-
 .../lib/convert_dashboard_state.ts            |   2 +-
 .../load_dashboard_history_location_state.ts  |   2 +-
 .../lib/sync_dashboard_url_state.ts           |   2 +-
 .../application/top_nav/dashboard_top_nav.tsx |  12 +-
 .../top_nav/show_share_modal.test.tsx         | 106 +++++++++++++++++-
 .../application/top_nav/show_share_modal.tsx  |  45 +++++---
 src/plugins/dashboard/public/services/core.ts |   1 +
 8 files changed, 158 insertions(+), 23 deletions(-)
 rename src/plugins/dashboard/public/application/lib/{convert_saved_panels_to_panel_map.ts => convert_dashboard_panels.ts} (66%)

diff --git a/src/plugins/dashboard/public/application/lib/convert_saved_panels_to_panel_map.ts b/src/plugins/dashboard/public/application/lib/convert_dashboard_panels.ts
similarity index 66%
rename from src/plugins/dashboard/public/application/lib/convert_saved_panels_to_panel_map.ts
rename to src/plugins/dashboard/public/application/lib/convert_dashboard_panels.ts
index b91940f45081b..4ff1278d9467e 100644
--- a/src/plugins/dashboard/public/application/lib/convert_saved_panels_to_panel_map.ts
+++ b/src/plugins/dashboard/public/application/lib/convert_dashboard_panels.ts
@@ -6,7 +6,10 @@
  * Side Public License, v 1.
  */
 
-import { convertSavedDashboardPanelToPanelState } from '../../../common/embeddable/embeddable_saved_object_converters';
+import {
+  convertSavedDashboardPanelToPanelState,
+  convertPanelStateToSavedDashboardPanel,
+} from '../../../common/embeddable/embeddable_saved_object_converters';
 import type { SavedDashboardPanel, DashboardPanelMap } from '../../types';
 
 export const convertSavedPanelsToPanelMap = (panels?: SavedDashboardPanel[]): DashboardPanelMap => {
@@ -16,3 +19,9 @@ export const convertSavedPanelsToPanelMap = (panels?: SavedDashboardPanel[]): Da
   });
   return panelsMap;
 };
+
+export const convertPanelMapToSavedPanels = (panels: DashboardPanelMap, version: string) => {
+  return Object.values(panels).map((panel) =>
+    convertPanelStateToSavedDashboardPanel(panel, version)
+  );
+};
diff --git a/src/plugins/dashboard/public/application/lib/convert_dashboard_state.ts b/src/plugins/dashboard/public/application/lib/convert_dashboard_state.ts
index 123ef381f25f6..0bd49cccbe5ef 100644
--- a/src/plugins/dashboard/public/application/lib/convert_dashboard_state.ts
+++ b/src/plugins/dashboard/public/application/lib/convert_dashboard_state.ts
@@ -19,7 +19,7 @@ import {
   DashboardContainerInput,
   DashboardBuildContext,
 } from '../../types';
-import { convertSavedPanelsToPanelMap } from './convert_saved_panels_to_panel_map';
+import { convertSavedPanelsToPanelMap } from './convert_dashboard_panels';
 
 interface SavedObjectToDashboardStateProps {
   version: string;
diff --git a/src/plugins/dashboard/public/application/lib/load_dashboard_history_location_state.ts b/src/plugins/dashboard/public/application/lib/load_dashboard_history_location_state.ts
index d20e14cea74b5..ce06ef443d69f 100644
--- a/src/plugins/dashboard/public/application/lib/load_dashboard_history_location_state.ts
+++ b/src/plugins/dashboard/public/application/lib/load_dashboard_history_location_state.ts
@@ -8,7 +8,7 @@
 
 import { ForwardedDashboardState } from '../../locator';
 import { DashboardState } from '../../types';
-import { convertSavedPanelsToPanelMap } from './convert_saved_panels_to_panel_map';
+import { convertSavedPanelsToPanelMap } from './convert_dashboard_panels';
 
 export const loadDashboardHistoryLocationState = (
   state?: ForwardedDashboardState
diff --git a/src/plugins/dashboard/public/application/lib/sync_dashboard_url_state.ts b/src/plugins/dashboard/public/application/lib/sync_dashboard_url_state.ts
index 00b8f8217e25f..d314dc631631d 100644
--- a/src/plugins/dashboard/public/application/lib/sync_dashboard_url_state.ts
+++ b/src/plugins/dashboard/public/application/lib/sync_dashboard_url_state.ts
@@ -21,7 +21,7 @@ import type {
   DashboardState,
   RawDashboardState,
 } from '../../types';
-import { convertSavedPanelsToPanelMap } from './convert_saved_panels_to_panel_map';
+import { convertSavedPanelsToPanelMap } from './convert_dashboard_panels';
 
 type SyncDashboardUrlStateProps = DashboardBuildContext & { savedDashboard: DashboardSavedObject };
 
diff --git a/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx b/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx
index 712c070e17b9f..8391edd30d8ee 100644
--- a/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx
+++ b/src/plugins/dashboard/public/application/top_nav/dashboard_top_nav.tsx
@@ -407,16 +407,24 @@ export function DashboardTopNav({
       const timeRange = timefilter.getTime();
       ShowShareModal({
         share,
+        timeRange,
         kibanaVersion,
         anchorElement,
         dashboardCapabilities,
+        dashboardSessionStorage,
         currentDashboardState: currentState,
         savedDashboard: dashboardAppState.savedDashboard,
         isDirty: Boolean(dashboardAppState.hasUnsavedChanges),
-        timeRange,
       });
     },
-    [dashboardAppState, dashboardCapabilities, share, kibanaVersion, timefilter]
+    [
+      share,
+      timefilter,
+      kibanaVersion,
+      dashboardAppState,
+      dashboardCapabilities,
+      dashboardSessionStorage,
+    ]
   );
 
   const dashboardTopNavActions = useMemo(() => {
diff --git a/src/plugins/dashboard/public/application/top_nav/show_share_modal.test.tsx b/src/plugins/dashboard/public/application/top_nav/show_share_modal.test.tsx
index c684370c92062..184d25081d4fa 100644
--- a/src/plugins/dashboard/public/application/top_nav/show_share_modal.test.tsx
+++ b/src/plugins/dashboard/public/application/top_nav/show_share_modal.test.tsx
@@ -6,8 +6,13 @@
  * Side Public License, v 1.
  */
 
-import { Capabilities } from 'src/core/public';
-import { showPublicUrlSwitch } from './show_share_modal';
+import { DashboardState } from '../../types';
+import { DashboardAppLocatorParams } from '../..';
+import { Capabilities } from '../../services/core';
+import { SharePluginStart } from '../../services/share';
+import { stateToRawDashboardState } from '../lib/convert_dashboard_state';
+import { getSavedDashboardMock, makeDefaultServices } from '../test_helpers';
+import { showPublicUrlSwitch, ShowShareModal, ShowShareModalProps } from './show_share_modal';
 
 describe('showPublicUrlSwitch', () => {
   test('returns false if "dashboard" app is not available', () => {
@@ -49,3 +54,100 @@ describe('showPublicUrlSwitch', () => {
     expect(result).toBe(true);
   });
 });
+
+describe('ShowShareModal', () => {
+  const unsavedStateKeys = ['query', 'filters', 'options', 'savedQuery', 'panels'] as Array<
+    keyof DashboardAppLocatorParams
+  >;
+
+  const getPropsAndShare = (
+    unsavedState?: Partial<DashboardState>
+  ): { share: SharePluginStart; showModalProps: ShowShareModalProps } => {
+    const services = makeDefaultServices();
+    const share = {} as unknown as SharePluginStart;
+    share.toggleShareContextMenu = jest.fn();
+    services.dashboardSessionStorage.getState = jest.fn().mockReturnValue(unsavedState);
+    return {
+      showModalProps: {
+        share,
+        isDirty: true,
+        kibanaVersion: 'testKibanaVersion',
+        savedDashboard: getSavedDashboardMock(),
+        anchorElement: document.createElement('div'),
+        dashboardCapabilities: services.dashboardCapabilities,
+        currentDashboardState: { panels: {} } as unknown as DashboardState,
+        dashboardSessionStorage: services.dashboardSessionStorage,
+        timeRange: {
+          from: '2021-10-07T00:00:00.000Z',
+          to: '2021-10-10T00:00:00.000Z',
+        },
+      },
+      share,
+    };
+  };
+
+  it('locatorParams is missing all unsaved state when none is given', () => {
+    const { share, showModalProps } = getPropsAndShare();
+    const toggleShareMenuSpy = jest.spyOn(share, 'toggleShareContextMenu');
+    ShowShareModal(showModalProps);
+    expect(share.toggleShareContextMenu).toHaveBeenCalledTimes(1);
+    const shareLocatorParams = (
+      toggleShareMenuSpy.mock.calls[0][0].sharingData as {
+        locatorParams: { params: DashboardAppLocatorParams };
+      }
+    ).locatorParams.params;
+    unsavedStateKeys.forEach((key) => {
+      expect(shareLocatorParams[key]).toBeUndefined();
+    });
+  });
+
+  it('locatorParams unsaved state is properly propagated to locator', () => {
+    const unsavedDashboardState: DashboardState = {
+      panels: {
+        panel_1: {
+          type: 'panel_type',
+          gridData: { w: 0, h: 0, x: 0, y: 0, i: '0' },
+          panelRefName: 'superPanel',
+          explicitInput: {
+            id: 'superPanel',
+          },
+        },
+      },
+      options: {
+        hidePanelTitles: true,
+        useMargins: true,
+        syncColors: true,
+      },
+      filters: [
+        {
+          meta: {
+            alias: null,
+            disabled: false,
+            negate: false,
+          },
+          query: { query: 'hi' },
+        },
+      ],
+      query: { query: 'bye', language: 'kuery' },
+      savedQuery: 'amazingSavedQuery',
+    } as unknown as DashboardState;
+    const { share, showModalProps } = getPropsAndShare(unsavedDashboardState);
+    const toggleShareMenuSpy = jest.spyOn(share, 'toggleShareContextMenu');
+    ShowShareModal(showModalProps);
+    expect(share.toggleShareContextMenu).toHaveBeenCalledTimes(1);
+    const shareLocatorParams = (
+      toggleShareMenuSpy.mock.calls[0][0].sharingData as {
+        locatorParams: { params: DashboardAppLocatorParams };
+      }
+    ).locatorParams.params;
+    const rawDashboardState = stateToRawDashboardState({
+      state: unsavedDashboardState,
+      version: 'testKibanaVersion',
+    });
+    unsavedStateKeys.forEach((key) => {
+      expect(shareLocatorParams[key]).toStrictEqual(
+        (rawDashboardState as Partial<DashboardAppLocatorParams>)[key]
+      );
+    });
+  });
+});
diff --git a/src/plugins/dashboard/public/application/top_nav/show_share_modal.tsx b/src/plugins/dashboard/public/application/top_nav/show_share_modal.tsx
index 879afd4b9d305..3bfac12a6b500 100644
--- a/src/plugins/dashboard/public/application/top_nav/show_share_modal.tsx
+++ b/src/plugins/dashboard/public/application/top_nav/show_share_modal.tsx
@@ -21,18 +21,21 @@ import { SharePluginStart } from '../../services/share';
 import { DashboardAppCapabilities, DashboardState } from '../../types';
 import { dashboardUrlParams } from '../dashboard_router';
 import { stateToRawDashboardState } from '../lib/convert_dashboard_state';
+import { convertPanelMapToSavedPanels } from '../lib/convert_dashboard_panels';
+import { DashboardSessionStorage } from '../lib';
 
 const showFilterBarId = 'showFilterBar';
 
-interface ShowShareModalProps {
+export interface ShowShareModalProps {
   isDirty: boolean;
+  timeRange: TimeRange;
   kibanaVersion: string;
   share: SharePluginStart;
   anchorElement: HTMLElement;
   savedDashboard: DashboardSavedObject;
   currentDashboardState: DashboardState;
   dashboardCapabilities: DashboardAppCapabilities;
-  timeRange: TimeRange;
+  dashboardSessionStorage: DashboardSessionStorage;
 }
 
 export const showPublicUrlSwitch = (anonymousUserCapabilities: Capabilities) => {
@@ -46,12 +49,13 @@ export const showPublicUrlSwitch = (anonymousUserCapabilities: Capabilities) =>
 export function ShowShareModal({
   share,
   isDirty,
+  timeRange,
   kibanaVersion,
   anchorElement,
   savedDashboard,
   dashboardCapabilities,
   currentDashboardState,
-  timeRange,
+  dashboardSessionStorage,
 }: ShowShareModalProps) {
   const EmbedUrlParamExtension = ({
     setParamValue,
@@ -110,23 +114,31 @@ export function ShowShareModal({
     );
   };
 
