diff --git a/docs/development/core/server/kibana-plugin-core-server.md b/docs/development/core/server/kibana-plugin-core-server.md
index dfffdffb08a08..c16600d1d0492 100644
--- a/docs/development/core/server/kibana-plugin-core-server.md
+++ b/docs/development/core/server/kibana-plugin-core-server.md
@@ -28,6 +28,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectsErrorHelpers](./kibana-plugin-core-server.savedobjectserrorhelpers.md) |  |
 |  [SavedObjectsRepository](./kibana-plugin-core-server.savedobjectsrepository.md) |  |
 |  [SavedObjectsSerializer](./kibana-plugin-core-server.savedobjectsserializer.md) | A serializer that can be used to manually convert [raw](./kibana-plugin-core-server.savedobjectsrawdoc.md) or [sanitized](./kibana-plugin-core-server.savedobjectsanitizeddoc.md) documents to the other kind. |
+|  [SavedObjectsUtils](./kibana-plugin-core-server.savedobjectsutils.md) |  |
 |  [SavedObjectTypeRegistry](./kibana-plugin-core-server.savedobjecttyperegistry.md) | Registry holding information about all the registered [saved object types](./kibana-plugin-core-server.savedobjectstype.md)<!-- -->. |
 
 ## Enumerations
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsbulkupdateobject.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsbulkupdateobject.md
index e079e0fa51aac..d71eda6009284 100644
--- a/docs/development/core/server/kibana-plugin-core-server.savedobjectsbulkupdateobject.md
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsbulkupdateobject.md
@@ -17,5 +17,6 @@ export interface SavedObjectsBulkUpdateObject<T = unknown> extends Pick<SavedObj
 |  --- | --- | --- |
 |  [attributes](./kibana-plugin-core-server.savedobjectsbulkupdateobject.attributes.md) | <code>Partial&lt;T&gt;</code> | The data for a Saved Object is stored as an object in the <code>attributes</code> property. |
 |  [id](./kibana-plugin-core-server.savedobjectsbulkupdateobject.id.md) | <code>string</code> | The ID of this Saved Object, guaranteed to be unique for all objects of the same <code>type</code> |
+|  [namespace](./kibana-plugin-core-server.savedobjectsbulkupdateobject.namespace.md) | <code>string</code> | Optional namespace string to use when searching for this object. If this is defined, it will supersede the namespace ID that is in [SavedObjectsBulkUpdateOptions](./kibana-plugin-core-server.savedobjectsbulkupdateoptions.md)<!-- -->.<!-- -->Note: the default namespace's string representation is <code>'default'</code>, and its ID representation is <code>undefined</code>. |
 |  [type](./kibana-plugin-core-server.savedobjectsbulkupdateobject.type.md) | <code>string</code> | The type of this Saved Object. Each plugin can define it's own custom Saved Object types. |
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsbulkupdateobject.namespace.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsbulkupdateobject.namespace.md
new file mode 100644
index 0000000000000..544efcd3be909
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsbulkupdateobject.namespace.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [SavedObjectsBulkUpdateObject](./kibana-plugin-core-server.savedobjectsbulkupdateobject.md) &gt; [namespace](./kibana-plugin-core-server.savedobjectsbulkupdateobject.namespace.md)
+
+## SavedObjectsBulkUpdateObject.namespace property
+
+Optional namespace string to use when searching for this object. If this is defined, it will supersede the namespace ID that is in [SavedObjectsBulkUpdateOptions](./kibana-plugin-core-server.savedobjectsbulkupdateoptions.md)<!-- -->.
+
+Note: the default namespace's string representation is `'default'`<!-- -->, and its ID representation is `undefined`<!-- -->.
+
+<b>Signature:</b>
+
+```typescript
+namespace?: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.md
new file mode 100644
index 0000000000000..e365dfbcb5142
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.md
@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [SavedObjectsUtils](./kibana-plugin-core-server.savedobjectsutils.md)
+
+## SavedObjectsUtils class
+
+
+<b>Signature:</b>
+
+```typescript
+export declare class SavedObjectsUtils 
+```
+
+## Properties
+
+|  Property | Modifiers | Type | Description |
+|  --- | --- | --- | --- |
+|  [namespaceIdToString](./kibana-plugin-core-server.savedobjectsutils.namespaceidtostring.md) | <code>static</code> | <code>(namespace?: string &#124; undefined) =&gt; string</code> | Converts a given saved object namespace ID to its string representation. All namespace IDs have an identical string representation, with the exception of the <code>undefined</code> namespace ID (which has a namespace string of <code>'default'</code>). |
+|  [namespaceStringToId](./kibana-plugin-core-server.savedobjectsutils.namespacestringtoid.md) | <code>static</code> | <code>(namespace: string) =&gt; string &#124; undefined</code> | Converts a given saved object namespace string to its ID representation. All namespace strings have an identical ID representation, with the exception of the <code>'default'</code> namespace string (which has a namespace ID of <code>undefined</code>). |
+
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.namespaceidtostring.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.namespaceidtostring.md
new file mode 100644
index 0000000000000..591505892e64f
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.namespaceidtostring.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [SavedObjectsUtils](./kibana-plugin-core-server.savedobjectsutils.md) &gt; [namespaceIdToString](./kibana-plugin-core-server.savedobjectsutils.namespaceidtostring.md)
+
+## SavedObjectsUtils.namespaceIdToString property
+
+Converts a given saved object namespace ID to its string representation. All namespace IDs have an identical string representation, with the exception of the `undefined` namespace ID (which has a namespace string of `'default'`<!-- -->).
+
+<b>Signature:</b>
+
+```typescript
+static namespaceIdToString: (namespace?: string | undefined) => string;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.namespacestringtoid.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.namespacestringtoid.md
new file mode 100644
index 0000000000000..e052fe493b5ea
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.namespacestringtoid.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [SavedObjectsUtils](./kibana-plugin-core-server.savedobjectsutils.md) &gt; [namespaceStringToId](./kibana-plugin-core-server.savedobjectsutils.namespacestringtoid.md)
+
+## SavedObjectsUtils.namespaceStringToId property
+
+Converts a given saved object namespace string to its ID representation. All namespace strings have an identical ID representation, with the exception of the `'default'` namespace string (which has a namespace ID of `undefined`<!-- -->).
+
+<b>Signature:</b>
+
+```typescript
+static namespaceStringToId: (namespace: string) => string | undefined;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig._constructor_.md
new file mode 100644
index 0000000000000..9287a08ff196b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig._constructor_.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.aggconfig._constructor_.md)
+
+## AggConfig.(constructor)
+
+Constructs a new instance of the `AggConfig` class
+
+<b>Signature:</b>
+
+```typescript
+constructor(aggConfigs: IAggConfigs, opts: AggConfigOptions);
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  aggConfigs | <code>IAggConfigs</code> |  |
+|  opts | <code>AggConfigOptions</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.aggconfigs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.aggconfigs.md
new file mode 100644
index 0000000000000..f552bbd2d1cfc
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.aggconfigs.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [aggConfigs](./kibana-plugin-plugins-data-public.aggconfig.aggconfigs.md)
+
+## AggConfig.aggConfigs property
+
+<b>Signature:</b>
+
+```typescript
+aggConfigs: IAggConfigs;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.brandnew.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.brandnew.md
new file mode 100644
index 0000000000000..eb1f3af4c5b01
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.brandnew.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [brandNew](./kibana-plugin-plugins-data-public.aggconfig.brandnew.md)
+
+## AggConfig.brandNew property
+
+<b>Signature:</b>
+
+```typescript
+brandNew?: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.createfilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.createfilter.md
new file mode 100644
index 0000000000000..7ec0350f65321
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.createfilter.md
@@ -0,0 +1,23 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [createFilter](./kibana-plugin-plugins-data-public.aggconfig.createfilter.md)
+
+## AggConfig.createFilter() method
+
+<b>Signature:</b>
+
+```typescript
+createFilter(key: string, params?: {}): any;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  key | <code>string</code> |  |
+|  params | <code>{}</code> |  |
+
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.enabled.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.enabled.md
new file mode 100644
index 0000000000000..82595ee5f5b63
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.enabled.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [enabled](./kibana-plugin-plugins-data-public.aggconfig.enabled.md)
+
+## AggConfig.enabled property
+
+<b>Signature:</b>
+
+```typescript
+enabled: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.ensureids.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.ensureids.md
new file mode 100644
index 0000000000000..04e0b82187a5f
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.ensureids.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [ensureIds](./kibana-plugin-plugins-data-public.aggconfig.ensureids.md)
+
+## AggConfig.ensureIds() method
+
+Ensure that all of the objects in the list have ids, the objects and list are modified by reference.
+
+<b>Signature:</b>
+
+```typescript
+static ensureIds(list: any[]): any[];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  list | <code>any[]</code> |  |
+
+<b>Returns:</b>
+
+`any[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.fieldistimefield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.fieldistimefield.md
new file mode 100644
index 0000000000000..a1fde4dec25b1
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.fieldistimefield.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [fieldIsTimeField](./kibana-plugin-plugins-data-public.aggconfig.fieldistimefield.md)
+
+## AggConfig.fieldIsTimeField() method
+
+<b>Signature:</b>
+
+```typescript
+fieldIsTimeField(): boolean | "" | undefined;
+```
+<b>Returns:</b>
+
+`boolean | "" | undefined`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.fieldname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.fieldname.md
new file mode 100644
index 0000000000000..2d3acb7f026ff
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.fieldname.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [fieldName](./kibana-plugin-plugins-data-public.aggconfig.fieldname.md)
+
+## AggConfig.fieldName() method
+
+<b>Signature:</b>
+
+```typescript
+fieldName(): any;
+```
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getaggparams.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getaggparams.md
new file mode 100644
index 0000000000000..f898844ff0273
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getaggparams.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getAggParams](./kibana-plugin-plugins-data-public.aggconfig.getaggparams.md)
+
+## AggConfig.getAggParams() method
+
+<b>Signature:</b>
+
+```typescript
+getAggParams(): import("./param_types/agg").AggParamType<AggConfig>[];
+```
+<b>Returns:</b>
+
+`import("./param_types/agg").AggParamType<AggConfig>[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getfield.md
new file mode 100644
index 0000000000000..1fb6f88c43171
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getfield.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getField](./kibana-plugin-plugins-data-public.aggconfig.getfield.md)
+
+## AggConfig.getField() method
+
+<b>Signature:</b>
+
+```typescript
+getField(): any;
+```
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getfielddisplayname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getfielddisplayname.md
new file mode 100644
index 0000000000000..710499cee62dd
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getfielddisplayname.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getFieldDisplayName](./kibana-plugin-plugins-data-public.aggconfig.getfielddisplayname.md)
+
+## AggConfig.getFieldDisplayName() method
+
+<b>Signature:</b>
+
+```typescript
+getFieldDisplayName(): any;
+```
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getindexpattern.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getindexpattern.md
new file mode 100644
index 0000000000000..ed0e9d0fbb5de
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getindexpattern.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getIndexPattern](./kibana-plugin-plugins-data-public.aggconfig.getindexpattern.md)
+
+## AggConfig.getIndexPattern() method
+
+<b>Signature:</b>
+
+```typescript
+getIndexPattern(): import("../../../public").IndexPattern;
+```
+<b>Returns:</b>
+
+`import("../../../public").IndexPattern`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getkey.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getkey.md
new file mode 100644
index 0000000000000..a2a59fcf9ae31
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getkey.md
@@ -0,0 +1,23 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getKey](./kibana-plugin-plugins-data-public.aggconfig.getkey.md)
+
+## AggConfig.getKey() method
+
+<b>Signature:</b>
+
+```typescript
+getKey(bucket: any, key?: string): any;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  bucket | <code>any</code> |  |
+|  key | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getparam.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getparam.md
new file mode 100644
index 0000000000000..ad4cd2fa175f8
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getparam.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getParam](./kibana-plugin-plugins-data-public.aggconfig.getparam.md)
+
+## AggConfig.getParam() method
+
+<b>Signature:</b>
+
+```typescript
+getParam(key: string): any;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  key | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getrequestaggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getrequestaggs.md
new file mode 100644
index 0000000000000..773c2f5a7c0e9
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getrequestaggs.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getRequestAggs](./kibana-plugin-plugins-data-public.aggconfig.getrequestaggs.md)
+
+## AggConfig.getRequestAggs() method
+
+<b>Signature:</b>
+
+```typescript
+getRequestAggs(): AggConfig[];
+```
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getresponseaggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getresponseaggs.md
new file mode 100644
index 0000000000000..cf515e68dcc57
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getresponseaggs.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getResponseAggs](./kibana-plugin-plugins-data-public.aggconfig.getresponseaggs.md)
+
+## AggConfig.getResponseAggs() method
+
+<b>Signature:</b>
+
+```typescript
+getResponseAggs(): AggConfig[];
+```
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.gettimerange.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.gettimerange.md
new file mode 100644
index 0000000000000..897a6d8dda3f1
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.gettimerange.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getTimeRange](./kibana-plugin-plugins-data-public.aggconfig.gettimerange.md)
+
+## AggConfig.getTimeRange() method
+
+<b>Signature:</b>
+
+```typescript
+getTimeRange(): import("../../../public").TimeRange | undefined;
+```
+<b>Returns:</b>
+
+`import("../../../public").TimeRange | undefined`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getvalue.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getvalue.md
new file mode 100644
index 0000000000000..4fab1af3f6464
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.getvalue.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [getValue](./kibana-plugin-plugins-data-public.aggconfig.getvalue.md)
+
+## AggConfig.getValue() method
+
+<b>Signature:</b>
+
+```typescript
+getValue(bucket: any): any;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  bucket | <code>any</code> |  |
+
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.id.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.id.md
new file mode 100644
index 0000000000000..1fa7a5c57e2a8
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.id.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [id](./kibana-plugin-plugins-data-public.aggconfig.id.md)
+
+## AggConfig.id property
+
+<b>Signature:</b>
+
+```typescript
+id: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.isfilterable.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.isfilterable.md
new file mode 100644
index 0000000000000..a795ab1e91c2c
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.isfilterable.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [isFilterable](./kibana-plugin-plugins-data-public.aggconfig.isfilterable.md)
+
+## AggConfig.isFilterable() method
+
+<b>Signature:</b>
+
+```typescript
+isFilterable(): boolean;
+```
+<b>Returns:</b>
+
+`boolean`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.makelabel.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.makelabel.md
new file mode 100644
index 0000000000000..65923ed0ae889
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.makelabel.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [makeLabel](./kibana-plugin-plugins-data-public.aggconfig.makelabel.md)
+
+## AggConfig.makeLabel() method
+
+<b>Signature:</b>
+
+```typescript
+makeLabel(percentageMode?: boolean): any;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  percentageMode | <code>boolean</code> |  |
+
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.md
new file mode 100644
index 0000000000000..ceb90cffbf6ca
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.md
@@ -0,0 +1,62 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md)
+
+## AggConfig class
+
+<b>Signature:</b>
+
+```typescript
+export declare class AggConfig 
+```
+
+## Constructors
+
+|  Constructor | Modifiers | Description |
+|  --- | --- | --- |
+|  [(constructor)(aggConfigs, opts)](./kibana-plugin-plugins-data-public.aggconfig._constructor_.md) |  | Constructs a new instance of the <code>AggConfig</code> class |
+
+## Properties
+
+|  Property | Modifiers | Type | Description |
+|  --- | --- | --- | --- |
+|  [aggConfigs](./kibana-plugin-plugins-data-public.aggconfig.aggconfigs.md) |  | <code>IAggConfigs</code> |  |
+|  [brandNew](./kibana-plugin-plugins-data-public.aggconfig.brandnew.md) |  | <code>boolean</code> |  |
+|  [enabled](./kibana-plugin-plugins-data-public.aggconfig.enabled.md) |  | <code>boolean</code> |  |
+|  [id](./kibana-plugin-plugins-data-public.aggconfig.id.md) |  | <code>string</code> |  |
+|  [params](./kibana-plugin-plugins-data-public.aggconfig.params.md) |  | <code>any</code> |  |
+|  [parent](./kibana-plugin-plugins-data-public.aggconfig.parent.md) |  | <code>IAggConfigs</code> |  |
+|  [schema](./kibana-plugin-plugins-data-public.aggconfig.schema.md) |  | <code>string</code> |  |
+|  [type](./kibana-plugin-plugins-data-public.aggconfig.type.md) |  | <code>IAggType</code> |  |
+
+## Methods
+
+|  Method | Modifiers | Description |
+|  --- | --- | --- |
+|  [createFilter(key, params)](./kibana-plugin-plugins-data-public.aggconfig.createfilter.md) |  |  |
+|  [ensureIds(list)](./kibana-plugin-plugins-data-public.aggconfig.ensureids.md) | <code>static</code> | Ensure that all of the objects in the list have ids, the objects and list are modified by reference. |
+|  [fieldIsTimeField()](./kibana-plugin-plugins-data-public.aggconfig.fieldistimefield.md) |  |  |
+|  [fieldName()](./kibana-plugin-plugins-data-public.aggconfig.fieldname.md) |  |  |
+|  [getAggParams()](./kibana-plugin-plugins-data-public.aggconfig.getaggparams.md) |  |  |
+|  [getField()](./kibana-plugin-plugins-data-public.aggconfig.getfield.md) |  |  |
+|  [getFieldDisplayName()](./kibana-plugin-plugins-data-public.aggconfig.getfielddisplayname.md) |  |  |
+|  [getIndexPattern()](./kibana-plugin-plugins-data-public.aggconfig.getindexpattern.md) |  |  |
+|  [getKey(bucket, key)](./kibana-plugin-plugins-data-public.aggconfig.getkey.md) |  |  |
+|  [getParam(key)](./kibana-plugin-plugins-data-public.aggconfig.getparam.md) |  |  |
+|  [getRequestAggs()](./kibana-plugin-plugins-data-public.aggconfig.getrequestaggs.md) |  |  |
+|  [getResponseAggs()](./kibana-plugin-plugins-data-public.aggconfig.getresponseaggs.md) |  |  |
+|  [getTimeRange()](./kibana-plugin-plugins-data-public.aggconfig.gettimerange.md) |  |  |
+|  [getValue(bucket)](./kibana-plugin-plugins-data-public.aggconfig.getvalue.md) |  |  |
+|  [isFilterable()](./kibana-plugin-plugins-data-public.aggconfig.isfilterable.md) |  |  |
+|  [makeLabel(percentageMode)](./kibana-plugin-plugins-data-public.aggconfig.makelabel.md) |  |  |
+|  [nextId(list)](./kibana-plugin-plugins-data-public.aggconfig.nextid.md) | <code>static</code> | Calculate the next id based on the ids in this list {<!-- -->array<!-- -->} list - a list of objects with id properties |
+|  [onSearchRequestStart(searchSource, options)](./kibana-plugin-plugins-data-public.aggconfig.onsearchrequeststart.md) |  | Hook for pre-flight logic, see AggType\#onSearchRequestStart |
+|  [serialize()](./kibana-plugin-plugins-data-public.aggconfig.serialize.md) |  |  |
+|  [setParams(from)](./kibana-plugin-plugins-data-public.aggconfig.setparams.md) |  | Write the current values to this.params, filling in the defaults as we go |
+|  [setType(type)](./kibana-plugin-plugins-data-public.aggconfig.settype.md) |  |  |
+|  [toDsl(aggConfigs)](./kibana-plugin-plugins-data-public.aggconfig.todsl.md) |  | Convert this aggConfig to its dsl syntax.<!-- -->Adds params and adhoc subaggs to a pojo, then returns it |
+|  [toExpressionAst()](./kibana-plugin-plugins-data-public.aggconfig.toexpressionast.md) |  |  |
+|  [toJSON()](./kibana-plugin-plugins-data-public.aggconfig.tojson.md) |  |  |
+|  [toSerializedFieldFormat()](./kibana-plugin-plugins-data-public.aggconfig.toserializedfieldformat.md) |  | Returns a serialized field format for the field used in this agg. This can be passed to fieldFormats.deserialize to get the field format instance. |
+|  [write(aggs)](./kibana-plugin-plugins-data-public.aggconfig.write.md) |  |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.nextid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.nextid.md
new file mode 100644
index 0000000000000..ab524a6d1c4f1
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.nextid.md
@@ -0,0 +1,26 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [nextId](./kibana-plugin-plugins-data-public.aggconfig.nextid.md)
+
+## AggConfig.nextId() method
+
+Calculate the next id based on the ids in this list
+
+ {<!-- -->array<!-- -->} list - a list of objects with id properties
+
+<b>Signature:</b>
+
+```typescript
+static nextId(list: IAggConfig[]): number;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  list | <code>IAggConfig[]</code> |  |
+
+<b>Returns:</b>
+
+`number`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.onsearchrequeststart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.onsearchrequeststart.md
new file mode 100644
index 0000000000000..81df7866560e3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.onsearchrequeststart.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [onSearchRequestStart](./kibana-plugin-plugins-data-public.aggconfig.onsearchrequeststart.md)
+
+## AggConfig.onSearchRequestStart() method
+
+Hook for pre-flight logic, see AggType\#onSearchRequestStart
+
+<b>Signature:</b>
+
+```typescript
+onSearchRequestStart(searchSource: ISearchSource, options?: ISearchOptions): Promise<void> | Promise<any[]>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  searchSource | <code>ISearchSource</code> |  |
+|  options | <code>ISearchOptions</code> |  |
+
+<b>Returns:</b>
+
+`Promise<void> | Promise<any[]>`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.params.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.params.md
new file mode 100644
index 0000000000000..5bdb67f53b519
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.params.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [params](./kibana-plugin-plugins-data-public.aggconfig.params.md)
+
+## AggConfig.params property
+
+<b>Signature:</b>
+
+```typescript
+params: any;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.parent.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.parent.md
new file mode 100644
index 0000000000000..53d028457a9ae
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.parent.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [parent](./kibana-plugin-plugins-data-public.aggconfig.parent.md)
+
+## AggConfig.parent property
+
+<b>Signature:</b>
+
+```typescript
+parent?: IAggConfigs;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.schema.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.schema.md
new file mode 100644
index 0000000000000..afbf685951356
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.schema.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [schema](./kibana-plugin-plugins-data-public.aggconfig.schema.md)
+
+## AggConfig.schema property
+
+<b>Signature:</b>
+
+```typescript
+schema?: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.serialize.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.serialize.md
new file mode 100644
index 0000000000000..b0eebdbcc11ec
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.serialize.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [serialize](./kibana-plugin-plugins-data-public.aggconfig.serialize.md)
+
+## AggConfig.serialize() method
+
+<b>Signature:</b>
+
+```typescript
+serialize(): AggConfigSerialized;
+```
+<b>Returns:</b>
+
+`AggConfigSerialized`
+
+Returns a serialized representation of an AggConfig.
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.setparams.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.setparams.md
new file mode 100644
index 0000000000000..cb495b7653f8a
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.setparams.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [setParams](./kibana-plugin-plugins-data-public.aggconfig.setparams.md)
+
+## AggConfig.setParams() method
+
+Write the current values to this.params, filling in the defaults as we go
+
+<b>Signature:</b>
+
+```typescript
+setParams(from: any): void;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  from | <code>any</code> |  |
+
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.settype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.settype.md
new file mode 100644
index 0000000000000..0b07186a6ca33
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.settype.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [setType](./kibana-plugin-plugins-data-public.aggconfig.settype.md)
+
+## AggConfig.setType() method
+
+<b>Signature:</b>
+
+```typescript
+setType(type: IAggType): void;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  type | <code>IAggType</code> |  |
+
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.todsl.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.todsl.md
new file mode 100644
index 0000000000000..ac655c2a88a7b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.todsl.md
@@ -0,0 +1,26 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [toDsl](./kibana-plugin-plugins-data-public.aggconfig.todsl.md)
+
+## AggConfig.toDsl() method
+
+Convert this aggConfig to its dsl syntax.
+
+Adds params and adhoc subaggs to a pojo, then returns it
+
+<b>Signature:</b>
+
+```typescript
+toDsl(aggConfigs?: IAggConfigs): any;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  aggConfigs | <code>IAggConfigs</code> |  |
+
+<b>Returns:</b>
+
+`any`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.toexpressionast.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.toexpressionast.md
new file mode 100644
index 0000000000000..99001e81fde49
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.toexpressionast.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [toExpressionAst](./kibana-plugin-plugins-data-public.aggconfig.toexpressionast.md)
+
+## AggConfig.toExpressionAst() method
+
+<b>Signature:</b>
+
+```typescript
+toExpressionAst(): ExpressionAstFunction | undefined;
+```
+<b>Returns:</b>
+
+`ExpressionAstFunction | undefined`
+
+Returns an ExpressionAst representing the function for this agg type.
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.tojson.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.tojson.md
new file mode 100644
index 0000000000000..aa639aa574076
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.tojson.md
@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [toJSON](./kibana-plugin-plugins-data-public.aggconfig.tojson.md)
+
+## AggConfig.toJSON() method
+
+> Warning: This API is now obsolete.
+> 
+> - Use serialize() instead.
+> 
+
+<b>Signature:</b>
+
+```typescript
+toJSON(): AggConfigSerialized;
+```
+<b>Returns:</b>
+
+`AggConfigSerialized`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.toserializedfieldformat.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.toserializedfieldformat.md
new file mode 100644
index 0000000000000..7a75950f9cc6d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.toserializedfieldformat.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [toSerializedFieldFormat](./kibana-plugin-plugins-data-public.aggconfig.toserializedfieldformat.md)
+
+## AggConfig.toSerializedFieldFormat() method
+
+Returns a serialized field format for the field used in this agg. This can be passed to fieldFormats.deserialize to get the field format instance.
+
+<b>Signature:</b>
+
+```typescript
+toSerializedFieldFormat(): {} | Ensure<SerializedFieldFormat<SerializableState>, SerializableState>;
+```
+<b>Returns:</b>
+
+`{} | Ensure<SerializedFieldFormat<SerializableState>, SerializableState>`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.type.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.type.md
new file mode 100644
index 0000000000000..9dc44caee42e8
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.type.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [type](./kibana-plugin-plugins-data-public.aggconfig.type.md)
+
+## AggConfig.type property
+
+<b>Signature:</b>
+
+```typescript
+get type(): IAggType;
+
+set type(type: IAggType);
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.write.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.write.md
new file mode 100644
index 0000000000000..f98394b57cac3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.write.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) &gt; [write](./kibana-plugin-plugins-data-public.aggconfig.write.md)
+
+## AggConfig.write() method
+
+<b>Signature:</b>
+
+```typescript
+write(aggs?: IAggConfigs): Record<string, any>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  aggs | <code>IAggConfigs</code> |  |
+
+<b>Returns:</b>
+
+`Record<string, any>`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs._constructor_.md
new file mode 100644
index 0000000000000..c9e08b9712480
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs._constructor_.md
@@ -0,0 +1,32 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.aggconfigs._constructor_.md)
+
+## AggConfigs.(constructor)
+
+Constructs a new instance of the `AggConfigs` class
+
+<b>Signature:</b>
+
+```typescript
+constructor(indexPattern: IndexPattern, configStates: Pick<Pick<{
+        type: string;
+        enabled?: boolean | undefined;
+        id?: string | undefined;
+        params?: {} | import("./agg_config").SerializableState | undefined;
+        schema?: string | undefined;
+    }, "enabled" | "schema" | "id" | "params"> & Pick<{
+        type: string | IAggType;
+    }, "type"> & Pick<{
+        type: string | IAggType;
+    }, never>, "enabled" | "type" | "schema" | "id" | "params">[] | undefined, opts: AggConfigsOptions);
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  indexPattern | <code>IndexPattern</code> |  |
+|  configStates | <code>Pick&lt;Pick&lt;{</code><br/><code>        type: string;</code><br/><code>        enabled?: boolean &#124; undefined;</code><br/><code>        id?: string &#124; undefined;</code><br/><code>        params?: {} &#124; import(&quot;./agg_config&quot;).SerializableState &#124; undefined;</code><br/><code>        schema?: string &#124; undefined;</code><br/><code>    }, &quot;enabled&quot; &#124; &quot;schema&quot; &#124; &quot;id&quot; &#124; &quot;params&quot;&gt; &amp; Pick&lt;{</code><br/><code>        type: string &#124; IAggType;</code><br/><code>    }, &quot;type&quot;&gt; &amp; Pick&lt;{</code><br/><code>        type: string &#124; IAggType;</code><br/><code>    }, never&gt;, &quot;enabled&quot; &#124; &quot;type&quot; &#124; &quot;schema&quot; &#124; &quot;id&quot; &#124; &quot;params&quot;&gt;[] &#124; undefined</code> |  |
+|  opts | <code>AggConfigsOptions</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.aggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.aggs.md
new file mode 100644
index 0000000000000..0d217e037ecb1
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.aggs.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [aggs](./kibana-plugin-plugins-data-public.aggconfigs.aggs.md)
+
+## AggConfigs.aggs property
+
+<b>Signature:</b>
+
+```typescript
+aggs: IAggConfig[];
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byid.md
new file mode 100644
index 0000000000000..14d65ada5e39d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byid.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [byId](./kibana-plugin-plugins-data-public.aggconfigs.byid.md)
+
+## AggConfigs.byId() method
+
+<b>Signature:</b>
+
+```typescript
+byId(id: string): AggConfig | undefined;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  id | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig | undefined`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byindex.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byindex.md
new file mode 100644
index 0000000000000..5977c81ddaf36
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byindex.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [byIndex](./kibana-plugin-plugins-data-public.aggconfigs.byindex.md)
+
+## AggConfigs.byIndex() method
+
+<b>Signature:</b>
+
+```typescript
+byIndex(index: number): AggConfig;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  index | <code>number</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byname.md
new file mode 100644
index 0000000000000..772ba1f074d0d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byname.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [byName](./kibana-plugin-plugins-data-public.aggconfigs.byname.md)
+
+## AggConfigs.byName() method
+
+<b>Signature:</b>
+
+```typescript
+byName(name: string): AggConfig[];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  name | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byschemaname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byschemaname.md
new file mode 100644
index 0000000000000..3a7c6a5f89e17
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.byschemaname.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [bySchemaName](./kibana-plugin-plugins-data-public.aggconfigs.byschemaname.md)
+
+## AggConfigs.bySchemaName() method
+
+<b>Signature:</b>
+
+```typescript
+bySchemaName(schema: string): AggConfig[];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  schema | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.bytype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.bytype.md
new file mode 100644
index 0000000000000..8bbf85ce4f29b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.bytype.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [byType](./kibana-plugin-plugins-data-public.aggconfigs.bytype.md)
+
+## AggConfigs.byType() method
+
+<b>Signature:</b>
+
+```typescript
+byType(type: string): AggConfig[];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  type | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.bytypename.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.bytypename.md
new file mode 100644
index 0000000000000..97f05837493f2
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.bytypename.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [byTypeName](./kibana-plugin-plugins-data-public.aggconfigs.bytypename.md)
+
+## AggConfigs.byTypeName() method
+
+<b>Signature:</b>
+
+```typescript
+byTypeName(type: string): AggConfig[];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  type | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.clone.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.clone.md
new file mode 100644
index 0000000000000..0206f3c6b4751
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.clone.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [clone](./kibana-plugin-plugins-data-public.aggconfigs.clone.md)
+
+## AggConfigs.clone() method
+
+<b>Signature:</b>
+
+```typescript
+clone({ enabledOnly }?: {
+        enabledOnly?: boolean | undefined;
+    }): AggConfigs;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  { enabledOnly } | <code>{</code><br/><code>        enabledOnly?: boolean &#124; undefined;</code><br/><code>    }</code> |  |
+
+<b>Returns:</b>
+
+`AggConfigs`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.createaggconfig.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.createaggconfig.md
new file mode 100644
index 0000000000000..2ccded7c74e4c
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.createaggconfig.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [createAggConfig](./kibana-plugin-plugins-data-public.aggconfigs.createaggconfig.md)
+
+## AggConfigs.createAggConfig property
+
+<b>Signature:</b>
+
+```typescript
+createAggConfig: <T extends AggConfig = AggConfig>(params: CreateAggConfigParams, { addToAggConfigs }?: {
+        addToAggConfigs?: boolean | undefined;
+    }) => T;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getall.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getall.md
new file mode 100644
index 0000000000000..091ec1ce416c3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getall.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [getAll](./kibana-plugin-plugins-data-public.aggconfigs.getall.md)
+
+## AggConfigs.getAll() method
+
+<b>Signature:</b>
+
+```typescript
+getAll(): AggConfig[];
+```
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getrequestaggbyid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getrequestaggbyid.md
new file mode 100644
index 0000000000000..f375648ca1cb7
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getrequestaggbyid.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [getRequestAggById](./kibana-plugin-plugins-data-public.aggconfigs.getrequestaggbyid.md)
+
+## AggConfigs.getRequestAggById() method
+
+<b>Signature:</b>
+
+```typescript
+getRequestAggById(id: string): AggConfig | undefined;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  id | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig | undefined`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getrequestaggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getrequestaggs.md
new file mode 100644
index 0000000000000..f4db6e373f5c3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getrequestaggs.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [getRequestAggs](./kibana-plugin-plugins-data-public.aggconfigs.getrequestaggs.md)
+
+## AggConfigs.getRequestAggs() method
+
+<b>Signature:</b>
+
+```typescript
+getRequestAggs(): AggConfig[];
+```
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getresponseaggbyid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getresponseaggbyid.md
new file mode 100644
index 0000000000000..ab31c74f6000d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getresponseaggbyid.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [getResponseAggById](./kibana-plugin-plugins-data-public.aggconfigs.getresponseaggbyid.md)
+
+## AggConfigs.getResponseAggById() method
+
+Find a response agg by it's id. This may be an agg in the aggConfigs, or one created specifically for a response value
+
+<b>Signature:</b>
+
+```typescript
+getResponseAggById(id: string): AggConfig | undefined;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  id | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`AggConfig | undefined`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getresponseaggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getresponseaggs.md
new file mode 100644
index 0000000000000..47e26bdea9e9c
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.getresponseaggs.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [getResponseAggs](./kibana-plugin-plugins-data-public.aggconfigs.getresponseaggs.md)
+
+## AggConfigs.getResponseAggs() method
+
+Gets the AggConfigs (and possibly ResponseAggConfigs) that represent the values that will be produced when all aggs are run.
+
+With multi-value metric aggs it is possible for a single agg request to result in multiple agg values, which is why the length of a vis' responseValuesAggs may be different than the vis' aggs
+
+ {<!-- -->array\[AggConfig\]<!-- -->}
+
+<b>Signature:</b>
+
+```typescript
+getResponseAggs(): AggConfig[];
+```
+<b>Returns:</b>
+
+`AggConfig[]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.indexpattern.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.indexpattern.md
new file mode 100644
index 0000000000000..9bd91e185df1e
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.indexpattern.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [indexPattern](./kibana-plugin-plugins-data-public.aggconfigs.indexpattern.md)
+
+## AggConfigs.indexPattern property
+
+<b>Signature:</b>
+
+```typescript
+indexPattern: IndexPattern;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.jsondataequals.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.jsondataequals.md
new file mode 100644
index 0000000000000..d94c3959cd6a2
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.jsondataequals.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [jsonDataEquals](./kibana-plugin-plugins-data-public.aggconfigs.jsondataequals.md)
+
+## AggConfigs.jsonDataEquals() method
+
+Data-by-data comparison of this Aggregation Ignores the non-array indexes
+
+<b>Signature:</b>
+
+```typescript
+jsonDataEquals(aggConfigs: AggConfig[]): boolean;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  aggConfigs | <code>AggConfig[]</code> |  |
+
+<b>Returns:</b>
+
+`boolean`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.md
new file mode 100644
index 0000000000000..c0ba1bbeea334
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.md
@@ -0,0 +1,48 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md)
+
+## AggConfigs class
+
+<b>Signature:</b>
+
+```typescript
+export declare class AggConfigs 
+```
+
+## Constructors
+
+|  Constructor | Modifiers | Description |
+|  --- | --- | --- |
+|  [(constructor)(indexPattern, configStates, opts)](./kibana-plugin-plugins-data-public.aggconfigs._constructor_.md) |  | Constructs a new instance of the <code>AggConfigs</code> class |
+
+## Properties
+
+|  Property | Modifiers | Type | Description |
+|  --- | --- | --- | --- |
+|  [aggs](./kibana-plugin-plugins-data-public.aggconfigs.aggs.md) |  | <code>IAggConfig[]</code> |  |
+|  [createAggConfig](./kibana-plugin-plugins-data-public.aggconfigs.createaggconfig.md) |  | <code>&lt;T extends AggConfig = AggConfig&gt;(params: CreateAggConfigParams, { addToAggConfigs }?: {</code><br/><code>        addToAggConfigs?: boolean &#124; undefined;</code><br/><code>    }) =&gt; T</code> |  |
+|  [indexPattern](./kibana-plugin-plugins-data-public.aggconfigs.indexpattern.md) |  | <code>IndexPattern</code> |  |
+|  [timeRange](./kibana-plugin-plugins-data-public.aggconfigs.timerange.md) |  | <code>TimeRange</code> |  |
+
+## Methods
+
+|  Method | Modifiers | Description |
+|  --- | --- | --- |
+|  [byId(id)](./kibana-plugin-plugins-data-public.aggconfigs.byid.md) |  |  |
+|  [byIndex(index)](./kibana-plugin-plugins-data-public.aggconfigs.byindex.md) |  |  |
+|  [byName(name)](./kibana-plugin-plugins-data-public.aggconfigs.byname.md) |  |  |
+|  [bySchemaName(schema)](./kibana-plugin-plugins-data-public.aggconfigs.byschemaname.md) |  |  |
+|  [byType(type)](./kibana-plugin-plugins-data-public.aggconfigs.bytype.md) |  |  |
+|  [byTypeName(type)](./kibana-plugin-plugins-data-public.aggconfigs.bytypename.md) |  |  |
+|  [clone({ enabledOnly })](./kibana-plugin-plugins-data-public.aggconfigs.clone.md) |  |  |
+|  [getAll()](./kibana-plugin-plugins-data-public.aggconfigs.getall.md) |  |  |
+|  [getRequestAggById(id)](./kibana-plugin-plugins-data-public.aggconfigs.getrequestaggbyid.md) |  |  |
+|  [getRequestAggs()](./kibana-plugin-plugins-data-public.aggconfigs.getrequestaggs.md) |  |  |
+|  [getResponseAggById(id)](./kibana-plugin-plugins-data-public.aggconfigs.getresponseaggbyid.md) |  | Find a response agg by it's id. This may be an agg in the aggConfigs, or one created specifically for a response value |
+|  [getResponseAggs()](./kibana-plugin-plugins-data-public.aggconfigs.getresponseaggs.md) |  | Gets the AggConfigs (and possibly ResponseAggConfigs) that represent the values that will be produced when all aggs are run.<!-- -->With multi-value metric aggs it is possible for a single agg request to result in multiple agg values, which is why the length of a vis' responseValuesAggs may be different than the vis' aggs {<!-- -->array\[AggConfig\]<!-- -->} |
+|  [jsonDataEquals(aggConfigs)](./kibana-plugin-plugins-data-public.aggconfigs.jsondataequals.md) |  | Data-by-data comparison of this Aggregation Ignores the non-array indexes |
+|  [onSearchRequestStart(searchSource, options)](./kibana-plugin-plugins-data-public.aggconfigs.onsearchrequeststart.md) |  |  |
+|  [setTimeRange(timeRange)](./kibana-plugin-plugins-data-public.aggconfigs.settimerange.md) |  |  |
+|  [toDsl(hierarchical)](./kibana-plugin-plugins-data-public.aggconfigs.todsl.md) |  |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.onsearchrequeststart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.onsearchrequeststart.md
new file mode 100644
index 0000000000000..3ae7af408563c
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.onsearchrequeststart.md
@@ -0,0 +1,23 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [onSearchRequestStart](./kibana-plugin-plugins-data-public.aggconfigs.onsearchrequeststart.md)
+
+## AggConfigs.onSearchRequestStart() method
+
+<b>Signature:</b>
+
+```typescript
+onSearchRequestStart(searchSource: ISearchSource, options?: ISearchOptions): Promise<[unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown]>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  searchSource | <code>ISearchSource</code> |  |
+|  options | <code>ISearchOptions</code> |  |
+
+<b>Returns:</b>
+
+`Promise<[unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown]>`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.settimerange.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.settimerange.md
new file mode 100644
index 0000000000000..77530f02bc9a3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.settimerange.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [setTimeRange](./kibana-plugin-plugins-data-public.aggconfigs.settimerange.md)
+
+## AggConfigs.setTimeRange() method
+
+<b>Signature:</b>
+
+```typescript
+setTimeRange(timeRange: TimeRange): void;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  timeRange | <code>TimeRange</code> |  |
+
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.timerange.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.timerange.md
new file mode 100644
index 0000000000000..b4caef6c7f6d2
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.timerange.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [timeRange](./kibana-plugin-plugins-data-public.aggconfigs.timerange.md)
+
+## AggConfigs.timeRange property
+
+<b>Signature:</b>
+
+```typescript
+timeRange?: TimeRange;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.todsl.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.todsl.md
new file mode 100644
index 0000000000000..055c4113ca3e4
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigs.todsl.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) &gt; [toDsl](./kibana-plugin-plugins-data-public.aggconfigs.todsl.md)
+
+## AggConfigs.toDsl() method
+
+<b>Signature:</b>
+
+```typescript
+toDsl(hierarchical?: boolean): Record<string, any>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  hierarchical | <code>boolean</code> |  |
+
+<b>Returns:</b>
+
+`Record<string, any>`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggsstart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggsstart.md
new file mode 100644
index 0000000000000..7bdf9d6501203
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggsstart.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggsStart](./kibana-plugin-plugins-data-public.aggsstart.md)
+
+## AggsStart type
+
+AggsStart represents the actual external contract as AggsCommonStart is only used internally. The difference is that AggsStart includes the typings for the registry with initialized agg types.
+
+<b>Signature:</b>
+
+```typescript
+export declare type AggsStart = Assign<AggsCommonStart, {
+    types: AggTypesRegistryStart;
+}>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.autocompletestart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.autocompletestart.md
new file mode 100644
index 0000000000000..44cee8c32421d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.autocompletestart.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AutocompleteStart](./kibana-plugin-plugins-data-public.autocompletestart.md)
+
+## AutocompleteStart type
+
+\*
+
+<b>Signature:</b>
+
+```typescript
+export declare type AutocompleteStart = ReturnType<AutocompleteService['start']>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.md
index dba1d79e78682..fc5624aeddce1 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.md
@@ -4,6 +4,8 @@
 