-  const rawDashboardState = stateToRawDashboardState({
-    state: currentDashboardState,
-    version: kibanaVersion,
-  });
+  let unsavedStateForLocator: Pick<
+    DashboardAppLocatorParams,
+    'options' | 'query' | 'savedQuery' | 'filters' | 'panels'
+  > = {};
+  const unsavedDashboardState = dashboardSessionStorage.getState(savedDashboard.id);
+  if (unsavedDashboardState) {
+    unsavedStateForLocator = {
+      query: unsavedDashboardState.query,
+      filters: unsavedDashboardState.filters,
+      options: unsavedDashboardState.options,
+      savedQuery: unsavedDashboardState.savedQuery,
+      panels: unsavedDashboardState.panels
+        ? convertPanelMapToSavedPanels(unsavedDashboardState.panels, kibanaVersion)
+        : undefined,
+    };
+  }
 
   const locatorParams: DashboardAppLocatorParams = {
     dashboardId: savedDashboard.id,
-    filters: rawDashboardState.filters,
     preserveSavedFilters: true,
-    query: rawDashboardState.query,
-    savedQuery: rawDashboardState.savedQuery,
+    refreshInterval: undefined, // We don't share refresh interval externally
+    viewMode: ViewMode.VIEW, // For share locators we always load the dashboard in view mode
     useHash: false,
-    panels: rawDashboardState.panels,
     timeRange,
-    viewMode: ViewMode.VIEW, // For share locators we always load the dashboard in view mode
-    refreshInterval: undefined, // We don't share refresh interval externally
-    options: rawDashboardState.options,
+    ...unsavedStateForLocator,
   };
 
   share.toggleShareContextMenu({
@@ -136,7 +148,10 @@ export function ShowShareModal({
     allowShortUrl: dashboardCapabilities.createShortUrl,
     shareableUrl: setStateToKbnUrl(
       '_a',
-      rawDashboardState,
+      stateToRawDashboardState({
+        state: currentDashboardState,
+        version: kibanaVersion,
+      }),
       { useHash: false, storeInHashQuery: true },
       unhashUrl(window.location.href)
     ),
diff --git a/src/plugins/dashboard/public/services/core.ts b/src/plugins/dashboard/public/services/core.ts
index 75461729841e9..e805c6cd706a9 100644
--- a/src/plugins/dashboard/public/services/core.ts
+++ b/src/plugins/dashboard/public/services/core.ts
@@ -9,6 +9,7 @@
 export {
   AppMountParameters,
   CoreSetup,
+  Capabilities,
   PluginInitializerContext,
   ScopedHistory,
   NotificationsStart,

From 7e593a05a2d58311bbee83e916720719bf9bd06a Mon Sep 17 00:00:00 2001
From: Bryan Clement <bclement01@gmail.com>
Date: Wed, 20 Oct 2021 07:09:08 -0700
Subject: [PATCH 5/6] [Osquery] Cypress automation for osquery manager
 integration (#108759)

---
 x-pack/plugins/osquery/cypress/.gitignore     |   2 +
 x-pack/plugins/osquery/cypress/README.md      |  12 +-
 .../integration/osquery_manager.spec.ts       |  14 +-
 .../osquery/cypress/screens/integrations.ts   |   1 +
 .../osquery/cypress/screens/live_query.ts     |  11 +
 .../osquery/cypress/tasks/integrations.ts     |  22 +-
 .../osquery/cypress/tasks/live_query.ts       |  25 +++
 .../osquery/cypress/tasks/navigation.ts       |  10 +-
 .../public/live_queries/form/index.tsx        |   1 +
 x-pack/test/osquery_cypress/agent.ts          | 126 +++++++++++
 .../test/osquery_cypress/artifact_manager.ts  | 125 +++++++++++
 x-pack/test/osquery_cypress/fleet_server.ts   |  65 ++++++
 x-pack/test/osquery_cypress/fleet_server.yml  |  17 ++
 .../test/osquery_cypress/resource_manager.ts  |  24 ++
 x-pack/test/osquery_cypress/runner.ts         | 205 +++++++++++++-----
 x-pack/test/osquery_cypress/users.ts          | 101 +++++++++
 16 files changed, 679 insertions(+), 82 deletions(-)
 create mode 100644 x-pack/plugins/osquery/cypress/.gitignore
 create mode 100644 x-pack/plugins/osquery/cypress/screens/live_query.ts
 create mode 100644 x-pack/plugins/osquery/cypress/tasks/live_query.ts
 create mode 100644 x-pack/test/osquery_cypress/agent.ts
 create mode 100644 x-pack/test/osquery_cypress/artifact_manager.ts
 create mode 100644 x-pack/test/osquery_cypress/fleet_server.ts
 create mode 100644 x-pack/test/osquery_cypress/fleet_server.yml
 create mode 100644 x-pack/test/osquery_cypress/resource_manager.ts
 create mode 100644 x-pack/test/osquery_cypress/users.ts

diff --git a/x-pack/plugins/osquery/cypress/.gitignore b/x-pack/plugins/osquery/cypress/.gitignore
new file mode 100644
index 0000000000000..adaba54810395
--- /dev/null
+++ b/x-pack/plugins/osquery/cypress/.gitignore
@@ -0,0 +1,2 @@
+videos
+screenshots
diff --git a/x-pack/plugins/osquery/cypress/README.md b/x-pack/plugins/osquery/cypress/README.md
index 0df311ebc0a05..72d558b6e5980 100644
--- a/x-pack/plugins/osquery/cypress/README.md
+++ b/x-pack/plugins/osquery/cypress/README.md
@@ -20,7 +20,7 @@ A headless browser is a browser simulation program that does not have a user int
 
 #### FTR (CI)
 
-This is the configuration used by CI. It uses the FTR to spawn both a Kibana instance (http://localhost:5620) and an Elasticsearch instance (http://localhost:9220) with a preloaded minimum set of data (see preceding "Test data" section), and then executes cypress against this stack. You can find this configuration in `x-pack/test/security_solution_cypress`
+This is the configuration used by CI. It uses the FTR to spawn both a Kibana instance (http://localhost:5620) and an Elasticsearch instance (http://localhost:9220) with a preloaded minimum set of data (see preceding "Test data" section), and then executes cypress against this stack. You can find this configuration in `x-pack/test/osquery_cypress`
 
 ### Test Execution: Examples
 
@@ -36,7 +36,7 @@ yarn kbn bootstrap
 node scripts/build_kibana_platform_plugins
 
 # launch the cypress test runner
-cd x-pack/plugins/security_solution
+cd x-pack/plugins/osquery
 yarn cypress:run-as-ci
 ```
 #### FTR + Interactive
@@ -51,7 +51,7 @@ yarn kbn bootstrap
 node scripts/build_kibana_platform_plugins
 
 # launch the cypress test runner
-cd x-pack/plugins/security_solution
+cd x-pack/plugins/osquery
 yarn cypress:open-as-ci
 ```
 
@@ -98,16 +98,16 @@ We use es_archiver to manage the data that our Cypress tests need.
 
 1. Set up a clean instance of kibana and elasticsearch (if this is not possible, try to clean/minimize the data that you are going to archive).
 2. With the kibana and elasticsearch instance up and running, create the data that you need for your test.
-3. When you are sure that you have all the data you need run the following command from: `x-pack/plugins/security_solution`
+3. When you are sure that you have all the data you need run the following command from: `x-pack/plugins/osquery`
 
 ```sh
-node ../../../scripts/es_archiver save <nameOfTheFolderWhereDataIsSaved> <indexPatternsToBeSaved>  --dir ../../test/security_solution_cypress/es_archives --config ../../../test/functional/config.js --es-url http://<elasticsearchUsername>:<elasticsearchPassword>@<elasticsearchHost>:<elasticsearchPort>
+node ../../../scripts/es_archiver save <nameOfTheFolderWhereDataIsSaved> <indexPatternsToBeSaved>  --dir ../../test/osquery_cypress/es_archives --config ../../../test/functional/config.js --es-url http://<elasticsearchUsername>:<elasticsearchPassword>@<elasticsearchHost>:<elasticsearchPort>
 ```
 
 Example:
 
 ```sh
-node ../../../scripts/es_archiver save custom_rules ".kibana",".siem-signal*"  --dir ../../test/security_solution_cypress/es_archives --config ../../../test/functional/config.js --es-url http://elastic:changeme@localhost:9220
+node ../../../scripts/es_archiver save custom_rules ".kibana",".siem-signal*"  --dir ../../test/osquery_cypress/es_archives --config ../../../test/functional/config.js --es-url http://elastic:changeme@localhost:9220
 ```
 
 Note that the command will create the folder if it does not exist.
diff --git a/x-pack/plugins/osquery/cypress/integration/osquery_manager.spec.ts b/x-pack/plugins/osquery/cypress/integration/osquery_manager.spec.ts
index 0babfd2f10a8e..367de59b3e1fc 100644
--- a/x-pack/plugins/osquery/cypress/integration/osquery_manager.spec.ts
+++ b/x-pack/plugins/osquery/cypress/integration/osquery_manager.spec.ts
@@ -8,13 +8,19 @@
 import { HEADER } from '../screens/osquery';
 import { OSQUERY_NAVIGATION_LINK } from '../screens/navigation';
 
-import { INTEGRATIONS, OSQUERY, openNavigationFlyout, navigateTo } from '../tasks/navigation';
+import { OSQUERY, NEW_LIVE_QUERY, openNavigationFlyout, navigateTo } from '../tasks/navigation';
 import { addIntegration } from '../tasks/integrations';
+import { checkResults, inputQuery, selectAllAgents, submitQuery } from '../tasks/live_query';
 
 describe('Osquery Manager', () => {
-  before(() => {
-    navigateTo(INTEGRATIONS);
-    addIntegration('Osquery Manager');
+  before(() => addIntegration(Cypress.env('OSQUERY_POLICY')));
+
+  it('Runs live queries', () => {
+    navigateTo(NEW_LIVE_QUERY);
+    selectAllAgents();
+    inputQuery();
+    submitQuery();
+    checkResults();
   });
 
   it('Displays Osquery on the navigation flyout once installed ', () => {
diff --git a/x-pack/plugins/osquery/cypress/screens/integrations.ts b/x-pack/plugins/osquery/cypress/screens/integrations.ts
index 0b29e857f46ee..6a2951c85bf74 100644
--- a/x-pack/plugins/osquery/cypress/screens/integrations.ts
+++ b/x-pack/plugins/osquery/cypress/screens/integrations.ts
@@ -8,3 +8,4 @@
 export const ADD_POLICY_BTN = '[data-test-subj="addIntegrationPolicyButton"]';
 export const CREATE_PACKAGE_POLICY_SAVE_BTN = '[data-test-subj="createPackagePolicySaveButton"]';
 export const INTEGRATIONS_CARD = '.euiCard__titleAnchor';
+export const SAVE_PACKAGE_CONFIRM = '[data-test-subj=confirmModalConfirmButton]';
diff --git a/x-pack/plugins/osquery/cypress/screens/live_query.ts b/x-pack/plugins/osquery/cypress/screens/live_query.ts
new file mode 100644
index 0000000000000..1a521fe1cd651
--- /dev/null
+++ b/x-pack/plugins/osquery/cypress/screens/live_query.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const AGENT_FIELD = '[data-test-subj="comboBoxInput"]';
+export const ALL_AGENTS_OPTION = '[title="All agents"]';
+export const LIVE_QUERY_EDITOR = '#osquery_editor';
+export const SUBMIT_BUTTON = '#submit-button';
diff --git a/x-pack/plugins/osquery/cypress/tasks/integrations.ts b/x-pack/plugins/osquery/cypress/tasks/integrations.ts
index f85ef56550af5..4de42ffa95bb5 100644
--- a/x-pack/plugins/osquery/cypress/tasks/integrations.ts
+++ b/x-pack/plugins/osquery/cypress/tasks/integrations.ts
@@ -5,16 +5,18 @@
  * 2.0.
  */
 
-import {
-  ADD_POLICY_BTN,
-  CREATE_PACKAGE_POLICY_SAVE_BTN,
-  INTEGRATIONS_CARD,
-} from '../screens/integrations';
+import { CREATE_PACKAGE_POLICY_SAVE_BTN, SAVE_PACKAGE_CONFIRM } from '../screens/integrations';
 
-export const addIntegration = (integration: string) => {
-  cy.get(INTEGRATIONS_CARD).contains(integration).click();
-  cy.get(ADD_POLICY_BTN).click();
+import { navigateTo, OSQUERY_INTEGRATION_PAGE } from './navigation';
+
+// TODO: allow adding integration version strings to this
+export const addIntegration = (policyId: string) => {
+  navigateTo(OSQUERY_INTEGRATION_PAGE, { qs: { policyId } });
   cy.get(CREATE_PACKAGE_POLICY_SAVE_BTN).click();
-  cy.get(CREATE_PACKAGE_POLICY_SAVE_BTN).should('not.exist');
-  cy.reload();
+  cy.get(SAVE_PACKAGE_CONFIRM).click();
+  // XXX: there is a race condition between the test going to the ui powered by the agent, and the agent having the integration ready to go
+  // so we wait.
+  // TODO: actually make this wait til the agent has been updated with the proper integration
+  cy.wait(5000);
+  return cy.reload();
 };
diff --git a/x-pack/plugins/osquery/cypress/tasks/live_query.ts b/x-pack/plugins/osquery/cypress/tasks/live_query.ts
new file mode 100644
index 0000000000000..c2b97c885cad6
--- /dev/null
+++ b/x-pack/plugins/osquery/cypress/tasks/live_query.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  AGENT_FIELD,
+  ALL_AGENTS_OPTION,
+  LIVE_QUERY_EDITOR,
+  SUBMIT_BUTTON,
+} from '../screens/live_query';
+
+export const selectAllAgents = () => {
+  cy.get(AGENT_FIELD).first().click();
+  return cy.get(ALL_AGENTS_OPTION).contains('All agents').click();
+};
+
+export const inputQuery = () => cy.get(LIVE_QUERY_EDITOR).type('select * from processes;');
+
+export const submitQuery = () => cy.get(SUBMIT_BUTTON).contains('Submit').click();
+
+export const checkResults = () =>
+  cy.get('[data-test-subj="dataGridRowCell"]').should('have.lengthOf.above', 0);
diff --git a/x-pack/plugins/osquery/cypress/tasks/navigation.ts b/x-pack/plugins/osquery/cypress/tasks/navigation.ts
index 63d6b205b433b..7528f318a2fa4 100644
--- a/x-pack/plugins/osquery/cypress/tasks/navigation.ts
+++ b/x-pack/plugins/osquery/cypress/tasks/navigation.ts
@@ -7,11 +7,13 @@
 
 import { TOGGLE_NAVIGATION_BTN } from '../screens/navigation';
 