 ## DataPublicPluginSetup interface
 
+Data plugin public Setup contract
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md
index 25ce6eaa688f8..10997c94fab06 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md
@@ -4,11 +4,10 @@
 
 ## DataPublicPluginStart.actions property
 
+filter creation utilities [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md)
+
 <b>Signature:</b>
 
 ```typescript
-actions: {
-        createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;
-        createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;
-    };
+actions: DataPublicPluginStartActions;
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md
index d2e5aee7d90dd..8a09a10cccb24 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md
@@ -4,6 +4,8 @@
 
 ## DataPublicPluginStart.autocomplete property
 
+autocomplete service [AutocompleteStart](./kibana-plugin-plugins-data-public.autocompletestart.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md
index dd4b38f64d10b..344044b38f7de 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md
@@ -4,6 +4,8 @@
 
 ## DataPublicPluginStart.fieldFormats property
 
+field formats service [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md
index b3dd6a61760a6..0cf1e3101713d 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md
@@ -4,6 +4,8 @@
 
 ## DataPublicPluginStart.indexPatterns property
 
+index patterns service [IndexPatternsContract](./kibana-plugin-plugins-data-public.indexpatternscontract.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md
index 4f43f10ce089e..7bae0bca701bf 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md
@@ -4,6 +4,8 @@
 
 ## DataPublicPluginStart interface
 
+Data plugin public Start contract
+
 <b>Signature:</b>
 
 ```typescript
@@ -14,11 +16,11 @@ export interface DataPublicPluginStart
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [actions](./kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md) | <code>{</code><br/><code>        createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;</code><br/><code>        createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;</code><br/><code>    }</code> |  |
-|  [autocomplete](./kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md) | <code>AutocompleteStart</code> |  |
-|  [fieldFormats](./kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md) | <code>FieldFormatsStart</code> |  |
-|  [indexPatterns](./kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md) | <code>IndexPatternsContract</code> |  |
-|  [query](./kibana-plugin-plugins-data-public.datapublicpluginstart.query.md) | <code>QueryStart</code> |  |
-|  [search](./kibana-plugin-plugins-data-public.datapublicpluginstart.search.md) | <code>ISearchStart</code> |  |
-|  [ui](./kibana-plugin-plugins-data-public.datapublicpluginstart.ui.md) | <code>{</code><br/><code>        IndexPatternSelect: React.ComponentType&lt;IndexPatternSelectProps&gt;;</code><br/><code>        SearchBar: React.ComponentType&lt;StatefulSearchBarProps&gt;;</code><br/><code>    }</code> |  |
+|  [actions](./kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md) | <code>DataPublicPluginStartActions</code> | filter creation utilities [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md) |
+|  [autocomplete](./kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md) | <code>AutocompleteStart</code> | autocomplete service [AutocompleteStart](./kibana-plugin-plugins-data-public.autocompletestart.md) |
+|  [fieldFormats](./kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md) | <code>FieldFormatsStart</code> | field formats service [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md) |
+|  [indexPatterns](./kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md) | <code>IndexPatternsContract</code> | index patterns service [IndexPatternsContract](./kibana-plugin-plugins-data-public.indexpatternscontract.md) |
+|  [query](./kibana-plugin-plugins-data-public.datapublicpluginstart.query.md) | <code>QueryStart</code> | query service [QueryStart](./kibana-plugin-plugins-data-public.querystart.md) |
+|  [search](./kibana-plugin-plugins-data-public.datapublicpluginstart.search.md) | <code>ISearchStart</code> | search service [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md) |
+|  [ui](./kibana-plugin-plugins-data-public.datapublicpluginstart.ui.md) | <code>DataPublicPluginStartUi</code> | prewired UI components [DataPublicPluginStartUi](./kibana-plugin-plugins-data-public.datapublicpluginstartui.md) |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.query.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.query.md
index a44e250077ed4..16ba5dafbb264 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.query.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.query.md
@@ -4,6 +4,8 @@
 
 ## DataPublicPluginStart.query property
 
+query service [QueryStart](./kibana-plugin-plugins-data-public.querystart.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.search.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.search.md
index eec00e7b13e9d..98832d7ca11d8 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.search.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.search.md
@@ -4,6 +4,8 @@
 
 ## DataPublicPluginStart.search property
 
+search service [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.ui.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.ui.md
index 9c24216834371..671a1814ac644 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.ui.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.ui.md
@@ -4,11 +4,10 @@
 