-export const INTEGRATIONS = 'app/integrations#/';
 export const OSQUERY = 'app/osquery/live_queries';
-
-export const navigateTo = (page: string) => {
-  cy.visit(page);
+export const NEW_LIVE_QUERY = 'app/osquery/live_queries/new';
+export const OSQUERY_INTEGRATION_PAGE = '/app/fleet/integrations/osquery_manager/add-integration';
+export const navigateTo = (page: string, opts?: Partial<Cypress.VisitOptions>) => {
+  cy.visit(page, opts);
+  // There's a security warning toast that seemingly makes ui elements in the bottom right unavailable, so we close it
+  return cy.get('[data-test-subj="toastCloseButton"]').click();
 };
 
 export const openNavigationFlyout = () => {
diff --git a/x-pack/plugins/osquery/public/live_queries/form/index.tsx b/x-pack/plugins/osquery/public/live_queries/form/index.tsx
index 86323b7ab4315..6d13c76d9d592 100644
--- a/x-pack/plugins/osquery/public/live_queries/form/index.tsx
+++ b/x-pack/plugins/osquery/public/live_queries/form/index.tsx
@@ -328,6 +328,7 @@ const LiveQueryFormComponent: React.FC<LiveQueryFormProps> = ({
           )}
           <EuiFlexItem grow={false}>
             <EuiButton
+              id="submit-button"
               disabled={!enabled || !agentSelected || !queryValueProvided || isSubmitting}
               onClick={submit}
             >
diff --git a/x-pack/test/osquery_cypress/agent.ts b/x-pack/test/osquery_cypress/agent.ts
new file mode 100644
index 0000000000000..802a7caa66d5f
--- /dev/null
+++ b/x-pack/test/osquery_cypress/agent.ts
@@ -0,0 +1,126 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ToolingLog } from '@kbn/dev-utils';
+import axios, { AxiosRequestConfig } from 'axios';
+import { copyFile } from 'fs/promises';
+import { ChildProcess, execFileSync, spawn } from 'child_process';
+import { resolve } from 'path';
+import { unlinkSync } from 'fs';
+import { Manager } from './resource_manager';
+
+interface AgentManagerParams {
+  user: string;
+  password: string;
+  kibanaUrl: string;
+  esHost: string;
+}
+
+export class AgentManager extends Manager {
+  private directoryPath: string;
+  private params: AgentManagerParams;
+  private log: ToolingLog;
+  private agentProcess?: ChildProcess;
+  private requestOptions: AxiosRequestConfig;
+  constructor(directoryPath: string, params: AgentManagerParams, log: ToolingLog) {
+    super();
+    // TODO: check if the file exists
+    this.directoryPath = directoryPath;
+    this.log = log;
+    this.params = params;
+    this.requestOptions = {
+      headers: {
+        'kbn-xsrf': 'kibana',
+      },
+      auth: {
+        username: this.params.user,
+        password: this.params.password,
+      },
+    };
+  }
+
+  public getBinaryPath() {
+    return resolve(this.directoryPath, 'elastic-agent');
+  }
+
+  public async setup() {
+    this.log.info('Running agent preconfig');
+    await axios.post(`${this.params.kibanaUrl}/api/fleet/agents/setup`, {}, this.requestOptions);
+
+    this.log.info('Updating the default agent output');
+    const {
+      data: {
+        items: [defaultOutput],
+      },
+    } = await axios.get(this.params.kibanaUrl + '/api/fleet/outputs', this.requestOptions);
+
+    await axios.put(
+      `${this.params.kibanaUrl}/api/fleet/outputs/${defaultOutput.id}`,
+      { hosts: [this.params.esHost] },
+      this.requestOptions
+    );
+
+    this.log.info('Getting agent enrollment key');
+    const { data: apiKeys } = await axios.get(
+      this.params.kibanaUrl + '/api/fleet/enrollment-api-keys',
+      this.requestOptions
+    );
+    const policy = apiKeys.list[1];
+
+    this.log.info('Enrolling the agent');
+    const args = [
+      'enroll',
+      '--insecure',
+      '-f',
+      // TODO: parse the host/port out of the logs for the fleet server
+      '--url=http://localhost:8220',
+      `--enrollment-token=${policy.api_key}`,
+    ];
+    const agentBinPath = this.getBinaryPath();
+    execFileSync(agentBinPath, args, { stdio: 'inherit' });
+
+    // Copy the config file
+    const configPath = resolve(__dirname, this.directoryPath, 'elastic-agent.yml');
+    this.log.info(`Copying agent config from ${configPath}`);
+    await copyFile(configPath, resolve('.', 'elastic-agent.yml'));
+
+    this.log.info('Running the agent');
+    this.agentProcess = spawn(agentBinPath, ['run', '-v'], { stdio: 'inherit' });
+
+    // Wait til we see the agent is online
+    let done = false;
+    let retries = 0;
+    while (!done) {
+      await new Promise((r) => setTimeout(r, 5000));
+      const { data: agents } = await axios.get(
+        `${this.params.kibanaUrl}/api/fleet/agents`,
+        this.requestOptions
+      );
+      done = agents.list[0]?.status === 'online';
+      if (++retries > 12) {
+        this.log.error('Giving up on enrolling the agent after a minute');
+        throw new Error('Agent timed out while coming online');
+      }
+    }
+    return { policyId: policy.policy_id as string };
+  }
+
+  protected _cleanup() {
+    this.log.info('Cleaning up the agent process');
+    if (this.agentProcess) {
+      if (!this.agentProcess.kill(9)) {
+        this.log.warning('Unable to kill agent process');
+      }
+
+      this.agentProcess.on('close', () => {
+        this.log.info('Agent process closed');
+      });
+      delete this.agentProcess;
+    }
+    unlinkSync(resolve('.', 'elastic-agent.yml'));
+  }
+}
diff --git a/x-pack/test/osquery_cypress/artifact_manager.ts b/x-pack/test/osquery_cypress/artifact_manager.ts
new file mode 100644
index 0000000000000..89d6f34987007
--- /dev/null
+++ b/x-pack/test/osquery_cypress/artifact_manager.ts
@@ -0,0 +1,125 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import axios, { AxiosResponse } from 'axios';
+import { get } from 'lodash';
+import { execSync } from 'child_process';
+import { writeFileSync, unlinkSync, rmdirSync } from 'fs';
+import { resolve } from 'path';
+import { ToolingLog } from '@kbn/dev-utils';
+import { Manager } from './resource_manager';
+
+const archMap: { [key: string]: string } = {
+  x64: 'x86_64',
+};
+
+type ArtifactName = 'elastic-agent' | 'fleet-server';
+
+async function getArtifact(
+  artifact: string,
+  urlExtractor: (data: AxiosResponse<any>, filename: string) => string,
+  log: ToolingLog,
+  version: string
+) {
+  log.info(`Fetching ${version} of ${artifact}`);
+  const agents = await axios(
+    `https://artifacts-api.elastic.co/v1/versions/${version}/builds/latest`
+  );
+  const arch = archMap[process.arch] ?? process.arch;
+  const dirName = `${artifact}-${version}-${process.platform}-${arch}`;
+  const filename = dirName + '.tar.gz';
+  const url = urlExtractor(agents.data, filename);
+  if (!url) {
+    log.error(`Could not find url for ${artifact}:  ${url}`);
+    throw new Error(`Unable to fetch ${artifact}`);
+  }
+  log.info(`Fetching ${filename} from ${url}`);
+  const agent = await axios(url as string, { responseType: 'arraybuffer' });
+  writeFileSync(filename, agent.data);
+  execSync(`tar xvf ${filename}`);
+  return resolve(filename);
+}
+
+// There has to be a better way to represent partial function application
+type ArtifactFetcher = (
+  log: Parameters<typeof getArtifact>[2],
+  version: Parameters<typeof getArtifact>[3]
+) => ReturnType<typeof getArtifact>;
+type ArtifactFetchers = {
+  [artifactName in ArtifactName]: ArtifactFetcher;
+};
+
+const fetchers: ArtifactFetchers = {
+  'elastic-agent': getArtifact.bind(null, 'elastic-agent', (data, filename) =>
+    get(data, ['build', 'projects', 'beats', 'packages', filename, 'url'])
+  ),
+  'fleet-server': getArtifact.bind(null, 'fleet-server', (data, filename) =>
+    get(data, ['build', 'projects', 'fleet-server', 'packages', filename, 'url'])
+  ),
+};
+
+export type FetchArtifactsParams = {
+  [artifactName in ArtifactName]?: string;
+};
+
+type ArtifactPaths = FetchArtifactsParams;
+export class ArtifactManager extends Manager {
+  private artifacts: ArtifactPaths;
+  private versions: FetchArtifactsParams;
+  private log: ToolingLog;
+
+  constructor(versions: FetchArtifactsParams, log: ToolingLog) {
+    super();
+    this.versions = versions;
+    this.log = log;
+    this.artifacts = {};
+  }
+
+  public fetchArtifacts = async () => {
+    this.log.info('Fetching artifacts');
+    await Promise.all(
+      Object.keys(this.versions).map(async (name: string) => {
+        const artifactName = name as ArtifactName;
+        const version = this.versions[artifactName];
+        if (!version) {
+          this.log.warning(`No version is specified for ${artifactName}, skipping`);
+          return;
+        }
+        const fetcher = fetchers[artifactName];
+        if (!fetcher) {
+          this.log.warning(`No fetcher is defined for ${artifactName}, skipping`);
+        }
+
+        this.artifacts[artifactName] = await fetcher(this.log, version);
+      })
+    );
+  };
+
+  public getArtifactDirectory(artifactName: string) {
+    const file = this.artifacts[artifactName as ArtifactName];
+    // this will break if the tarball name diverges from the directory that gets untarred
+    if (!file) {
+      throw new Error(`Unknown artifact ${artifactName}, unable to retreive directory`);
+    }
+    return file.replace('.tar.gz', '');
+  }
+
+  protected _cleanup() {
+    this.log.info('Cleaning up artifacts');
+    if (this.artifacts) {
+      for (const artifactName of Object.keys(this.artifacts)) {
+        const file = this.artifacts[artifactName as ArtifactName];
+        if (!file) {
+          this.log.warning(`Unknown artifact ${artifactName} encountered during cleanup, skipping`);
+          continue;
+        }
+        unlinkSync(file);
+        rmdirSync(this.getArtifactDirectory(artifactName), { recursive: true });
+      }
+    }
+  }
+}
diff --git a/x-pack/test/osquery_cypress/fleet_server.ts b/x-pack/test/osquery_cypress/fleet_server.ts
new file mode 100644
index 0000000000000..3c520233bc9b0
--- /dev/null
+++ b/x-pack/test/osquery_cypress/fleet_server.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ChildProcess, spawn } from 'child_process';
+import { copyFile } from 'fs/promises';
+import { unlinkSync } from 'fs';
+import { resolve } from 'path';
+import { ToolingLog } from '@kbn/dev-utils';
+import { Manager } from './resource_manager';
+export interface ElasticsearchConfig {
+  esHost: string;
+  user: string;
+  password: string;
+}
+
+export class FleetManager extends Manager {
+  private directoryPath: string;
+  private fleetProcess?: ChildProcess;
+  private esConfig: ElasticsearchConfig;
+  private log: ToolingLog;
+  constructor(directoryPath: string, esConfig: ElasticsearchConfig, log: ToolingLog) {
+    super();
+    // TODO: check if the file exists
+    this.esConfig = esConfig;
+    this.directoryPath = directoryPath;
+    this.log = log;
+  }
+  public async setup(): Promise<void> {
+    this.log.info('Setting fleet up');
+    await copyFile(resolve(__dirname, 'fleet_server.yml'), resolve('.', 'fleet-server.yml'));
+    return new Promise((res, rej) => {
+      const env = {
+        ELASTICSEARCH_HOSTS: this.esConfig.esHost,
+        ELASTICSEARCH_USERNAME: this.esConfig.user,
+        ELASTICSEARCH_PASSWORD: this.esConfig.password,
+      };
+      const file = resolve(this.directoryPath, 'fleet-server');
+      // TODO: handle logging properly
+      this.fleetProcess = spawn(file, [], { stdio: 'inherit', env });
+      this.fleetProcess.on('error', rej);
+      // TODO: actually wait for the fleet server to start listening
+      setTimeout(res, 15000);
+    });
+  }
+
+  protected _cleanup() {
+    this.log.info('Removing old fleet config');
+    if (this.fleetProcess) {
+      this.log.info('Closing fleet process');
+      if (!this.fleetProcess.kill(9)) {
+        this.log.warning('Unable to kill fleet server process');
+      }
+
+      this.fleetProcess.on('close', () => {
+        this.log.info('Fleet server process closed');
+      });
+      delete this.fleetProcess;
+    }
+    unlinkSync(resolve('.', 'fleet-server.yml'));
+  }
+}
diff --git a/x-pack/test/osquery_cypress/fleet_server.yml b/x-pack/test/osquery_cypress/fleet_server.yml
new file mode 100644
index 0000000000000..70ac62b018a25
--- /dev/null
+++ b/x-pack/test/osquery_cypress/fleet_server.yml
@@ -0,0 +1,17 @@
+# mostly a stub config
+output:
+  elasticsearch:
+    hosts: '${ELASTICSEARCH_HOSTS:localhost:9220}'
+    username: '${ELASTICSEARCH_USERNAME:elastic}'
+    password: '${ELASTICSEARCH_PASSWORD:changeme}'
+
+fleet:
+  agent:
+    id: 1e4954ce-af37-4731-9f4a-407b08e69e42
+    logging:
+      level: '${LOG_LEVEL:DEBUG}'
+
+logging:
+  to_stderr: true
+
+http.enabled: true
diff --git a/x-pack/test/osquery_cypress/resource_manager.ts b/x-pack/test/osquery_cypress/resource_manager.ts
new file mode 100644
index 0000000000000..e892021155417
--- /dev/null
+++ b/x-pack/test/osquery_cypress/resource_manager.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+const CLEANUP_EVENTS = ['SIGINT', 'exit', 'uncaughtException', 'unhandledRejection'];
+export class Manager {
+  private cleaned = false;
+  constructor() {
+    const cleanup = () => this.cleanup();
+    CLEANUP_EVENTS.forEach((ev) => process.on(ev, cleanup));
+  }
+  // This must be a synchronous method because it is used in the unhandledException and exit event handlers
+  public cleanup() {
+    // Since this can be called multiple places we proxy it with some protection
+    if (this._cleanup && !this.cleaned) {
+      this.cleaned = true;
+      this._cleanup();
+    }
+  }
+  protected _cleanup?(): void;
+}
diff --git a/x-pack/test/osquery_cypress/runner.ts b/x-pack/test/osquery_cypress/runner.ts
index 32c84af5faf76..bd0a97ad5feac 100644
--- a/x-pack/test/osquery_cypress/runner.ts
+++ b/x-pack/test/osquery_cypress/runner.ts
@@ -12,70 +12,159 @@ import { withProcRunner } from '@kbn/dev-utils';
 