 ## DataPublicPluginStart.ui property
 
+prewired UI components [DataPublicPluginStartUi](./kibana-plugin-plugins-data-public.datapublicpluginstartui.md)
+
 <b>Signature:</b>
 
 ```typescript
-ui: {
-        IndexPatternSelect: React.ComponentType<IndexPatternSelectProps>;
-        SearchBar: React.ComponentType<StatefulSearchBarProps>;
-    };
+ui: DataPublicPluginStartUi;
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromrangeselectaction.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromrangeselectaction.md
new file mode 100644
index 0000000000000..c954e0095cbb6
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromrangeselectaction.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md) &gt; [createFiltersFromRangeSelectAction](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromrangeselectaction.md)
+
+## DataPublicPluginStartActions.createFiltersFromRangeSelectAction property
+
+<b>Signature:</b>
+
+```typescript
+createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromvalueclickaction.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromvalueclickaction.md
new file mode 100644
index 0000000000000..70bd5091f3604
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromvalueclickaction.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md) &gt; [createFiltersFromValueClickAction](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromvalueclickaction.md)
+
+## DataPublicPluginStartActions.createFiltersFromValueClickAction property
+
+<b>Signature:</b>
+
+```typescript
+createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.md
new file mode 100644
index 0000000000000..d44c9e892cb80
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartactions.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md)
+
+## DataPublicPluginStartActions interface
+
+utilities to generate filters from action context
+
+<b>Signature:</b>
+
+```typescript
+export interface DataPublicPluginStartActions 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [createFiltersFromRangeSelectAction](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromrangeselectaction.md) | <code>typeof createFiltersFromRangeSelectAction</code> |  |
+|  [createFiltersFromValueClickAction](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.createfiltersfromvalueclickaction.md) | <code>typeof createFiltersFromValueClickAction</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.indexpatternselect.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.indexpatternselect.md
new file mode 100644
index 0000000000000..eac29dc5de70d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.indexpatternselect.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [DataPublicPluginStartUi](./kibana-plugin-plugins-data-public.datapublicpluginstartui.md) &gt; [IndexPatternSelect](./kibana-plugin-plugins-data-public.datapublicpluginstartui.indexpatternselect.md)
+
+## DataPublicPluginStartUi.IndexPatternSelect property
+
+<b>Signature:</b>
+
+```typescript
+IndexPatternSelect: React.ComponentType<IndexPatternSelectProps>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.md
new file mode 100644
index 0000000000000..3d827c0db465b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [DataPublicPluginStartUi](./kibana-plugin-plugins-data-public.datapublicpluginstartui.md)
+
+## DataPublicPluginStartUi interface
+
+Data plugin prewired UI components
+
+<b>Signature:</b>
+
+```typescript
+export interface DataPublicPluginStartUi 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [IndexPatternSelect](./kibana-plugin-plugins-data-public.datapublicpluginstartui.indexpatternselect.md) | <code>React.ComponentType&lt;IndexPatternSelectProps&gt;</code> |  |
+|  [SearchBar](./kibana-plugin-plugins-data-public.datapublicpluginstartui.searchbar.md) | <code>React.ComponentType&lt;StatefulSearchBarProps&gt;</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.searchbar.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.searchbar.md
new file mode 100644
index 0000000000000..06339d14cde24
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstartui.searchbar.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [DataPublicPluginStartUi](./kibana-plugin-plugins-data-public.datapublicpluginstartui.md) &gt; [SearchBar](./kibana-plugin-plugins-data-public.datapublicpluginstartui.searchbar.md)
+
+## DataPublicPluginStartUi.SearchBar property
+
+<b>Signature:</b>
+
+```typescript
+SearchBar: React.ComponentType<StatefulSearchBarProps>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsstart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsstart.md
new file mode 100644
index 0000000000000..1a0a08f44451a
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsstart.md
@@ -0,0 +1,14 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md)
+
+## FieldFormatsStart type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type FieldFormatsStart = Omit<FieldFormatsRegistry, 'init' & 'register'> & {
+    deserialize: FormatFactory;
+};
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.aggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.aggs.md
new file mode 100644
index 0000000000000..ad97820d4d760
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.aggs.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchSetup](./kibana-plugin-plugins-data-public.isearchsetup.md) &gt; [aggs](./kibana-plugin-plugins-data-public.isearchsetup.aggs.md)
+
+## ISearchSetup.aggs property
+
+<b>Signature:</b>
+
+```typescript
+aggs: AggsSetup;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.md
new file mode 100644
index 0000000000000..b68c4d61e4e03
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchSetup](./kibana-plugin-plugins-data-public.isearchsetup.md)
+
+## ISearchSetup interface
+
+The setup contract exposed by the Search plugin exposes the search strategy extension point.
+
+<b>Signature:</b>
+
+```typescript
+export interface ISearchSetup 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [aggs](./kibana-plugin-plugins-data-public.isearchsetup.aggs.md) | <code>AggsSetup</code> |  |
+|  [usageCollector](./kibana-plugin-plugins-data-public.isearchsetup.usagecollector.md) | <code>SearchUsageCollector</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.usagecollector.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.usagecollector.md
new file mode 100644
index 0000000000000..908a842974f25
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsetup.usagecollector.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchSetup](./kibana-plugin-plugins-data-public.isearchsetup.md) &gt; [usageCollector](./kibana-plugin-plugins-data-public.isearchsetup.usagecollector.md)
+
+## ISearchSetup.usageCollector property
+
+<b>Signature:</b>
+
+```typescript
+usageCollector?: SearchUsageCollector;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsource.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsource.md
index 4b9f6e3594dc5..43e10d0bef57a 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsource.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchsource.md
@@ -4,7 +4,7 @@
 
 ## ISearchSource type
 
-\*
+search source interface
 
 <b>Signature:</b>
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.aggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.aggs.md
new file mode 100644
index 0000000000000..993c6bf5a922b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.aggs.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md) &gt; [aggs](./kibana-plugin-plugins-data-public.isearchstart.aggs.md)
+
+## ISearchStart.aggs property
+
+agg config sub service [AggsStart](./kibana-plugin-plugins-data-public.aggsstart.md)
+
+<b>Signature:</b>
+
+```typescript
+aggs: AggsStart;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.md
new file mode 100644
index 0000000000000..cee213fc6e7e3
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md)
+
+## ISearchStart interface
+
+search service
+
+<b>Signature:</b>
+
+```typescript
+export interface ISearchStart 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [aggs](./kibana-plugin-plugins-data-public.isearchstart.aggs.md) | <code>AggsStart</code> | agg config sub service [AggsStart](./kibana-plugin-plugins-data-public.aggsstart.md) |
+|  [search](./kibana-plugin-plugins-data-public.isearchstart.search.md) | <code>ISearchGeneric</code> | low level search [ISearchGeneric](./kibana-plugin-plugins-data-public.isearchgeneric.md) |
+|  [searchSource](./kibana-plugin-plugins-data-public.isearchstart.searchsource.md) | <code>ISearchStartSearchSource</code> | high level search [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md) |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.search.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.search.md
new file mode 100644
index 0000000000000..80e140e9fdd5c
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.search.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md) &gt; [search](./kibana-plugin-plugins-data-public.isearchstart.search.md)
+
+## ISearchStart.search property
+
+low level search [ISearchGeneric](./kibana-plugin-plugins-data-public.isearchgeneric.md)
+
+<b>Signature:</b>
+
+```typescript
+search: ISearchGeneric;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.searchsource.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.searchsource.md
new file mode 100644
index 0000000000000..5d4b884b2c25b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstart.searchsource.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md) &gt; [searchSource](./kibana-plugin-plugins-data-public.isearchstart.searchsource.md)
+
+## ISearchStart.searchSource property
+
+high level search [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md)
+
+<b>Signature:</b>
+
+```typescript
+searchSource: ISearchStartSearchSource;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.create.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.create.md
new file mode 100644
index 0000000000000..7f6344b82d27c
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.create.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md) &gt; [create](./kibana-plugin-plugins-data-public.isearchstartsearchsource.create.md)
+
+## ISearchStartSearchSource.create property
+
+creates [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) based on provided serialized [SearchSourceFields](./kibana-plugin-plugins-data-public.searchsourcefields.md)
+
+<b>Signature:</b>
+
+```typescript
+create: (fields?: SearchSourceFields) => Promise<ISearchSource>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.createempty.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.createempty.md
new file mode 100644
index 0000000000000..b13b5d227c8b4
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.createempty.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md) &gt; [createEmpty](./kibana-plugin-plugins-data-public.isearchstartsearchsource.createempty.md)
+
+## ISearchStartSearchSource.createEmpty property
+
+creates empty [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md)
+
+<b>Signature:</b>
+
+```typescript
+createEmpty: () => ISearchSource;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.md
new file mode 100644
index 0000000000000..f10d5bb002a0f
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isearchstartsearchsource.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md)
+
+## ISearchStartSearchSource interface
+
+high level search service
+
+<b>Signature:</b>
+
+```typescript
+export interface ISearchStartSearchSource 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [create](./kibana-plugin-plugins-data-public.isearchstartsearchsource.create.md) | <code>(fields?: SearchSourceFields) =&gt; Promise&lt;ISearchSource&gt;</code> | creates [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) based on provided serialized [SearchSourceFields](./kibana-plugin-plugins-data-public.searchsourcefields.md) |
+|  [createEmpty](./kibana-plugin-plugins-data-public.isearchstartsearchsource.createempty.md) | <code>() =&gt; ISearchSource</code> | creates empty [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index 0c493ca492953..f51549c81fb62 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -8,6 +8,8 @@
 
 |  Class | Description |
 |  --- | --- |
+|  [AggConfig](./kibana-plugin-plugins-data-public.aggconfig.md) |  |
+|  [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) |  |
 |  [AggParamType](./kibana-plugin-plugins-data-public.aggparamtype.md) |  |
 |  [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) |  |
 |  [FilterManager](./kibana-plugin-plugins-data-public.filtermanager.md) |  |
@@ -18,6 +20,7 @@
 |  [Plugin](./kibana-plugin-plugins-data-public.plugin.md) |  |
 |  [RequestTimeoutError](./kibana-plugin-plugins-data-public.requesttimeouterror.md) | Class used to signify that a request timed out. Useful for applications to conditionally handle this type of error differently than other errors. |
 |  [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) |  |
+|  [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) | \* |
 |  [TimeHistory](./kibana-plugin-plugins-data-public.timehistory.md) |  |
 
 ## Enumerations
@@ -47,8 +50,10 @@
 |  --- | --- |
 |  [AggParamOption](./kibana-plugin-plugins-data-public.aggparamoption.md) |  |
 |  [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) |  |
-|  [DataPublicPluginSetup](./kibana-plugin-plugins-data-public.datapublicpluginsetup.md) |  |
-|  [DataPublicPluginStart](./kibana-plugin-plugins-data-public.datapublicpluginstart.md) |  |
+|  [DataPublicPluginSetup](./kibana-plugin-plugins-data-public.datapublicpluginsetup.md) | Data plugin public Setup contract |
+|  [DataPublicPluginStart](./kibana-plugin-plugins-data-public.datapublicpluginstart.md) | Data plugin public Start contract |
+|  [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md) | utilities to generate filters from action context |
+|  [DataPublicPluginStartUi](./kibana-plugin-plugins-data-public.datapublicpluginstartui.md) | Data plugin prewired UI components |
 |  [EsQueryConfig](./kibana-plugin-plugins-data-public.esqueryconfig.md) |  |
 |  [FieldFormatConfig](./kibana-plugin-plugins-data-public.fieldformatconfig.md) |  |
 |  [FieldMappingSpec](./kibana-plugin-plugins-data-public.fieldmappingspec.md) |  |
@@ -65,6 +70,9 @@
 |  [IndexPatternAttributes](./kibana-plugin-plugins-data-public.indexpatternattributes.md) | Use data plugin interface instead |
 |  [IndexPatternTypeMeta](./kibana-plugin-plugins-data-public.indexpatterntypemeta.md) |  |
 |  [ISearchOptions](./kibana-plugin-plugins-data-public.isearchoptions.md) |  |
+|  [ISearchSetup](./kibana-plugin-plugins-data-public.isearchsetup.md) | The setup contract exposed by the Search plugin exposes the search strategy extension point. |
+|  [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md) | search service |
+|  [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md) | high level search service |
 |  [KueryNode](./kibana-plugin-plugins-data-public.kuerynode.md) |  |
 |  [OptionedValueProp](./kibana-plugin-plugins-data-public.optionedvalueprop.md) |  |
 |  [Query](./kibana-plugin-plugins-data-public.query.md) |  |
@@ -79,7 +87,7 @@
 |  [SavedQueryService](./kibana-plugin-plugins-data-public.savedqueryservice.md) |  |
 |  [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) |  |
 |  [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) |  |
-|  [SearchSourceFields](./kibana-plugin-plugins-data-public.searchsourcefields.md) |  |
+|  [SearchSourceFields](./kibana-plugin-plugins-data-public.searchsourcefields.md) | search source fields |
 |  [TabbedAggColumn](./kibana-plugin-plugins-data-public.tabbedaggcolumn.md) | \* |
 |  [TabbedTable](./kibana-plugin-plugins-data-public.tabbedtable.md) | \* |
 |  [TimeRange](./kibana-plugin-plugins-data-public.timerange.md) |  |
@@ -125,6 +133,8 @@
 |  [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) |  |
 |  [AggGroupName](./kibana-plugin-plugins-data-public.agggroupname.md) |  |
 |  [AggParam](./kibana-plugin-plugins-data-public.aggparam.md) |  |
+|  [AggsStart](./kibana-plugin-plugins-data-public.aggsstart.md) | AggsStart represents the actual external contract as AggsCommonStart is only used internally. The difference is that AggsStart includes the typings for the registry with initialized agg types. |
+|  [AutocompleteStart](./kibana-plugin-plugins-data-public.autocompletestart.md) | \* |
 |  [CustomFilter](./kibana-plugin-plugins-data-public.customfilter.md) |  |
 |  [EsaggsExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.esaggsexpressionfunctiondefinition.md) |  |
 |  [EsdslExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.esdslexpressionfunctiondefinition.md) |  |
@@ -134,6 +144,7 @@
 |  [FieldFormatId](./kibana-plugin-plugins-data-public.fieldformatid.md) |  id type is needed for creating custom converters. |
 |  [FieldFormatsContentType](./kibana-plugin-plugins-data-public.fieldformatscontenttype.md) | \* |
 |  [FieldFormatsGetConfigFn](./kibana-plugin-plugins-data-public.fieldformatsgetconfigfn.md) |  |
+|  [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md) |  |
 |  [IAggConfig](./kibana-plugin-plugins-data-public.iaggconfig.md) |  AggConfig This class represents an aggregation, which is displayed in the left-hand nav of the Visualize app. |
 |  [IAggType](./kibana-plugin-plugins-data-public.iaggtype.md) |  |
 |  [IFieldFormat](./kibana-plugin-plugins-data-public.ifieldformat.md) |  |
@@ -145,12 +156,13 @@
 |  [InputTimeRange](./kibana-plugin-plugins-data-public.inputtimerange.md) |  |
 |  [ISearch](./kibana-plugin-plugins-data-public.isearch.md) |  |
 |  [ISearchGeneric](./kibana-plugin-plugins-data-public.isearchgeneric.md) |  |
-|  [ISearchSource](./kibana-plugin-plugins-data-public.isearchsource.md) | \* |
+|  [ISearchSource](./kibana-plugin-plugins-data-public.isearchsource.md) | search source interface |
 |  [MappingObject](./kibana-plugin-plugins-data-public.mappingobject.md) |  |
 |  [MatchAllFilter](./kibana-plugin-plugins-data-public.matchallfilter.md) |  |
 |  [ParsedInterval](./kibana-plugin-plugins-data-public.parsedinterval.md) |  |
 |  [PhraseFilter](./kibana-plugin-plugins-data-public.phrasefilter.md) |  |
 |  [PhrasesFilter](./kibana-plugin-plugins-data-public.phrasesfilter.md) |  |
+|  [QueryStart](./kibana-plugin-plugins-data-public.querystart.md) |  |
 |  [QuerySuggestion](./kibana-plugin-plugins-data-public.querysuggestion.md) | \* |
 |  [QuerySuggestionGetFn](./kibana-plugin-plugins-data-public.querysuggestiongetfn.md) |  |
 |  [RangeFilter](./kibana-plugin-plugins-data-public.rangefilter.md) |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystart.md
new file mode 100644
index 0000000000000..f48a9ee7a79e4
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystart.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [QueryStart](./kibana-plugin-plugins-data-public.querystart.md)
+
+## QueryStart type
+
+<b>Signature:</b>
+
+```typescript
+export declare type QueryStart = ReturnType<QueryService['start']>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
index 3dbfd9430e913..cf171d9ee9f37 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-QueryStringInput: React.FC<Pick<Props, "query" | "prepend" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>
+QueryStringInput: React.FC<Pick<Props, "query" | "prepend" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "isInvalid" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.getpendingcount_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.getpendingcount_.md
deleted file mode 100644
index ef36b3f37b0c7..0000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.getpendingcount_.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [getPendingCount$](./kibana-plugin-plugins-data-public.searchinterceptor.getpendingcount_.md)
-
-## SearchInterceptor.getPendingCount$() method
-
-Returns an `Observable` over the current number of pending searches. This could mean that one of the search requests is still in flight, or that it has only received partial responses.
-
-<b>Signature:</b>
-
-```typescript
-getPendingCount$(): Observable<number>;
-```
-<b>Returns:</b>
-
-`Observable<number>`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
index fd9f23a7f0052..5cee345db6cd2 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
@@ -21,11 +21,11 @@ export declare class SearchInterceptor
 |  Property | Modifiers | Type | Description |
 |  --- | --- | --- | --- |
 |  [deps](./kibana-plugin-plugins-data-public.searchinterceptor.deps.md) |  | <code>SearchInterceptorDeps</code> |  |
+|  [showTimeoutError](./kibana-plugin-plugins-data-public.searchinterceptor.showtimeouterror.md) |  | <code>((e: Error) =&gt; void) &amp; import(&quot;lodash&quot;).Cancelable</code> |  |
 
 ## Methods
 
 |  Method | Modifiers | Description |
 |  --- | --- | --- |
-|  [getPendingCount$()](./kibana-plugin-plugins-data-public.searchinterceptor.getpendingcount_.md) |  | Returns an <code>Observable</code> over the current number of pending searches. This could mean that one of the search requests is still in flight, or that it has only received partial responses. |
 |  [search(request, options)](./kibana-plugin-plugins-data-public.searchinterceptor.search.md) |  | Searches using the given <code>search</code> method. Overrides the <code>AbortSignal</code> with one that will abort either when <code>cancelPending</code> is called, when the request times out, or when the original <code>AbortSignal</code> is aborted. Updates <code>pendingCount$</code> when the request is started/finalized. |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.showtimeouterror.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.showtimeouterror.md
new file mode 100644
index 0000000000000..91ecb2821acbf
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.showtimeouterror.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [showTimeoutError](./kibana-plugin-plugins-data-public.searchinterceptor.showtimeouterror.md)
+
+## SearchInterceptor.showTimeoutError property
+
+<b>Signature:</b>
+
+```typescript
+protected showTimeoutError: ((e: Error) => void) & import("lodash").Cancelable;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource._constructor_.md
new file mode 100644
index 0000000000000..00e9050ee8ff9
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource._constructor_.md
@@ -0,0 +1,21 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.searchsource._constructor_.md)
+
+## SearchSource.(constructor)
+
+Constructs a new instance of the `SearchSource` class
+
+<b>Signature:</b>
+
+```typescript
+constructor(fields: SearchSourceFields | undefined, dependencies: SearchSourceDependencies);
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  fields | <code>SearchSourceFields &#124; undefined</code> |  |
+|  dependencies | <code>SearchSourceDependencies</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.create.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.create.md
new file mode 100644
index 0000000000000..4264c3ff224b1
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.create.md
@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [create](./kibana-plugin-plugins-data-public.searchsource.create.md)
+
+## SearchSource.create() method
+
+> Warning: This API is now obsolete.
+> 
+> Don't use.
+> 
+
+<b>Signature:</b>
+
+```typescript
+create(): SearchSource;
+```
+<b>Returns:</b>
+
+`SearchSource`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.createchild.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.createchild.md
new file mode 100644
index 0000000000000..0c2e75651b354
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.createchild.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [createChild](./kibana-plugin-plugins-data-public.searchsource.createchild.md)
+
+## SearchSource.createChild() method
+
+creates a new child search source
+
+<b>Signature:</b>
+
+```typescript
+createChild(options?: {}): SearchSource;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  options | <code>{}</code> |  |
+
+<b>Returns:</b>
+
+`SearchSource`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.createcopy.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.createcopy.md
new file mode 100644
index 0000000000000..1053d31010d00
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.createcopy.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [createCopy](./kibana-plugin-plugins-data-public.searchsource.createcopy.md)
+
+## SearchSource.createCopy() method
+
+creates a copy of this search source (without its children)
+
+<b>Signature:</b>
+
+```typescript
+createCopy(): SearchSource;
+```
+<b>Returns:</b>
+
+`SearchSource`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.destroy.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.destroy.md
new file mode 100644
index 0000000000000..8a7cc5ee75d11
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.destroy.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [destroy](./kibana-plugin-plugins-data-public.searchsource.destroy.md)
+
+## SearchSource.destroy() method
+
+Completely destroy the SearchSource.  {<!-- -->undefined<!-- -->}
+
+<b>Signature:</b>
+
+```typescript
+destroy(): void;
+```
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
new file mode 100644
index 0000000000000..8fd17e6b1a1d9
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [fetch](./kibana-plugin-plugins-data-public.searchsource.fetch.md)
+
+## SearchSource.fetch() method
+
+Fetch this source and reject the returned Promise on error
+
+
+<b>Signature:</b>
+
+```typescript
+fetch(options?: ISearchOptions): Promise<import("elasticsearch").SearchResponse<any>>;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  options | <code>ISearchOptions</code> |  |
+
+<b>Returns:</b>
+
+`Promise<import("elasticsearch").SearchResponse<any>>`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getfield.md
new file mode 100644
index 0000000000000..7c516cc29df15
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getfield.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [getField](./kibana-plugin-plugins-data-public.searchsource.getfield.md)
+
+## SearchSource.getField() method
+
+Gets a single field from the fields
+
+<b>Signature:</b>
+
+```typescript
+getField<K extends keyof SearchSourceFields>(field: K, recurse?: boolean): SearchSourceFields[K];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  field | <code>K</code> |  |
+|  recurse | <code>boolean</code> |  |
+
+<b>Returns:</b>
+
+`SearchSourceFields[K]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getfields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getfields.md
new file mode 100644
index 0000000000000..1980227bee623
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getfields.md
@@ -0,0 +1,51 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [getFields](./kibana-plugin-plugins-data-public.searchsource.getfields.md)
+
+## SearchSource.getFields() method
+
+returns all search source fields
+
+<b>Signature:</b>
+
+```typescript
+getFields(): {
+        type?: string | undefined;
+        query?: import("../..").Query | undefined;
+        filter?: Filter | Filter[] | (() => Filter | Filter[] | undefined) | undefined;
+        sort?: Record<string, import("./types").SortDirection | import("./types").SortDirectionNumeric> | Record<string, import("./types").SortDirection | import("./types").SortDirectionNumeric>[] | undefined;
+        highlight?: any;
+        highlightAll?: boolean | undefined;
+        aggs?: any;
+        from?: number | undefined;
+        size?: number | undefined;
+        source?: string | boolean | string[] | undefined;
+        version?: boolean | undefined;
+        fields?: string | boolean | string[] | undefined;
+        index?: import("../..").IndexPattern | undefined;
+        searchAfter?: import("./types").EsQuerySearchAfter | undefined;
+        timeout?: string | undefined;
+        terminate_after?: number | undefined;
+    };
+```
+<b>Returns:</b>
+
+`{
+        type?: string | undefined;
+        query?: import("../..").Query | undefined;
+        filter?: Filter | Filter[] | (() => Filter | Filter[] | undefined) | undefined;
+        sort?: Record<string, import("./types").SortDirection | import("./types").SortDirectionNumeric> | Record<string, import("./types").SortDirection | import("./types").SortDirectionNumeric>[] | undefined;
+        highlight?: any;
+        highlightAll?: boolean | undefined;
+        aggs?: any;
+        from?: number | undefined;
+        size?: number | undefined;
+        source?: string | boolean | string[] | undefined;
+        version?: boolean | undefined;
+        fields?: string | boolean | string[] | undefined;
+        index?: import("../..").IndexPattern | undefined;
+        searchAfter?: import("./types").EsQuerySearchAfter | undefined;
+        timeout?: string | undefined;
+        terminate_after?: number | undefined;
+    }`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getid.md
new file mode 100644
index 0000000000000..b33410d86ae85
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getid.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [getId](./kibana-plugin-plugins-data-public.searchsource.getid.md)
+
+## SearchSource.getId() method
+
+returns search source id
+
+<b>Signature:</b>
+
+```typescript
+getId(): string;
+```
+<b>Returns:</b>
+
+`string`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getownfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getownfield.md
new file mode 100644
index 0000000000000..d5a133772264e
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getownfield.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [getOwnField](./kibana-plugin-plugins-data-public.searchsource.getownfield.md)
+
+## SearchSource.getOwnField() method
+
+Get the field from our own fields, don't traverse up the chain
+
+<b>Signature:</b>
+
+```typescript
+getOwnField<K extends keyof SearchSourceFields>(field: K): SearchSourceFields[K];
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  field | <code>K</code> |  |
+
+<b>Returns:</b>
+
+`SearchSourceFields[K]`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getparent.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getparent.md
new file mode 100644
index 0000000000000..14578f7949ba6
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getparent.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [getParent](./kibana-plugin-plugins-data-public.searchsource.getparent.md)
+
+## SearchSource.getParent() method
+
+Get the parent of this SearchSource  {<!-- -->undefined\|searchSource<!-- -->}
+
+<b>Signature:</b>
+
+```typescript
+getParent(): SearchSource | undefined;
+```
+<b>Returns:</b>
+
+`SearchSource | undefined`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getsearchrequestbody.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getsearchrequestbody.md
new file mode 100644
index 0000000000000..cc50d3f017971
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getsearchrequestbody.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [getSearchRequestBody](./kibana-plugin-plugins-data-public.searchsource.getsearchrequestbody.md)
+
+## SearchSource.getSearchRequestBody() method
+
+Returns body contents of the search request, often referred as query DSL.
+
+<b>Signature:</b>
+
+```typescript
+getSearchRequestBody(): Promise<any>;
+```
+<b>Returns:</b>
+
+`Promise<any>`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getserializedfields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getserializedfields.md
new file mode 100644
index 0000000000000..3f58a76b24cd0
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.getserializedfields.md
@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [getSerializedFields](./kibana-plugin-plugins-data-public.searchsource.getserializedfields.md)
+
+## SearchSource.getSerializedFields() method
+
+serializes search source fields (which can later be passed to [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md)<!-- -->)
+
+<b>Signature:</b>
+
+```typescript
+getSerializedFields(): SearchSourceFields;
+```
+<b>Returns:</b>
+
+`SearchSourceFields`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.history.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.history.md
new file mode 100644
index 0000000000000..e77c9dac7239f
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.history.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [history](./kibana-plugin-plugins-data-public.searchsource.history.md)
+
+## SearchSource.history property
+
+<b>Signature:</b>
+
+```typescript
+history: SearchRequest[];
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.md
new file mode 100644
index 0000000000000..87346f81b13e2
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.md
@@ -0,0 +1,49 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md)
+
+## SearchSource class
+
+\*
+
+<b>Signature:</b>
+
+```typescript
+export declare class SearchSource 
+```
+
+## Constructors
+
+|  Constructor | Modifiers | Description |
+|  --- | --- | --- |
+|  [(constructor)(fields, dependencies)](./kibana-plugin-plugins-data-public.searchsource._constructor_.md) |  | Constructs a new instance of the <code>SearchSource</code> class |
+
+## Properties
+
+|  Property | Modifiers | Type | Description |
+|  --- | --- | --- | --- |
+|  [history](./kibana-plugin-plugins-data-public.searchsource.history.md) |  | <code>SearchRequest[]</code> |  |
+
+## Methods
+
+|  Method | Modifiers | Description |
+|  --- | --- | --- |
+|  [create()](./kibana-plugin-plugins-data-public.searchsource.create.md) |  |  |
+|  [createChild(options)](./kibana-plugin-plugins-data-public.searchsource.createchild.md) |  | creates a new child search source |
+|  [createCopy()](./kibana-plugin-plugins-data-public.searchsource.createcopy.md) |  | creates a copy of this search source (without its children) |
+|  [destroy()](./kibana-plugin-plugins-data-public.searchsource.destroy.md) |  | Completely destroy the SearchSource.  {<!-- -->undefined<!-- -->} |
+|  [fetch(options)](./kibana-plugin-plugins-data-public.searchsource.fetch.md) |  | Fetch this source and reject the returned Promise on error |
+|  [getField(field, recurse)](./kibana-plugin-plugins-data-public.searchsource.getfield.md) |  | Gets a single field from the fields |
+|  [getFields()](./kibana-plugin-plugins-data-public.searchsource.getfields.md) |  | returns all search source fields |
+|  [getId()](./kibana-plugin-plugins-data-public.searchsource.getid.md) |  | returns search source id |
+|  [getOwnField(field)](./kibana-plugin-plugins-data-public.searchsource.getownfield.md) |  | Get the field from our own fields, don't traverse up the chain |
+|  [getParent()](./kibana-plugin-plugins-data-public.searchsource.getparent.md) |  | Get the parent of this SearchSource  {<!-- -->undefined\|searchSource<!-- -->} |
+|  [getSearchRequestBody()](./kibana-plugin-plugins-data-public.searchsource.getsearchrequestbody.md) |  | Returns body contents of the search request, often referred as query DSL. |
+|  [getSerializedFields()](./kibana-plugin-plugins-data-public.searchsource.getserializedfields.md) |  | serializes search source fields (which can later be passed to [ISearchStartSearchSource](./kibana-plugin-plugins-data-public.isearchstartsearchsource.md)<!-- -->) |
+|  [onRequestStart(handler)](./kibana-plugin-plugins-data-public.searchsource.onrequeststart.md) |  | Add a handler that will be notified whenever requests start |
+|  [serialize()](./kibana-plugin-plugins-data-public.searchsource.serialize.md) |  | Serializes the instance to a JSON string and a set of referenced objects. Use this method to get a representation of the search source which can be stored in a saved object.<!-- -->The references returned by this function can be mixed with other references in the same object, however make sure there are no name-collisions. The references will be named <code>kibanaSavedObjectMeta.searchSourceJSON.index</code> and <code>kibanaSavedObjectMeta.searchSourceJSON.filter[&lt;number&gt;].meta.index</code>.<!-- -->Using <code>createSearchSource</code>, the instance can be re-created. |
+|  [setField(field, value)](./kibana-plugin-plugins-data-public.searchsource.setfield.md) |  | sets value to a single search source feild |
+|  [setFields(newFields)](./kibana-plugin-plugins-data-public.searchsource.setfields.md) |  | Internal, do not use. Overrides all search source fields with the new field array. |
+|  [setParent(parent, options)](./kibana-plugin-plugins-data-public.searchsource.setparent.md) |  | Set a searchSource that this source should inherit from |
+|  [setPreferredSearchStrategyId(searchStrategyId)](./kibana-plugin-plugins-data-public.searchsource.setpreferredsearchstrategyid.md) |  | internal, dont use |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.onrequeststart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.onrequeststart.md
new file mode 100644
index 0000000000000..a9386ddae44e1
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.onrequeststart.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [onRequestStart](./kibana-plugin-plugins-data-public.searchsource.onrequeststart.md)
+
+## SearchSource.onRequestStart() method
+
+Add a handler that will be notified whenever requests start
+
+<b>Signature:</b>
+
+```typescript
+onRequestStart(handler: (searchSource: SearchSource, options?: ISearchOptions) => Promise<unknown>): void;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  handler | <code>(searchSource: SearchSource, options?: ISearchOptions) =&gt; Promise&lt;unknown&gt;</code> |  |
+
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.serialize.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.serialize.md
new file mode 100644
index 0000000000000..73ba8eb66040b
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.serialize.md
@@ -0,0 +1,27 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [serialize](./kibana-plugin-plugins-data-public.searchsource.serialize.md)
+
+## SearchSource.serialize() method
+
+Serializes the instance to a JSON string and a set of referenced objects. Use this method to get a representation of the search source which can be stored in a saved object.
+
+The references returned by this function can be mixed with other references in the same object, however make sure there are no name-collisions. The references will be named `kibanaSavedObjectMeta.searchSourceJSON.index` and `kibanaSavedObjectMeta.searchSourceJSON.filter[<number>].meta.index`<!-- -->.
+
+Using `createSearchSource`<!-- -->, the instance can be re-created.
+
+<b>Signature:</b>
+
+```typescript
+serialize(): {
+        searchSourceJSON: string;
+        references: import("../../../../../core/public").SavedObjectReference[];
+    };
+```
+<b>Returns:</b>
+
+`{
+        searchSourceJSON: string;
+        references: import("../../../../../core/public").SavedObjectReference[];
+    }`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setfield.md
new file mode 100644
index 0000000000000..22619940f1589
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setfield.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [setField](./kibana-plugin-plugins-data-public.searchsource.setfield.md)
+
+## SearchSource.setField() method
+
+sets value to a single search source feild
+
+<b>Signature:</b>
+
+```typescript
+setField<K extends keyof SearchSourceFields>(field: K, value: SearchSourceFields[K]): this;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  field | <code>K</code> |  |
+|  value | <code>SearchSourceFields[K]</code> |  |
+
+<b>Returns:</b>
+
+`this`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setfields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setfields.md
new file mode 100644
index 0000000000000..f92ffc0fc991d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setfields.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [setFields](./kibana-plugin-plugins-data-public.searchsource.setfields.md)
+
+## SearchSource.setFields() method
+
+Internal, do not use. Overrides all search source fields with the new field array.
+
+
+<b>Signature:</b>
+
+```typescript
+setFields(newFields: SearchSourceFields): this;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  newFields | <code>SearchSourceFields</code> |  |
+
+<b>Returns:</b>
+
+`this`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setparent.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setparent.md
new file mode 100644
index 0000000000000..19bf10bec210f
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setparent.md
@@ -0,0 +1,25 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [setParent](./kibana-plugin-plugins-data-public.searchsource.setparent.md)
+
+## SearchSource.setParent() method
+
+Set a searchSource that this source should inherit from
+
+<b>Signature:</b>
+
+```typescript
+setParent(parent?: ISearchSource, options?: SearchSourceOptions): this;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  parent | <code>ISearchSource</code> |  |
+|  options | <code>SearchSourceOptions</code> |  |
+
+<b>Returns:</b>
+
+`this`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setpreferredsearchstrategyid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setpreferredsearchstrategyid.md
new file mode 100644
index 0000000000000..e3261873ba104
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.setpreferredsearchstrategyid.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) &gt; [setPreferredSearchStrategyId](./kibana-plugin-plugins-data-public.searchsource.setpreferredsearchstrategyid.md)
+
+## SearchSource.setPreferredSearchStrategyId() method
+
+internal, dont use
+
+<b>Signature:</b>
+
+```typescript
+setPreferredSearchStrategyId(searchStrategyId: string): void;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  searchStrategyId | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`void`
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md
index 743646708b4c6..f6bab8e424857 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.aggs.md
@@ -4,6 +4,8 @@
 
 ## SearchSourceFields.aggs property
 
+[AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.filter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.filter.md
index a14d33420a22d..5fd615cc647d2 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.filter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.filter.md
@@ -4,6 +4,8 @@
 
 ## SearchSourceFields.filter property
 
+[Filter](./kibana-plugin-plugins-data-public.filter.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.index.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.index.md
index fa1d1a552a560..cf1b1cfa253fd 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.index.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.index.md
@@ -4,6 +4,7 @@
 
 ## SearchSourceFields.index property
 
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md
index 7a64af0f8b2b8..d19f1da439cee 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.md
@@ -4,6 +4,8 @@
 
 ## SearchSourceFields interface
 
+search source fields
+
 <b>Signature:</b>
 
 ```typescript
@@ -14,17 +16,17 @@ export interface SearchSourceFields
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [aggs](./kibana-plugin-plugins-data-public.searchsourcefields.aggs.md) | <code>any</code> |  |
+|  [aggs](./kibana-plugin-plugins-data-public.searchsourcefields.aggs.md) | <code>any</code> | [AggConfigs](./kibana-plugin-plugins-data-public.aggconfigs.md) |
 |  [fields](./kibana-plugin-plugins-data-public.searchsourcefields.fields.md) | <code>NameList</code> |  |
-|  [filter](./kibana-plugin-plugins-data-public.searchsourcefields.filter.md) | <code>Filter[] &#124; Filter &#124; (() =&gt; Filter[] &#124; Filter &#124; undefined)</code> |  |
+|  [filter](./kibana-plugin-plugins-data-public.searchsourcefields.filter.md) | <code>Filter[] &#124; Filter &#124; (() =&gt; Filter[] &#124; Filter &#124; undefined)</code> | [Filter](./kibana-plugin-plugins-data-public.filter.md) |
 |  [from](./kibana-plugin-plugins-data-public.searchsourcefields.from.md) | <code>number</code> |  |
 |  [highlight](./kibana-plugin-plugins-data-public.searchsourcefields.highlight.md) | <code>any</code> |  |
 |  [highlightAll](./kibana-plugin-plugins-data-public.searchsourcefields.highlightall.md) | <code>boolean</code> |  |
 |  [index](./kibana-plugin-plugins-data-public.searchsourcefields.index.md) | <code>IndexPattern</code> |  |
-|  [query](./kibana-plugin-plugins-data-public.searchsourcefields.query.md) | <code>Query</code> |  |
+|  [query](./kibana-plugin-plugins-data-public.searchsourcefields.query.md) | <code>Query</code> | [Query](./kibana-plugin-plugins-data-public.query.md) |
 |  [searchAfter](./kibana-plugin-plugins-data-public.searchsourcefields.searchafter.md) | <code>EsQuerySearchAfter</code> |  |
 |  [size](./kibana-plugin-plugins-data-public.searchsourcefields.size.md) | <code>number</code> |  |
-|  [sort](./kibana-plugin-plugins-data-public.searchsourcefields.sort.md) | <code>EsQuerySortValue &#124; EsQuerySortValue[]</code> |  |
+|  [sort](./kibana-plugin-plugins-data-public.searchsourcefields.sort.md) | <code>EsQuerySortValue &#124; EsQuerySortValue[]</code> | [EsQuerySortValue](./kibana-plugin-plugins-data-public.esquerysortvalue.md) |
 |  [source](./kibana-plugin-plugins-data-public.searchsourcefields.source.md) | <code>NameList</code> |  |
 |  [terminate\_after](./kibana-plugin-plugins-data-public.searchsourcefields.terminate_after.md) | <code>number</code> |  |
 |  [timeout](./kibana-plugin-plugins-data-public.searchsourcefields.timeout.md) | <code>string</code> |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.query.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.query.md
index 687dafce798d1..661ce94a06afb 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.query.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.query.md
@@ -4,6 +4,8 @@
 
 ## SearchSourceFields.query property
 
+[Query](./kibana-plugin-plugins-data-public.query.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.sort.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.sort.md
index c10f556cef6d6..32f513378e35e 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.sort.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsourcefields.sort.md
@@ -4,6 +4,8 @@
 
 ## SearchSourceFields.sort property
 
+[EsQuerySortValue](./kibana-plugin-plugins-data-public.esquerysortvalue.md)
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/package.json b/package.json
index 95a6de337f62a..7468a49d56959 100644
--- a/package.json
+++ b/package.json
@@ -63,7 +63,7 @@
     "uiFramework:createComponent": "cd packages/kbn-ui-framework && yarn createComponent",
     "uiFramework:documentComponent": "cd packages/kbn-ui-framework && yarn documentComponent",
     "kbn:watch": "node scripts/kibana --dev --logging.json=false",
-    "build:types": "tsc --p tsconfig.types.json",
+    "build:types": "rm -rf ./target/types && tsc --p tsconfig.types.json",
     "docs:acceptApiChanges": "node --max-old-space-size=6144 scripts/check_published_api_changes.js --accept",
     "kbn:bootstrap": "node scripts/build_ts_refs && node scripts/register_git_hook",
     "spec_to_console": "node scripts/spec_to_console",
diff --git a/packages/kbn-ui-framework/src/components/local_nav/_local_search.scss b/packages/kbn-ui-framework/src/components/local_nav/_local_search.scss
index 130807790e987..740ae664c7f5b 100644
--- a/packages/kbn-ui-framework/src/components/local_nav/_local_search.scss
+++ b/packages/kbn-ui-framework/src/components/local_nav/_local_search.scss
@@ -26,13 +26,6 @@
   border-radius: 0;
   border-left-width: 0;
 }
-
-.kuiLocalSearchAssistedInput {
-  display: flex;
-  flex: 1 1 100%;
-  position: relative;
-}
-
 /**
  * 1. em used for right padding so documentation link and query string
  *    won't overlap if the user increases their default browser font size
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index 97aca74bfd48f..d127471348d9f 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -293,6 +293,7 @@ export {
   SavedObjectsTypeManagementDefinition,
   SavedObjectMigrationMap,
   SavedObjectMigrationFn,
+  SavedObjectsUtils,
   exportSavedObjectsToStream,
   importSavedObjectsFromStream,
   resolveSavedObjectsImportErrors,
diff --git a/src/core/server/plugins/discovery/plugin_manifest_parser.test.ts b/src/core/server/plugins/discovery/plugin_manifest_parser.test.ts
index 64d1256be2f30..836aabf881474 100644
--- a/src/core/server/plugins/discovery/plugin_manifest_parser.test.ts
+++ b/src/core/server/plugins/discovery/plugin_manifest_parser.test.ts
@@ -116,6 +116,16 @@ test('logs warning if pluginId is not in camelCase format', async () => {
   `);
 });
 
+test('does not log pluginId format warning in dist mode', async () => {
+  mockReadFile.mockImplementation((path, cb) => {
+    cb(null, Buffer.from(JSON.stringify({ id: 'some_name', version: 'kibana', server: true })));
+  });
+
+  expect(loggingSystemMock.collect(logger).warn).toHaveLength(0);
+  await parseManifest(pluginPath, { ...packageInfo, dist: true }, logger);
+  expect(loggingSystemMock.collect(logger).warn.length).toBe(0);
+});
+
 test('return error when plugin version is missing', async () => {
   mockReadFile.mockImplementation((path, cb) => {
     cb(null, Buffer.from(JSON.stringify({ id: 'someId' })));
diff --git a/src/core/server/plugins/discovery/plugin_manifest_parser.ts b/src/core/server/plugins/discovery/plugin_manifest_parser.ts
index 0d33e266c37db..cfc412cb60b50 100644
--- a/src/core/server/plugins/discovery/plugin_manifest_parser.ts
+++ b/src/core/server/plugins/discovery/plugin_manifest_parser.ts
@@ -116,7 +116,7 @@ export async function parseManifest(
     );
   }
 
-  if (!isCamelCase(manifest.id)) {
+  if (!packageInfo.dist && !isCamelCase(manifest.id)) {
     log.warn(`Expect plugin "id" in camelCase, but found: ${manifest.id}`);
   }
 
diff --git a/src/core/server/saved_objects/routes/bulk_update.ts b/src/core/server/saved_objects/routes/bulk_update.ts
index c112833b29f3f..882213644146a 100644
--- a/src/core/server/saved_objects/routes/bulk_update.ts
+++ b/src/core/server/saved_objects/routes/bulk_update.ts
@@ -40,6 +40,7 @@ export const registerBulkUpdateRoute = (router: IRouter) => {
                 })
               )
             ),
+            namespace: schema.maybe(schema.string({ minLength: 1 })),
           })
         ),
       },
diff --git a/src/core/server/saved_objects/service/index.ts b/src/core/server/saved_objects/service/index.ts
index 271d4dd67d43e..c33a9f2f3b157 100644
--- a/src/core/server/saved_objects/service/index.ts
+++ b/src/core/server/saved_objects/service/index.ts
@@ -27,6 +27,7 @@ export {
   SavedObjectsErrorHelpers,
   SavedObjectsClientFactory,
   SavedObjectsClientFactoryProvider,
+  SavedObjectsUtils,
 } from './lib';
 
 export * from './saved_objects_client';
diff --git a/src/core/server/saved_objects/service/lib/index.ts b/src/core/server/saved_objects/service/lib/index.ts
index e103120388e35..eae8c5ef2e10c 100644
--- a/src/core/server/saved_objects/service/lib/index.ts
+++ b/src/core/server/saved_objects/service/lib/index.ts
@@ -30,3 +30,5 @@ export {
 } from './scoped_client_provider';
 
 export { SavedObjectsErrorHelpers } from './errors';
+
+export { SavedObjectsUtils } from './utils';
diff --git a/src/core/server/saved_objects/service/lib/repository.test.js b/src/core/server/saved_objects/service/lib/repository.test.js
index f2e3b3e633cd6..7d30875b90796 100644
--- a/src/core/server/saved_objects/service/lib/repository.test.js
+++ b/src/core/server/saved_objects/service/lib/repository.test.js
@@ -155,27 +155,33 @@ describe('SavedObjectsRepository', () => {
     log: {},
   });
 
-  const getMockGetResponse = ({ type, id, references, namespace, originId }) => ({
-    // NOTE: Elasticsearch returns more fields (_index, _type) but the SavedObjectsRepository method ignores these
-    found: true,
-    _id: `${registry.isSingleNamespace(type) && namespace ? `${namespace}:` : ''}${type}:${id}`,
-    ...mockVersionProps,
-    _source: {
-      ...(registry.isSingleNamespace(type) && { namespace }),
-      ...(registry.isMultiNamespace(type) && { namespaces: [namespace ?? 'default'] }),
-      ...(originId && { originId }),
-      type,
-      [type]: { title: 'Testing' },
-      references,
-      specialProperty: 'specialValue',
-      ...mockTimestampFields,
-    },
-  });
+  const getMockGetResponse = (
+    { type, id, references, namespace: objectNamespace, originId },
+    namespace
+  ) => {
+    const namespaceId = objectNamespace === 'default' ? undefined : objectNamespace ?? namespace;
+    return {
+      // NOTE: Elasticsearch returns more fields (_index, _type) but the SavedObjectsRepository method ignores these
+      found: true,
+      _id: `${
+        registry.isSingleNamespace(type) && namespaceId ? `${namespaceId}:` : ''
+      }${type}:${id}`,
+      ...mockVersionProps,
+      _source: {
+        ...(registry.isSingleNamespace(type) && { namespace: namespaceId }),
+        ...(registry.isMultiNamespace(type) && { namespaces: [namespaceId ?? 'default'] }),
+        ...(originId && { originId }),
+        type,
+        [type]: { title: 'Testing' },
+        references,
+        specialProperty: 'specialValue',
+        ...mockTimestampFields,
+      },
+    };
+  };
 
   const getMockMgetResponse = (objects, namespace) => ({
-    docs: objects.map((obj) =>
-      obj.found === false ? obj : getMockGetResponse({ ...obj, namespace })
-    ),
+    docs: objects.map((obj) => (obj.found === false ? obj : getMockGetResponse(obj, namespace))),
   });
 
   expect.extend({
@@ -586,6 +592,16 @@ describe('SavedObjectsRepository', () => {
         );
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        await bulkCreateSuccess([obj1, obj2], { namespace: 'default' });
+        const expected = expect.not.objectContaining({ namespace: 'default' });
+        const body = [expect.any(Object), expected, expect.any(Object), expected];
+        expect(client.bulk).toHaveBeenCalledWith(
+          expect.objectContaining({ body }),
+          expect.anything()
+        );
+      });
+
       it(`doesn't add namespace to request body for any types that are not single-namespace`, async () => {
         const objects = [
           { ...obj1, type: NAMESPACE_AGNOSTIC_TYPE },
@@ -653,19 +669,19 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`prepends namespace to the id when providing namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${namespace}:${type}:${id}`;
+        const getId = (type, id) => `${namespace}:${type}:${id}`; // test that the raw document ID equals this (e.g., has a namespace prefix)
         await bulkCreateSuccess([obj1, obj2], { namespace });
         expectClientCallArgsAction([obj1, obj2], { method: 'create', getId });
       });
 
       it(`doesn't prepend namespace to the id when providing no namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${type}:${id}`;
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         await bulkCreateSuccess([obj1, obj2]);
         expectClientCallArgsAction([obj1, obj2], { method: 'create', getId });
       });
 
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
-        const getId = (type, id) => `${type}:${id}`;
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         const objects = [
           { ...obj1, type: NAMESPACE_AGNOSTIC_TYPE },
           { ...obj2, type: MULTI_NAMESPACE_TYPE },
@@ -972,19 +988,25 @@ describe('SavedObjectsRepository', () => {
 
     describe('client calls', () => {
       it(`prepends namespace to the id when providing namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${namespace}:${type}:${id}`;
+        const getId = (type, id) => `${namespace}:${type}:${id}`; // test that the raw document ID equals this (e.g., has a namespace prefix)
         await bulkGetSuccess([obj1, obj2], { namespace });
         _expectClientCallArgs([obj1, obj2], { getId });
       });
 
       it(`doesn't prepend namespace to the id when providing no namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${type}:${id}`;
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         await bulkGetSuccess([obj1, obj2]);
         _expectClientCallArgs([obj1, obj2], { getId });
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
+        await bulkGetSuccess([obj1, obj2], { namespace: 'default' });
+        _expectClientCallArgs([obj1, obj2], { getId });
+      });
+
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
-        const getId = (type, id) => `${type}:${id}`;
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         let objects = [obj1, obj2].map((obj) => ({ ...obj, type: NAMESPACE_AGNOSTIC_TYPE }));
         await bulkGetSuccess(objects, { namespace });
         _expectClientCallArgs(objects, { getId });
@@ -1327,32 +1349,66 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`prepends namespace to the id when providing namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${namespace}:${type}:${id}`;
+        const getId = (type, id) => `${namespace}:${type}:${id}`; // test that the raw document ID equals this (e.g., has a namespace prefix)
         await bulkUpdateSuccess([obj1, obj2], { namespace });
         expectClientCallArgsAction([obj1, obj2], { method: 'update', getId });
+
+        jest.clearAllMocks();
+        // test again with object namespace string that supersedes the operation's namespace ID
+        await bulkUpdateSuccess([
+          { ...obj1, namespace },
+          { ...obj2, namespace },
+        ]);
+        expectClientCallArgsAction([obj1, obj2], { method: 'update', getId });
       });
 
       it(`doesn't prepend namespace to the id when providing no namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${type}:${id}`;
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         await bulkUpdateSuccess([obj1, obj2]);
         expectClientCallArgsAction([obj1, obj2], { method: 'update', getId });
+
+        jest.clearAllMocks();
+        // test again with object namespace string that supersedes the operation's namespace ID
+        await bulkUpdateSuccess(
+          [
+            { ...obj1, namespace: 'default' },
+            { ...obj2, namespace: 'default' },
+          ],
+          { namespace }
+        );
+        expectClientCallArgsAction([obj1, obj2], { method: 'update', getId });
       });
 
-      it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
         const getId = (type, id) => `${type}:${id}`;
-        const objects1 = [{ ...obj1, type: NAMESPACE_AGNOSTIC_TYPE }];
-        await bulkUpdateSuccess(objects1, { namespace });
-        expectClientCallArgsAction(objects1, { method: 'update', getId });
-        client.bulk.mockClear();
+        await bulkUpdateSuccess([obj1, obj2], { namespace: 'default' });
+        expectClientCallArgsAction([obj1, obj2], { method: 'update', getId });
+      });
+
+      it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         const overrides = {
           // bulkUpdate uses a preflight `get` request for multi-namespace saved objects, and specifies that version on `update`
           // we aren't testing for this here, but we need to include Jest assertions so this test doesn't fail
           if_primary_term: expect.any(Number),
           if_seq_no: expect.any(Number),
         };
-        const objects2 = [{ ...obj2, type: MULTI_NAMESPACE_TYPE }];
-        await bulkUpdateSuccess(objects2, { namespace });
-        expectClientCallArgsAction(objects2, { method: 'update', getId, overrides }, 2);
+        const _obj1 = { ...obj1, type: NAMESPACE_AGNOSTIC_TYPE };
+        const _obj2 = { ...obj2, type: MULTI_NAMESPACE_TYPE };
+
+        await bulkUpdateSuccess([_obj1], { namespace });
+        expectClientCallArgsAction([_obj1], { method: 'update', getId });
+        client.bulk.mockClear();
+        await bulkUpdateSuccess([_obj2], { namespace });
+        expectClientCallArgsAction([_obj2], { method: 'update', getId, overrides }, 2);
+
+        jest.clearAllMocks();
+        // test again with object namespace string that supersedes the operation's namespace ID
+        await bulkUpdateSuccess([{ ..._obj1, namespace }]);
+        expectClientCallArgsAction([_obj1], { method: 'update', getId });
+        client.bulk.mockClear();
+        await bulkUpdateSuccess([{ ..._obj2, namespace }]);
+        expectClientCallArgsAction([_obj2], { method: 'update', getId, overrides }, 2);
       });
     });
 
@@ -1581,19 +1637,25 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`prepends namespace to the id when providing namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${namespace}:${type}:${id}`;
+        const getId = (type, id) => `${namespace}:${type}:${id}`; // test that the raw document ID equals this (e.g., has a namespace prefix)
         await checkConflictsSuccess([obj1, obj2], { namespace });
         _expectClientCallArgs([obj1, obj2], { getId });
       });
 
       it(`doesn't prepend namespace to the id when providing no namespace for single-namespace type`, async () => {
-        const getId = (type, id) => `${type}:${id}`;
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         await checkConflictsSuccess([obj1, obj2]);
         _expectClientCallArgs([obj1, obj2], { getId });
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
+        await checkConflictsSuccess([obj1, obj2], { namespace: 'default' });
+        _expectClientCallArgs([obj1, obj2], { getId });
+      });
+
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
-        const getId = (type, id) => `${type}:${id}`;
+        const getId = (type, id) => `${type}:${id}`; // test that the raw document ID equals this (e.g., does not have a namespace prefix)
         // obj3 is multi-namespace, and obj6 is namespace-agnostic
         await checkConflictsSuccess([obj3, obj6], { namespace });
         _expectClientCallArgs([obj3, obj6], { getId });
@@ -1816,6 +1878,16 @@ describe('SavedObjectsRepository', () => {
         );
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        await createSuccess(type, attributes, { id, namespace: 'default' });
+        expect(client.create).toHaveBeenCalledWith(
+          expect.objectContaining({
+            id: `${type}:${id}`,
+          }),
+          expect.anything()
+        );
+      });
+
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
         await createSuccess(NAMESPACE_AGNOSTIC_TYPE, attributes, { id, namespace });
         expect(client.create).toHaveBeenCalledWith(
@@ -1852,11 +1924,7 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`throws when there is a conflict with an existing multi-namespace saved object (get)`, async () => {
-        const response = getMockGetResponse({
-          type: MULTI_NAMESPACE_TYPE,
-          id,
-          namespace: 'bar-namespace',
-        });
+        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id }, 'bar-namespace');
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(response)
         );
@@ -1959,7 +2027,7 @@ describe('SavedObjectsRepository', () => {
 
     const deleteSuccess = async (type, id, options) => {
       if (registry.isMultiNamespace(type)) {
-        const mockGetResponse = getMockGetResponse({ type, id, namespace: options?.namespace });
+        const mockGetResponse = getMockGetResponse({ type, id }, options?.namespace);
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(mockGetResponse)
         );
@@ -2035,6 +2103,14 @@ describe('SavedObjectsRepository', () => {
         );
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        await deleteSuccess(type, id, { namespace: 'default' });
+        expect(client.delete).toHaveBeenCalledWith(
+          expect.objectContaining({ id: `${type}:${id}` }),
+          expect.anything()
+        );
+      });
+
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
         await deleteSuccess(NAMESPACE_AGNOSTIC_TYPE, id, { namespace });
         expect(client.delete).toHaveBeenCalledWith(
@@ -2085,7 +2161,7 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`throws when the type is multi-namespace and the document exists, but not in this namespace`, async () => {
-        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id, namespace });
+        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id }, namespace);
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(response)
         );
@@ -2660,14 +2736,16 @@ describe('SavedObjectsRepository', () => {
     const originId = 'some-origin-id';
 
     const getSuccess = async (type, id, options, includeOriginId) => {
-      const response = getMockGetResponse({
-        type,
-        id,
-        namespace: options?.namespace,
-        // "includeOriginId" is not an option for the operation; however, if the existing saved object contains an originId attribute, the
-        // operation will return it in the result. This flag is just used for test purposes to modify the mock cluster call response.
-        ...(includeOriginId && { originId }),
-      });
+      const response = getMockGetResponse(
+        {
+          type,
+          id,
+          // "includeOriginId" is not an option for the operation; however, if the existing saved object contains an originId attribute, the
+          // operation will return it in the result. This flag is just used for test purposes to modify the mock cluster call response.
+          ...(includeOriginId && { originId }),
+        },
+        options?.namespace
+      );
       client.get.mockResolvedValueOnce(
         elasticsearchClientMock.createSuccessTransportRequestPromise(response)
       );
@@ -2702,6 +2780,16 @@ describe('SavedObjectsRepository', () => {
         );
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        await getSuccess(type, id, { namespace: 'default' });
+        expect(client.get).toHaveBeenCalledWith(
+          expect.objectContaining({
+            id: `${type}:${id}`,
+          }),
+          expect.anything()
+        );
+      });
+
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
         await getSuccess(NAMESPACE_AGNOSTIC_TYPE, id, { namespace });
         expect(client.get).toHaveBeenCalledWith(
@@ -2756,7 +2844,7 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`throws when type is multi-namespace and the document exists, but not in this namespace`, async () => {
-        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id, namespace });
+        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id }, namespace);
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(response)
         );
@@ -2812,7 +2900,7 @@ describe('SavedObjectsRepository', () => {
     const incrementCounterSuccess = async (type, id, field, options) => {
       const isMultiNamespace = registry.isMultiNamespace(type);
       if (isMultiNamespace) {
-        const response = getMockGetResponse({ type, id, namespace: options?.namespace });
+        const response = getMockGetResponse({ type, id }, options?.namespace);
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(response)
         );
@@ -2883,6 +2971,16 @@ describe('SavedObjectsRepository', () => {
         );
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        await incrementCounterSuccess(type, id, field, { namespace: 'default' });
+        expect(client.update).toHaveBeenCalledWith(
+          expect.objectContaining({
+            id: `${type}:${id}`,
+          }),
+          expect.anything()
+        );
+      });
+
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
         await incrementCounterSuccess(NAMESPACE_AGNOSTIC_TYPE, id, field, { namespace });
         expect(client.update).toHaveBeenCalledWith(
@@ -2949,11 +3047,7 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`throws when there is a conflict with an existing multi-namespace saved object (get)`, async () => {
-        const response = getMockGetResponse({
-          type: MULTI_NAMESPACE_TYPE,
-          id,
-          namespace: 'bar-namespace',
-        });
+        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id }, 'bar-namespace');
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(response)
         );
@@ -3246,7 +3340,7 @@ describe('SavedObjectsRepository', () => {
         expect(client.update).not.toHaveBeenCalled();
       });
 
-      it(`throws when type is not namespace-agnostic`, async () => {
+      it(`throws when type is not multi-namespace`, async () => {
         const test = async (type) => {
           const message = `${type} doesn't support multiple namespaces`;
           await expectBadRequestError(type, id, [namespace1, namespace2], message);
@@ -3388,7 +3482,7 @@ describe('SavedObjectsRepository', () => {
 
     const updateSuccess = async (type, id, attributes, options, includeOriginId) => {
       if (registry.isMultiNamespace(type)) {
-        const mockGetResponse = getMockGetResponse({ type, id, namespace: options?.namespace });
+        const mockGetResponse = getMockGetResponse({ type, id }, options?.namespace);
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(mockGetResponse)
         );
@@ -3519,6 +3613,14 @@ describe('SavedObjectsRepository', () => {
         );
       });
 
+      it(`normalizes options.namespace from 'default' to undefined`, async () => {
+        await updateSuccess(type, id, attributes, { references, namespace: 'default' });
+        expect(client.update).toHaveBeenCalledWith(
+          expect.objectContaining({ id: expect.stringMatching(`${type}:${id}`) }),
+          expect.anything()
+        );
+      });
+
       it(`doesn't prepend namespace to the id when not using single-namespace type`, async () => {
         await updateSuccess(NAMESPACE_AGNOSTIC_TYPE, id, attributes, { namespace });
         expect(client.update).toHaveBeenCalledWith(
@@ -3589,7 +3691,7 @@ describe('SavedObjectsRepository', () => {
       });
 
       it(`throws when type is multi-namespace and the document exists, but not in this namespace`, async () => {
-        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id, namespace });
+        const response = getMockGetResponse({ type: MULTI_NAMESPACE_TYPE, id }, namespace);
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(response)
         );
diff --git a/src/core/server/saved_objects/service/lib/repository.ts b/src/core/server/saved_objects/service/lib/repository.ts
index e3fb7d2306469..125f97e7feb11 100644
--- a/src/core/server/saved_objects/service/lib/repository.ts
+++ b/src/core/server/saved_objects/service/lib/repository.ts
@@ -67,6 +67,7 @@ import {
 } from '../../types';
 import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import { validateConvertFilterToKueryNode } from './filter_utils';
+import { SavedObjectsUtils } from './utils';
 
 // BEWARE: The SavedObjectClient depends on the implementation details of the SavedObjectsRepository
 // so any breaking changes to this repository are considered breaking changes to the SavedObjectsClient.
@@ -220,13 +221,13 @@ export class SavedObjectsRepository {
     const {
       id,
       migrationVersion,
-      namespace,
       overwrite = false,
       references = [],
       refresh = DEFAULT_REFRESH_SETTING,
       originId,
       version,
     } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     if (!this._allowedTypes.includes(type)) {
       throw SavedObjectsErrorHelpers.createUnsupportedTypeError(type);
@@ -293,7 +294,8 @@ export class SavedObjectsRepository {
     objects: Array<SavedObjectsBulkCreateObject<T>>,
     options: SavedObjectsCreateOptions = {}
   ): Promise<SavedObjectsBulkResponse<T>> {
-    const { namespace, overwrite = false, refresh = DEFAULT_REFRESH_SETTING } = options;
+    const { overwrite = false, refresh = DEFAULT_REFRESH_SETTING } = options;
+    const namespace = normalizeNamespace(options.namespace);
     const time = this._getCurrentTime();
 
     let bulkGetRequestIndexCounter = 0;
@@ -468,7 +470,7 @@ export class SavedObjectsRepository {
       return { errors: [] };
     }
 
-    const { namespace } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     let bulkGetRequestIndexCounter = 0;
     const expectedBulkGetResults: Either[] = objects.map((object) => {
@@ -551,7 +553,8 @@ export class SavedObjectsRepository {
       throw SavedObjectsErrorHelpers.createGenericNotFoundError(type, id);
     }
 
-    const { namespace, refresh = DEFAULT_REFRESH_SETTING } = options;
+    const { refresh = DEFAULT_REFRESH_SETTING } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     const rawId = this._serializer.generateRawId(namespace, type, id);
     let preflightResult: SavedObjectsRawDoc | undefined;
@@ -560,7 +563,7 @@ export class SavedObjectsRepository {
       preflightResult = await this.preflightCheckIncludesNamespace(type, id, namespace);
       const existingNamespaces = getSavedObjectNamespaces(undefined, preflightResult);
       const remainingNamespaces = existingNamespaces?.filter(
-        (x) => x !== getNamespaceString(namespace)
+        (x) => x !== SavedObjectsUtils.namespaceIdToString(namespace)
       );
 
       if (remainingNamespaces?.length) {
@@ -658,7 +661,7 @@ export class SavedObjectsRepository {
               }
             `,
             lang: 'painless',
-            params: { namespace: getNamespaceString(namespace) },
+            params: { namespace },
           },
           conflicts: 'proceed',
           ...getSearchDsl(this._mappings, this._registry, {
@@ -814,7 +817,7 @@ export class SavedObjectsRepository {
     objects: SavedObjectsBulkGetObject[] = [],
     options: SavedObjectsBaseOptions = {}
   ): Promise<SavedObjectsBulkResponse<T>> {
-    const { namespace } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     if (objects.length === 0) {
       return { saved_objects: [] };
@@ -884,7 +887,9 @@ export class SavedObjectsRepository {
         const { originId, updated_at: updatedAt } = doc._source;
         let namespaces = [];
         if (!this._registry.isNamespaceAgnostic(type)) {
-          namespaces = doc._source.namespaces ?? [getNamespaceString(doc._source.namespace)];
+          namespaces = doc._source.namespaces ?? [
+            SavedObjectsUtils.namespaceIdToString(doc._source.namespace),
+          ];
         }
 
         return {
@@ -920,7 +925,7 @@ export class SavedObjectsRepository {
       throw SavedObjectsErrorHelpers.createGenericNotFoundError(type, id);
     }
 
-    const { namespace } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     const { body, statusCode } = await this.client.get<GetResponse<SavedObjectsRawDocSource>>(
       {
@@ -941,7 +946,9 @@ export class SavedObjectsRepository {
 
     let namespaces: string[] = [];
     if (!this._registry.isNamespaceAgnostic(type)) {
-      namespaces = body._source.namespaces ?? [getNamespaceString(body._source.namespace)];
+      namespaces = body._source.namespaces ?? [
+        SavedObjectsUtils.namespaceIdToString(body._source.namespace),
+      ];
     }
 
     return {
@@ -978,7 +985,8 @@ export class SavedObjectsRepository {
       throw SavedObjectsErrorHelpers.createGenericNotFoundError(type, id);
     }
 
-    const { version, namespace, references, refresh = DEFAULT_REFRESH_SETTING } = options;
+    const { version, references, refresh = DEFAULT_REFRESH_SETTING } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     let preflightResult: SavedObjectsRawDoc | undefined;
     if (this._registry.isMultiNamespace(type)) {
@@ -1016,7 +1024,9 @@ export class SavedObjectsRepository {
     const { originId } = body.get._source;
     let namespaces = [];
     if (!this._registry.isNamespaceAgnostic(type)) {
-      namespaces = body.get._source.namespaces ?? [getNamespaceString(body.get._source.namespace)];
+      namespaces = body.get._source.namespaces ?? [
+        SavedObjectsUtils.namespaceIdToString(body.get._source.namespace),
+      ];
     }
 
     return {
@@ -1060,6 +1070,7 @@ export class SavedObjectsRepository {
     }
 
     const { version, namespace, refresh = DEFAULT_REFRESH_SETTING } = options;
+    // we do not need to normalize the namespace to its ID format, since it will be converted to a namespace string before being used
 
     const rawId = this._serializer.generateRawId(undefined, type, id);
     const preflightResult = await this.preflightCheckIncludesNamespace(type, id, namespace);
@@ -1122,6 +1133,7 @@ export class SavedObjectsRepository {
     }
 
     const { namespace, refresh = DEFAULT_REFRESH_SETTING } = options;
+    // we do not need to normalize the namespace to its ID format, since it will be converted to a namespace string before being used
 
     const rawId = this._serializer.generateRawId(undefined, type, id);
     const preflightResult = await this.preflightCheckIncludesNamespace(type, id, namespace);
@@ -1208,7 +1220,7 @@ export class SavedObjectsRepository {
     options: SavedObjectsBulkUpdateOptions = {}
   ): Promise<SavedObjectsBulkUpdateResponse<T>> {
     const time = this._getCurrentTime();
-    const { namespace } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     let bulkGetRequestIndexCounter = 0;
     const expectedBulkGetResults: Either[] = objects.map((object) => {
@@ -1225,7 +1237,9 @@ export class SavedObjectsRepository {
         };
       }
 
-      const { attributes, references, version } = object;
+      const { attributes, references, version, namespace: objectNamespace } = object;
+      // `objectNamespace` is a namespace string, while `namespace` is a namespace ID.
+      // The object namespace string, if defined, will supersede the operation's namespace ID.
 
       const documentToSave = {
         [type]: attributes,
@@ -1242,16 +1256,24 @@ export class SavedObjectsRepository {
           id,
           version,
           documentToSave,
+          objectNamespace,
           ...(requiresNamespacesCheck && { esRequestIndex: bulkGetRequestIndexCounter++ }),
         },
       };
     });
 
+    const getNamespaceId = (objectNamespace?: string) =>
+      objectNamespace !== undefined
+        ? SavedObjectsUtils.namespaceStringToId(objectNamespace)
+        : namespace;
+    const getNamespaceString = (objectNamespace?: string) =>
+      objectNamespace ?? SavedObjectsUtils.namespaceIdToString(namespace);
+
     const bulkGetDocs = expectedBulkGetResults
       .filter(isRight)
       .filter(({ value }) => value.esRequestIndex !== undefined)
-      .map(({ value: { type, id } }) => ({
-        _id: this._serializer.generateRawId(namespace, type, id),
+      .map(({ value: { type, id, objectNamespace } }) => ({
+        _id: this._serializer.generateRawId(getNamespaceId(objectNamespace), type, id),
         _index: this.getIndexForType(type),
         _source: ['type', 'namespaces'],
       }));
@@ -1276,14 +1298,25 @@ export class SavedObjectsRepository {
           return expectedBulkGetResult;
         }
 
-        const { esRequestIndex, id, type, version, documentToSave } = expectedBulkGetResult.value;
+        const {
+          esRequestIndex,
+          id,
+          type,
+          version,
+          documentToSave,
+          objectNamespace,
+        } = expectedBulkGetResult.value;
+
         let namespaces;
         let versionProperties;
         if (esRequestIndex !== undefined) {
           const indexFound = bulkGetResponse?.statusCode !== 404;
           const actualResult = indexFound ? bulkGetResponse?.body.docs[esRequestIndex] : undefined;
           const docFound = indexFound && actualResult.found === true;
-          if (!docFound || !this.rawDocExistsInNamespace(actualResult, namespace)) {
+          if (
+            !docFound ||
+            !this.rawDocExistsInNamespace(actualResult, getNamespaceId(objectNamespace))
+          ) {
             return {
               tag: 'Left' as 'Left',
               error: {
@@ -1294,12 +1327,13 @@ export class SavedObjectsRepository {
             };
           }
           namespaces = actualResult._source.namespaces ?? [
-            getNamespaceString(actualResult._source.namespace),
+            SavedObjectsUtils.namespaceIdToString(actualResult._source.namespace),
           ];
           versionProperties = getExpectedVersionProperties(version, actualResult);
         } else {
           if (this._registry.isSingleNamespace(type)) {
-            namespaces = [getNamespaceString(namespace)];
+            // if `objectNamespace` is undefined, fall back to `options.namespace`
+            namespaces = [getNamespaceString(objectNamespace)];
           }
           versionProperties = getExpectedVersionProperties(version);
         }
@@ -1315,7 +1349,7 @@ export class SavedObjectsRepository {
         bulkUpdateParams.push(
           {
             update: {
-              _id: this._serializer.generateRawId(namespace, type, id),
+              _id: this._serializer.generateRawId(getNamespaceId(objectNamespace), type, id),
               _index: this.getIndexForType(type),
               ...versionProperties,
             },
@@ -1401,7 +1435,8 @@ export class SavedObjectsRepository {
       throw SavedObjectsErrorHelpers.createUnsupportedTypeError(type);
     }
 
-    const { migrationVersion, namespace, refresh = DEFAULT_REFRESH_SETTING } = options;
+    const { migrationVersion, refresh = DEFAULT_REFRESH_SETTING } = options;
+    const namespace = normalizeNamespace(options.namespace);
 
     const time = this._getCurrentTime();
     let savedObjectNamespace;
@@ -1495,7 +1530,7 @@ export class SavedObjectsRepository {
     const savedObject = this._serializer.rawToSavedObject(raw);
     const { namespace, type } = savedObject;
     if (this._registry.isSingleNamespace(type)) {
-      savedObject.namespaces = [getNamespaceString(namespace)];
+      savedObject.namespaces = [SavedObjectsUtils.namespaceIdToString(namespace)];
     }
     return omit(savedObject, 'namespace') as SavedObject<T>;
   }
@@ -1518,7 +1553,7 @@ export class SavedObjectsRepository {
     }
 
     const namespaces = raw._source.namespaces;
-    return namespaces?.includes(getNamespaceString(namespace)) ?? false;
+    return namespaces?.includes(SavedObjectsUtils.namespaceIdToString(namespace)) ?? false;
   }
 
   /**
@@ -1623,14 +1658,6 @@ function getExpectedVersionProperties(version?: string, document?: SavedObjectsR
   return {};
 }
 
-/**
- * Returns the string representation of a namespace.
- * The default namespace is undefined, and is represented by the string 'default'.
- */
-function getNamespaceString(namespace?: string) {
-  return namespace ?? 'default';
-}
-
 /**
  * Returns a string array of namespaces for a given saved object. If the saved object is undefined, the result is an array that contains the
  * current namespace. Value may be undefined if an existing saved object has no namespaces attribute; this should not happen in normal
@@ -1646,9 +1673,16 @@ function getSavedObjectNamespaces(
   if (document) {
     return document._source?.namespaces;
   }
-  return [getNamespaceString(namespace)];
+  return [SavedObjectsUtils.namespaceIdToString(namespace)];
 }
 
+/**
+ * Ensure that a namespace is always in its namespace ID representation.
+ * This allows `'default'` to be used interchangeably with `undefined`.
+ */
+const normalizeNamespace = (namespace?: string) =>
+  namespace === undefined ? namespace : SavedObjectsUtils.namespaceStringToId(namespace);
+
 /**
  * Extracts the contents of a decorated error to return the attributes for bulk operations.
  */
diff --git a/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts b/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts
index ad1a08187dc32..3ff72a86c2f89 100644
--- a/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts
+++ b/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts
@@ -21,6 +21,7 @@ import { esKuery, KueryNode } from '../../../../../../plugins/data/server';
 
 import { getRootPropertiesObjects, IndexMapping } from '../../../mappings';
 import { ISavedObjectTypeRegistry } from '../../../saved_objects_type_registry';
+import { DEFAULT_NAMESPACE_STRING } from '../utils';
 
 /**
  * Gets the types based on the type. Uses mappings to support
@@ -73,7 +74,7 @@ function getFieldsForTypes(
  */
 function getClauseForType(
   registry: ISavedObjectTypeRegistry,
-  namespaces: string[] = ['default'],
+  namespaces: string[] = [DEFAULT_NAMESPACE_STRING],
   type: string
 ) {
   if (namespaces.length === 0) {
@@ -88,11 +89,11 @@ function getClauseForType(
     };
   } else if (registry.isSingleNamespace(type)) {
     const should: Array<Record<string, any>> = [];
-    const eligibleNamespaces = namespaces.filter((namespace) => namespace !== 'default');
+    const eligibleNamespaces = namespaces.filter((x) => x !== DEFAULT_NAMESPACE_STRING);
     if (eligibleNamespaces.length > 0) {
       should.push({ terms: { namespace: eligibleNamespaces } });
     }
-    if (namespaces.includes('default')) {
+    if (namespaces.includes(DEFAULT_NAMESPACE_STRING)) {
       should.push({ bool: { must_not: [{ exists: { field: 'namespace' } }] } });
     }
     if (should.length === 0) {
@@ -162,9 +163,7 @@ export function getQueryParams({
   // would result in no results being returned, as the wildcard is treated as a literal, and not _actually_ as a wildcard.
   // We had a good discussion around the tradeoffs here: https://github.com/elastic/kibana/pull/67644#discussion_r441055716
   const normalizedNamespaces = namespaces
-    ? Array.from(
-        new Set(namespaces.map((namespace) => (namespace === '*' ? 'default' : namespace)))
-      )
+    ? Array.from(new Set(namespaces.map((x) => (x === '*' ? DEFAULT_NAMESPACE_STRING : x))))
     : undefined;
 
   const bool: any = {
diff --git a/src/core/server/saved_objects/service/lib/utils.test.ts b/src/core/server/saved_objects/service/lib/utils.test.ts
new file mode 100644
index 0000000000000..ea4fa68242bea
--- /dev/null
+++ b/src/core/server/saved_objects/service/lib/utils.test.ts
@@ -0,0 +1,57 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SavedObjectsUtils } from './utils';
+
+describe('SavedObjectsUtils', () => {
+  const { namespaceIdToString, namespaceStringToId } = SavedObjectsUtils;
+
+  describe('#namespaceIdToString', () => {
+    it('converts `undefined` to default namespace string', () => {
+      expect(namespaceIdToString(undefined)).toEqual('default');
+    });
+
+    it('leaves other namespace IDs as-is', () => {
+      expect(namespaceIdToString('foo')).toEqual('foo');
+    });
+
+    it('throws an error when a namespace ID is an empty string', () => {
+      expect(() => namespaceIdToString('')).toThrowError('namespace cannot be an empty string');
+    });
+  });
+
+  describe('#namespaceStringToId', () => {
+    it('converts default namespace string to `undefined`', () => {
+      expect(namespaceStringToId('default')).toBeUndefined();
+    });
+
+    it('leaves other namespace strings as-is', () => {
+      expect(namespaceStringToId('foo')).toEqual('foo');
+    });
+
+    it('throws an error when a namespace string is falsy', () => {
+      const test = (arg: any) =>
+        expect(() => namespaceStringToId(arg)).toThrowError('namespace must be a non-empty string');
+
+      test(undefined);
+      test(null);
+      test('');
+    });
+  });
+});
diff --git a/src/core/server/saved_objects/service/lib/utils.ts b/src/core/server/saved_objects/service/lib/utils.ts
new file mode 100644
index 0000000000000..6101ad57cc401
--- /dev/null
+++ b/src/core/server/saved_objects/service/lib/utils.ts
@@ -0,0 +1,53 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export const DEFAULT_NAMESPACE_STRING = 'default';
+
+/**
+ * @public
+ */
+export class SavedObjectsUtils {
+  /**
+   * Converts a given saved object namespace ID to its string representation. All namespace IDs have an identical string representation, with
+   * the exception of the `undefined` namespace ID (which has a namespace string of `'default'`).
+   *
+   * @param namespace The namespace ID, which must be either a non-empty string or `undefined`.
+   */
+  public static namespaceIdToString = (namespace?: string) => {
+    if (namespace === '') {
+      throw new TypeError('namespace cannot be an empty string');
+    }
+
+    return namespace ?? DEFAULT_NAMESPACE_STRING;
+  };
+
+  /**
+   * Converts a given saved object namespace string to its ID representation. All namespace strings have an identical ID representation, with
+   * the exception of the `'default'` namespace string (which has a namespace ID of `undefined`).
+   *
+   * @param namespace The namespace string, which must be non-empty.
+   */
+  public static namespaceStringToId = (namespace: string) => {
+    if (!namespace) {
+      throw new TypeError('namespace must be a non-empty string');
+    }
+
+    return namespace !== DEFAULT_NAMESPACE_STRING ? namespace : undefined;
+  };
+}
diff --git a/src/core/server/saved_objects/service/saved_objects_client.ts b/src/core/server/saved_objects/service/saved_objects_client.ts
index 347c760f841bc..8c96116de49cb 100644
--- a/src/core/server/saved_objects/service/saved_objects_client.ts
+++ b/src/core/server/saved_objects/service/saved_objects_client.ts
@@ -80,6 +80,13 @@ export interface SavedObjectsBulkUpdateObject<T = unknown>
   type: string;
   /** {@inheritdoc SavedObjectAttributes} */
   attributes: Partial<T>;
+  /**
+   * Optional namespace string to use when searching for this object. If this is defined, it will supersede the namespace ID that is in
+   * {@link SavedObjectsBulkUpdateOptions}.
+   *
+   * Note: the default namespace's string representation is `'default'`, and its ID representation is `undefined`.
+   **/
+  namespace?: string;
 }
 
 /**
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index aef1bda9ccf4e..ec457704e89c7 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -2047,6 +2047,7 @@ export interface SavedObjectsBulkResponse<T = unknown> {
 export interface SavedObjectsBulkUpdateObject<T = unknown> extends Pick<SavedObjectsUpdateOptions, 'version' | 'references'> {
     attributes: Partial<T>;
     id: string;
+    namespace?: string;
     type: string;
 }
 
@@ -2630,6 +2631,12 @@ export interface SavedObjectsUpdateResponse<T = unknown> extends Omit<SavedObjec
     references: SavedObjectReference[] | undefined;
 }
 
+// @public (undocumented)
+export class SavedObjectsUtils {
+    static namespaceIdToString: (namespace?: string | undefined) => string;
+    static namespaceStringToId: (namespace: string) => string | undefined;
+}
+
 // @public
 export class SavedObjectTypeRegistry {
     getAllTypes(): SavedObjectsType[];
diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker b/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker
index d7f137e965327..b02b7cc16ec4a 100755
--- a/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker
+++ b/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker
@@ -18,6 +18,8 @@ kibana_vars=(
     console.enabled
     console.proxyConfig
     console.proxyFilter
+    ops.cGroupOverrides.cpuPath
+    ops.cGroupOverrides.cpuAcctPath
     cpu.cgroup.path.override
     cpuacct.cgroup.path.override
     csp.rules
@@ -279,4 +281,4 @@ umask 0002
 # Therefore, we set this value here so that cgroup statistics are
 # available for the container this process will run in.
 