 import { FtrProviderContext } from './ftr_provider_context';
 
-export async function OsqueryCypressCliTestRunner({ getService }: FtrProviderContext) {
+import { ArtifactManager, FetchArtifactsParams } from './artifact_manager';
+import { setupUsers } from './users';
+import { AgentManager } from './agent';
+import { FleetManager } from './fleet_server';
+
+interface SetupParams {
+  artifacts: FetchArtifactsParams;
+}
+
+async function withFleetAgent(
+  { getService }: FtrProviderContext,
+  params: SetupParams,
+  runner: (runnerEnv: Record<string, string>) => Promise<void>
+) {
   const log = getService('log');
   const config = getService('config');
 
-  await withProcRunner(log, async (procs) => {
-    await procs.run('cypress', {
-      cmd: 'yarn',
-      args: ['cypress:run'],
-      cwd: resolve(__dirname, '../../plugins/osquery'),
-      env: {
-        FORCE_COLOR: '1',
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_baseUrl: Url.format(config.get('servers.kibana')),
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_protocol: config.get('servers.kibana.protocol'),
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_hostname: config.get('servers.kibana.hostname'),
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_configport: config.get('servers.kibana.port'),
-        CYPRESS_ELASTICSEARCH_URL: Url.format(config.get('servers.elasticsearch')),
-        CYPRESS_ELASTICSEARCH_USERNAME: config.get('servers.elasticsearch.username'),
-        CYPRESS_ELASTICSEARCH_PASSWORD: config.get('servers.elasticsearch.password'),
-        CYPRESS_KIBANA_URL: Url.format({
-          protocol: config.get('servers.kibana.protocol'),
-          hostname: config.get('servers.kibana.hostname'),
-          port: config.get('servers.kibana.port'),
-        }),
-        ...process.env,
-      },
-      wait: true,
-    });
+  const artifactManager = new ArtifactManager(params.artifacts, log);
+  await artifactManager.fetchArtifacts();
+
+  const esHost = Url.format(config.get('servers.elasticsearch'));
+  const esConfig = {
+    user: config.get('servers.elasticsearch.username'),
+    password: config.get('servers.elasticsearch.password'),
+    esHost,
+  };
+  const fleetManager = new FleetManager(
+    artifactManager.getArtifactDirectory('fleet-server'),
+    esConfig,
+    log
+  );
+
+  const agentManager = new AgentManager(
+    artifactManager.getArtifactDirectory('elastic-agent'),
+    {
+      ...esConfig,
+      kibanaUrl: Url.format({
+        protocol: config.get('servers.kibana.protocol'),
+        hostname: config.get('servers.kibana.hostname'),
+        port: config.get('servers.kibana.port'),
+      }),
+    },
+    log
+  );
+
+  // Since the managers will create uncaughtException event handlers we need to exit manually
+  process.on('uncaughtException', (err) => {
+    // eslint-disable-next-line no-console
+    console.error('Encountered error; exiting after cleanup.', err);
+    process.exit(1);
   });
+
+  await fleetManager.setup();
+  const { policyId } = await agentManager.setup();
+  await setupUsers(esConfig);
+  try {
+    await runner({
+      CYPRESS_OSQUERY_POLICY: policyId,
+    });
+  } finally {
+    fleetManager.cleanup();
+    agentManager.cleanup();
+    artifactManager.cleanup();
+  }
 }
 
-export async function OsqueryCypressVisualTestRunner({ getService }: FtrProviderContext) {
-  const log = getService('log');
-  const config = getService('config');
+export async function OsqueryCypressCliTestRunner(context: FtrProviderContext) {
+  const log = context.getService('log');
+  const config = context.getService('config');
+  await withFleetAgent(
+    context,
+    {
+      artifacts: {
+        'elastic-agent': '7.15.0-SNAPSHOT',
+        'fleet-server': '7.15.0-SNAPSHOT',
+      },
+    },
+    (runnerEnv) =>
+      withProcRunner(log, async (procs) => {
+        await procs.run('cypress', {
+          cmd: 'yarn',
+          args: ['cypress:run'],
+          cwd: resolve(__dirname, '../../plugins/osquery'),
+          env: {
+            FORCE_COLOR: '1',
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            CYPRESS_baseUrl: Url.format(config.get('servers.kibana')),
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            CYPRESS_protocol: config.get('servers.kibana.protocol'),
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            CYPRESS_hostname: config.get('servers.kibana.hostname'),
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            CYPRESS_configport: config.get('servers.kibana.port'),
+            CYPRESS_ELASTICSEARCH_URL: Url.format(config.get('servers.elasticsearch')),
+            CYPRESS_ELASTICSEARCH_USERNAME: config.get('servers.elasticsearch.username'),
+            CYPRESS_ELASTICSEARCH_PASSWORD: config.get('servers.elasticsearch.password'),
+            CYPRESS_KIBANA_URL: Url.format({
+              protocol: config.get('servers.kibana.protocol'),
+              hostname: config.get('servers.kibana.hostname'),
+              port: config.get('servers.kibana.port'),
+            }),
+            ...runnerEnv,
+            ...process.env,
+          },
+          wait: true,
+        });
+      })
+  );
+}
+
+export async function OsqueryCypressVisualTestRunner(context: FtrProviderContext) {
+  const log = context.getService('log');
+  const config = context.getService('config');
 
-  await withProcRunner(log, async (procs) => {
-    await procs.run('cypress', {
-      cmd: 'yarn',
-      args: ['cypress:open'],
-      cwd: resolve(__dirname, '../../plugins/osquery'),
-      env: {
-        FORCE_COLOR: '1',
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_baseUrl: Url.format(config.get('servers.kibana')),
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_protocol: config.get('servers.kibana.protocol'),
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_hostname: config.get('servers.kibana.hostname'),
-        // eslint-disable-next-line @typescript-eslint/naming-convention
-        CYPRESS_configport: config.get('servers.kibana.port'),
-        CYPRESS_ELASTICSEARCH_URL: Url.format(config.get('servers.elasticsearch')),
-        CYPRESS_ELASTICSEARCH_USERNAME: config.get('servers.elasticsearch.username'),
-        CYPRESS_ELASTICSEARCH_PASSWORD: config.get('servers.elasticsearch.password'),
-        CYPRESS_KIBANA_URL: Url.format({
-          protocol: config.get('servers.kibana.protocol'),
-          hostname: config.get('servers.kibana.hostname'),
-          port: config.get('servers.kibana.port'),
-        }),
-        ...process.env,
+  await withFleetAgent(
+    context,
+    {
+      artifacts: {
+        'elastic-agent': '7.15.0-SNAPSHOT',
+        'fleet-server': '7.15.0-SNAPSHOT',
       },
-      wait: true,
-    });
-  });
+    },
+    (runnerEnv) =>
+      withProcRunner(
+        log,
+        async (procs) =>
+          await procs.run('cypress', {
+            cmd: 'yarn',
+            args: ['cypress:open'],
+            cwd: resolve(__dirname, '../../plugins/osquery'),
+            env: {
+              FORCE_COLOR: '1',
+              // eslint-disable-next-line @typescript-eslint/naming-convention
+              CYPRESS_baseUrl: Url.format(config.get('servers.kibana')),
+              // eslint-disable-next-line @typescript-eslint/naming-convention
+              CYPRESS_protocol: config.get('servers.kibana.protocol'),
+              // eslint-disable-next-line @typescript-eslint/naming-convention
+              CYPRESS_hostname: config.get('servers.kibana.hostname'),
+              // eslint-disable-next-line @typescript-eslint/naming-convention
+              CYPRESS_configport: config.get('servers.kibana.port'),
+              CYPRESS_ELASTICSEARCH_URL: Url.format(config.get('servers.elasticsearch')),
+              CYPRESS_ELASTICSEARCH_USERNAME: config.get('servers.elasticsearch.username'),
+              CYPRESS_ELASTICSEARCH_PASSWORD: config.get('servers.elasticsearch.password'),
+              CYPRESS_KIBANA_URL: Url.format({
+                protocol: config.get('servers.kibana.protocol'),
+                hostname: config.get('servers.kibana.hostname'),
+                port: config.get('servers.kibana.port'),
+              }),
+              ...runnerEnv,
+              ...process.env,
+            },
+            wait: true,
+          })
+      )
+  );
 }
diff --git a/x-pack/test/osquery_cypress/users.ts b/x-pack/test/osquery_cypress/users.ts
new file mode 100644
index 0000000000000..bfe8abfd8452f
--- /dev/null
+++ b/x-pack/test/osquery_cypress/users.ts
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import axios from 'axios';
+import { ElasticsearchConfig } from './fleet_server';
+
+interface Roles {
+  [roleName: string]: {
+    indices: [
+      {
+        names: string[];
+        privileges: string[];
+        allow_restricted_indices: boolean;
+      }
+    ];
+    applications: [
+      {
+        application: string;
+        privileges: string[];
+        resources: string[];
+      }
+    ];
+    transient_metadata: {
+      enabled: boolean;
+    };
+  };
+}
+
+interface Users {
+  [username: string]: { roles: string[] };
+}
+
+export const ROLES: Roles = {
+  read: {
+    indices: [
+      {
+        names: ['logs-*'],
+        privileges: ['read'],
+        allow_restricted_indices: false,
+      },
+    ],
+    applications: [
+      {
+        application: 'kibana-.kibana',
+        privileges: ['feature_osquery.read'],
+        resources: ['*'],
+      },
+    ],
+    transient_metadata: {
+      enabled: true,
+    },
+  },
+  all: {
+    indices: [
+      {
+        names: ['logs-*'],
+        privileges: ['read'],
+        allow_restricted_indices: false,
+      },
+    ],
+    applications: [
+      {
+        application: 'kibana-.kibana',
+        privileges: ['feature_osquery.all'],
+        resources: ['*'],
+      },
+    ],
+    transient_metadata: {
+      enabled: true,
+    },
+  },
+};
+
+export const USERS: Users = {
+  osqueryRead: {
+    roles: ['osquery_read'],
+  },
+  osqueryAll: {
+    roles: ['osquery_all'],
+  },
+};
+
+export const setupUsers = async (config: ElasticsearchConfig) => {
+  const { esHost, user: username, password } = config;
+  const params = {
+    auth: { username, password },
+  };
+  await Promise.all(
+    Object.keys(ROLES).map((role) =>
+      axios.put(`${esHost}/_security/role/osquery_${role}`, ROLES[role], params)
+    )
+  );
+  await Promise.all(
+    Object.keys(USERS).map((newUsername) =>
+      axios.put(`${esHost}/_security/user/${newUsername}`, { password, ...USERS[username] }, params)
+    )
+  );
+};

From c6fcde9a8bb28a361a6c8baf847874fe1140ecb6 Mon Sep 17 00:00:00 2001
From: Mikhail Shustov <restrry@gmail.com>
Date: Wed, 20 Oct 2021 16:46:37 +0200
Subject: [PATCH 6/6] [ES client] Rename deprecated params (#115528)

* filterPath --> filter_path

* ignoreUnavailable --> ignore_unavailable

* ignoreUnavailable --> ignore_unavailable

* trackScores --> track_scores

* trackTotalHits --> track_total_hits

* rollback unnecessary changes
---
 .../server/fetcher/lib/es_api.test.js         |  4 +--
 .../get_saved_object_counts.test.ts           | 12 +++----
 .../get_saved_object_counts.ts                |  4 +--
 .../collectors/custom_element_collector.ts    |  4 +--
 .../server/collectors/workpad_collector.ts    |  4 +--
 .../log_entries/kibana_log_entries_adapter.ts |  8 ++---
 .../adapters/metrics/lib/check_valid_node.ts  |  4 +--
 .../elasticsearch_source_status_adapter.ts    |  4 +--
 .../queries/log_entry_datasets.ts             |  8 ++---
 .../server/lib/infra_ml/queries/common.ts     |  8 ++---
 .../queries/metrics_host_anomalies.test.ts    |  8 ++---
 .../queries/metrics_k8s_anomalies.test.ts     |  8 ++---
 .../server/lib/log_analysis/queries/common.ts |  8 ++---
 .../plugins/infra/server/lib/metrics/index.ts |  4 +--
 .../infra/server/lib/sources/has_data.ts      |  4 +--
 .../lib/get_cloud_metadata.ts                 |  4 +--
 .../metadata/lib/get_cloud_metric_metadata.ts |  4 +--
 .../metadata/lib/get_metric_metadata.ts       |  4 +--
 .../routes/metadata/lib/get_node_info.ts      |  4 +--
 .../routes/metadata/lib/get_pod_node_name.ts  |  4 +--
 .../lib/get_dataset_for_field.ts              |  4 +--
 .../lib/query_total_groupings.ts              |  4 +--
 .../server/utils/calculate_metric_interval.ts |  4 +--
 .../lib/elasticsearch/get_last_recovery.ts    |  2 +-
 .../actions/all/query.all_actions.dsl.ts      |  4 +--
 .../details/query.action_details.dsl.ts       |  4 +--
 .../results/query.action_results.dsl.ts       |  4 +--
 .../factory/agents/query.all_agents.dsl.ts    |  4 +--
 .../factory/results/query.all_results.dsl.ts  |  4 +--
 .../server/usage/get_reporting_usage.ts       |  2 +-
 .../rollup/server/collectors/helpers.ts       |  4 +--
 .../factory/cti/event_enrichment/query.ts     |  4 +--
 .../cti/event_enrichment/response.test.ts     |  4 +--
 .../factory/hosts/all/__mocks__/index.ts      |  8 ++---
 .../factory/hosts/all/query.all_hosts.dsl.ts  |  4 +--
 .../hosts/all/query.all_hosts_entities.dsl.ts |  4 +--
 .../hosts/authentications/__mocks__/index.ts  |  8 ++---
 .../hosts/authentications/dsl/query.dsl.ts    |  4 +--
 .../authentications/dsl/query_entities.dsl.ts |  4 +--
 .../factory/hosts/details/__mocks__/index.ts  |  8 ++---
 .../hosts/details/query.host_details.dsl.ts   |  4 +--
 .../query.hosts_kpi_authentications.dsl.ts    |  4 +--
 ....hosts_kpi_authentications_entities.dsl.ts |  4 +--
 .../kpi/hosts/query.hosts_kpi_hosts.dsl.ts    |  4 +--
 .../query.hosts_kpi_hosts_entities.dsl.ts     |  4 +--
 .../query.hosts_kpi_unique_ips.dsl.ts         |  4 +--
 ...query.hosts_kpi_unique_ips_entities.dsl.ts |  4 +--
 .../hosts/last_first_seen/__mocks__/index.ts  | 12 +++----
 .../query.first_or_last_seen_host.dsl.ts      |  4 +--
 .../factory/hosts/overview/__mocks__/index.ts |  8 ++---
 .../hosts/overview/query.overview_host.dsl.ts |  4 +--
 .../hosts/risk_score/query.hosts_risk.dsl.ts  |  4 +--
 .../uncommon_processes/__mocks__/index.ts     |  8 ++---
 .../hosts/uncommon_processes/dsl/query.dsl.ts |  4 +--
 .../matrix_histogram/__mocks__/index.ts       | 24 +++++++-------
 .../alerts/__mocks__/index.ts                 |  4 +--
 .../alerts/query.alerts_histogram.dsl.ts      |  4 +--
 .../anomalies/__mocks__/index.ts              |  4 +--
 .../query.anomalies_histogram.dsl.ts          |  4 +--
 .../authentications/__mocks__/index.ts        |  4 +--
 .../query.authentications_histogram.dsl.ts    |  4 +--
 ....authentications_histogram_entities.dsl.ts |  4 +--
 .../matrix_histogram/dns/__mocks__/index.ts   |  4 +--
 .../dns/query.dns_histogram.dsl.ts            |  4 +--
 .../events/__mocks__/index.ts                 | 32 +++++++++----------
 .../events/query.events_histogram.dsl.ts      |  4 +--
 .../network/details/__mocks__/index.ts        |  8 ++---
 .../details/query.details_network.dsl.ts      |  4 +--
 .../factory/network/dns/__mocks__/index.ts    |  8 ++---
 .../network/dns/query.dns_network.dsl.ts      |  4 +--
 .../factory/network/http/__mocks__/index.ts   |  8 ++---
 .../network/http/query.http_network.dsl.ts    |  4 +--
 .../dns/query.network_kip_dns_entities.dsl.ts |  4 +--
 .../kpi/dns/query.network_kpi_dns.dsl.ts      |  4 +--
 .../query.network_kpi_network_events.dsl.ts   |  4 +--
 ...network_kpi_network_events_entities.dsl.ts |  4 +--
 .../query.network_kpi_tls_handshakes.dsl.ts   |  4 +--
 ...network_kpi_tls_handshakes_entities.dsl.ts |  4 +--
 .../query.network_kpi_unique_flows.dsl.ts     |  4 +--
 ...uery.network_kpi_unique_private_ips.dsl.ts |  4 +--
 ...ork_kpi_unique_private_ips_entities.dsl.ts |  4 +--
 .../network/overview/__mocks__/index.ts       |  8 ++---
 .../overview/query.overview_network.dsl.ts    |  4 +--
 .../factory/network/tls/__mocks__/index.ts    |  8 ++---
 .../network/tls/query.tls_network.dsl.ts      |  4 +--
 .../network/top_countries/__mocks__/index.ts  |  8 ++---
 .../query.top_countries_network.dsl.ts        |  4 +--
 ...uery.top_countries_network_entities.dsl.ts |  4 +--
 .../network/top_n_flow/__mocks__/index.ts     |  8 ++---
 .../query.top_n_flow_network.dsl.ts           |  4 +--
 .../query.top_n_flow_network_entities.dsl.ts  |  4 +--
 .../factory/network/users/__mocks__/index.ts  |  8 ++---
 .../network/users/query.users_network.dsl.ts  |  4 +--
 .../ueba/host_rules/query.host_rules.dsl.ts   |  4 +--
 .../host_tactics/query.host_tactics.dsl.ts    |  4 +--
 .../ueba/risk_score/query.risk_score.dsl.ts   |  4 +--
 .../ueba/user_rules/query.user_rules.dsl.ts   |  4 +--
 .../detections/detection_rule_helpers.ts      |  4 +--
 .../server/usage/detections/types.ts          |  4 +--
 .../events/all/query.events_all.dsl.ts        |  4 +--
 .../details/query.events_details.dsl.test.ts  |  4 +--
 .../details/query.events_details.dsl.ts       |  4 +--
 .../factory/events/kpi/query.kpi.dsl.ts       |  4 +--
 .../query.events_last_event_time.dsl.ts       | 12 +++----
 104 files changed, 280 insertions(+), 280 deletions(-)

diff --git a/src/plugins/data_views/server/fetcher/lib/es_api.test.js b/src/plugins/data_views/server/fetcher/lib/es_api.test.js
index 2893fde671bb2..085add965b921 100644
--- a/src/plugins/data_views/server/fetcher/lib/es_api.test.js
+++ b/src/plugins/data_views/server/fetcher/lib/es_api.test.js
@@ -61,7 +61,7 @@ describe('server/index_patterns/service/lib/es_api', () => {
       expect(resp).toBe(football);
     });
 
-    it('sets ignoreUnavailable and allowNoIndices params', async () => {
+    it('sets ignore_unavailable and allow_no_indices params', async () => {
       const getAlias = sinon.stub();
       const callCluster = {
         indices: {
@@ -149,7 +149,7 @@ describe('server/index_patterns/service/lib/es_api', () => {
       expect(resp).toBe(football);
     });
 
-    it('sets ignoreUnavailable, allowNoIndices, and fields params', async () => {
+    it('sets ignore_unavailable, allow_no_indices, and fields params', async () => {
       const fieldCaps = sinon.stub();
       const callCluster = {
         indices: {
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.test.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.test.ts
index 94c618354fc37..4b3421efed96e 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.test.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.test.ts
@@ -26,8 +26,8 @@ describe('getSavedObjectsCounts', () => {
     expect(results).toStrictEqual([]);
     expect(esClient.search).toHaveBeenCalledWith({
       index: '.kibana',
-      ignoreUnavailable: true,
-      filterPath: 'aggregations.types.buckets',
+      ignore_unavailable: true,
+      filter_path: 'aggregations.types.buckets',
       body: {
         size: 0,
         query: { match_all: {} },
@@ -41,8 +41,8 @@ describe('getSavedObjectsCounts', () => {
     await getSavedObjectsCounts(esClient, '.kibana');
     expect(esClient.search).toHaveBeenCalledWith({
       index: '.kibana',
-      ignoreUnavailable: true,
-      filterPath: 'aggregations.types.buckets',
+      ignore_unavailable: true,
+      filter_path: 'aggregations.types.buckets',
       body: {
         size: 0,
         query: { match_all: {} },
@@ -56,8 +56,8 @@ describe('getSavedObjectsCounts', () => {
     await getSavedObjectsCounts(esClient, '.kibana', ['type_one', 'type_two']);
     expect(esClient.search).toHaveBeenCalledWith({
       index: '.kibana',
-      ignoreUnavailable: true,
-      filterPath: 'aggregations.types.buckets',
+      ignore_unavailable: true,
+      filter_path: 'aggregations.types.buckets',
       body: {
         size: 0,
         query: { terms: { type: ['type_one', 'type_two'] } },
diff --git a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.ts b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.ts
index eeaeed67e753f..f82a803b763c5 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/saved_objects_counts/get_saved_object_counts.ts
@@ -17,8 +17,8 @@ export async function getSavedObjectsCounts(
 
   const savedObjectCountSearchParams = {
     index: kibanaIndex,
-    ignoreUnavailable: true,
-    filterPath: 'aggregations.types.buckets',
+    ignore_unavailable: true,
+    filter_path: 'aggregations.types.buckets',
     body: {
       size: 0,
       query,
diff --git a/x-pack/plugins/canvas/server/collectors/custom_element_collector.ts b/x-pack/plugins/canvas/server/collectors/custom_element_collector.ts
index 18cfe1a3df56c..b0e219a4d886d 100644
--- a/x-pack/plugins/canvas/server/collectors/custom_element_collector.ts
+++ b/x-pack/plugins/canvas/server/collectors/custom_element_collector.ts
@@ -147,8 +147,8 @@ const customElementCollector: TelemetryCollector = async function customElementC
   const customElementParams = {
     size: 10000,
     index: kibanaIndex,
-    ignoreUnavailable: true,
-    filterPath: [`hits.hits._source.${CUSTOM_ELEMENT_TYPE}.content`],
+    ignore_unavailable: true,
+    filter_path: [`hits.hits._source.${CUSTOM_ELEMENT_TYPE}.content`],
     body: { query: { bool: { filter: { term: { type: CUSTOM_ELEMENT_TYPE } } } } },
   };
 
diff --git a/x-pack/plugins/canvas/server/collectors/workpad_collector.ts b/x-pack/plugins/canvas/server/collectors/workpad_collector.ts
index d42b8480ed7c7..62b0ce200e320 100644
--- a/x-pack/plugins/canvas/server/collectors/workpad_collector.ts
+++ b/x-pack/plugins/canvas/server/collectors/workpad_collector.ts
@@ -381,8 +381,8 @@ const workpadCollector: TelemetryCollector = async function (kibanaIndex, esClie
   const searchParams = {
     size: 10000, // elasticsearch index.max_result_window default value
     index: kibanaIndex,
-    ignoreUnavailable: true,
-    filterPath: ['hits.hits._source.canvas-workpad', '-hits.hits._source.canvas-workpad.assets'],
+    ignore_unavailable: true,
+    filter_path: ['hits.hits._source.canvas-workpad', '-hits.hits._source.canvas-workpad.assets'],
     body: { query: { bool: { filter: { term: { type: CANVAS_TYPE } } } } },
   };
 
diff --git a/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts b/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
index ab98de7901a3d..524658559eadf 100644
--- a/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
@@ -69,9 +69,9 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
     };
 
     const esQuery = {
-      allowNoIndices: true,
+      allow_no_indices: true,
       index: resolvedLogSourceConfiguration.indices,
-      ignoreUnavailable: true,
+      ignore_unavailable: true,
       body: {
         size: size + 1, // Extra one to test if it has more before or after
         track_total_hits: false,
@@ -139,9 +139,9 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
     );
 