-exec /usr/share/kibana/bin/kibana --cpu.cgroup.path.override=/ --cpuacct.cgroup.path.override=/ ${longopts} "$@"
+exec /usr/share/kibana/bin/kibana --ops.cGroupOverrides.cpuPath=/ --ops.cGroupOverrides.cpuAcctPath=/ ${longopts} "$@"
diff --git a/src/legacy/server/config/schema.js b/src/legacy/server/config/schema.js
index dd65e45659ffc..ce7a500a00dc8 100644
--- a/src/legacy/server/config/schema.js
+++ b/src/legacy/server/config/schema.js
@@ -49,22 +49,6 @@ export default () =>
 
     csp: HANDLED_IN_NEW_PLATFORM,
 
-    cpu: Joi.object({
-      cgroup: Joi.object({
-        path: Joi.object({
-          override: Joi.string().default(),
-        }),
-      }),
-    }),
-
-    cpuacct: Joi.object({
-      cgroup: Joi.object({
-        path: Joi.object({
-          override: Joi.string().default(),
-        }),
-      }),
-    }),
-
     server: Joi.object({
       name: Joi.string().default(os.hostname()),
       // keep them for BWC, remove when not used in Legacy.
@@ -144,6 +128,10 @@ export default () =>
 
     ops: Joi.object({
       interval: Joi.number().default(5000),
+      cGroupOverrides: Joi.object().keys({
+        cpuPath: Joi.string().default(),
+        cpuAcctPath: Joi.string().default(),
+      }),
     }).default(),
 
     plugins: Joi.object({
diff --git a/src/legacy/server/status/lib/metrics.js b/src/legacy/server/status/lib/metrics.js
index 2631b245e72ab..478bf0829b1aa 100644
--- a/src/legacy/server/status/lib/metrics.js
+++ b/src/legacy/server/status/lib/metrics.js
@@ -116,8 +116,8 @@ export class Metrics {
   async captureCGroups() {
     try {
       const cgroup = await cGroupStats({
-        cpuPath: this.config.get('cpu.cgroup.path.override'),
-        cpuAcctPath: this.config.get('cpuacct.cgroup.path.override'),
+        cpuPath: this.config.get('ops.cGroupOverrides.cpuPath'),
+        cpuAcctPath: this.config.get('ops.cGroupOverrides.cpuAcctPath'),
       });
 
       if (isObject(cgroup)) {
diff --git a/src/plugins/data/common/search/aggs/types.ts b/src/plugins/data/common/search/aggs/types.ts
index dabd653463d4f..aec3dcc9d068c 100644
--- a/src/plugins/data/common/search/aggs/types.ts
+++ b/src/plugins/data/common/search/aggs/types.ts
@@ -93,7 +93,7 @@ export interface AggsCommonStart {
  * is only used internally. The difference is that AggsStart includes the
  * typings for the registry with initialized agg types.
  *
- * @internal
+ * @public
  */
 export type AggsStart = Assign<AggsCommonStart, { types: AggTypesRegistryStart }>;
 
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 553ee6bde5f2d..5038af9409316 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -172,7 +172,7 @@ import {
 } from '../common/field_formats';
 
 import { DateNanosFormat, DateFormat } from './field_formats';
-export { baseFormattersPublic } from './field_formats';
+export { baseFormattersPublic, FieldFormatsStart } from './field_formats';
 
 // Field formats helpers namespace:
 export const fieldFormats = {
@@ -276,6 +276,7 @@ export {
   QuerySuggestionGetFnArgs,
   QuerySuggestionBasic,
   QuerySuggestionField,
+  AutocompleteStart,
 } from './autocomplete';
 
 /*
@@ -313,6 +314,7 @@ import {
 
 export {
   // aggs
+  AggConfigSerialized,
   AggGroupLabels,
   AggGroupName,
   AggGroupNames,
@@ -337,6 +339,8 @@ export {
   TabbedTable,
 } from '../common';
 
+export type { AggConfigs, AggConfig } from '../common';
+
 export {
   // search
   ES_SEARCH_STRATEGY,
@@ -350,6 +354,9 @@ export {
   IKibanaSearchResponse,
   injectSearchSourceReferences,
   ISearch,
+  ISearchSetup,
+  ISearchStart,
+  ISearchStartSearchSource,
   ISearchGeneric,
   ISearchSource,
   parseSearchSourceJSON,
@@ -365,6 +372,8 @@ export {
   EsRawResponseExpressionTypeDefinition,
 } from './search';
 
+export type { SearchSource } from './search';
+
 export { ISearchOptions } from '../common';
 
 // Search namespace
@@ -430,8 +439,11 @@ export {
   TimefilterContract,
   TimeHistoryContract,
   QueryStateChange,
+  QueryStart,
 } from './query';
 
+export { AggsStart } from './search/aggs';
+
 export {
   getTime,
   // kbn field types
@@ -455,7 +467,13 @@ export function plugin(initializerContext: PluginInitializerContext<ConfigSchema
   return new DataPublicPlugin(initializerContext);
 }
 
-export { DataPublicPluginSetup, DataPublicPluginStart, IDataPluginServices } from './types';
+export {
+  DataPublicPluginSetup,
+  DataPublicPluginStart,
+  IDataPluginServices,
+  DataPublicPluginStartUi,
+  DataPublicPluginStartActions,
+} from './types';
 
 // Export plugin after all other imports
 export { DataPublicPlugin as Plugin };
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index 27d4ea49f9eb1..fa5d3cd85f430 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -65,7 +65,6 @@ import { Search } from '@elastic/elasticsearch/api/requestParams';
 import { SearchResponse } from 'elasticsearch';
 import { SerializedFieldFormat as SerializedFieldFormat_2 } from 'src/plugins/expressions/common';
 import { Subscription } from 'rxjs';
-import { Toast } from 'kibana/public';
 import { ToastInputFields } from 'src/core/public/notifications';
 import { ToastsSetup } from 'kibana/public';
 import { TransportRequestOptions } from '@elastic/elasticsearch/lib/Transport';
@@ -84,7 +83,90 @@ import { UserProvidedValues } from 'src/core/server/types';
 // @public (undocumented)
 export const ACTION_GLOBAL_APPLY_FILTER = "ACTION_GLOBAL_APPLY_FILTER";
 
-// Warning: (ae-forgotten-export) The symbol "AggConfigSerialized" needs to be exported by the entry point index.d.ts
+// Warning: (ae-missing-release-tag) "AggConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export class AggConfig {
+    // Warning: (ae-incompatible-release-tags) The symbol "__constructor" is marked as @public, but its signature references "IAggConfigs" which is marked as @internal
+    constructor(aggConfigs: IAggConfigs, opts: AggConfigOptions);
+    // Warning: (ae-incompatible-release-tags) The symbol "aggConfigs" is marked as @public, but its signature references "IAggConfigs" which is marked as @internal
+    //
+    // (undocumented)
+    aggConfigs: IAggConfigs;
+    // (undocumented)
+    brandNew?: boolean;
+    // (undocumented)
+    createFilter(key: string, params?: {}): any;
+    // (undocumented)
+    enabled: boolean;
+    static ensureIds(list: any[]): any[];
+    // (undocumented)
+    fieldIsTimeField(): boolean | "" | undefined;
+    // (undocumented)
+    fieldName(): any;
+    // (undocumented)
+    getAggParams(): import("./param_types/agg").AggParamType<AggConfig>[];
+    // (undocumented)
+    getField(): any;
+    // (undocumented)
+    getFieldDisplayName(): any;
+    // (undocumented)
+    getIndexPattern(): import("../../../public").IndexPattern;
+    // (undocumented)
+    getKey(bucket: any, key?: string): any;
+    // (undocumented)
+    getParam(key: string): any;
+    // (undocumented)
+    getRequestAggs(): AggConfig[];
+    // (undocumented)
+    getResponseAggs(): AggConfig[];
+    // (undocumented)
+    getTimeRange(): import("../../../public").TimeRange | undefined;
+    // (undocumented)
+    getValue(bucket: any): any;
+    // (undocumented)
+    id: string;
+    // (undocumented)
+    isFilterable(): boolean;
+    // (undocumented)
+    makeLabel(percentageMode?: boolean): any;
+    static nextId(list: IAggConfig[]): number;
+    onSearchRequestStart(searchSource: ISearchSource_2, options?: ISearchOptions): Promise<void> | Promise<any[]>;
+    // (undocumented)
+    params: any;
+    // Warning: (ae-incompatible-release-tags) The symbol "parent" is marked as @public, but its signature references "IAggConfigs" which is marked as @internal
+    //
+    // (undocumented)
+    parent?: IAggConfigs;
+    // (undocumented)
+    schema?: string;
+    // Warning: (ae-incompatible-release-tags) The symbol "serialize" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
+    //
+    // (undocumented)
+    serialize(): AggConfigSerialized;
+    setParams(from: any): void;
+    // (undocumented)
+    setType(type: IAggType): void;
+    // Warning: (ae-incompatible-release-tags) The symbol "toDsl" is marked as @public, but its signature references "IAggConfigs" which is marked as @internal
+    toDsl(aggConfigs?: IAggConfigs): any;
+    // (undocumented)
+    toExpressionAst(): ExpressionAstFunction | undefined;
+    // Warning: (ae-incompatible-release-tags) The symbol "toJSON" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
+    //
+    // @deprecated (undocumented)
+    toJSON(): AggConfigSerialized;
+    // Warning: (ae-forgotten-export) The symbol "SerializableState" needs to be exported by the entry point index.d.ts
+    toSerializedFieldFormat(): {} | Ensure<SerializedFieldFormat_2<SerializableState>, SerializableState>;
+    // (undocumented)
+    get type(): IAggType;
+    set type(type: IAggType);
+    // Warning: (ae-incompatible-release-tags) The symbol "write" is marked as @public, but its signature references "IAggConfigs" which is marked as @internal
+    //
+    // (undocumented)
+    write(aggs?: IAggConfigs): Record<string, any>;
+}
+
+// Warning: (ae-incompatible-release-tags) The symbol "AggConfigOptions" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
 // Warning: (ae-missing-release-tag) "AggConfigOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -92,6 +174,76 @@ export type AggConfigOptions = Assign<AggConfigSerialized, {
     type: IAggType;
 }>;
 
+// Warning: (ae-missing-release-tag) "AggConfigs" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export class AggConfigs {
+    // Warning: (ae-forgotten-export) The symbol "AggConfigsOptions" needs to be exported by the entry point index.d.ts
+    constructor(indexPattern: IndexPattern, configStates: Pick<Pick<{
+        type: string;
+        enabled?: boolean | undefined;
+        id?: string | undefined;
+        params?: {} | import("./agg_config").SerializableState | undefined;
+        schema?: string | undefined;
+    }, "enabled" | "schema" | "id" | "params"> & Pick<{
+        type: string | IAggType;
+    }, "type"> & Pick<{
+        type: string | IAggType;
+    }, never>, "enabled" | "type" | "schema" | "id" | "params">[] | undefined, opts: AggConfigsOptions);
+    // (undocumented)
+    aggs: IAggConfig[];
+    // (undocumented)
+    byId(id: string): AggConfig | undefined;
+    // (undocumented)
+    byIndex(index: number): AggConfig;
+    // (undocumented)
+    byName(name: string): AggConfig[];
+    // (undocumented)
+    bySchemaName(schema: string): AggConfig[];
+    // (undocumented)
+    byType(type: string): AggConfig[];
+    // (undocumented)
+    byTypeName(type: string): AggConfig[];
+    // (undocumented)
+    clone({ enabledOnly }?: {
+        enabledOnly?: boolean | undefined;
+    }): AggConfigs;
+    // Warning: (ae-forgotten-export) The symbol "CreateAggConfigParams" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    createAggConfig: <T extends AggConfig = AggConfig>(params: CreateAggConfigParams, { addToAggConfigs }?: {
+        addToAggConfigs?: boolean | undefined;
+    }) => T;
+    // (undocumented)
+    getAll(): AggConfig[];
+    // (undocumented)
+    getRequestAggById(id: string): AggConfig | undefined;
+    // (undocumented)
+    getRequestAggs(): AggConfig[];
+    getResponseAggById(id: string): AggConfig | undefined;
+    getResponseAggs(): AggConfig[];
+    // (undocumented)
+    indexPattern: IndexPattern;
+    jsonDataEquals(aggConfigs: AggConfig[]): boolean;
+    // (undocumented)
+    onSearchRequestStart(searchSource: ISearchSource_2, options?: ISearchOptions_2): Promise<[unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown, unknown]>;
+    // (undocumented)
+    setTimeRange(timeRange: TimeRange): void;
+    // (undocumented)
+    timeRange?: TimeRange;
+    // (undocumented)
+    toDsl(hierarchical?: boolean): Record<string, any>;
+    }
+
+// @internal (undocumented)
+export type AggConfigSerialized = Ensure<{
+    type: string;
+    enabled?: boolean;
+    id?: string;
+    params?: {} | SerializableState;
+    schema?: string;
+}, SerializableState>;
+
 // Warning: (ae-missing-release-tag) "AggGroupLabels" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -127,8 +279,6 @@ export type AggParam = BaseParamType;
 export interface AggParamOption {
     // (undocumented)
     display: string;
-    // Warning: (ae-forgotten-export) The symbol "AggConfig" needs to be exported by the entry point index.d.ts
-    //
     // (undocumented)
     enabled?(agg: AggConfig): boolean;
     // (undocumented)
@@ -142,10 +292,19 @@ export class AggParamType<TAggConfig extends IAggConfig = IAggConfig> extends Ba
     constructor(config: Record<string, any>);
     // (undocumented)
     allowedAggs: string[];
+    // Warning: (ae-incompatible-release-tags) The symbol "makeAgg" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
+    //
     // (undocumented)
     makeAgg: (agg: TAggConfig, state?: AggConfigSerialized) => TAggConfig;
 }
 
+// Warning: (ae-forgotten-export) The symbol "AggsCommonStart" needs to be exported by the entry point index.d.ts
+//
+// @public
+export type AggsStart = Assign<AggsCommonStart, {
+    types: AggTypesRegistryStart;
+}>;
+
 // Warning: (ae-missing-release-tag) "ApplyGlobalFilterActionContext" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -160,6 +319,11 @@ export interface ApplyGlobalFilterActionContext {
     timeFieldName?: string;
 }
 
+// Warning: (ae-forgotten-export) The symbol "AutocompleteService" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type AutocompleteStart = ReturnType<AutocompleteService['start']>;
+
 // Warning: (ae-forgotten-export) The symbol "DateFormat" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "DateNanosFormat" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "baseFormattersPublic" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -200,7 +364,6 @@ export enum BUCKET_TYPES {
 // @public
 export const castEsToKbnFieldTypeName: (esType: ES_FIELD_TYPES | string) => KBN_FIELD_TYPES;
 
-// Warning: (ae-forgotten-export) The symbol "QueryStart" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "QuerySetup" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "BaseStateContainer" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "connectToQueryState" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -227,7 +390,7 @@ export type CustomFilter = Filter & {
 
 // Warning: (ae-missing-release-tag) "DataPublicPluginSetup" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
-// @public (undocumented)
+// @public
 export interface DataPublicPluginSetup {
     // Warning: (ae-forgotten-export) The symbol "DataPublicPluginEnhancements" needs to be exported by the entry point index.d.ts
     //
@@ -243,42 +406,47 @@ export interface DataPublicPluginSetup {
     fieldFormats: FieldFormatsSetup;
     // (undocumented)
     query: QuerySetup;
-    // Warning: (ae-forgotten-export) The symbol "ISearchSetup" needs to be exported by the entry point index.d.ts
-    //
     // (undocumented)
     search: ISearchSetup;
 }
 
 // Warning: (ae-missing-release-tag) "DataPublicPluginStart" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
-// @public (undocumented)
+// @public
 export interface DataPublicPluginStart {
-    // (undocumented)
-    actions: {
-        createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;
-        createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;
-    };
-    // Warning: (ae-forgotten-export) The symbol "AutocompleteStart" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
+    actions: DataPublicPluginStartActions;
     autocomplete: AutocompleteStart;
-    // Warning: (ae-forgotten-export) The symbol "FieldFormatsStart" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
     fieldFormats: FieldFormatsStart;
-    // (undocumented)
     indexPatterns: IndexPatternsContract;
-    // (undocumented)
     query: QueryStart;
-    // Warning: (ae-forgotten-export) The symbol "ISearchStart" needs to be exported by the entry point index.d.ts
+    search: ISearchStart;
+    ui: DataPublicPluginStartUi;
+}
+
+// Warning: (ae-missing-release-tag) "DataPublicPluginStartActions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public
+export interface DataPublicPluginStartActions {
+    // Warning: (ae-forgotten-export) The symbol "createFiltersFromRangeSelectAction" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
-    search: ISearchStart;
+    createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;
+    // Warning: (ae-forgotten-export) The symbol "createFiltersFromValueClickAction" needs to be exported by the entry point index.d.ts
+    //
     // (undocumented)
-    ui: {
-        IndexPatternSelect: React.ComponentType<IndexPatternSelectProps>;
-        SearchBar: React.ComponentType<StatefulSearchBarProps>;
-    };
+    createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;
+}
+
+// Warning: (ae-missing-release-tag) "DataPublicPluginStartUi" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public
+export interface DataPublicPluginStartUi {
+    // Warning: (ae-forgotten-export) The symbol "IndexPatternSelectProps" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    IndexPatternSelect: React.ComponentType<IndexPatternSelectProps>;
+    // (undocumented)
+    SearchBar: React.ComponentType<StatefulSearchBarProps>;
 }
 
 // @public (undocumented)
@@ -595,6 +763,11 @@ export type FieldFormatsContentType = 'html' | 'text';
 // @public (undocumented)
 export type FieldFormatsGetConfigFn = GetConfigFn;
 
+// @public (undocumented)
+export type FieldFormatsStart = Omit<FieldFormatsRegistry, 'init' & 'register'> & {
+    deserialize: FormatFactory;
+};
+
 // Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "fieldList" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -709,8 +882,6 @@ export function getTime(indexPattern: IIndexPattern | undefined, timeRange: Time
 // @public
 export type IAggConfig = AggConfig;
 
-// Warning: (ae-forgotten-export) The symbol "AggConfigs" needs to be exported by the entry point index.d.ts
-//
 // @internal
 export type IAggConfigs = AggConfigs;
 
@@ -1231,11 +1402,40 @@ export interface ISearchOptions {
     strategy?: string;
 }
 
-// Warning: (ae-forgotten-export) The symbol "SearchSource" needs to be exported by the entry point index.d.ts
+// Warning: (ae-missing-release-tag) "ISearchSetup" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
-// @public (undocumented)
+// @public
+export interface ISearchSetup {
+    // Warning: (ae-forgotten-export) The symbol "SearchEnhancements" needs to be exported by the entry point index.d.ts
+    //
+    // @internal (undocumented)
+    __enhance: (enhancements: SearchEnhancements) => void;
+    // Warning: (ae-forgotten-export) The symbol "AggsSetup" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    aggs: AggsSetup;
+    // Warning: (ae-forgotten-export) The symbol "SearchUsageCollector" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    usageCollector?: SearchUsageCollector;
+}
+
+// @public
 export type ISearchSource = Pick<SearchSource, keyof SearchSource>;
 
+// @public
+export interface ISearchStart {
+    aggs: AggsStart;
+    search: ISearchGeneric;
+    searchSource: ISearchStartSearchSource;
+}
+
+// @public
+export interface ISearchStartSearchSource {
+    create: (fields?: SearchSourceFields) => Promise<ISearchSource>;
+    createEmpty: () => ISearchSource;
+}
+
 // Warning: (ae-missing-release-tag) "isFilter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1450,6 +1650,12 @@ export interface Query {
     };
 }
 
+// Warning: (ae-forgotten-export) The symbol "QueryService" needs to be exported by the entry point index.d.ts
+// Warning: (ae-missing-release-tag) "QueryStart" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export type QueryStart = ReturnType<QueryService['start']>;
+
 // Warning: (ae-missing-release-tag) "QueryState" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
@@ -1479,7 +1685,7 @@ export interface QueryStateChange extends QueryStateChangePartial {
 // Warning: (ae-missing-release-tag) "QueryStringInput" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export const QueryStringInput: React.FC<Pick<Props_3, "query" | "prepend" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>;
+export const QueryStringInput: React.FC<Pick<Props_3, "query" | "prepend" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "isInvalid" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>;
 
 // @public (undocumented)
 export type QuerySuggestion = QuerySuggestionBasic | QuerySuggestionField;
@@ -1732,11 +1938,6 @@ export class SearchInterceptor {
     protected application: CoreStart['application'];
     // (undocumented)
     protected readonly deps: SearchInterceptorDeps;
-    getPendingCount$(): Observable<number>;
-    // @internal (undocumented)
-    protected hideToast: () => void;
-    // @internal
-    protected longRunningToast?: Toast;
     // @internal
     protected pendingCount$: BehaviorSubject<number>;
     // @internal (undocumented)
@@ -1750,8 +1951,8 @@ export class SearchInterceptor {
         combinedSignal: AbortSignal;
         cleanup: () => void;
     };
-    // @internal (undocumented)
-    protected showToast: () => void;
+    // (undocumented)
+    protected showTimeoutError: ((e: Error) => void) & import("lodash").Cancelable;
     // @internal
     protected timeoutSubscriptions: Subscription;
 }
@@ -1768,8 +1969,6 @@ export interface SearchInterceptorDeps {
     toasts: ToastsSetup;
     // (undocumented)
     uiSettings: CoreSetup_2['uiSettings'];
-    // Warning: (ae-forgotten-export) The symbol "SearchUsageCollector" needs to be exported by the entry point index.d.ts
-    //
     // (undocumented)
     usageCollector?: SearchUsageCollector;
 }
@@ -1777,9 +1976,59 @@ export interface SearchInterceptorDeps {
 // @internal
 export type SearchRequest = Record<string, any>;
 
+// @public (undocumented)
+export class SearchSource {
+    // Warning: (ae-forgotten-export) The symbol "SearchSourceDependencies" needs to be exported by the entry point index.d.ts
+    constructor(fields: SearchSourceFields | undefined, dependencies: SearchSourceDependencies);
+    // @deprecated (undocumented)
+    create(): SearchSource;
+    createChild(options?: {}): SearchSource;
+    createCopy(): SearchSource;
+    destroy(): void;
+    fetch(options?: ISearchOptions): Promise<import("elasticsearch").SearchResponse<any>>;
+    getField<K extends keyof SearchSourceFields>(field: K, recurse?: boolean): SearchSourceFields[K];
+    getFields(): {
+        type?: string | undefined;
+        query?: import("../..").Query | undefined;
+        filter?: Filter | Filter[] | (() => Filter | Filter[] | undefined) | undefined;
+        sort?: Record<string, import("./types").SortDirection | import("./types").SortDirectionNumeric> | Record<string, import("./types").SortDirection | import("./types").SortDirectionNumeric>[] | undefined;
+        highlight?: any;
+        highlightAll?: boolean | undefined;
+        aggs?: any;
+        from?: number | undefined;
+        size?: number | undefined;
+        source?: string | boolean | string[] | undefined;
+        version?: boolean | undefined;
+        fields?: string | boolean | string[] | undefined;
+        index?: import("../..").IndexPattern | undefined;
+        searchAfter?: import("./types").EsQuerySearchAfter | undefined;
+        timeout?: string | undefined;
+        terminate_after?: number | undefined;
+    };
+    getId(): string;
+    getOwnField<K extends keyof SearchSourceFields>(field: K): SearchSourceFields[K];
+    getParent(): SearchSource | undefined;
+    getSearchRequestBody(): Promise<any>;
+    getSerializedFields(): SearchSourceFields;
+    // Warning: (ae-incompatible-release-tags) The symbol "history" is marked as @public, but its signature references "SearchRequest" which is marked as @internal
+    //
+    // (undocumented)
+    history: SearchRequest[];
+    onRequestStart(handler: (searchSource: SearchSource, options?: ISearchOptions) => Promise<unknown>): void;
+    serialize(): {
+        searchSourceJSON: string;
+        references: import("../../../../../core/public").SavedObjectReference[];
+    };
+    setField<K extends keyof SearchSourceFields>(field: K, value: SearchSourceFields[K]): this;
+    setFields(newFields: SearchSourceFields): this;
+    // Warning: (ae-forgotten-export) The symbol "SearchSourceOptions" needs to be exported by the entry point index.d.ts
+    setParent(parent?: ISearchSource, options?: SearchSourceOptions): this;
+    setPreferredSearchStrategyId(searchStrategyId: string): void;
+}
+
 // Warning: (ae-missing-release-tag) "SearchSourceFields" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
-// @public (undocumented)
+// @public
 export interface SearchSourceFields {
     // (undocumented)
     aggs?: any;
@@ -1793,6 +2042,8 @@ export interface SearchSourceFields {
     highlight?: any;
     // (undocumented)
     highlightAll?: boolean;
+    // Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "IndexPatternService"
+    //
     // (undocumented)
     index?: IndexPattern;
     // (undocumented)
@@ -1944,6 +2195,8 @@ export const UI_SETTINGS: {
 // src/plugins/data/common/es_query/filters/match_all_filter.ts:28:3 - (ae-forgotten-export) The symbol "MatchAllFilterMeta" needs to be exported by the entry point index.d.ts
 // src/plugins/data/common/es_query/filters/phrase_filter.ts:33:3 - (ae-forgotten-export) The symbol "PhraseFilterMeta" needs to be exported by the entry point index.d.ts
 // src/plugins/data/common/es_query/filters/phrases_filter.ts:31:3 - (ae-forgotten-export) The symbol "PhrasesFilterMeta" needs to be exported by the entry point index.d.ts
+// src/plugins/data/common/search/aggs/types.ts:98:51 - (ae-forgotten-export) The symbol "AggTypesRegistryStart" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/field_formats/field_formats_service.ts:67:3 - (ae-forgotten-export) The symbol "FormatFactory" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:66:23 - (ae-forgotten-export) The symbol "FilterLabel" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:66:23 - (ae-forgotten-export) The symbol "FILTERS" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:66:23 - (ae-forgotten-export) The symbol "getDisplayValueFromFilter" needs to be exported by the entry point index.d.ts
@@ -1976,25 +2229,22 @@ export const UI_SETTINGS: {
 // src/plugins/data/public/index.ts:234:27 - (ae-forgotten-export) The symbol "getFromSavedObject" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:234:27 - (ae-forgotten-export) The symbol "flattenHitWrapper" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:234:27 - (ae-forgotten-export) The symbol "formatHitProvider" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:371:20 - (ae-forgotten-export) The symbol "getRequestInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:371:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:371:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:371:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:373:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:374:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:383:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:384:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:385:1 - (ae-forgotten-export) The symbol "Ipv4Address" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:386:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:390:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:391:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:394:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:395:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:398:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "getRequestInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:382:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:383:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:392:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:393:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:394:1 - (ae-forgotten-export) The symbol "Ipv4Address" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:395:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:399:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:400:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:403:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:404:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:407:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/query/state_sync/connect_to_query_state.ts:45:5 - (ae-forgotten-export) The symbol "FilterStateStore" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/types.ts:62:5 - (ae-forgotten-export) The symbol "createFiltersFromValueClickAction" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/types.ts:63:5 - (ae-forgotten-export) The symbol "createFiltersFromRangeSelectAction" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/types.ts:71:5 - (ae-forgotten-export) The symbol "IndexPatternSelectProps" needs to be exported by the entry point index.d.ts
 
 // (No @packageDocumentation comment for this package)
 
diff --git a/src/plugins/data/public/search/README.md b/src/plugins/data/public/search/README.md
index 33e6d9ab0bd1a..0a123ffa3f1e9 100644
--- a/src/plugins/data/public/search/README.md
+++ b/src/plugins/data/public/search/README.md
@@ -1,13 +1,23 @@
 # search
 
-The `search` plugin provides the ability to register search strategies that take in a request
-object, and return a response object, of a given shape.
+The `search` service provides you with APIs to query Elasticsearch.
 
-Both client side search strategies can be registered, as well as server side search strategies.
+The services are split into two parts: (1) low-level API; and (2) high-level API.
 