     const query = {
-      allowNoIndices: true,
+      allow_no_indices: true,
       index: resolvedLogSourceConfiguration.indices,
-      ignoreUnavailable: true,
+      ignore_unavailable: true,
       body: {
         aggregations: {
           count_by_date: {
diff --git a/x-pack/plugins/infra/server/lib/adapters/metrics/lib/check_valid_node.ts b/x-pack/plugins/infra/server/lib/adapters/metrics/lib/check_valid_node.ts
index f53016561dc5b..f2b7691646e48 100644
--- a/x-pack/plugins/infra/server/lib/adapters/metrics/lib/check_valid_node.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/metrics/lib/check_valid_node.ts
@@ -14,8 +14,8 @@ export const checkValidNode = async (
   id: string
 ): Promise<boolean> => {
   const params = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     index: indexPattern,
     terminateAfter: 1,
     body: {
diff --git a/x-pack/plugins/infra/server/lib/adapters/source_status/elasticsearch_source_status_adapter.ts b/x-pack/plugins/infra/server/lib/adapters/source_status/elasticsearch_source_status_adapter.ts
index 0aa305a580ffa..9c15d4746cdc5 100644
--- a/x-pack/plugins/infra/server/lib/adapters/source_status/elasticsearch_source_status_adapter.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/source_status/elasticsearch_source_status_adapter.ts
@@ -18,13 +18,13 @@ export class InfraElasticsearchSourceStatusAdapter implements InfraSourceStatusA
       this.framework
         .callWithRequest(requestContext, 'indices.getAlias', {
           name: aliasName,
-          filterPath: '*.settings.index.uuid', // to keep the response size as small as possible
+          filter_path: '*.settings.index.uuid', // to keep the response size as small as possible
         })
         .catch(withDefaultIfNotFound<InfraDatabaseGetIndicesResponse>({})),
       this.framework
         .callWithRequest(requestContext, 'indices.get', {
           index: aliasName,
-          filterPath: '*.settings.index.uuid', // to keep the response size as small as possible
+          filter_path: '*.settings.index.uuid', // to keep the response size as small as possible
         })
         .catch(withDefaultIfNotFound<InfraDatabaseGetIndicesResponse>({})),
     ]);
diff --git a/x-pack/plugins/infra/server/lib/domains/log_entries_domain/queries/log_entry_datasets.ts b/x-pack/plugins/infra/server/lib/domains/log_entries_domain/queries/log_entry_datasets.ts
index 3431f3bfb0c8c..9eae8daa3e74f 100644
--- a/x-pack/plugins/infra/server/lib/domains/log_entries_domain/queries/log_entry_datasets.ts
+++ b/x-pack/plugins/infra/server/lib/domains/log_entries_domain/queries/log_entry_datasets.ts
@@ -65,10 +65,10 @@ export const createLogEntryDatasetsQuery = (
 });
 
 const defaultRequestParameters = {
-  allowNoIndices: true,
-  ignoreUnavailable: true,
-  trackScores: false,
-  trackTotalHits: false,
+  allow_no_indices: true,
+  ignore_unavailable: true,
+  track_scores: false,
+  track_total_hits: false,
 };
 
 const compositeDatasetKeyRT = rt.type({
diff --git a/x-pack/plugins/infra/server/lib/infra_ml/queries/common.ts b/x-pack/plugins/infra/server/lib/infra_ml/queries/common.ts
index f4088c56303e2..594dc3371f3a2 100644
--- a/x-pack/plugins/infra/server/lib/infra_ml/queries/common.ts
+++ b/x-pack/plugins/infra/server/lib/infra_ml/queries/common.ts
@@ -6,10 +6,10 @@
  */
 
 export const defaultRequestParameters = {
-  allowNoIndices: true,
-  ignoreUnavailable: true,
-  trackScores: false,
-  trackTotalHits: false,
+  allow_no_indices: true,
+  ignore_unavailable: true,
+  track_scores: false,
+  track_total_hits: false,
 };
 
 export const createJobIdFilters = (jobId: string) => [
diff --git a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_host_anomalies.test.ts b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_host_anomalies.test.ts
index 7c281963e5717..5e7cb78790de0 100644
--- a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_host_anomalies.test.ts
+++ b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_host_anomalies.test.ts
@@ -27,10 +27,10 @@ describe('createMetricsHostAnomaliesQuery', () => {
         pagination,
       })
     ).toMatchObject({
-      allowNoIndices: true,
-      ignoreUnavailable: true,
-      trackScores: false,
-      trackTotalHits: false,
+      allow_no_indices: true,
+      ignore_unavailable: true,
+      track_scores: false,
+      track_total_hits: false,
       body: {
         query: {
           bool: {
diff --git a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.test.ts b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.test.ts
index 61efb896a6c89..959b20a482544 100644
--- a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.test.ts
+++ b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.test.ts
@@ -27,10 +27,10 @@ describe('createMetricsK8sAnomaliesQuery', () => {
         pagination,
       })
     ).toMatchObject({
-      allowNoIndices: true,
-      ignoreUnavailable: true,
-      trackScores: false,
-      trackTotalHits: false,
+      allow_no_indices: true,
+      ignore_unavailable: true,
+      track_scores: false,
+      track_total_hits: false,
       body: {
         query: {
           bool: {
diff --git a/x-pack/plugins/infra/server/lib/log_analysis/queries/common.ts b/x-pack/plugins/infra/server/lib/log_analysis/queries/common.ts
index 4c3ba5612c443..b05e4ce00fe9c 100644
--- a/x-pack/plugins/infra/server/lib/log_analysis/queries/common.ts
+++ b/x-pack/plugins/infra/server/lib/log_analysis/queries/common.ts
@@ -6,10 +6,10 @@
  */
 
 export const defaultRequestParameters = {
-  allowNoIndices: true,
-  ignoreUnavailable: true,
-  trackScores: false,
-  trackTotalHits: false,
+  allow_no_indices: true,
+  ignore_unavailable: true,
+  track_scores: false,
+  track_total_hits: false,
 };
 
 export const createJobIdFilters = (jobId: string) => [
diff --git a/x-pack/plugins/infra/server/lib/metrics/index.ts b/x-pack/plugins/infra/server/lib/metrics/index.ts
index 131f6944b0484..d291dbf88b49a 100644
--- a/x-pack/plugins/infra/server/lib/metrics/index.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/index.ts
@@ -47,8 +47,8 @@ export const query = async (
   ];
 
   const params = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     index: options.indexPattern,
     body: {
       size: 0,
diff --git a/x-pack/plugins/infra/server/lib/sources/has_data.ts b/x-pack/plugins/infra/server/lib/sources/has_data.ts
index b036124344ea9..d56512918f11a 100644
--- a/x-pack/plugins/infra/server/lib/sources/has_data.ts
+++ b/x-pack/plugins/infra/server/lib/sources/has_data.ts
@@ -10,9 +10,9 @@ import { ESSearchClient } from '../metrics/types';
 export const hasData = async (index: string, client: ESSearchClient) => {
   const params = {
     index,
-    allowNoIndices: true,
+    allow_no_indices: true,
     terminate_after: 1,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       size: 0,
     },
diff --git a/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts b/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts
index 57f99aee6d187..c721ca75ea978 100644
--- a/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts
+++ b/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts
@@ -40,8 +40,8 @@ export const getCloudMetadata = async (
   }
 
   const metricQuery = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     index: sourceConfiguration.metricAlias,
     body: {
       query: {
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts
index be2a39b84ef1c..d9da7bce2246f 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts
@@ -26,8 +26,8 @@ export const getCloudMetricsMetadata = async (
   timeRange: { from: number; to: number }
 ): Promise<InfraCloudMetricsAdapterResponse> => {
   const metricQuery = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     index: sourceConfiguration.metricAlias,
     body: {
       query: {
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts
index 26bcf267ad6cc..bfa0884bfe199 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts
@@ -32,8 +32,8 @@ export const getMetricMetadata = async (
 ): Promise<InfraMetricsAdapterResponse> => {
   const fields = findInventoryFields(nodeType, sourceConfiguration.fields);
   const metricQuery = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     index: sourceConfiguration.metricAlias,
     body: {
       query: {
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts
index fccbead2832c9..06035ed40adf1 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts
@@ -53,8 +53,8 @@ export const getNodeInfo = async (
   const fields = findInventoryFields(nodeType, sourceConfiguration.fields);
   const timestampField = sourceConfiguration.fields.timestamp;
   const params = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     terminateAfter: 1,
     index: sourceConfiguration.metricAlias,
     body: {
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts
index 8e4c707d9b467..9bf809ba3b3f4 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts
@@ -22,8 +22,8 @@ export const getPodNodeName = async (
   const fields = findInventoryFields(nodeType, sourceConfiguration.fields);
   const timestampField = sourceConfiguration.fields.timestamp;
   const params = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     terminateAfter: 1,
     index: sourceConfiguration.metricAlias,
     body: {
diff --git a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts
index b88472fbb4b14..be25bbbf022ee 100644
--- a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts
+++ b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts
@@ -22,8 +22,8 @@ export const getDatasetForField = async (
   timerange: { field: string; to: number; from: number }
 ) => {
   const params = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     terminateAfter: 1,
     index: indexPattern,
     body: {
diff --git a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts
index b871fa21c111d..a2bf778d5016d 100644
--- a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts
+++ b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts
@@ -41,8 +41,8 @@ export const queryTotalGroupings = async (
   }
 
   const params = {
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     index: options.indexPattern,
     body: {
       size: 0,
diff --git a/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts b/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts
index 13a108b76b6a4..3357b1a842183 100644
--- a/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts
+++ b/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts
@@ -35,9 +35,9 @@ export const calculateMetricInterval = async (
     from = options.timerange.to - inventoryModel.metrics.defaultTimeRangeInSeconds * 1000;
   }
   const query = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: options.indexPattern,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       query: {
         bool: {
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.ts b/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.ts
index 43527f875cf72..974ffad7745d9 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.ts
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.ts
@@ -107,7 +107,7 @@ export async function getLastRecovery(req: LegacyRequest, esIndexPattern: string
   const mbParams = {
     index: esIndexPattern,
     size,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       _source: ['elasticsearch.index.recovery', '@timestamp'],
       sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
index 55bec687d3e2c..8dc8fad02a7c1 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/all/query.all_actions.dsl.ts
@@ -20,9 +20,9 @@ export const buildActionsQuery = ({
   // const filter = [...createQueryFilterClauses(filterQuery)];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: '.fleet-actions',
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       // query: { bool: { filter } },
       query: {
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/details/query.action_details.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/details/query.action_details.dsl.ts
index bc9d63e619338..41f2875b1d4c8 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/details/query.action_details.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/details/query.action_details.dsl.ts
@@ -23,9 +23,9 @@ export const buildActionDetailsQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: '.fleet-actions',
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       query: { bool: { filter } },
       size: 1,
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
index d74067bff0251..109e260911933 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/actions/results/query.action_results.dsl.ts
@@ -25,9 +25,9 @@ export const buildActionResultsQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: '.fleet-actions-results*',
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggs: {
         aggs: {
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/query.all_agents.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/query.all_agents.dsl.ts
index 52101462270c7..314de574f0a70 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/query.all_agents.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/agents/query.all_agents.dsl.ts
@@ -21,9 +21,9 @@ export const buildAgentsQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: '.fleet-agents',
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       query: {
         bool: {
diff --git a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
index 406ff26991f0e..59326d6c50155 100644
--- a/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
+++ b/x-pack/plugins/osquery/server/search_strategy/osquery/factory/results/query.all_results.dsl.ts
@@ -36,9 +36,9 @@ export const buildResultsQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: `logs-${OSQUERY_INTEGRATION_NAME}.result*`,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggs: {
         count_by_agent_id: {
diff --git a/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts b/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
index 69213d8f8cacc..b2c6aece924f2 100644
--- a/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
+++ b/x-pack/plugins/reporting/server/usage/get_reporting_usage.ts
@@ -148,7 +148,7 @@ export async function getReportingUsage(
   const reportingIndex = REPORTING_SYSTEM_INDEX;
   const params = {
     index: `${reportingIndex}-*`,
-    filterPath: 'aggregations.*.buckets',
+    filter_path: 'aggregations.*.buckets',
     body: {
       size: 0,
       aggs: {
diff --git a/x-pack/plugins/rollup/server/collectors/helpers.ts b/x-pack/plugins/rollup/server/collectors/helpers.ts
index b6e5bc190d972..b007bbbff7e4a 100644
--- a/x-pack/plugins/rollup/server/collectors/helpers.ts
+++ b/x-pack/plugins/rollup/server/collectors/helpers.ts
@@ -32,8 +32,8 @@ export async function fetchRollupIndexPatterns(kibanaIndex: string, esClient: El
   const searchParams = {
     size: ES_MAX_RESULT_WINDOW_DEFAULT_VALUE,
     index: kibanaIndex,
-    ignoreUnavailable: true,
-    filterPath: ['hits.hits._id'],
+    ignore_unavailable: true,
+    filter_path: ['hits.hits._id'],
     body: {
       query: {
         bool: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/query.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/query.ts
index 786f9a20f77e5..ea015ea145b3f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/query.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/query.ts
@@ -28,8 +28,8 @@ export const buildEventEnrichmentQuery: SecuritySolutionFactory<CtiQueries.event
     ];
 