-The `search` plugin includes two one concrete client side implementations - 
- `SYNC_SEARCH_STRATEGY` and `ES_SEARCH_STRATEGY` which uses `SYNC_SEARCH_STRATEGY`.  There is also one
- default server side search strategy, `ES_SEARCH_STRATEGY`.
+## Low-level API
 
- Includes the `esSearch` plugin in order to search for data from Elasticsearch using Elasticsearch
-DSL.
+With low level API you work directly with elasticsearch DSL
+
+```typescript
+const results = await data.search.search(request, params);
+```
+
+## High-level API
+
+Using high-level API you work with Kibana abstractions around Elasticsearch DSL: filters, queries, and aggregations. Provided by the *Search Source* service.
+
+```typescript
+const search = data.search.searchSource.createEmpty();
+search.setField('query', data.query.queryString);
+const results = await search.fetch();
+```
diff --git a/src/plugins/data/public/search/collectors/create_usage_collector.test.ts b/src/plugins/data/public/search/collectors/create_usage_collector.test.ts
index 315d4678cabf1..9cadb1e796ad6 100644
--- a/src/plugins/data/public/search/collectors/create_usage_collector.test.ts
+++ b/src/plugins/data/public/search/collectors/create_usage_collector.test.ts
@@ -63,31 +63,4 @@ describe('Search Usage Collector', () => {
       SEARCH_EVENT_TYPE.QUERIES_CANCELLED
     );
   });
-
-  test('tracks long popups', async () => {
-    await usageCollector.trackLongQueryPopupShown();
-    expect(mockUsageCollectionSetup.reportUiStats).toHaveBeenCalled();
-    expect(mockUsageCollectionSetup.reportUiStats.mock.calls[0][1]).toBe(METRIC_TYPE.LOADED);
-    expect(mockUsageCollectionSetup.reportUiStats.mock.calls[0][2]).toBe(
-      SEARCH_EVENT_TYPE.LONG_QUERY_POPUP_SHOWN
-    );
-  });
-
-  test('tracks long popups dismissed', async () => {
-    await usageCollector.trackLongQueryDialogDismissed();
-    expect(mockUsageCollectionSetup.reportUiStats).toHaveBeenCalled();
-    expect(mockUsageCollectionSetup.reportUiStats.mock.calls[0][1]).toBe(METRIC_TYPE.CLICK);
-    expect(mockUsageCollectionSetup.reportUiStats.mock.calls[0][2]).toBe(
-      SEARCH_EVENT_TYPE.LONG_QUERY_DIALOG_DISMISSED
-    );
-  });
-
-  test('tracks run query beyond timeout', async () => {
-    await usageCollector.trackLongQueryRunBeyondTimeout();
-    expect(mockUsageCollectionSetup.reportUiStats).toHaveBeenCalled();
-    expect(mockUsageCollectionSetup.reportUiStats.mock.calls[0][1]).toBe(METRIC_TYPE.CLICK);
-    expect(mockUsageCollectionSetup.reportUiStats.mock.calls[0][2]).toBe(
-      SEARCH_EVENT_TYPE.LONG_QUERY_RUN_BEYOND_TIMEOUT
-    );
-  });
 });
diff --git a/src/plugins/data/public/search/collectors/create_usage_collector.ts b/src/plugins/data/public/search/collectors/create_usage_collector.ts
index 321b2c5b99049..187ed90652bb2 100644
--- a/src/plugins/data/public/search/collectors/create_usage_collector.ts
+++ b/src/plugins/data/public/search/collectors/create_usage_collector.ts
@@ -48,29 +48,5 @@ export const createUsageCollector = (
         SEARCH_EVENT_TYPE.QUERIES_CANCELLED
       );
     },
-    trackLongQueryPopupShown: async () => {
-      const currentApp = await getCurrentApp();
-      return usageCollection?.reportUiStats(
-        currentApp!,
-        METRIC_TYPE.LOADED,
-        SEARCH_EVENT_TYPE.LONG_QUERY_POPUP_SHOWN
-      );
-    },
-    trackLongQueryDialogDismissed: async () => {
-      const currentApp = await getCurrentApp();
-      return usageCollection?.reportUiStats(
-        currentApp!,
-        METRIC_TYPE.CLICK,
-        SEARCH_EVENT_TYPE.LONG_QUERY_DIALOG_DISMISSED
-      );
-    },
-    trackLongQueryRunBeyondTimeout: async () => {
-      const currentApp = await getCurrentApp();
-      return usageCollection?.reportUiStats(
-        currentApp!,
-        METRIC_TYPE.CLICK,
-        SEARCH_EVENT_TYPE.LONG_QUERY_RUN_BEYOND_TIMEOUT
-      );
-    },
   };
 };
diff --git a/src/plugins/data/public/search/collectors/types.ts b/src/plugins/data/public/search/collectors/types.ts
index 3e98f901eb0c3..bb7fa1e6ae4a2 100644
--- a/src/plugins/data/public/search/collectors/types.ts
+++ b/src/plugins/data/public/search/collectors/types.ts
@@ -20,15 +20,9 @@
 export enum SEARCH_EVENT_TYPE {
   QUERY_TIMED_OUT = 'queryTimedOut',
   QUERIES_CANCELLED = 'queriesCancelled',
-  LONG_QUERY_POPUP_SHOWN = 'longQueryPopupShown',
-  LONG_QUERY_DIALOG_DISMISSED = 'longQueryDialogDismissed',
-  LONG_QUERY_RUN_BEYOND_TIMEOUT = 'longQueryRunBeyondTimeout',
 }
 
 export interface SearchUsageCollector {
   trackQueryTimedOut: () => Promise<void>;
   trackQueriesCancelled: () => Promise<void>;
-  trackLongQueryPopupShown: () => Promise<void>;
-  trackLongQueryDialogDismissed: () => Promise<void>;
-  trackLongQueryRunBeyondTimeout: () => Promise<void>;
 }
diff --git a/src/plugins/data/public/search/index.ts b/src/plugins/data/public/search/index.ts
index a6a1736ac91da..c1af9699acbb2 100644
--- a/src/plugins/data/public/search/index.ts
+++ b/src/plugins/data/public/search/index.ts
@@ -19,7 +19,14 @@
 
 export * from './expressions';
 
-export { ISearch, ISearchGeneric, ISearchSetup, ISearchStart, SearchEnhancements } from './types';
+export {
+  ISearch,
+  ISearchGeneric,
+  ISearchSetup,
+  ISearchStart,
+  ISearchStartSearchSource,
+  SearchEnhancements,
+} from './types';
 
 export { IEsSearchResponse, IEsSearchRequest, ES_SEARCH_STRATEGY } from '../../common/search';
 
diff --git a/src/plugins/data/public/search/long_query_notification.tsx b/src/plugins/data/public/search/long_query_notification.tsx
deleted file mode 100644
index 1db298618fae8..0000000000000
--- a/src/plugins/data/public/search/long_query_notification.tsx
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { EuiButton, EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-import React from 'react';
-import { ApplicationStart } from 'kibana/public';
-import { toMountPoint } from '../../../kibana_react/public';
-
-interface Props {
-  application: ApplicationStart;
-}
-
-export function getLongQueryNotification(props: Props) {
-  return toMountPoint(<LongQueryNotification application={props.application} />);
-}
-
-export function LongQueryNotification(props: Props) {
-  return (
-    <div>
-      <FormattedMessage
-        id="data.query.queryBar.longQueryMessage"
-        defaultMessage="With an upgraded license, you can ensure requests have enough time to complete."
-      />
-      <EuiSpacer size="s" />
-      <EuiFlexGroup justifyContent="flexEnd" gutterSize="s">
-        <EuiFlexItem grow={false}>
-          <EuiButton
-            size="s"
-            onClick={async () => {
-              await props.application.navigateToApp('management/stack/license_management');
-            }}
-          >
-            <FormattedMessage
-              id="data.query.queryBar.licenseOptions"
-              defaultMessage="Go to license options"
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </div>
-  );
-}
diff --git a/src/plugins/data/public/search/search_interceptor.test.ts b/src/plugins/data/public/search/search_interceptor.test.ts
index 84db69a83a005..7bfa6f0ab1bc5 100644
--- a/src/plugins/data/public/search/search_interceptor.test.ts
+++ b/src/plugins/data/public/search/search_interceptor.test.ts
@@ -95,6 +95,39 @@ describe('SearchInterceptor', () => {
       await flushPromises();
     });
 
+    test('Should not timeout if requestTimeout is undefined', async () => {
+      searchInterceptor = new SearchInterceptor({
+        startServices: mockCoreSetup.getStartServices(),
+        uiSettings: mockCoreSetup.uiSettings,
+        http: mockCoreSetup.http,
+        toasts: mockCoreSetup.notifications.toasts,
+      });
+      mockCoreSetup.http.fetch.mockImplementationOnce((options: any) => {
+        return new Promise((resolve, reject) => {
+          options.signal.addEventListener('abort', () => {
+            reject(new AbortError());
+          });
+
+          setTimeout(resolve, 5000);
+        });
+      });
+      const mockRequest: IEsSearchRequest = {
+        params: {},
+      };
+      const response = searchInterceptor.search(mockRequest);
+
+      expect.assertions(1);
+      const next = jest.fn();
+      const complete = () => {
+        expect(next).toBeCalled();
+      };
+      response.subscribe({ next, complete });
+
+      jest.advanceTimersByTime(5000);
+
+      await flushPromises();
+    });
+
     test('Observable should fail if user aborts (test merged signal)', async () => {
       const abortController = new AbortController();
       mockCoreSetup.http.fetch.mockImplementationOnce((options: any) => {
@@ -125,7 +158,7 @@ describe('SearchInterceptor', () => {
       await flushPromises();
     });
 
-    test('Immediatelly aborts if passed an aborted abort signal', async (done) => {
+    test('Immediately aborts if passed an aborted abort signal', async (done) => {
       const abort = new AbortController();
       const mockRequest: IEsSearchRequest = {
         params: {},
@@ -141,44 +174,4 @@ describe('SearchInterceptor', () => {
       response.subscribe({ error });
     });
   });
-
-  describe('getPendingCount$', () => {
-    test('should observe the number of pending requests', () => {
-      const pendingCount$ = searchInterceptor.getPendingCount$();
-      const pendingNext = jest.fn();
-      pendingCount$.subscribe(pendingNext);
-
-      const mockResponse: any = { result: 200 };
-      mockCoreSetup.http.fetch.mockResolvedValue(mockResponse);
-      const mockRequest: IEsSearchRequest = {
-        params: {},
-      };
-      const response = searchInterceptor.search(mockRequest);
-
-      response.subscribe({
-        complete: () => {
-          expect(pendingNext.mock.calls).toEqual([[0], [1], [0]]);
-        },
-      });
-    });
-
-    test('should observe the number of pending requests on error', () => {
-      const pendingCount$ = searchInterceptor.getPendingCount$();
-      const pendingNext = jest.fn();
-      pendingCount$.subscribe(pendingNext);
-
-      const mockResponse: any = { result: 500 };
-      mockCoreSetup.http.fetch.mockRejectedValue(mockResponse);
-      const mockRequest: IEsSearchRequest = {
-        params: {},
-      };
-      const response = searchInterceptor.search(mockRequest);
-
-      response.subscribe({
-        complete: () => {
-          expect(pendingNext.mock.calls).toEqual([[0], [1], [0]]);
-        },
-      });
-    });
-  });
 });
diff --git a/src/plugins/data/public/search/search_interceptor.ts b/src/plugins/data/public/search/search_interceptor.ts
index 0a6d60afed2f7..888e12a4285b1 100644
--- a/src/plugins/data/public/search/search_interceptor.ts
+++ b/src/plugins/data/public/search/search_interceptor.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { trimEnd } from 'lodash';
+import { trimEnd, debounce } from 'lodash';
 import {
   BehaviorSubject,
   throwError,
@@ -28,25 +28,24 @@ import {
   Observable,
   NEVER,
 } from 'rxjs';
-import { finalize, filter } from 'rxjs/operators';
-import { Toast, CoreStart, ToastsSetup, CoreSetup } from 'kibana/public';
-import { getCombinedSignal, AbortError } from '../../common/utils';
+import { catchError, finalize } from 'rxjs/operators';
+import { CoreStart, CoreSetup, ToastsSetup } from 'kibana/public';
+import { i18n } from '@kbn/i18n';
 import {
+  getCombinedSignal,
+  AbortError,
   IEsSearchRequest,
   IEsSearchResponse,
   ISearchOptions,
   ES_SEARCH_STRATEGY,
-} from '../../common/search';
-import { getLongQueryNotification } from './long_query_notification';
+} from '../../common';
 import { SearchUsageCollector } from './collectors';
 
-const LONG_QUERY_NOTIFICATION_DELAY = 10000;
-
 export interface SearchInterceptorDeps {
-  toasts: ToastsSetup;
   http: CoreSetup['http'];
   uiSettings: CoreSetup['uiSettings'];
   startServices: Promise<[CoreStart, any, unknown]>;
+  toasts: ToastsSetup;
   usageCollector?: SearchUsageCollector;
 }
 
@@ -69,12 +68,6 @@ export class SearchInterceptor {
    */
   protected timeoutSubscriptions: Subscription = new Subscription();
 
-  /**
-   * The current long-running toast (if there is one).
-   * @internal
-   */
-  protected longRunningToast?: Toast;
-
   /**
    * @internal
    */
@@ -89,19 +82,6 @@ export class SearchInterceptor {
     this.deps.startServices.then(([coreStart]) => {
       this.application = coreStart.application;
     });
-
-    // When search requests go out, a notification is scheduled allowing users to continue the
-    // request past the timeout. When all search requests complete, we remove the notification.
-    this.getPendingCount$()
-      .pipe(filter((count) => count === 0))
-      .subscribe(this.hideToast);
-  }
-  /**
-   * Returns an `Observable` over the current number of pending searches. This could mean that one
-   * of the search requests is still in flight, or that it has only received partial responses.
-   */
-  public getPendingCount$() {
-    return this.pendingCount$.asObservable();
   }
 
   /**
@@ -146,6 +126,12 @@ export class SearchInterceptor {
       this.pendingCount$.next(this.pendingCount$.getValue() + 1);
 
       return this.runSearch(request, combinedSignal, options?.strategy).pipe(
+        catchError((e: any) => {
+          if (e.body?.attributes?.error === 'Request timed out') {
+            this.showTimeoutError(e);
+          }
+          return throwError(e);
+        }),
         finalize(() => {
           this.pendingCount$.next(this.pendingCount$.getValue() - 1);
           cleanup();
@@ -170,12 +156,10 @@ export class SearchInterceptor {
     const timeout$ = timeout ? timer(timeout) : NEVER;
     const subscription = timeout$.subscribe(() => {
       timeoutController.abort();
+      this.showTimeoutError(new AbortError());
     });
     this.timeoutSubscriptions.add(subscription);
 
-    // Schedule the notification to allow users to cancel or wait beyond the timeout
-    const notificationSubscription = timer(LONG_QUERY_NOTIFICATION_DELAY).subscribe(this.showToast);
-
     // Get a combined `AbortSignal` that will be aborted whenever the first of the following occurs:
     // 1. The user manually aborts (via `cancelPending`)
     // 2. The request times out
@@ -189,7 +173,6 @@ export class SearchInterceptor {
     const combinedSignal = getCombinedSignal(signals);
     const cleanup = () => {
       this.timeoutSubscriptions.remove(subscription);
-      notificationSubscription.unsubscribe();
     };
 
     combinedSignal.addEventListener('abort', cleanup);
@@ -200,36 +183,23 @@ export class SearchInterceptor {
     };
   }
 
-  /**
-   *  @internal
-   */
-  protected showToast = () => {
-    if (this.longRunningToast) return;
-    this.longRunningToast = this.deps.toasts.addInfo(
-      {
-        title: 'Your query is taking a while',
-        text: getLongQueryNotification({
-          application: this.application,
+  // Right now we are debouncing but we will hook this up with background sessions to show only one
+  // error notification per session.
+  protected showTimeoutError = debounce(
+    (e: Error) => {
+      this.deps.toasts.addError(e, {
+        title: 'Timed out',
+        toastMessage: i18n.translate('data.search.upgradeLicense', {
+          defaultMessage:
+            'One or more queries timed out. With our free Basic tier, your queries never time out.',
         }),
-      },
-      {
-        toastLifeTimeMs: 1000000,
-      }
-    );
-  };
-
-  /**
-   *  @internal
-   */
-  protected hideToast = () => {
-    if (this.longRunningToast) {
-      this.deps.toasts.remove(this.longRunningToast);
-      delete this.longRunningToast;
-      if (this.deps.usageCollector) {
-        this.deps.usageCollector.trackLongQueryDialogDismissed();
-      }
+      });
+    },
+    60000,
+    {
+      leading: true,
     }
-  };
+  );
 }
 
 export type ISearchInterceptor = PublicMethodsOf<SearchInterceptor>;
diff --git a/src/plugins/data/public/search/search_service.ts b/src/plugins/data/public/search/search_service.ts
index f8f4acbe43dfd..6b73761c5a437 100644
--- a/src/plugins/data/public/search/search_service.ts
+++ b/src/plugins/data/public/search/search_service.ts
@@ -103,7 +103,13 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
       aggs: this.aggsService.start({ fieldFormats, uiSettings }),
       search,
       searchSource: {
+        /**
+         * creates searchsource based on serialized search source fields
+         */
         create: createSearchSource(indexPatterns, searchSourceDependencies),
+        /**
+         * creates an enpty search source
+         */
         createEmpty: () => {
           return new SearchSource({}, searchSourceDependencies);
         },
diff --git a/src/plugins/data/public/search/search_source/search_source.ts b/src/plugins/data/public/search/search_source/search_source.ts
index 68c7b663b3628..a39898e6a9f52 100644
--- a/src/plugins/data/public/search/search_source/search_source.ts
+++ b/src/plugins/data/public/search/search_source/search_source.ts
@@ -143,15 +143,19 @@ export class SearchSource {
    * PUBLIC API
    *****/
 
+  /**
+   * internal, dont use
+   * @param searchStrategyId
+   */
   setPreferredSearchStrategyId(searchStrategyId: string) {
     this.searchStrategyId = searchStrategyId;
   }
 
-  setFields(newFields: SearchSourceFields) {
-    this.fields = newFields;
-    return this;
-  }
-
+  /**
+   * sets value to a single search source feild
+   * @param field: field name
+   * @param value: value for the field
+   */
   setField<K extends keyof SearchSourceFields>(field: K, value: SearchSourceFields[K]) {
     if (value == null) {
       delete this.fields[field];
@@ -161,16 +165,33 @@ export class SearchSource {
     return this;
   }
 
+  /**
+   * Internal, do not use. Overrides all search source fields with the new field array.
+   *
+   * @private
+   * @param newFields New field array.
+   */
+  setFields(newFields: SearchSourceFields) {
+    this.fields = newFields;
+    return this;
+  }
+
+  /**
+   * returns search source id
+   */
   getId() {
     return this.id;
   }
 
+  /**
+   * returns all search source fields
+   */
   getFields() {
     return { ...this.fields };
   }
 
   /**
-   * Get fields from the fields
+   * Gets a single field from the fields
    */
   getField<K extends keyof SearchSourceFields>(field: K, recurse = true): SearchSourceFields[K] {
     if (!recurse || this.fields[field] !== void 0) {
@@ -187,10 +208,16 @@ export class SearchSource {
     return this.getField(field, false);
   }
 
+  /**
+   * @deprecated Don't use.
+   */
   create() {
     return new SearchSource({}, this.dependencies);
   }
 
+  /**
+   * creates a copy of this search source (without its children)
+   */
   createCopy() {
     const newSearchSource = new SearchSource({}, this.dependencies);
     newSearchSource.setFields({ ...this.fields });
@@ -201,6 +228,10 @@ export class SearchSource {
     return newSearchSource;
   }
 
+  /**
+   * creates a new child search source
+   * @param options
+   */
   createChild(options = {}) {
     const childSearchSource = new SearchSource({}, this.dependencies);
     childSearchSource.setParent(this, options);
@@ -227,42 +258,6 @@ export class SearchSource {
     return this.parent;
   }
 
-  /**
-   * Run a search using the search service
-   * @return {Observable<SearchResponse<unknown>>}
-   */
-  private fetch$(searchRequest: SearchRequest, options: ISearchOptions) {
-    const { search, getConfig } = this.dependencies;
-
-    const params = getSearchParamsFromRequest(searchRequest, {
-      getConfig,
-    });
-
-    return search({ params, indexType: searchRequest.indexType }, options).pipe(
-      map(({ rawResponse }) => handleResponse(searchRequest, rawResponse))
-    );
-  }
-
-  /**
-   * Run a search using the search service
-   * @return {Promise<SearchResponse<unknown>>}
-   */
-  private async legacyFetch(searchRequest: SearchRequest, options: ISearchOptions) {
-    const { http, getConfig, loadingCount$ } = this.dependencies;
-
-    return await fetchSoon(
-      searchRequest,
-      {
-        ...(this.searchStrategyId && { searchStrategyId: this.searchStrategyId }),
-        ...options,
-      },
-      {
-        http,
-        config: { get: getConfig },
-        loadingCount$,
-      }
-    );
-  }
   /**
    * Fetch this source and reject the returned Promise on error
    *
@@ -301,6 +296,9 @@ export class SearchSource {
     this.requestStartHandlers.push(handler);
   }
 
+  /**
+   * Returns body contents of the search request, often referred as query DSL.
+   */
   async getSearchRequestBody() {
     const searchRequest = await this.flatten();
     return searchRequest.body;
@@ -318,6 +316,43 @@ export class SearchSource {
    * PRIVATE APIS
    ******/
 
+  /**
+   * Run a search using the search service
+   * @return {Observable<SearchResponse<unknown>>}
+   */
+  private fetch$(searchRequest: SearchRequest, options: ISearchOptions) {
+    const { search, getConfig } = this.dependencies;
+
+    const params = getSearchParamsFromRequest(searchRequest, {
+      getConfig,
+    });
+
+    return search({ params, indexType: searchRequest.indexType }, options).pipe(
+      map(({ rawResponse }) => handleResponse(searchRequest, rawResponse))
+    );
+  }
+
+  /**
+   * Run a search using the search service
+   * @return {Promise<SearchResponse<unknown>>}
+   */
+  private async legacyFetch(searchRequest: SearchRequest, options: ISearchOptions) {
+    const { http, getConfig, loadingCount$ } = this.dependencies;
+
+    return await fetchSoon(
+      searchRequest,
+      {
+        ...(this.searchStrategyId && { searchStrategyId: this.searchStrategyId }),
+        ...options,
+      },
+      {
+        http,
+        config: { get: getConfig },
+        loadingCount$,
+      }
+    );
+  }
+
   /**
    *  Called by requests of this search source when they are started
    *  @param options
@@ -480,6 +515,9 @@ export class SearchSource {
     return searchRequest;
   }
 
+  /**
+   * serializes search source fields (which can later be passed to {@link ISearchStartSearchSource})
+   */
   public getSerializedFields() {
     const { filter: originalFilters, ...searchSourceFields } = omit(this.getFields(), [
       'sort',
@@ -531,5 +569,8 @@ export class SearchSource {
   }
 }
 
-/** @public **/
+/**
+ * search source interface
+ * @public
+ */
 export type ISearchSource = Pick<SearchSource, keyof SearchSource>;
diff --git a/src/plugins/data/public/search/search_source/types.ts b/src/plugins/data/public/search/search_source/types.ts
index c2f8701a64fa3..0882aa9a2ceec 100644
--- a/src/plugins/data/public/search/search_source/types.ts
+++ b/src/plugins/data/public/search/search_source/types.ts
@@ -34,19 +34,37 @@ export interface SortDirectionNumeric {
 
 export type EsQuerySortValue = Record<string, SortDirection | SortDirectionNumeric>;
 
+/**
+ * search source fields
+ */
 export interface SearchSourceFields {
   type?: string;
+  /**
+   * {@link Query}
+   */
   query?: Query;
+  /**
+   * {@link Filter}
+   */
   filter?: Filter[] | Filter | (() => Filter[] | Filter | undefined);
+  /**
+   * {@link EsQuerySortValue}
+   */
   sort?: EsQuerySortValue | EsQuerySortValue[];
   highlight?: any;
   highlightAll?: boolean;
+  /**
+   * {@link AggConfigs}
+   */
   aggs?: any;
   from?: number;
   size?: number;
   source?: NameList;
   version?: boolean;
   fields?: NameList;
+  /**
+   * {@link IndexPatternService}
+   */
   index?: IndexPattern;
   searchAfter?: EsQuerySearchAfter;
   timeout?: string;
diff --git a/src/plugins/data/public/search/types.ts b/src/plugins/data/public/search/types.ts
index cec5c63294e96..83a542269046f 100644
--- a/src/plugins/data/public/search/types.ts
+++ b/src/plugins/data/public/search/types.ts
@@ -62,13 +62,42 @@ export interface ISearchSetup {
   __enhance: (enhancements: SearchEnhancements) => void;
 }
 
+/**
+ * high level search service
+ * @public
+ */
+export interface ISearchStartSearchSource {
+  /**
+   * creates {@link SearchSource} based on provided serialized {@link SearchSourceFields}
+   * @param fields
+   */
+  create: (fields?: SearchSourceFields) => Promise<ISearchSource>;
+  /**
+   * creates empty {@link SearchSource}
+   */
+  createEmpty: () => ISearchSource;
+}
+/**
+ * search service
+ * @public
+ */
 export interface ISearchStart {
+  /**
+   * agg config sub service
+   * {@link AggsStart}
+   *
+   */
   aggs: AggsStart;
+  /**
+   * low level search
+   * {@link ISearchGeneric}
+   */
   search: ISearchGeneric;
-  searchSource: {
-    create: (fields?: SearchSourceFields) => Promise<ISearchSource>;
-    createEmpty: () => ISearchSource;
-  };
+  /**
+   * high level search
+   * {@link ISearchStartSearchSource}
+   */
+  searchSource: ISearchStartSearchSource;
 }
 
 export { SEARCH_EVENT_TYPE } from './collectors';
diff --git a/src/plugins/data/public/types.ts b/src/plugins/data/public/types.ts
index bffc10642eb47..7b5d79aff24ef 100644
--- a/src/plugins/data/public/types.ts
+++ b/src/plugins/data/public/types.ts
@@ -46,6 +46,9 @@ export interface DataStartDependencies {
   uiActions: UiActionsStart;
 }
 
+/**
+ * Data plugin public Setup contract
+ */
 export interface DataPublicPluginSetup {
   autocomplete: AutocompleteSetup;
   search: ISearchSetup;
@@ -57,20 +60,61 @@ export interface DataPublicPluginSetup {
   __enhance: (enhancements: DataPublicPluginEnhancements) => void;
 }
 
+/**
+ * Data plugin prewired UI components
+ */
+export interface DataPublicPluginStartUi {
+  IndexPatternSelect: React.ComponentType<IndexPatternSelectProps>;
+  SearchBar: React.ComponentType<StatefulSearchBarProps>;
+}
+
+/**
+ * utilities to generate filters from action context
+ */
+export interface DataPublicPluginStartActions {
+  createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;
+  createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;
+}
+
+/**
+ * Data plugin public Start contract
+ */
 export interface DataPublicPluginStart {
-  actions: {
-    createFiltersFromValueClickAction: typeof createFiltersFromValueClickAction;
-    createFiltersFromRangeSelectAction: typeof createFiltersFromRangeSelectAction;
-  };
+  /**
+   * filter creation utilities
+   * {@link DataPublicPluginStartActions}
+   */
+  actions: DataPublicPluginStartActions;
+  /**
+   * autocomplete service
+   * {@link AutocompleteStart}
+   */
   autocomplete: AutocompleteStart;
+  /**
+   * index patterns service
+   * {@link IndexPatternsContract}
+   */
   indexPatterns: IndexPatternsContract;
+  /**
+   * search service
+   * {@link ISearchStart}
+   */
   search: ISearchStart;
+  /**
+   * field formats service
+   * {@link FieldFormatsStart}
+   */
   fieldFormats: FieldFormatsStart;
+  /**
+   * query service
+   * {@link QueryStart}
+   */
   query: QueryStart;
-  ui: {
-    IndexPatternSelect: React.ComponentType<IndexPatternSelectProps>;
-    SearchBar: React.ComponentType<StatefulSearchBarProps>;
-  };
+  /**
+   * prewired UI components
+   * {@link DataPublicPluginStartUi}
+   */
+  ui: DataPublicPluginStartUi;
 }
 
 export interface IDataPluginServices extends Partial<CoreStart> {
diff --git a/src/plugins/data/public/ui/query_string_input/_query_bar.scss b/src/plugins/data/public/ui/query_string_input/_query_bar.scss
index 00895ec49003b..1ff24c61954e7 100644
--- a/src/plugins/data/public/ui/query_string_input/_query_bar.scss
+++ b/src/plugins/data/public/ui/query_string_input/_query_bar.scss
@@ -8,30 +8,37 @@
   border-right: none !important;
 }
 
+.kbnQueryBar__textareaWrap {
+  overflow: visible !important; // Override EUI form control
+  display: flex;
+  flex: 1 1 100%;
+  position: relative;
+}
+
 .kbnQueryBar__textarea {
   z-index: $euiZContentMenu;
   resize: none !important; // When in the group, it will autosize
-  height: $euiSizeXXL;
+  height: $euiFormControlHeight;
   // Unlike most inputs within layout control groups, the text area still needs a border.
   // These adjusts help it sit above the control groups shadow to line up correctly.
-  padding-top: $euiSizeS + 3px !important;
-  transform: translateY(-2px);
-  padding: $euiSizeS - 1px;
+  padding: $euiSizeS;
+  padding-top: $euiSizeS + 3px;
+  transform: translateY(-1px) translateX(-1px);
 
-  &:not(:focus) {
+  &:not(:focus):not(:invalid) {
     @include euiYScrollWithShadows;
+  }
+
+  &:not(:focus) {
     white-space: nowrap;
     overflow-y: hidden;
     overflow-x: hidden;
-    border: none;
-    box-shadow: none;
   }
 
   // When focused, let it scroll
   &:focus {
     overflow-x: auto;
     overflow-y: auto;
-    width: calc(100% + 1px); // To overtake the group's fake border
     white-space: normal;
   }
 }
diff --git a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
index 0bfac2a07a7eb..f159cac664a9e 100644
--- a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
+++ b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
@@ -19,6 +19,7 @@
 
 import React, { Component, RefObject, createRef } from 'react';
 import { i18n } from '@kbn/i18n';
+
 import classNames from 'classnames';
 import {
   EuiTextArea,
@@ -63,6 +64,7 @@ interface Props {
   dataTestSubj?: string;
   size?: SuggestionsListSize;
   className?: string;
+  isInvalid?: boolean;
 }
 
 interface State {
@@ -591,6 +593,7 @@ export class QueryStringInputUI extends Component<Props, State> {
       'euiFormControlLayout euiFormControlLayout--group kbnQueryBar__wrap',
       this.props.className
     );
+
     return (
       <div className={className}>
         {this.props.prepend}
@@ -607,7 +610,7 @@ export class QueryStringInputUI extends Component<Props, State> {
           >
             <div
               role="search"
-              className="euiFormControlLayout__childrenWrapper kuiLocalSearchAssistedInput"
+              className="euiFormControlLayout__childrenWrapper kbnQueryBar__textareaWrap"
               ref={this.queryBarInputDivRefInstance}
             >
               <EuiTextArea
@@ -651,6 +654,7 @@ export class QueryStringInputUI extends Component<Props, State> {
                 }
                 role="textbox"
                 data-test-subj={this.props.dataTestSubj || 'queryInput'}
+                isInvalid={this.props.isInvalid}
               >
                 {this.getQueryString()}
               </EuiTextArea>
diff --git a/src/plugins/data/public/ui/typeahead/constants.ts b/src/plugins/data/public/ui/typeahead/constants.ts
index 08f9bd23e16f3..0e28891a14535 100644
--- a/src/plugins/data/public/ui/typeahead/constants.ts
+++ b/src/plugins/data/public/ui/typeahead/constants.ts
@@ -33,4 +33,4 @@ export const SUGGESTIONS_LIST_REQUIRED_BOTTOM_SPACE = 250;
  * A distance in px to display suggestions list right under the query input without a gap
  * @public
  */
-export const SUGGESTIONS_LIST_REQUIRED_TOP_OFFSET = 2;
+export const SUGGESTIONS_LIST_REQUIRED_TOP_OFFSET = 1;
diff --git a/src/plugins/data/public/ui/typeahead/suggestions_component.tsx b/src/plugins/data/public/ui/typeahead/suggestions_component.tsx
index dc7c55374f1d5..50ed9e9542d36 100644
--- a/src/plugins/data/public/ui/typeahead/suggestions_component.tsx
+++ b/src/plugins/data/public/ui/typeahead/suggestions_component.tsx
@@ -154,6 +154,7 @@ export class SuggestionsComponent extends Component<Props> {
 const StyledSuggestionsListDiv = styled.div`
   ${(props: { queryBarRect: DOMRect; verticalListPosition: string }) => `
       position: absolute;
+      z-index: 4001;
       left: ${props.queryBarRect.left}px;
       width: ${props.queryBarRect.width}px;
       ${props.verticalListPosition}`}
diff --git a/src/plugins/data/server/search/es_search/es_search_strategy.ts b/src/plugins/data/server/search/es_search/es_search_strategy.ts
index 106f974ed3457..e2ed500689cfa 100644
--- a/src/plugins/data/server/search/es_search/es_search_strategy.ts
+++ b/src/plugins/data/server/search/es_search/es_search_strategy.ts
@@ -52,10 +52,11 @@ export const esSearchStrategyProvider = (
       });
 
       try {
-        const esResponse = (await context.core.elasticsearch.client.asCurrentUser.search(
-          params
-        )) as ApiResponse<SearchResponse<any>>;
-        const rawResponse = esResponse.body;
+        // Temporary workaround until https://github.com/elastic/elasticsearch-js/issues/1297
+        const promise = context.core.elasticsearch.client.asCurrentUser.search(params);
+        if (options?.abortSignal)
+          options.abortSignal.addEventListener('abort', () => promise.abort());
+        const { body: rawResponse } = (await promise) as ApiResponse<SearchResponse<any>>;
 
         if (usage) usage.trackSuccess(rawResponse.took);
 
diff --git a/src/plugins/data/server/search/types.ts b/src/plugins/data/server/search/types.ts
index b2b958454de48..aefdac2ab639f 100644
--- a/src/plugins/data/server/search/types.ts
+++ b/src/plugins/data/server/search/types.ts
@@ -20,7 +20,7 @@
 import { RequestHandlerContext } from '../../../../core/server';
 import { ISearchOptions } from '../../common/search';
 import { AggsSetup, AggsStart } from './aggs';
-import { SearchUsage } from './collectors/usage';
+import { SearchUsage } from './collectors';
 import { IEsSearchRequest, IEsSearchResponse } from './es_search';
 
 export interface SearchEnhancements {
diff --git a/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx b/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
index 0d6fd122ad22c..7a42ed7fad427 100644
--- a/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
+++ b/src/plugins/es_ui_shared/public/request/use_request.test.helpers.tsx
@@ -106,7 +106,7 @@ export const createUseRequestHelpers = (): UseRequestHelpers => {
     };
 
     const TestComponent = ({ requestConfig }: { requestConfig: UseRequestConfig }) => {
-      const { isInitialRequest, isLoading, error, data, sendRequest } = useRequest(
+      const { isInitialRequest, isLoading, error, data, resendRequest } = useRequest(
         httpClient as HttpSetup,
         requestConfig
       );
@@ -115,7 +115,7 @@ export const createUseRequestHelpers = (): UseRequestHelpers => {
       hookResult.isLoading = isLoading;
       hookResult.error = error;
       hookResult.data = data;
-      hookResult.sendRequest = sendRequest;
+      hookResult.resendRequest = resendRequest;
 
       return null;
     };
diff --git a/src/plugins/es_ui_shared/public/request/use_request.test.ts b/src/plugins/es_ui_shared/public/request/use_request.test.ts
index f7902218d9314..2a639f93b47b4 100644
--- a/src/plugins/es_ui_shared/public/request/use_request.test.ts
+++ b/src/plugins/es_ui_shared/public/request/use_request.test.ts
@@ -102,7 +102,7 @@ describe('useRequest hook', () => {
         setupSuccessRequest();
         expect(hookResult.isInitialRequest).toBe(true);
 