     return {
-      allowNoIndices: true,
-      ignoreUnavailable: true,
+      allow_no_indices: true,
+      ignore_unavailable: true,
       index: defaultIndex,
       body: {
         _source: false,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/response.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/response.test.ts
index 137dd3b2c3d14..de88860876089 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/response.test.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/cti/event_enrichment/response.test.ts
@@ -18,7 +18,7 @@ describe('parseEventEnrichmentResponse', () => {
     const parsedResponse = await parseEventEnrichmentResponse(options, response);
 
     const expectedInspect = expect.objectContaining({
-      allowNoIndices: true,
+      allow_no_indices: true,
       body: {
         _source: false,
         fields: ['*'],
@@ -57,7 +57,7 @@ describe('parseEventEnrichmentResponse', () => {
           },
         },
       },
-      ignoreUnavailable: true,
+      ignore_unavailable: true,
       index: ['filebeat-*'],
     });
     const parsedInspect = JSON.parse(parsedResponse.inspect.dsl[0]);
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
index 0369f182a4c75..d6e456e706673 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/__mocks__/index.ts
@@ -611,7 +611,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -622,7 +622,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             docvalue_fields: mockOptions.docValueFields,
@@ -783,7 +783,7 @@ export const mockBuckets: HostAggEsItem = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   track_total_hits: false,
   body: {
     aggregations: {
@@ -821,7 +821,7 @@ export const expectedDsl = {
     docvalue_fields: mockOptions.docValueFields,
     size: 0,
   },
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
index 5d8540f886077..bc405e89bf7a6 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
@@ -40,9 +40,9 @@ export const buildHostsQuery = ({
   const agg = { host_count: { cardinality: { field: 'host.name' } } };
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts_entities.dsl.ts
index 1c338998e3b65..94124bc9567b7 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts_entities.dsl.ts
@@ -40,9 +40,9 @@ export const buildHostsQueryEntities = ({
   const agg = { host_count: { cardinality: { field: 'host.name' } } };
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
index 1dd3dc8ee4cff..bdc4755c6a02b 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/__mocks__/index.ts
@@ -2149,7 +2149,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -2160,7 +2160,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           body: {
             docvalue_fields: mockOptions.docValueFields,
             aggregations: {
@@ -2371,7 +2371,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -2382,7 +2382,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   body: {
     docvalue_fields: mockOptions.docValueFields,
     aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
index 325d45e04b2b0..1057ace837b43 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query.dsl.ts
@@ -61,9 +61,9 @@ export const buildQuery = ({
   };
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query_entities.dsl.ts
index d320130115588..a17bb2ecf9c8f 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/authentications/dsl/query_entities.dsl.ts
@@ -41,9 +41,9 @@ export const buildQueryEntities = ({
   };
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
index e0473c9501b0c..ec8c7d7ca6866 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
@@ -1301,7 +1301,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -1312,7 +1312,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             aggregations: {
@@ -1415,7 +1415,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -1426,7 +1426,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   track_total_hits: false,
   body: {
     aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
index 45afed2526aa3..003149a9501bb 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
@@ -35,9 +35,9 @@ export const buildHostDetailsQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications.dsl.ts
index 01473a4368dbc..738a9db683728 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications.dsl.ts
@@ -39,8 +39,8 @@ export const buildHostsKpiAuthenticationsQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications_entities.dsl.ts
index cff09f2354d31..fd1104345babc 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/authentications/query.hosts_kpi_authentications_entities.dsl.ts
@@ -28,8 +28,8 @@ export const buildHostsKpiAuthenticationsQueryEntities = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts.dsl.ts
index 5ea2d1aa40780..ed1d0e8edb107 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts.dsl.ts
@@ -28,8 +28,8 @@ export const buildHostsKpiHostsQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts_entities.dsl.ts
index 972ead9a6538e..785f6aa5b6980 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/hosts/query.hosts_kpi_hosts_entities.dsl.ts
@@ -28,8 +28,8 @@ export const buildHostsKpiHostsQueryEntities = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips.dsl.ts
index 0471644d11bbe..c875e23b523e5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips.dsl.ts
@@ -28,8 +28,8 @@ export const buildHostsKpiUniqueIpsQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips_entities.dsl.ts
index 2a55c34238d70..e323de78a0459 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/kpi/unique_ips/query.hosts_kpi_unique_ips_entities.dsl.ts
@@ -28,8 +28,8 @@ export const buildHostsKpiUniqueIpsQueryEntities = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts
index 443e7e96a3c7f..54403f9c392e7 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/__mocks__/index.ts
@@ -124,7 +124,7 @@ export const formattedSearchStrategyFirstResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -135,7 +135,7 @@ export const formattedSearchStrategyFirstResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             query: { bool: { filter: [{ term: { 'host.name': 'siem-kibana' } }] } },
@@ -190,7 +190,7 @@ export const formattedSearchStrategyLastResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -201,7 +201,7 @@ export const formattedSearchStrategyLastResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             query: { bool: { filter: [{ term: { 'host.name': 'siem-kibana' } }] } },
@@ -225,7 +225,7 @@ export const formattedSearchStrategyLastResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -236,7 +236,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   track_total_hits: false,
   body: {
     _source: ['@timestamp'],
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/query.first_or_last_seen_host.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/query.first_or_last_seen_host.dsl.ts
index 21876b9aad11b..8f9f7462b9dcb 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/query.first_or_last_seen_host.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/last_first_seen/query.first_or_last_seen_host.dsl.ts
@@ -17,9 +17,9 @@ export const buildFirstOrLastSeenHostQuery = ({
   const filter = [{ term: { 'host.name': hostName } }];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
index 2b4e4b8291401..85bce797f52ae 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/__mocks__/index.ts
@@ -117,7 +117,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -128,7 +128,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             aggregations: {
@@ -330,7 +330,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -341,7 +341,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   track_total_hits: false,
   body: {
     aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts
index a0ae368ac0fe2..92d194e78284b 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/overview/query.overview_host.dsl.ts
@@ -28,9 +28,9 @@ export const buildOverviewHostQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/risk_score/query.hosts_risk.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/risk_score/query.hosts_risk.dsl.ts
index 43930ab3de2ef..5bbc9b7726002 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/risk_score/query.hosts_risk.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/risk_score/query.hosts_risk.dsl.ts
@@ -32,8 +32,8 @@ export const buildHostsRiskScoreQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: false,
-    ignoreUnavailable: true,
+    allow_no_indices: false,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       query: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
index 0ad976a0f498c..2730465323c19 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/__mocks__/index.ts
@@ -4300,7 +4300,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -4311,7 +4311,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           body: {
             aggregations: {
               process_count: { cardinality: { field: 'process.name' } },
@@ -4435,7 +4435,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -4446,7 +4446,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   body: {
     aggregations: {
       process_count: { cardinality: { field: 'process.name' } },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
index 5d4f45c68160a..c5a78354ed866 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
@@ -48,9 +48,9 @@ export const buildQuery = ({
   };
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggregations: {
         ...agg,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
index 7f36e3551e5be..d5478dad15d50 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
@@ -41,8 +41,8 @@ export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyRespo
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          allowNoIndices: true,
-          ignoreUnavailable: true,
+          allow_no_indices: true,
+          ignore_unavailable: true,
           track_total_hits: true,
           body: {
             aggregations: {
@@ -127,7 +127,7 @@ export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyRespo
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   track_total_hits: false,
   body: {
     aggregations: {
@@ -164,7 +164,7 @@ export const expectedDsl = {
     },
     size: 0,
   },
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -209,8 +209,8 @@ export const formattedAnomaliesSearchStrategyResponse: MatrixHistogramStrategyRe
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          allowNoIndices: true,
-          ignoreUnavailable: true,
+          allow_no_indices: true,
+          ignore_unavailable: true,
           track_total_hits: true,
           body: {
             aggs: {
@@ -392,8 +392,8 @@ export const formattedAuthenticationsSearchStrategyResponse: MatrixHistogramStra
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          allowNoIndices: true,
-          ignoreUnavailable: true,
+          allow_no_indices: true,
+          ignore_unavailable: true,
           track_total_hits: true,
           body: {
             aggregations: {
@@ -959,8 +959,8 @@ export const formattedEventsSearchStrategyResponse: MatrixHistogramStrategyRespo
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          allowNoIndices: true,
-          ignoreUnavailable: true,
+          allow_no_indices: true,
+          ignore_unavailable: true,
           track_total_hits: true,
           body: {
             aggregations: {
@@ -1927,7 +1927,7 @@ export const formattedDnsSearchStrategyResponse: MatrixHistogramStrategyResponse
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -1938,7 +1938,7 @@ export const formattedDnsSearchStrategyResponse: MatrixHistogramStrategyResponse
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           body: {
             aggregations: {
               dns_count: { cardinality: { field: 'dns.question.registered_domain' } },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
index 82531f35b09ab..4f6b910fbccf7 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
@@ -36,8 +36,8 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts
index 54ee066b64119..60df6023a13d0 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.ts
@@ -83,8 +83,8 @@ export const buildAlertsHistogramQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       aggregations: getHistogramAggregation(),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
index ab76d54dee11f..700580655f1b0 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
@@ -36,8 +36,8 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.ts
index 78fc0a30d0477..b82e7823fd847 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.ts
@@ -64,8 +64,8 @@ export const buildAnomaliesHistogramQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       aggs: getHistogramAggregation(),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
index 1fd7b85242df6..b917da12c9ad7 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
@@ -35,8 +35,8 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.ts
index 8661fff574b4a..b16efcd8301e0 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.ts
@@ -76,8 +76,8 @@ export const buildAuthenticationsHistogramQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       aggregations: getHistogramAggregation(),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram_entities.dsl.ts
index c66a0d6c11b94..886dcf11123bd 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram_entities.dsl.ts
@@ -59,8 +59,8 @@ export const buildAuthenticationsHistogramQueryEntities = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       aggregations: getHistogramAggregation(),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
index 4d97fba3cb80c..d4e721a5ebe80 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
@@ -26,7 +26,7 @@ export const mockOptions = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -37,7 +37,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   body: {
     aggregations: {
       dns_count: { cardinality: { field: 'dns.question.registered_domain' } },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.ts
index d9dfc57a264a8..7a7b4b49d17c1 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.ts
@@ -77,9 +77,9 @@ export const buildDnsHistogramQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
index 5dab2bcd5cf9d..d2ee38ddd66a8 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
@@ -40,8 +40,8 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
@@ -95,8 +95,8 @@ export const expectedThresholdDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
@@ -152,8 +152,8 @@ export const expectedThresholdMissingFieldDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
@@ -197,7 +197,7 @@ export const expectedThresholdMissingFieldDsl = {
 };
 
 export const expectedThresholdWithCardinalityDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   body: {
     aggregations: {
       eventActionGroup: {
@@ -244,7 +244,7 @@ export const expectedThresholdWithCardinalityDsl = {
     },
     size: 0,
   },
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -269,8 +269,8 @@ export const expectedThresholdWithGroupFieldsAndCardinalityDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
@@ -316,7 +316,7 @@ export const expectedThresholdWithGroupFieldsAndCardinalityDsl = {
 };
 
 export const expectedThresholdGroupWithCardinalityDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   body: {
     aggregations: {
       eventActionGroup: {
@@ -365,7 +365,7 @@ export const expectedThresholdGroupWithCardinalityDsl = {
     },
     size: 0,
   },
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -390,8 +390,8 @@ export const expectedIpIncludingMissingDataDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
@@ -453,8 +453,8 @@ export const expectedIpNotIncludingMissingDataDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   track_total_hits: true,
   body: {
     aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.ts
index 16bcb3cdbfcb1..91aeb50448d4e 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.ts
@@ -152,8 +152,8 @@ export const buildEventsHistogramQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       aggregations: getHistogramAggregation(),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts
index 7f71906bcaa97..158b63e6e8455 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/__mocks__/index.ts
@@ -304,7 +304,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -315,7 +315,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             docvalue_fields: mockOptions.docValueFields,
@@ -446,7 +446,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -457,7 +457,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   track_total_hits: false,
   body: {
     aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/query.details_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/query.details_network.dsl.ts
index e5a508663a2e0..5684c7685231e 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/query.details_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/query.details_network.dsl.ts
@@ -103,9 +103,9 @@ export const buildNetworkDetailsQuery = ({
   ip,
 }: NetworkDetailsRequestOptions) => {
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
index cc01450e5bec5..f1bae35f53ebb 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/__mocks__/index.ts
@@ -131,7 +131,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -142,7 +142,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           body: {
             aggregations: {
               dns_count: { cardinality: { field: 'dns.question.registered_domain' } },
@@ -203,7 +203,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -214,7 +214,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   body: {
     aggregations: {
       dns_count: { cardinality: { field: 'dns.question.registered_domain' } },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/query.dns_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/query.dns_network.dsl.ts
index 90e8ee02ee684..612d83e81660d 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/query.dns_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/dns/query.dns_network.dsl.ts
@@ -88,9 +88,9 @@ export const buildDnsQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
index 9d52eb638eac6..f831b9f20e8ca 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/__mocks__/index.ts
@@ -613,7 +613,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -624,7 +624,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           body: {
             aggregations: {
               http_count: { cardinality: { field: 'url.path' } },
@@ -671,7 +671,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -682,7 +682,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   body: {
     aggregations: {
       http_count: { cardinality: { field: 'url.path' } },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts
index 85db56cd72167..8882d17804261 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts
@@ -36,9 +36,9 @@ export const buildHttpQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggregations: {
         ...getCountAgg(),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kip_dns_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kip_dns_entities.dsl.ts
index 75b32af4b01f5..c0317772e5fa9 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kip_dns_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kip_dns_entities.dsl.ts
@@ -28,8 +28,8 @@ export const buildDnsQueryEntities = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kpi_dns.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kpi_dns.dsl.ts
index 1d1aa50cc3ee2..8d27f7d289d03 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kpi_dns.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kpi_dns.dsl.ts
@@ -56,8 +56,8 @@ export const buildDnsQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       query: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events.dsl.ts
index 3d5607c8b443a..4d5ca88fe383a 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events.dsl.ts
@@ -30,8 +30,8 @@ export const buildNetworkEventsQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       query: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events_entities.dsl.ts
index 6311bb6ea2039..bb40da0a064fb 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events_entities.dsl.ts
@@ -28,8 +28,8 @@ export const buildNetworkEventsQueryEntities = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes.dsl.ts
index 0a826938e95b8..eae7f7a29ce72 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes.dsl.ts
@@ -56,8 +56,8 @@ export const buildTlsHandshakeQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       query: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes_entities.dsl.ts
index 5b0ac92b35049..bd7a464e1a090 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes_entities.dsl.ts
@@ -28,8 +28,8 @@ export const buildTlsHandshakeQueryEntities = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/query.network_kpi_unique_flows.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/query.network_kpi_unique_flows.dsl.ts
index ec8de30cfff85..3cb04caf5afe5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/query.network_kpi_unique_flows.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/query.network_kpi_unique_flows.dsl.ts
@@ -30,8 +30,8 @@ export const buildUniqueFlowsQuery = ({
 
   const dslQuery = {
     index: defaultIndex,
-    allowNoIndices: true,
-    ignoreUnavailable: true,
+    allow_no_indices: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips.dsl.ts
index 590e7117826d7..c915cd4fb58d6 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips.dsl.ts
@@ -84,9 +84,9 @@ export const buildUniquePrivateIpsQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips_entities.dsl.ts
index a56cf4c3d1ced..922a082439807 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips_entities.dsl.ts
@@ -84,9 +84,9 @@ export const buildUniquePrivateIpsQueryEntities = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
index 74b201e9a2294..0b5019d6fec9a 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/__mocks__/index.ts
@@ -101,7 +101,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -112,7 +112,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             aggregations: {
@@ -206,8 +206,8 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
-  ignoreUnavailable: true,
+  allow_no_indices: true,
+  ignore_unavailable: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/query.overview_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/query.overview_network.dsl.ts
index 7e35ae2fd4308..f911850c8cd94 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/query.overview_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/overview/query.overview_network.dsl.ts
@@ -28,9 +28,9 @@ export const buildOverviewNetworkQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggregations: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
index e46c2c20aa1a8..c34ec2225ed95 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/__mocks__/index.ts
@@ -59,7 +59,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -70,7 +70,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             aggs: {
@@ -114,7 +114,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -125,7 +125,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   track_total_hits: false,
   body: {
     aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/query.tls_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/query.tls_network.dsl.ts
index 4f724cf9b15f9..297643fe56952 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/query.tls_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/tls/query.tls_network.dsl.ts
@@ -75,9 +75,9 @@ export const buildNetworkTlsQuery = ({
   const filter = ip ? [...defaultFilter, { term: { [`${flowTarget}.ip`]: ip } }] : defaultFilter;
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
index ba5db90df8245..490ade26ad2a5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/__mocks__/index.ts
@@ -58,7 +58,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -69,7 +69,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           body: {
             aggregations: {
               top_countries_count: { cardinality: { field: 'destination.geo.country_iso_code' } },
@@ -118,7 +118,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -129,7 +129,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   body: {
     aggregations: {
       top_countries_count: { cardinality: { field: 'destination.geo.country_iso_code' } },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network.dsl.ts
index 880cd4002086a..463d3c9b11bd2 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network.dsl.ts
@@ -42,9 +42,9 @@ export const buildTopCountriesQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggregations: {
         ...getCountAgg(flowTarget),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network_entities.dsl.ts
index d661bfa0d6707..7f1d27db45d2d 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_countries/query.top_countries_network_entities.dsl.ts
@@ -47,9 +47,9 @@ export const buildTopCountriesQueryEntities = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggregations: {
         ...getCountAgg(flowTarget),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
index e881a9ef93949..fa759661772d5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/__mocks__/index.ts
@@ -810,7 +810,7 @@ export const formattedSearchStrategyResponse: NetworkTopNFlowStrategyResponse =
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -821,7 +821,7 @@ export const formattedSearchStrategyResponse: NetworkTopNFlowStrategyResponse =
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           body: {
             aggregations: {
               top_n_flow_count: { cardinality: { field: 'source.ip' } },
@@ -878,7 +878,7 @@ export const formattedSearchStrategyResponse: NetworkTopNFlowStrategyResponse =
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
@@ -889,7 +889,7 @@ export const expectedDsl = {
     'packetbeat-*',
     'winlogbeat-*',
   ],
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   body: {
     aggregations: {
       top_n_flow_count: { cardinality: { field: 'source.ip' } },
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network.dsl.ts
index f1ac87e59d392..52efb50f00b4b 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network.dsl.ts
@@ -42,9 +42,9 @@ export const buildTopNFlowQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggregations: {
         ...getCountAgg(flowTarget),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network_entities.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network_entities.dsl.ts
index 3ea3c6f363de0..d11a2debf3cff 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network_entities.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/top_n_flow/query.top_n_flow_network_entities.dsl.ts
@@ -47,9 +47,9 @@ export const buildTopNFlowQueryEntities = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggregations: {
         ...getCountAgg(flowTarget),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
index 686730dbe7927..acb98b7e347bc 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/__mocks__/index.ts
@@ -119,7 +119,7 @@ export const formattedSearchStrategyResponse = {
     dsl: [
       JSON.stringify(
         {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: [
             'apm-*-transaction*',
             'traces-apm*',
@@ -130,7 +130,7 @@ export const formattedSearchStrategyResponse = {
             'packetbeat-*',
             'winlogbeat-*',
           ],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             aggs: {
@@ -175,7 +175,7 @@ export const formattedSearchStrategyResponse = {
 };
 
 export const expectedDsl = {
-  allowNoIndices: true,
+  allow_no_indices: true,
   track_total_hits: false,
   body: {
     aggs: {
@@ -209,7 +209,7 @@ export const expectedDsl = {
     },
     size: 0,
   },
-  ignoreUnavailable: true,
+  ignore_unavailable: true,
   index: [
     'apm-*-transaction*',
     'traces-apm*',
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/query.users_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/query.users_network.dsl.ts
index 2b02b25292a32..0c35c967c2ac5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/query.users_network.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/users/query.users_network.dsl.ts
@@ -34,9 +34,9 @@ export const buildUsersQuery = ({
   ];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: false,
     body: {
       aggs: {
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_rules/query.host_rules.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_rules/query.host_rules.dsl.ts
index 4c116104b3e14..d2aeb63b743f5 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_rules/query.host_rules.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_rules/query.host_rules.dsl.ts
@@ -30,9 +30,9 @@ export const buildHostRulesQuery = ({
   ];
 
   return {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex, // can stop getting this from sourcerer and assume default detections index if we want
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_tactics/query.host_tactics.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_tactics/query.host_tactics.dsl.ts
index ec1afe247011b..f9bbcc8077278 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_tactics/query.host_tactics.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/host_tactics/query.host_tactics.dsl.ts
@@ -30,9 +30,9 @@ export const buildHostTacticsQuery = ({
   ];
 
   return {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex, // can stop getting this from sourcerer and assume default detections index if we want
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/risk_score/query.risk_score.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/risk_score/query.risk_score.dsl.ts
index 79c50d84e3c92..90d2e51c8ff9e 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/risk_score/query.risk_score.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/risk_score/query.risk_score.dsl.ts
@@ -31,9 +31,9 @@ export const buildRiskScoreQuery = ({
   ];
 
   return {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/user_rules/query.user_rules.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/user_rules/query.user_rules.dsl.ts
index c2242ff00a6c1..d3111eed4aef8 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/user_rules/query.user_rules.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/ueba/user_rules/query.user_rules.dsl.ts
@@ -30,9 +30,9 @@ export const buildUserRulesQuery = ({
   ];
 
   return {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex, // can stop getting this from sourcerer and assume default detections index if we want
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     track_total_hits: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
diff --git a/x-pack/plugins/security_solution/server/usage/detections/detection_rule_helpers.ts b/x-pack/plugins/security_solution/server/usage/detections/detection_rule_helpers.ts
index 8d5a2efc7fae1..eaeceb8ab57ee 100644
--- a/x-pack/plugins/security_solution/server/usage/detections/detection_rule_helpers.ts
+++ b/x-pack/plugins/security_solution/server/usage/detections/detection_rule_helpers.ts
@@ -188,8 +188,8 @@ export const getDetectionRuleMetrics = async (
   let rulesUsage: DetectionRulesTypeUsage = initialDetectionRulesUsage;
   const ruleSearchOptions: RuleSearchParams = {
     body: { query: { bool: { filter: { term: { 'alert.alertTypeId': SIGNALS_ID } } } } },
-    filterPath: [],
-    ignoreUnavailable: true,
+    filter_path: [],
+    ignore_unavailable: true,
     index: kibanaIndex,
     size: MAX_RESULTS_WINDOW,
   };
diff --git a/x-pack/plugins/security_solution/server/usage/detections/types.ts b/x-pack/plugins/security_solution/server/usage/detections/types.ts
index 0e3ba97ca0f7c..430a524f3f03a 100644
--- a/x-pack/plugins/security_solution/server/usage/detections/types.ts
+++ b/x-pack/plugins/security_solution/server/usage/detections/types.ts
@@ -17,8 +17,8 @@ interface RuleSearchBody {
 
 export interface RuleSearchParams {
   body: RuleSearchBody;
-  filterPath: string[];
-  ignoreUnavailable: boolean;
+  filter_path: string[];
+  ignore_unavailable: boolean;
   index: string;
   size: number;
 }
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
index 72a7d6e2692e8..3653cb60d3653 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
@@ -63,9 +63,9 @@ export const buildTimelineEventsAllQuery = ({
     });
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
       aggregations: {
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts
index 3572a2b9c497e..9066861cdb818 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts
@@ -22,7 +22,7 @@ describe('buildTimelineDetailsQuery', () => {
 
     expect(query).toMatchInlineSnapshot(`
       Object {
-        "allowNoIndices": true,
+        "allow_no_indices": true,
         "body": Object {
           "_source": true,
           "docvalue_fields": Array [
@@ -53,7 +53,7 @@ describe('buildTimelineDetailsQuery', () => {
             },
           },
         },
-        "ignoreUnavailable": true,
+        "ignore_unavailable": true,
         "index": ".siem-signals-default",
         "size": 1,
       }
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
index 4297cd595e261..70b592440468e 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
@@ -33,9 +33,9 @@ export const buildTimelineDetailsQuery = (
         };
 
   return {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: indexName,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       docvalue_fields: docValueFields,
       query,
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/kpi/query.kpi.dsl.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/kpi/query.kpi.dsl.ts
index 41eed7cbb4fa3..dd87ef177bfe6 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/kpi/query.kpi.dsl.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/kpi/query.kpi.dsl.ts
@@ -44,9 +44,9 @@ export const buildTimelineKpiQuery = ({
   const filter = [...filterClause, ...getTimerangeFilter(timerange), { match_all: {} }];
 
   const dslQuery = {
-    allowNoIndices: true,
+    allow_no_indices: true,
     index: defaultIndex,
-    ignoreUnavailable: true,
+    ignore_unavailable: true,
     body: {
       aggs: {
         userCount: {
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/last_event_time/query.events_last_event_time.dsl.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/last_event_time/query.events_last_event_time.dsl.ts
index 354c682377bac..4ff86c9a9f290 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/last_event_time/query.events_last_event_time.dsl.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/last_event_time/query.events_last_event_time.dsl.ts
@@ -38,9 +38,9 @@ export const buildLastEventTimeQuery = ({
       case LastEventIndexKey.ipDetails:
         if (details.ip) {
           return {
-            allowNoIndices: true,
+            allow_no_indices: true,
             index: indicesToQuery.network,
-            ignoreUnavailable: true,
+            ignore_unavailable: true,
             track_total_hits: false,
             body: {
               ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
@@ -61,9 +61,9 @@ export const buildLastEventTimeQuery = ({
       case LastEventIndexKey.hostDetails:
         if (details.hostName) {
           return {
-            allowNoIndices: true,
+            allow_no_indices: true,
             index: indicesToQuery.hosts,
-            ignoreUnavailable: true,
+            ignore_unavailable: true,
             track_total_hits: false,
             body: {
               ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),
@@ -85,9 +85,9 @@ export const buildLastEventTimeQuery = ({
       case LastEventIndexKey.network:
       case LastEventIndexKey.ueba:
         return {
-          allowNoIndices: true,
+          allow_no_indices: true,
           index: indicesToQuery[indexKey],
-          ignoreUnavailable: true,
+          ignore_unavailable: true,
           track_total_hits: false,
           body: {
             ...(!isEmpty(docValueFields) ? { docvalue_fields: docValueFields } : {}),