-        hookResult.sendRequest();
+        hookResult.resendRequest();
         await completeRequest();
         expect(hookResult.isInitialRequest).toBe(false);
       });
@@ -148,7 +148,7 @@ describe('useRequest hook', () => {
         expect(hookResult.error).toBe(getErrorResponse().error);
 
         act(() => {
-          hookResult.sendRequest();
+          hookResult.resendRequest();
         });
         expect(hookResult.isLoading).toBe(true);
         expect(hookResult.error).toBe(getErrorResponse().error);
@@ -183,7 +183,7 @@ describe('useRequest hook', () => {
         expect(hookResult.data).toBe(getSuccessResponse().data);
 
         act(() => {
-          hookResult.sendRequest();
+          hookResult.resendRequest();
         });
         expect(hookResult.isLoading).toBe(true);
         expect(hookResult.data).toBe(getSuccessResponse().data);
@@ -215,7 +215,7 @@ describe('useRequest hook', () => {
   });
 
   describe('callbacks', () => {
-    describe('sendRequest', () => {
+    describe('resendRequest', () => {
       it('sends the request', async () => {
         const { setupSuccessRequest, completeRequest, hookResult, getSendRequestSpy } = helpers;
         setupSuccessRequest();
@@ -224,7 +224,7 @@ describe('useRequest hook', () => {
         expect(getSendRequestSpy().callCount).toBe(1);
 
         await act(async () => {
-          hookResult.sendRequest();
+          hookResult.resendRequest();
           await completeRequest();
         });
         expect(getSendRequestSpy().callCount).toBe(2);
@@ -239,17 +239,17 @@ describe('useRequest hook', () => {
         await advanceTime(REQUEST_TIME);
         expect(getSendRequestSpy().callCount).toBe(1);
         act(() => {
-          hookResult.sendRequest();
+          hookResult.resendRequest();
         });
 
         // The manual request resolves, and we'll send yet another one...
         await advanceTime(REQUEST_TIME);
         expect(getSendRequestSpy().callCount).toBe(2);
         act(() => {
-          hookResult.sendRequest();
+          hookResult.resendRequest();
         });
 
-        // At this point, we've moved forward 3s. The poll is set at 2s. If sendRequest didn't
+        // At this point, we've moved forward 3s. The poll is set at 2s. If resendRequest didn't
         // reset the poll, the request call count would be 4, not 3.
         await advanceTime(REQUEST_TIME);
         expect(getSendRequestSpy().callCount).toBe(3);
@@ -291,14 +291,14 @@ describe('useRequest hook', () => {
       const HALF_REQUEST_TIME = REQUEST_TIME * 0.5;
       setupSuccessRequest({ pollIntervalMs: REQUEST_TIME });
 
-      // Before the original request resolves, we make a manual sendRequest call.
+      // Before the original request resolves, we make a manual resendRequest call.
       await advanceTime(HALF_REQUEST_TIME);
       expect(getSendRequestSpy().callCount).toBe(0);
       act(() => {
-        hookResult.sendRequest();
+        hookResult.resendRequest();
       });
 
-      // The original quest resolves but it's been marked as outdated by the the manual sendRequest
+      // The original quest resolves but it's been marked as outdated by the the manual resendRequest
       // call "interrupts", so data is left undefined.
       await advanceTime(HALF_REQUEST_TIME);
       expect(getSendRequestSpy().callCount).toBe(1);
diff --git a/src/plugins/es_ui_shared/public/request/use_request.ts b/src/plugins/es_ui_shared/public/request/use_request.ts
index 481843bf40e88..e04f84a67b8a3 100644
--- a/src/plugins/es_ui_shared/public/request/use_request.ts
+++ b/src/plugins/es_ui_shared/public/request/use_request.ts
@@ -20,11 +20,7 @@
 import { useEffect, useCallback, useState, useRef, useMemo } from 'react';
 
 import { HttpSetup } from '../../../../../src/core/public';
-import {
-  sendRequest as sendStatelessRequest,
-  SendRequestConfig,
-  SendRequestResponse,
-} from './send_request';
+import { sendRequest, SendRequestConfig } from './send_request';
 
 export interface UseRequestConfig extends SendRequestConfig {
   pollIntervalMs?: number;
@@ -37,7 +33,7 @@ export interface UseRequestResponse<D = any, E = Error> {
   isLoading: boolean;
   error: E | null;
   data?: D | null;
-  sendRequest: () => Promise<SendRequestResponse<D, E>>;
+  resendRequest: () => void;
 }
 
 export const useRequest = <D = any, E = Error>(
@@ -80,7 +76,7 @@ export const useRequest = <D = any, E = Error>(
     /* eslint-disable-next-line react-hooks/exhaustive-deps */
   }, [path, method, queryStringified, bodyStringified]);
 
-  const sendRequest = useCallback(async () => {
+  const resendRequest = useCallback(async () => {
     // If we're on an interval, this allows us to reset it if the user has manually requested the
     // data, to avoid doubled-up requests.
     clearPollInterval();
@@ -91,7 +87,7 @@ export const useRequest = <D = any, E = Error>(
     // "old" error/data or loading state when a new request is in-flight.
     setIsLoading(true);
 
-    const response = await sendStatelessRequest<D, E>(httpClient, requestBody);
+    const response = await sendRequest<D, E>(httpClient, requestBody);
     const { data: serializedResponseData, error: responseError } = response;
 
     const isOutdatedRequest = requestId !== requestCountRef.current;
@@ -99,7 +95,7 @@ export const useRequest = <D = any, E = Error>(
 
     // Ignore outdated or irrelevant data.
     if (isOutdatedRequest || isUnmounted) {
-      return { data: null, error: null };
+      return;
     }
 
     setError(responseError);
@@ -112,8 +108,6 @@ export const useRequest = <D = any, E = Error>(
     }
     // Setting isLoading to false also acts as a signal for scheduling the next poll request.
     setIsLoading(false);
-
-    return { data: serializedResponseData, error: responseError };
   }, [requestBody, httpClient, deserializer, clearPollInterval]);
 
   const scheduleRequest = useCallback(() => {
@@ -121,19 +115,19 @@ export const useRequest = <D = any, E = Error>(
     clearPollInterval();
 
     if (pollIntervalMs) {
-      pollIntervalIdRef.current = setTimeout(sendRequest, pollIntervalMs);
+      pollIntervalIdRef.current = setTimeout(resendRequest, pollIntervalMs);
     }
-  }, [pollIntervalMs, sendRequest, clearPollInterval]);
+  }, [pollIntervalMs, resendRequest, clearPollInterval]);
 
-  // Send the request on component mount and whenever the dependencies of sendRequest() change.
+  // Send the request on component mount and whenever the dependencies of resendRequest() change.
   useEffect(() => {
-    sendRequest();
-  }, [sendRequest]);
+    resendRequest();
+  }, [resendRequest]);
 
   // Schedule the next poll request when the previous one completes.
   useEffect(() => {
     // When a request completes, attempt to schedule the next one. Note that we aren't re-scheduling
-    // a request whenever sendRequest's dependencies change. isLoading isn't set to false until the
+    // a request whenever resendRequest's dependencies change. isLoading isn't set to false until the
     // initial request has completed, so we won't schedule a request on mount.
     if (!isLoading) {
       scheduleRequest();
@@ -156,6 +150,6 @@ export const useRequest = <D = any, E = Error>(
     isLoading,
     error,
     data,
-    sendRequest, // Gives the user the ability to manually request data
+    resendRequest, // Gives the user the ability to manually request data
   };
 };
diff --git a/src/plugins/home/public/application/components/welcome.tsx b/src/plugins/home/public/application/components/welcome.tsx
index cacb507009c70..404185de3d2ea 100644
--- a/src/plugins/home/public/application/components/welcome.tsx
+++ b/src/plugins/home/public/application/components/welcome.tsx
@@ -76,7 +76,7 @@ export class Welcome extends React.Component<Props> {
   componentDidMount() {
     const { telemetry } = this.props;
     this.services.trackUiMetric(METRIC_TYPE.LOADED, 'welcomeScreenMount');
-    if (telemetry) {
+    if (telemetry?.telemetryService.userCanChangeSettings) {
       telemetry.telemetryNotifications.setOptedInNoticeSeen();
     }
     document.addEventListener('keydown', this.hideOnEsc);
@@ -88,7 +88,7 @@ export class Welcome extends React.Component<Props> {
 
   private renderTelemetryEnabledOrDisabledText = () => {
     const { telemetry } = this.props;
-    if (!telemetry) {
+    if (!telemetry || !telemetry.telemetryService.userCanChangeSettings) {
       return null;
     }
 
diff --git a/src/plugins/input_control_vis/public/vis_controller.tsx b/src/plugins/input_control_vis/public/vis_controller.tsx
index e4310960851ca..faea98b792291 100644
--- a/src/plugins/input_control_vis/public/vis_controller.tsx
+++ b/src/plugins/input_control_vis/public/vis_controller.tsx
@@ -18,8 +18,10 @@
  */
 
 import React from 'react';
+import { isEqual } from 'lodash';
 import { render, unmountComponentAtNode } from 'react-dom';
 
+import { Subscription } from 'rxjs';
 import { I18nStart } from 'kibana/public';
 import { InputControlVis } from './components/vis/input_control_vis';
 import { getControlFactory } from './control/control_factory';
@@ -34,11 +36,13 @@ import { VisParams, Vis } from '../../visualizations/public';
 export const createInputControlVisController = (deps: InputControlVisDependencies) => {
   return class InputControlVisController {
     private I18nContext?: I18nStart['Context'];
+    private isLoaded = false;
 
     controls: Array<RangeControl | ListControl>;
     queryBarUpdateHandler: () => void;
     filterManager: FilterManager;
     updateSubsciption: any;
+    timeFilterSubscription: Subscription;
     visParams?: VisParams;
 
     constructor(public el: Element, public vis: Vis) {
@@ -50,19 +54,32 @@ export const createInputControlVisController = (deps: InputControlVisDependencie
       this.updateSubsciption = this.filterManager
         .getUpdates$()
         .subscribe(this.queryBarUpdateHandler);
+      this.timeFilterSubscription = deps.data.query.timefilter.timefilter
+        .getTimeUpdate$()
+        .subscribe(() => {
+          if (this.visParams?.useTimeFilter) {
+            this.isLoaded = false;
+          }
+        });
     }
 
     async render(visData: any, visParams: VisParams) {
-      this.visParams = visParams;
-      this.controls = [];
-      this.controls = await this.initControls();
-      const [{ i18n }] = await deps.core.getStartServices();
-      this.I18nContext = i18n.Context;
+      if (!this.I18nContext) {
+        const [{ i18n }] = await deps.core.getStartServices();
+        this.I18nContext = i18n.Context;
+      }
+      if (!this.isLoaded || !isEqual(visParams, this.visParams)) {
+        this.visParams = visParams;
+        this.controls = [];
+        this.controls = await this.initControls();
+        this.isLoaded = true;
+      }
       this.drawVis();
     }
 
     destroy() {
       this.updateSubsciption.unsubscribe();
+      this.timeFilterSubscription.unsubscribe();
       unmountComponentAtNode(this.el);
       this.controls.forEach((control) => control.destroy());
     }
diff --git a/src/plugins/telemetry/public/mocks.ts b/src/plugins/telemetry/public/mocks.ts
index dd7e5a4cc4ce3..5f38b27144d02 100644
--- a/src/plugins/telemetry/public/mocks.ts
+++ b/src/plugins/telemetry/public/mocks.ts
@@ -48,6 +48,7 @@ export function mockTelemetryService({
     banner: true,
     allowChangingOptInStatus: true,
     telemetryNotifyUserAboutOptInDefault: true,
+    userCanChangeSettings: true,
     ...configOverride,
   };
 
diff --git a/src/plugins/telemetry/public/plugin.ts b/src/plugins/telemetry/public/plugin.ts
index 3846e7cb96a19..9fefa2ebdd02e 100644
--- a/src/plugins/telemetry/public/plugin.ts
+++ b/src/plugins/telemetry/public/plugin.ts
@@ -25,6 +25,7 @@ import {
   PluginInitializerContext,
   SavedObjectsClientContract,
   SavedObjectsBatchResponse,
+  ApplicationStart,
 } from '../../../core/public';
 
 import { TelemetrySender, TelemetryService, TelemetryNotifications } from './services';
@@ -61,6 +62,7 @@ export interface TelemetryPluginConfig {
   optInStatusUrl: string;
   sendUsageFrom: 'browser' | 'server';
   telemetryNotifyUserAboutOptInDefault?: boolean;
+  userCanChangeSettings?: boolean;
 }
 
 export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPluginStart> {
@@ -69,6 +71,7 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
   private telemetrySender?: TelemetrySender;
   private telemetryNotifications?: TelemetryNotifications;
   private telemetryService?: TelemetryService;
+  private canUserChangeSettings: boolean = true;
 
   constructor(initializerContext: PluginInitializerContext<TelemetryPluginConfig>) {
     this.currentKibanaVersion = initializerContext.env.packageInfo.version;
@@ -91,6 +94,9 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
       throw Error('Telemetry plugin failed to initialize properly.');
     }
 
+    this.canUserChangeSettings = this.getCanUserChangeSettings(application);
+    this.telemetryService.userCanChangeSettings = this.canUserChangeSettings;
+
     this.telemetryNotifications = new TelemetryNotifications({
       overlays,
       telemetryService: this.telemetryService,
@@ -125,6 +131,17 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
     };
   }
 
+  /**
+   * Can the user edit the saved objects?
+   * This is a security feature, not included in the OSS build, so we need to fallback to `true`
+   * in case it is `undefined`.
+   * @param application CoreStart.application
+   * @private
+   */
+  private getCanUserChangeSettings(application: ApplicationStart): boolean {
+    return (application.capabilities?.savedObjectsManagement?.edit as boolean | undefined) ?? true;
+  }
+
   private getIsUnauthenticated(http: HttpStart) {
     const { anonymousPaths } = http;
     return anonymousPaths.isAnonymous(window.location.pathname);
@@ -196,6 +213,7 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
       optIn,
       sendUsageFrom,
       telemetryNotifyUserAboutOptInDefault,
+      userCanChangeSettings: this.canUserChangeSettings,
     };
   }
 
diff --git a/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.test.ts b/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.test.ts
index f767615d25253..fd9a19c441617 100644
--- a/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.test.ts
+++ b/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.test.ts
@@ -53,3 +53,27 @@ describe('setOptedInNoticeSeen', () => {
     expect(telemetryService.setUserHasSeenNotice).toBeCalledTimes(1);
   });
 });
+
+describe('shouldShowOptedInNoticeBanner', () => {
+  it("should return true because a banner hasn't been shown, the notice hasn't been seen and the user has privileges to edit saved objects", () => {
+    const telemetryService = mockTelemetryService();
+    telemetryService.getUserShouldSeeOptInNotice = jest.fn().mockReturnValue(true);
+    const telemetryNotifications = mockTelemetryNotifications({ telemetryService });
+    expect(telemetryNotifications.shouldShowOptedInNoticeBanner()).toBe(true);
+  });
+
+  it('should return false because the banner is already on screen', () => {
+    const telemetryService = mockTelemetryService();
+    telemetryService.getUserShouldSeeOptInNotice = jest.fn().mockReturnValue(true);
+    const telemetryNotifications = mockTelemetryNotifications({ telemetryService });
+    telemetryNotifications['optedInNoticeBannerId'] = 'bruce-banner';
+    expect(telemetryNotifications.shouldShowOptedInNoticeBanner()).toBe(false);
+  });
+
+  it("should return false because the banner has already been seen or the user doesn't have privileges to change saved objects", () => {
+    const telemetryService = mockTelemetryService();
+    telemetryService.getUserShouldSeeOptInNotice = jest.fn().mockReturnValue(false);
+    const telemetryNotifications = mockTelemetryNotifications({ telemetryService });
+    expect(telemetryNotifications.shouldShowOptedInNoticeBanner()).toBe(false);
+  });
+});
diff --git a/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts b/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts
index bf25bb592db82..fc44a4db7cf5e 100644
--- a/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts
+++ b/src/plugins/telemetry/public/services/telemetry_notifications/telemetry_notifications.ts
@@ -39,9 +39,9 @@ export class TelemetryNotifications {
   }
 
   public shouldShowOptedInNoticeBanner = (): boolean => {
-    const userHasSeenOptedInNotice = this.telemetryService.getUserHasSeenOptedInNotice();
+    const userShouldSeeOptInNotice = this.telemetryService.getUserShouldSeeOptInNotice();
     const bannerOnScreen = typeof this.optedInNoticeBannerId !== 'undefined';
-    return !bannerOnScreen && userHasSeenOptedInNotice;
+    return !bannerOnScreen && userShouldSeeOptInNotice;
   };
 
   public renderOptedInNoticeBanner = (): void => {
diff --git a/src/plugins/telemetry/public/services/telemetry_service.test.ts b/src/plugins/telemetry/public/services/telemetry_service.test.ts
index 16faa0cfc7536..655bbfe746c2a 100644
--- a/src/plugins/telemetry/public/services/telemetry_service.test.ts
+++ b/src/plugins/telemetry/public/services/telemetry_service.test.ts
@@ -184,15 +184,15 @@ describe('TelemetryService', () => {
   describe('setUserHasSeenNotice', () => {
     it('should hit the API and change the config', async () => {
       const telemetryService = mockTelemetryService({
-        config: { telemetryNotifyUserAboutOptInDefault: undefined },
+        config: { telemetryNotifyUserAboutOptInDefault: undefined, userCanChangeSettings: true },
       });
 
       expect(telemetryService.userHasSeenOptedInNotice).toBe(undefined);
-      expect(telemetryService.getUserHasSeenOptedInNotice()).toBe(false);
+      expect(telemetryService.getUserShouldSeeOptInNotice()).toBe(false);
       await telemetryService.setUserHasSeenNotice();
       expect(telemetryService['http'].put).toBeCalledTimes(1);
       expect(telemetryService.userHasSeenOptedInNotice).toBe(true);
-      expect(telemetryService.getUserHasSeenOptedInNotice()).toBe(true);
+      expect(telemetryService.getUserShouldSeeOptInNotice()).toBe(true);
     });
 
     it('should show a toast notification if the request fail', async () => {
@@ -207,12 +207,33 @@ describe('TelemetryService', () => {
       });
 
       expect(telemetryService.userHasSeenOptedInNotice).toBe(undefined);
-      expect(telemetryService.getUserHasSeenOptedInNotice()).toBe(false);
+      expect(telemetryService.getUserShouldSeeOptInNotice()).toBe(false);
       await telemetryService.setUserHasSeenNotice();
       expect(telemetryService['http'].put).toBeCalledTimes(1);
       expect(telemetryService['notifications'].toasts.addError).toBeCalledTimes(1);
       expect(telemetryService.userHasSeenOptedInNotice).toBe(false);
-      expect(telemetryService.getUserHasSeenOptedInNotice()).toBe(false);
+      expect(telemetryService.getUserShouldSeeOptInNotice()).toBe(false);
+    });
+  });
+
+  describe('getUserShouldSeeOptInNotice', () => {
+    it('returns whether the user can update the telemetry config (has SavedObjects access)', () => {
+      const telemetryService = mockTelemetryService({
+        config: { userCanChangeSettings: undefined },
+      });
+      expect(telemetryService.config.userCanChangeSettings).toBe(undefined);
+      expect(telemetryService.userCanChangeSettings).toBe(false);
+      expect(telemetryService.getUserShouldSeeOptInNotice()).toBe(false);
+
+      telemetryService.userCanChangeSettings = false;
+      expect(telemetryService.config.userCanChangeSettings).toBe(false);
+      expect(telemetryService.userCanChangeSettings).toBe(false);
+      expect(telemetryService.getUserShouldSeeOptInNotice()).toBe(false);
+
+      telemetryService.userCanChangeSettings = true;
+      expect(telemetryService.config.userCanChangeSettings).toBe(true);
+      expect(telemetryService.userCanChangeSettings).toBe(true);
+      expect(telemetryService.getUserShouldSeeOptInNotice()).toBe(true);
     });
   });
 });
diff --git a/src/plugins/telemetry/public/services/telemetry_service.ts b/src/plugins/telemetry/public/services/telemetry_service.ts
index 6d87a74197fe5..c807aa9e1d35e 100644
--- a/src/plugins/telemetry/public/services/telemetry_service.ts
+++ b/src/plugins/telemetry/public/services/telemetry_service.ts
@@ -87,9 +87,25 @@ export class TelemetryService {
     return telemetryUrl;
   };
 
-  public getUserHasSeenOptedInNotice = () => {
-    return this.config.telemetryNotifyUserAboutOptInDefault || false;
-  };
+  /**
+   * Returns if an user should be shown the notice about Opt-In/Out telemetry.
+   * The decision is made based on whether any user has already dismissed the message or
+   * the user can't actually change the settings (in which case, there's no point on bothering them)
+   */
+  public getUserShouldSeeOptInNotice(): boolean {
+    return (
+      (this.config.telemetryNotifyUserAboutOptInDefault && this.config.userCanChangeSettings) ??
+      false
+    );
+  }
+
+  public get userCanChangeSettings() {
+    return this.config.userCanChangeSettings ?? false;
+  }
+
+  public set userCanChangeSettings(userCanChangeSettings: boolean) {
+    this.config = { ...this.config, userCanChangeSettings };
+  }
 
   public getIsOptedIn = () => {
     return this.isOptedIn;
diff --git a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
index dd4ee61fd1148..ab29656c557c2 100644
--- a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
+++ b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
@@ -228,7 +228,6 @@ exports[`TelemetryManagementSectionComponent renders null because allowChangingO
       "getIsOptedIn": [Function],
       "getOptInStatusUrl": [Function],
       "getTelemetryUrl": [Function],
-      "getUserHasSeenOptedInNotice": [Function],
       "http": Object {
         "addLoadingCountSource": [MockFunction],
         "anonymousPaths": Object {
@@ -430,7 +429,6 @@ exports[`TelemetryManagementSectionComponent renders null because query does not
       "getIsOptedIn": [Function],
       "getOptInStatusUrl": [Function],
       "getTelemetryUrl": [Function],
-      "getUserHasSeenOptedInNotice": [Function],
       "http": Object {
         "addLoadingCountSource": [MockFunction],
         "anonymousPaths": Object {
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js b/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
index 4b5aab85cfc4e..c5fc4b7b93269 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/es.test.js
@@ -100,9 +100,17 @@ describe('es', () => {
       expect(agg.time_buckets.date_histogram.time_zone).to.equal('Etc/UTC');
     });
 
-    it('sets the field and interval', () => {
+    it('sets the field', () => {
       expect(agg.time_buckets.date_histogram.field).to.equal('@timestamp');
-      expect(agg.time_buckets.date_histogram.interval).to.equal('1y');
+    });
+
+    it('sets the interval for calendar_interval correctly', () => {
+      expect(agg.time_buckets.date_histogram).to.have.property('calendar_interval', '1y');
+    });
+
+    it('sets the interval for fixed_interval correctly', () => {
+      const a = createDateAgg({ timefield: '@timestamp', interval: '24h' }, tlConfig);
+      expect(a.time_buckets.date_histogram).to.have.property('fixed_interval', '24h');
     });
 
     it('sets min_doc_count to 0', () => {
diff --git a/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js b/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js
index 904fe69cbc57c..b36f37ac5cc9d 100644
--- a/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js
+++ b/src/plugins/vis_type_timelion/server/series_functions/es/lib/create_date_agg.js
@@ -19,6 +19,8 @@
 
 import _ from 'lodash';
 import { buildAggBody } from './agg_body';
+import { search } from '../../../../../../plugins/data/server';
+const { dateHistogramInterval } = search.aggs;
 
 export default function createDateAgg(config, tlConfig, scriptedFields) {
   const dateAgg = {
@@ -26,13 +28,13 @@ export default function createDateAgg(config, tlConfig, scriptedFields) {
       meta: { type: 'time_buckets' },
       date_histogram: {
         field: config.timefield,
-        interval: config.interval,
         time_zone: tlConfig.time.timezone,
         extended_bounds: {
           min: tlConfig.time.from,
           max: tlConfig.time.to,
         },
         min_doc_count: 0,
+        ...dateHistogramInterval(config.interval),
       },
     },
   };
diff --git a/tasks/config/run.js b/tasks/config/run.js
index 132b51765b3ed..148be6ea8afaa 100644
--- a/tasks/config/run.js
+++ b/tasks/config/run.js
@@ -154,12 +154,6 @@ module.exports = function () {
       args: ['scripts/test_hardening.js'],
     }),
 
-    test_package_safer_lodash_set: scriptWithGithubChecks({
-      title: '@elastic/safer-lodash-set tests',
-      cmd: YARN,
-      args: ['--cwd', 'packages/elastic-safer-lodash-set', 'test'],
-    }),
-
     apiIntegrationTests: scriptWithGithubChecks({
       title: 'API integration tests',
       cmd: NODE,
diff --git a/tasks/jenkins.js b/tasks/jenkins.js
index adfb6f0f46868..90efadf41c435 100644
--- a/tasks/jenkins.js
+++ b/tasks/jenkins.js
@@ -38,7 +38,6 @@ module.exports = function (grunt) {
     'run:test_jest_integration',
     'run:test_projects',
     'run:test_hardening',
-    'run:test_package_safer_lodash_set',
     'run:apiIntegrationTests',
   ]);
 };
diff --git a/test/scripts/test/safer_lodash_set.sh b/test/scripts/test/safer_lodash_set.sh
deleted file mode 100755
index 4d7f9c28210d1..0000000000000
--- a/test/scripts/test/safer_lodash_set.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-source src/dev/ci_setup/setup_env.sh
-
-yarn run grunt run:test_package_safer_lodash_set
diff --git a/vars/tasks.groovy b/vars/tasks.groovy
index 52641ce31f0be..edd2c0aa47401 100644
--- a/vars/tasks.groovy
+++ b/vars/tasks.groovy
@@ -34,7 +34,6 @@ def test() {
 
     kibanaPipeline.scriptTask('Jest Unit Tests', 'test/scripts/test/jest_unit.sh'),
     kibanaPipeline.scriptTask('API Integration Tests', 'test/scripts/test/api_integration.sh'),
-    kibanaPipeline.scriptTask('@elastic/safer-lodash-set Tests', 'test/scripts/test/safer_lodash_set.sh'),
     kibanaPipeline.scriptTask('X-Pack SIEM cyclic dependency', 'test/scripts/test/xpack_siem_cyclic_dependency.sh'),
     kibanaPipeline.scriptTask('X-Pack List cyclic dependency', 'test/scripts/test/xpack_list_cyclic_dependency.sh'),
     kibanaPipeline.scriptTask('X-Pack Jest Unit Tests', 'test/scripts/test/xpack_jest_unit.sh'),
diff --git a/x-pack/plugins/actions/README.md b/x-pack/plugins/actions/README.md
index 3bc8acead6c13..c55b21b2f9029 100644
--- a/x-pack/plugins/actions/README.md
+++ b/x-pack/plugins/actions/README.md
@@ -331,15 +331,17 @@ const result = await actionsClient.execute({
 
 Kibana ships with a set of built-in action types:
 
-| Type                      | Id            | Description                                                        |
-| ------------------------- | ------------- | ------------------------------------------------------------------ |
-| [Server log](#server-log) | `.server-log` | Logs messages to the Kibana log using Kibana's logger              |
-| [Email](#email)           | `.email`      | Sends an email using SMTP                                          |
-| [Slack](#slack)           | `.slack`      | Posts a message to a slack channel                                 |
-| [Index](#index)           | `.index`      | Indexes document(s) into Elasticsearch                             |
-| [Webhook](#webhook)       | `.webhook`    | Send a payload to a web service using HTTP POST or PUT             |
-| [PagerDuty](#pagerduty)   | `.pagerduty`  | Trigger, resolve, or acknowlege an incident to a PagerDuty service |
-| [ServiceNow](#servicenow) | `.servicenow` | Create or update an incident to a ServiceNow instance              |
+| Type                            | Id            | Description                                                        |
+| ------------------------------- | ------------- | ------------------------------------------------------------------ |
+| [Server log](#server-log)       | `.server-log` | Logs messages to the Kibana log using Kibana's logger              |
+| [Email](#email)                 | `.email`      | Sends an email using SMTP                                          |
+| [Slack](#slack)                 | `.slack`      | Posts a message to a slack channel                                 |
+| [Index](#index)                 | `.index`      | Indexes document(s) into Elasticsearch                             |
+| [Webhook](#webhook)             | `.webhook`    | Send a payload to a web service using HTTP POST or PUT             |
+| [PagerDuty](#pagerduty)         | `.pagerduty`  | Trigger, resolve, or acknowlege an incident to a PagerDuty service |
+| [ServiceNow](#servicenow)       | `.servicenow` | Create or update an incident to a ServiceNow instance              |
+| [Jira](#jira)                   | `.jira`       | Create or update an issue to a Jira instance                       |
+| [IBM Resilient](#ibm-resilient) | `.resilient`  | Create or update an incident to a IBM Resilient instance           |
 
 ---
 
@@ -561,8 +563,8 @@ The ServiceNow action uses the [V2 Table API](https://developer.servicenow.com/a
 | Property      | Description                                                                                                               | Type                  |
 | ------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------- |
 | savedObjectId | The id of the saved object.                                                                                               | string                |
-| title         | The title of the case.                                                                                                    | string _(optional)_   |
-| description   | The description of the case.                                                                                              | string _(optional)_   |
+| title         | The title of the incident.                                                                                                | string _(optional)_   |
+| description   | The description of the incident.                                                                                          | string _(optional)_   |
 | comment       | A comment.                                                                                                                | string _(optional)_   |
 | comments      | The comments of the case. A comment is of the form `{ commentId: string, version: string, comment: string }`.             | object[] _(optional)_ |
 | externalId    | The id of the incident in ServiceNow. If presented the incident will be update. Otherwise a new incident will be created. | string _(optional)_   |
@@ -601,16 +603,16 @@ The Jira action uses the [V2 API](https://developer.atlassian.com/cloud/jira/pla
 
 #### `subActionParams (pushToService)`
 
-| Property      | Description                                                                                                         | Type                  |
-| ------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------- |
-| savedObjectId | The id of the saved object                                                                                          | string                |
-| title         | The title of the case                                                                                               | string _(optional)_   |
-| description   | The description of the case                                                                                         | string _(optional)_   |
-| externalId    | The id of the incident in Jira. If presented the incident will be update. Otherwise a new incident will be created. | string _(optional)_   |
-| issueType     | The id of the issue type in Jira.                                                                                   | string _(optional)_   |
-| priority      | The name of the priority in Jira. Example: `Medium`.                                                                | string _(optional)_   |
-| labels        | An array of labels.                                                                                                 | string[] _(optional)_ |
-| comments      | The comments of the case. A comment is of the form `{ commentId: string, version: string, comment: string }`        | object[] _(optional)_ |
+| Property      | Description                                                                                                      | Type                  |
+| ------------- | ---------------------------------------------------------------------------------------------------------------- | --------------------- |
+| savedObjectId | The id of the saved object                                                                                       | string                |
+| title         | The title of the issue                                                                                           | string _(optional)_   |
+| description   | The description of the issue                                                                                     | string _(optional)_   |
+| externalId    | The id of the issue in Jira. If presented the incident will be update. Otherwise a new incident will be created. | string _(optional)_   |
+| issueType     | The id of the issue type in Jira.                                                                                | string _(optional)_   |
+| priority      | The name of the priority in Jira. Example: `Medium`.                                                             | string _(optional)_   |
+| labels        | An array of labels.                                                                                              | string[] _(optional)_ |
+| comments      | The comments of the case. A comment is of the form `{ commentId: string, version: string, comment: string }`     | object[] _(optional)_ |
 
 #### `subActionParams (issueTypes)`
 
@@ -628,10 +630,10 @@ ID: `.resilient`
 
 ### `config`
 
-| Property              | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Type   |
-| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------ |
-| apiUrl                | IBM Resilient instance URL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | string |
-| incidentConfiguration | Case configuration object. The object should contain an attribute called `mapping`. A `mapping` is an array of objects. Each mapping object should be of the form `{ source: string, target: string, actionType: string }`. `source` is the Case field. `target` is the Jira field where `source` will be mapped to. `actionType` can be one of `nothing`, `overwrite` or `append`. For example the `{ source: 'title', target: 'summary', actionType: 'overwrite' }` record, inside mapping array, means that the title of a case will be mapped to the short description of an incident in IBM Resilient and will be overwrite on each update. | object |
+| Property              | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Type   |
+| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
+| apiUrl                | IBM Resilient instance URL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | string |
+| incidentConfiguration | Optional property and specific to **Cases only**. If defined, the object should contain an attribute called `mapping`. A `mapping` is an array of objects. Each mapping object should be of the form `{ source: string, target: string, actionType: string }`. `source` is the Case field. `target` is the Jira field where `source` will be mapped to. `actionType` can be one of `nothing`, `overwrite` or `append`. For example the `{ source: 'title', target: 'summary', actionType: 'overwrite' }` record, inside mapping array, means that the title of a case will be mapped to the short description of an incident in IBM Resilient and will be overwrite on each update. | object |
 
 ### `secrets`
 
@@ -652,10 +654,12 @@ ID: `.resilient`
 | Property      | Description                                                                                                                  | Type                  |
 | ------------- | ---------------------------------------------------------------------------------------------------------------------------- | --------------------- |
 | savedObjectId | The id of the saved object                                                                                                   | string                |
-| title         | The title of the case                                                                                                        | string _(optional)_   |
-| description   | The description of the case                                                                                                  | string _(optional)_   |
-| comments      | The comments of the case. A comment is of the form `{ commentId: string, version: string, comment: string }`                 | object[] _(optional)_ |
+| title         | The title of the incident                                                                                                    | string _(optional)_   |
+| description   | The description of the incident                                                                                              | string _(optional)_   |
+| comments      | The comments of the incident. A comment is of the form `{ commentId: string, version: string, comment: string }`             | object[] _(optional)_ |
 | externalId    | The id of the incident in IBM Resilient. If presented the incident will be update. Otherwise a new incident will be created. | string _(optional)_   |
+| incidentTypes | An array with the ids of IBM Resilient incident types.                                                                       | number[] _(optional)_ |
+| severityCode  | IBM Resilient id of the severity code.                                                                                       | number _(optional)_   |
 
 # Command Line Utility
 
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/api.ts b/x-pack/plugins/actions/server/builtin_action_types/case/api.ts
deleted file mode 100644
index de4b7edaed3da..0000000000000
--- a/x-pack/plugins/actions/server/builtin_action_types/case/api.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  ExternalServiceApi,
-  ExternalServiceParams,
-  PushToServiceResponse,
-  GetIncidentApiHandlerArgs,
-  HandshakeApiHandlerArgs,
-  PushToServiceApiHandlerArgs,
-} from './types';
-import { prepareFieldsForTransformation, transformFields, transformComments } from './utils';
-
-const handshakeHandler = async ({
-  externalService,
-  mapping,
-  params,
-}: HandshakeApiHandlerArgs) => {};
-const getIncidentHandler = async ({
-  externalService,
-  mapping,
-  params,
-}: GetIncidentApiHandlerArgs) => {};
-
-const pushToServiceHandler = async ({
-  externalService,
-  mapping,
-  params,
-}: PushToServiceApiHandlerArgs): Promise<PushToServiceResponse> => {
-  const { externalId, comments } = params;
-  const updateIncident = externalId ? true : false;
-  const defaultPipes = updateIncident ? ['informationUpdated'] : ['informationCreated'];
-  let currentIncident: ExternalServiceParams | undefined;
-  let res: PushToServiceResponse;
-
-  if (externalId) {
-    currentIncident = await externalService.getIncident(externalId);
-  }
-
-  const fields = prepareFieldsForTransformation({
-    externalCase: params.externalCase,
-    mapping,
-    defaultPipes,
-  });
-
-  const incident = transformFields({
-    params,
-    fields,
-    currentIncident,
-  });
-
-  if (updateIncident) {
-    res = await externalService.updateIncident({ incidentId: externalId, incident });
-  } else {
-    res = await externalService.createIncident({ incident });
-  }
-
-  if (
-    comments &&
-    Array.isArray(comments) &&
-    comments.length > 0 &&
-    mapping.get('comments')?.actionType !== 'nothing'
-  ) {
-    const commentsTransformed = transformComments(comments, ['informationAdded']);
-
-    res.comments = [];
-    for (const currentComment of commentsTransformed) {
-      const comment = await externalService.createComment({
-        incidentId: res.id,
-        comment: currentComment,
-        field: mapping.get('comments')?.target ?? 'comments',
-      });
-      res.comments = [
-        ...(res.comments ?? []),
-        {
-          commentId: comment.commentId,
-          pushedDate: comment.pushedDate,
-        },
-      ];
-    }
-  }
-
-  return res;
-};
-
-export const api: ExternalServiceApi = {
-  handshake: handshakeHandler,
-  pushToService: pushToServiceHandler,
-  getIncident: getIncidentHandler,
-};
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/common_schema.ts b/x-pack/plugins/actions/server/builtin_action_types/case/common_schema.ts
deleted file mode 100644
index 5a23eb89339e6..0000000000000
--- a/x-pack/plugins/actions/server/builtin_action_types/case/common_schema.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { schema } from '@kbn/config-schema';
-
-export const MappingActionType = schema.oneOf([
-  schema.literal('nothing'),
-  schema.literal('overwrite'),
-  schema.literal('append'),
-]);
-
-export const MapRecordSchema = schema.object({
-  source: schema.string(),
-  target: schema.string(),
-  actionType: MappingActionType,
-});
-
-export const IncidentConfigurationSchema = schema.object({
-  mapping: schema.arrayOf(MapRecordSchema),
-});
-
-export const UserSchema = schema.object({
-  fullName: schema.nullable(schema.string()),
-  username: schema.nullable(schema.string()),
-});
-
-export const EntityInformation = {
-  createdAt: schema.nullable(schema.string()),
-  createdBy: schema.nullable(UserSchema),
-  updatedAt: schema.nullable(schema.string()),
-  updatedBy: schema.nullable(UserSchema),
-};
-
-export const EntityInformationSchema = schema.object(EntityInformation);
-
-export const CommentSchema = schema.object({
-  commentId: schema.string(),
-  comment: schema.string(),
-  ...EntityInformation,
-});
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/common_types.ts b/x-pack/plugins/actions/server/builtin_action_types/case/common_types.ts
deleted file mode 100644
index cca83fb88ca92..0000000000000
--- a/x-pack/plugins/actions/server/builtin_action_types/case/common_types.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { TypeOf } from '@kbn/config-schema';
-import {
-  IncidentConfigurationSchema,
-  MapRecordSchema,
-  CommentSchema,
-  EntityInformationSchema,
-} from './common_schema';
-
-export interface CreateCommentRequest {
-  [key: string]: string;
-}
-
-export type IncidentConfiguration = TypeOf<typeof IncidentConfigurationSchema>;
-export type MapRecord = TypeOf<typeof MapRecordSchema>;
-export type Comment = TypeOf<typeof CommentSchema>;
-export type EntityInformation = TypeOf<typeof EntityInformationSchema>;
-
-export interface ExternalServiceCommentResponse {
-  commentId: string;
-  pushedDate: string;
-  externalCommentId?: string;
-}
-
-export interface PipedField {
-  key: string;
-  value: string;
-  actionType: string;
-  pipes: string[];
-}
-
-export interface TransformFieldsArgs<P, S> {
-  params: P;
-  fields: PipedField[];
-  currentIncident?: S;
-}
-
-export interface TransformerArgs {
-  value: string;
-  date?: string;
-  user?: string;
-  previousValue?: string;
-}
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/schema.ts b/x-pack/plugins/actions/server/builtin_action_types/case/schema.ts
index f47686c911ff0..5a23eb89339e6 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/case/schema.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/case/schema.ts
@@ -18,36 +18,18 @@ export const MapRecordSchema = schema.object({
   actionType: MappingActionType,
 });
 
-export const CaseConfigurationSchema = schema.object({
+export const IncidentConfigurationSchema = schema.object({
   mapping: schema.arrayOf(MapRecordSchema),
 });
 
-export const ExternalIncidentServiceConfiguration = {
-  apiUrl: schema.string(),
-  casesConfiguration: CaseConfigurationSchema,
-};
-
-export const ExternalIncidentServiceConfigurationSchema = schema.object(
-  ExternalIncidentServiceConfiguration
-);
-
-export const ExternalIncidentServiceSecretConfiguration = {
-  password: schema.string(),
-  username: schema.string(),
-};
-
-export const ExternalIncidentServiceSecretConfigurationSchema = schema.object(
-  ExternalIncidentServiceSecretConfiguration
-);
-
 export const UserSchema = schema.object({
   fullName: schema.nullable(schema.string()),
   username: schema.nullable(schema.string()),
 });
 
-const EntityInformation = {
-  createdAt: schema.string(),
-  createdBy: UserSchema,
+export const EntityInformation = {
+  createdAt: schema.nullable(schema.string()),
+  createdBy: schema.nullable(UserSchema),
   updatedAt: schema.nullable(schema.string()),
   updatedBy: schema.nullable(UserSchema),
 };
@@ -59,40 +41,3 @@ export const CommentSchema = schema.object({
   comment: schema.string(),
   ...EntityInformation,
 });
-
-export const ExecutorSubActionSchema = schema.oneOf([
-  schema.literal('getIncident'),
-  schema.literal('pushToService'),
-  schema.literal('handshake'),
-]);
-
-export const ExecutorSubActionPushParamsSchema = schema.object({
-  savedObjectId: schema.string(),
-  title: schema.string(),
-  description: schema.nullable(schema.string()),
-  comments: schema.nullable(schema.arrayOf(CommentSchema)),
-  externalId: schema.nullable(schema.string()),
-  ...EntityInformation,
-});
-
-export const ExecutorSubActionGetIncidentParamsSchema = schema.object({
-  externalId: schema.string(),
-});
-
-// Reserved for future implementation
-export const ExecutorSubActionHandshakeParamsSchema = schema.object({});
-
-export const ExecutorParamsSchema = schema.oneOf([
-  schema.object({
-    subAction: schema.literal('getIncident'),
-    subActionParams: ExecutorSubActionGetIncidentParamsSchema,
-  }),
-  schema.object({
-    subAction: schema.literal('handshake'),
-    subActionParams: ExecutorSubActionHandshakeParamsSchema,
-  }),
-  schema.object({
-    subAction: schema.literal('pushToService'),
-    subActionParams: ExecutorSubActionPushParamsSchema,
-  }),
-]);
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/types.ts b/x-pack/plugins/actions/server/builtin_action_types/case/types.ts
index 1030e3d9c5d8e..73d8297c638df 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/case/types.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/case/types.ts
@@ -4,74 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-// This will have to remain `any` until we can extend connectors with generics
-// and circular dependencies eliminated.
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
 import { TypeOf } from '@kbn/config-schema';
-import { Logger } from '../../../../../../src/core/server';
-
 import {
-  ExternalIncidentServiceConfigurationSchema,
-  ExternalIncidentServiceSecretConfigurationSchema,
-  ExecutorParamsSchema,
-  CaseConfigurationSchema,
+  IncidentConfigurationSchema,
   MapRecordSchema,
   CommentSchema,
-  ExecutorSubActionPushParamsSchema,
-  ExecutorSubActionGetIncidentParamsSchema,
-  ExecutorSubActionHandshakeParamsSchema,
+  EntityInformationSchema,
 } from './schema';
-import { LicenseType } from '../../../../../legacy/common/constants';
-
-export interface AnyParams {
-  [index: string]: string | number | object | undefined | null;
-}
-
-export type ExternalIncidentServiceConfiguration = TypeOf<
-  typeof ExternalIncidentServiceConfigurationSchema
->;
-export type ExternalIncidentServiceSecretConfiguration = TypeOf<
-  typeof ExternalIncidentServiceSecretConfigurationSchema
->;
-
-export type ExecutorParams = TypeOf<typeof ExecutorParamsSchema>;
-export type ExecutorSubActionPushParams = TypeOf<typeof ExecutorSubActionPushParamsSchema>;
 
-export type ExecutorSubActionGetIncidentParams = TypeOf<
-  typeof ExecutorSubActionGetIncidentParamsSchema
->;
-
-export type ExecutorSubActionHandshakeParams = TypeOf<
-  typeof ExecutorSubActionHandshakeParamsSchema
->;
-
-export type CaseConfiguration = TypeOf<typeof CaseConfigurationSchema>;
+export type IncidentConfiguration = TypeOf<typeof IncidentConfigurationSchema>;
 export type MapRecord = TypeOf<typeof MapRecordSchema>;
 export type Comment = TypeOf<typeof CommentSchema>;
-
-export interface ExternalServiceConfiguration {
-  id: string;
-  name: string;
-  minimumLicenseRequired: LicenseType;
-}
-
-export interface ExternalServiceCredentials {
-  config: Record<string, any>;
-  secrets: Record<string, any>;
-}
-
-export interface ExternalServiceValidation {
-  config: (configurationUtilities: any, configObject: any) => void;
-  secrets: (configurationUtilities: any, secrets: any) => void;
-}
-
-export interface ExternalServiceIncidentResponse {
-  id: string;
-  title: string;
-  url: string;
-  pushedDate: string;
-}
+export type EntityInformation = TypeOf<typeof EntityInformationSchema>;
 
 export interface ExternalServiceCommentResponse {
   commentId: string;
@@ -79,69 +23,6 @@ export interface ExternalServiceCommentResponse {
   externalCommentId?: string;
 }
 
-export interface ExternalServiceParams {
-  [index: string]: any;
-}
-
-export interface ExternalService {
-  getIncident: (id: string) => Promise<any>;
-  createIncident: (params: ExternalServiceParams) => Promise<ExternalServiceIncidentResponse>;
-  updateIncident: (params: ExternalServiceParams) => Promise<ExternalServiceIncidentResponse>;
-  createComment: (params: ExternalServiceParams) => Promise<ExternalServiceCommentResponse>;
-}
-
-export interface PushToServiceApiParams extends ExecutorSubActionPushParams {
-  externalCase: Record<string, any>;
-}
-
-export interface ExternalServiceApiHandlerArgs {
-  externalService: ExternalService;
-  mapping: Map<string, any>;
-}
-
-export interface PushToServiceApiHandlerArgs extends ExternalServiceApiHandlerArgs {
-  params: PushToServiceApiParams;
-}
-
-export interface GetIncidentApiHandlerArgs extends ExternalServiceApiHandlerArgs {
-  params: ExecutorSubActionGetIncidentParams;
-}
-
-export interface HandshakeApiHandlerArgs extends ExternalServiceApiHandlerArgs {
-  params: ExecutorSubActionHandshakeParams;
-}
-
-export interface PushToServiceResponse extends ExternalServiceIncidentResponse {
-  comments?: ExternalServiceCommentResponse[];
-}
-
-export interface ExternalServiceApi {
-  handshake: (args: HandshakeApiHandlerArgs) => Promise<void>;
-  pushToService: (args: PushToServiceApiHandlerArgs) => Promise<PushToServiceResponse>;
-  getIncident: (args: GetIncidentApiHandlerArgs) => Promise<void>;
-}
-
-export interface CreateExternalServiceBasicArgs {
-  api: ExternalServiceApi;
-  createExternalService: (
-    credentials: ExternalServiceCredentials,
-    logger: Logger,
-    proxySettings?: any
-  ) => ExternalService;
-  logger: Logger;
-}
-
-export interface CreateExternalServiceArgs extends CreateExternalServiceBasicArgs {
-  config: ExternalServiceConfiguration;
-  validate: ExternalServiceValidation;
-  validationSchema: { config: any; secrets: any };
-}
-
-export interface CreateActionTypeArgs {
-  configurationUtilities: any;
-  executor?: any;
-}
-
 export interface PipedField {
   key: string;
   value: string;
@@ -149,16 +30,10 @@ export interface PipedField {
   pipes: string[];
 }
 
-export interface PrepareFieldsForTransformArgs {
-  externalCase: Record<string, any>;
-  mapping: Map<string, MapRecord>;
-  defaultPipes?: string[];
-}
-
-export interface TransformFieldsArgs {
-  params: PushToServiceApiParams;
+export interface TransformFieldsArgs<P, S> {
+  params: P;
   fields: PipedField[];
-  currentIncident?: ExternalServiceParams;
+  currentIncident?: S;
 }
 
 export interface TransformerArgs {
@@ -167,3 +42,13 @@ export interface TransformerArgs {
   user?: string;
   previousValue?: string;
 }
+
+export interface AnyParams {
+  [index: string]: string | number | object | undefined | null;
+}
+
+export interface PrepareFieldsForTransformArgs {
+  externalCase: Record<string, string>;
+  mapping: Map<string, MapRecord>;
+  defaultPipes?: string[];
+}
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/utils.test.ts b/x-pack/plugins/actions/server/builtin_action_types/case/utils.test.ts
index 2e3cee3946d61..600e18eb5daff 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/case/utils.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/case/utils.test.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
 import {
   normalizeMapping,
   buildMap,
@@ -14,7 +16,23 @@ import {
 } from './utils';
 
 import { SUPPORTED_SOURCE_FIELDS } from './constants';
-import { Comment, MapRecord, PushToServiceApiParams } from './types';
+import { Comment, MapRecord } from './types';
+
+interface Entity {
+  createdAt: string | null;
+  createdBy: { fullName: string; username: string } | null;
+  updatedAt: string | null;
+  updatedBy: { fullName: string; username: string } | null;
+}
+
+interface PushToServiceApiParams extends Entity {
+  savedObjectId: string;
+  title: string;
+  description: string | null;
+  externalId: string | null;
+  externalObject: Record<string, any>;
+  comments: Comment[];
+}
 
 const mapping: MapRecord[] = [
   { source: 'title', target: 'short_description', actionType: 'overwrite' },
@@ -22,7 +40,6 @@ const mapping: MapRecord[] = [
   { source: 'comments', target: 'comments', actionType: 'append' },
 ];
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const finalMapping: Map<string, any> = new Map();
 
 finalMapping.set('title', {
@@ -61,7 +78,7 @@ const fullParams: PushToServiceApiParams = {
   updatedAt: null,
   updatedBy: null,
   externalId: null,
-  externalCase: {
+  externalObject: {
     short_description: 'a title',
     description: 'a description',
   },
@@ -154,7 +171,7 @@ describe('mapParams', () => {
 describe('prepareFieldsForTransformation', () => {
   test('prepare fields with defaults', () => {
     const res = prepareFieldsForTransformation({
-      externalCase: fullParams.externalCase,
+      externalCase: fullParams.externalObject,
       mapping: finalMapping,
     });
     expect(res).toEqual([
@@ -175,7 +192,7 @@ describe('prepareFieldsForTransformation', () => {
 
   test('prepare fields with default pipes', () => {
     const res = prepareFieldsForTransformation({
-      externalCase: fullParams.externalCase,
+      externalCase: fullParams.externalObject,
       mapping: finalMapping,
       defaultPipes: ['myTestPipe'],
     });
@@ -199,11 +216,15 @@ describe('prepareFieldsForTransformation', () => {
 describe('transformFields', () => {
   test('transform fields for creation correctly', () => {
     const fields = prepareFieldsForTransformation({
-      externalCase: fullParams.externalCase,
+      externalCase: fullParams.externalObject,
       mapping: finalMapping,
     });
 
-    const res = transformFields({
+    const res = transformFields<
+      PushToServiceApiParams,
+      {},
+      { short_description: string; description: string }
+    >({
       params: fullParams,
       fields,
     });
@@ -216,12 +237,16 @@ describe('transformFields', () => {
 
   test('transform fields for update correctly', () => {
     const fields = prepareFieldsForTransformation({
-      externalCase: fullParams.externalCase,
+      externalCase: fullParams.externalObject,
       mapping: finalMapping,
       defaultPipes: ['informationUpdated'],
     });
 
-    const res = transformFields({
+    const res = transformFields<
+      PushToServiceApiParams,
+      {},
+      { short_description: string; description: string }
+    >({
       params: {
         ...fullParams,
         updatedAt: '2020-03-15T08:34:53.450Z',
@@ -245,12 +270,16 @@ describe('transformFields', () => {
 
   test('add newline character to description', () => {
     const fields = prepareFieldsForTransformation({
-      externalCase: fullParams.externalCase,
+      externalCase: fullParams.externalObject,
       mapping: finalMapping,
       defaultPipes: ['informationUpdated'],
     });
 
-    const res = transformFields({
+    const res = transformFields<
+      PushToServiceApiParams,
+      {},
+      { short_description: string; description: string }
+    >({
       params: fullParams,
       fields,
       currentIncident: {
@@ -263,11 +292,15 @@ describe('transformFields', () => {
 
   test('append username if fullname is undefined when create', () => {
     const fields = prepareFieldsForTransformation({
-      externalCase: fullParams.externalCase,
+      externalCase: fullParams.externalObject,
       mapping: finalMapping,
     });
 
-    const res = transformFields({
+    const res = transformFields<
+      PushToServiceApiParams,
+      {},
+      { short_description: string; description: string }
+    >({
       params: {
         ...fullParams,
         createdBy: { fullName: '', username: 'elastic' },
@@ -283,12 +316,16 @@ describe('transformFields', () => {
 
   test('append username if fullname is undefined when update', () => {
     const fields = prepareFieldsForTransformation({
-      externalCase: fullParams.externalCase,
+      externalCase: fullParams.externalObject,
       mapping: finalMapping,
       defaultPipes: ['informationUpdated'],
     });
 
-    const res = transformFields({
+    const res = transformFields<
+      PushToServiceApiParams,
+      {},
+      { short_description: string; description: string }
+    >({
       params: {
         ...fullParams,
         updatedAt: '2020-03-15T08:34:53.450Z',
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/utils.ts b/x-pack/plugins/actions/server/builtin_action_types/case/utils.ts
index 701bbea14fde8..3d51f5e826279 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/case/utils.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/case/utils.ts
@@ -4,30 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { curry, flow, get } from 'lodash';
-import { schema } from '@kbn/config-schema';
-
-import { ActionTypeExecutorOptions, ActionTypeExecutorResult, ActionType } from '../../types';
-
-import { ExecutorParamsSchema } from './schema';
-import {
-  ExternalIncidentServiceConfiguration,
-  ExternalIncidentServiceSecretConfiguration,
-} from './types';
+import { flow, get } from 'lodash';
 
 import {
-  CreateExternalServiceArgs,
-  CreateActionTypeArgs,
-  ExecutorParams,
   MapRecord,
-  AnyParams,
-  CreateExternalServiceBasicArgs,
-  PrepareFieldsForTransformArgs,
-  PipedField,
   TransformFieldsArgs,
   Comment,
-  ExecutorSubActionPushParams,
-  PushToServiceResponse,
+  EntityInformation,
+  PipedField,
+  AnyParams,
+  PrepareFieldsForTransformArgs,
 } from './types';
 
 import { transformers } from './transformers';
@@ -61,92 +47,6 @@ export const mapParams = <T extends {}>(params: T, mapping: Map<string, MapRecor
   }, {});
 };
 
-export const createConnectorExecutor = ({
-  api,
-  createExternalService,
-  logger,
-}: CreateExternalServiceBasicArgs) => async (
-  execOptions: ActionTypeExecutorOptions<
-    ExternalIncidentServiceConfiguration,
-    ExternalIncidentServiceSecretConfiguration,
-    ExecutorParams
-  >
-): Promise<ActionTypeExecutorResult<PushToServiceResponse | {}>> => {
-  const { actionId, config, params, secrets } = execOptions;
-  const { subAction, subActionParams } = params;
-  let data = {};
-
-  const res: ActionTypeExecutorResult<void> = {
-    status: 'ok',
-    actionId,
-  };
-
-  const externalService = createExternalService(
-    {
-      config,
-      secrets,
-    },
-    logger,
-    execOptions.proxySettings
-  );
-
-  if (!api[subAction]) {
-    throw new Error('[Action][ExternalService] Unsupported subAction type.');
-  }
-
-  if (subAction !== 'pushToService') {
-    throw new Error('[Action][ExternalService] subAction not implemented.');
-  }
-
-  if (subAction === 'pushToService') {
-    const pushToServiceParams = subActionParams as ExecutorSubActionPushParams;
-    const { comments, externalId, ...restParams } = pushToServiceParams;
-
-    const mapping = buildMap(config.casesConfiguration.mapping);
-    const externalCase = mapParams<ExecutorSubActionPushParams>(
-      restParams as ExecutorSubActionPushParams,
-      mapping
-    );
-
-    data = await api.pushToService({
-      externalService,
-      mapping,
-      params: { ...pushToServiceParams, externalCase },
-    });
-  }
-
-  return {
-    ...res,
-    data,
-  };
-};
-
-export const createConnector = ({
-  api,
-  config,
-  validate,
-  createExternalService,
-  validationSchema,
-  logger,
-}: CreateExternalServiceArgs) => {
-  return ({
-    configurationUtilities,
-    executor = createConnectorExecutor({ api, createExternalService, logger }),
-  }: CreateActionTypeArgs): ActionType => ({
-    ...config,
-    validate: {
-      config: schema.object(validationSchema.config, {
-        validate: curry(validate.config)(configurationUtilities),
-      }),
-      secrets: schema.object(validationSchema.secrets, {
-        validate: curry(validate.secrets)(configurationUtilities),
-      }),
-      params: ExecutorParamsSchema,
-    },
-    executor,
-  });
-};
-
 export const prepareFieldsForTransformation = ({
   externalCase,
   mapping,
@@ -165,11 +65,15 @@ export const prepareFieldsForTransformation = ({
     });
 };
 
-export const transformFields = ({
+export const transformFields = <
+  P extends EntityInformation,
+  S extends Record<string, unknown>,
+  R extends {}
+>({
   params,
   fields,
   currentIncident,
-}: TransformFieldsArgs): Record<string, string> => {
+}: TransformFieldsArgs<P, S>): R => {
   return fields.reduce((prev, cur) => {
     const transform = flow(...cur.pipes.map((p) => transformers[p]));
     return {
@@ -177,18 +81,11 @@ export const transformFields = ({
       [cur.key]: transform({
         value: cur.value,
         date: params.updatedAt ?? params.createdAt,
-        user:
-          (params.updatedBy != null
-            ? params.updatedBy.fullName
-              ? params.updatedBy.fullName
-              : params.updatedBy.username
-            : params.createdBy.fullName
-            ? params.createdBy.fullName
-            : params.createdBy.username) ?? '',
+        user: getEntity(params),
         previousValue: currentIncident ? currentIncident[cur.key] : '',
       }).value,
     };
-  }, {});
+  }, {} as R);
 };
 
 export const transformComments = (comments: Comment[], pipes: string[]): Comment[] => {
@@ -197,18 +94,18 @@ export const transformComments = (comments: Comment[], pipes: string[]): Comment
     comment: flow(...pipes.map((p) => transformers[p]))({
       value: c.comment,
       date: c.updatedAt ?? c.createdAt,
-      user:
-        (c.updatedBy != null
-          ? c.updatedBy.fullName
-            ? c.updatedBy.fullName
-            : c.updatedBy.username
-          : c.createdBy.fullName
-          ? c.createdBy.fullName
-          : c.createdBy.username) ?? '',
+      user: getEntity(c),
     }).value,
   }));
 };
 
-export const getErrorMessage = (connector: string, msg: string) => {
-  return `[Action][${connector}]: ${msg}`;
-};
+export const getEntity = (entity: EntityInformation): string =>
+  (entity.updatedBy != null
+    ? entity.updatedBy.fullName
+      ? entity.updatedBy.fullName
+      : entity.updatedBy.username
+    : entity.createdBy != null
+    ? entity.createdBy.fullName
+      ? entity.createdBy.fullName
+      : entity.createdBy.username
+    : '') ?? '';
diff --git a/x-pack/plugins/actions/server/builtin_action_types/case/validators.ts b/x-pack/plugins/actions/server/builtin_action_types/case/validators.ts
deleted file mode 100644
index 08e8a8be6a3e6..0000000000000
--- a/x-pack/plugins/actions/server/builtin_action_types/case/validators.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { isEmpty } from 'lodash';
-
-import { ActionsConfigurationUtilities } from '../../actions_config';
-import {
-  ExternalIncidentServiceConfiguration,
-  ExternalIncidentServiceSecretConfiguration,
-} from './types';
-
-import * as i18n from './translations';
-
-export const validateCommonConfig = (
-  configurationUtilities: ActionsConfigurationUtilities,
-  configObject: ExternalIncidentServiceConfiguration
-) => {
-  try {
-    if (isEmpty(configObject.casesConfiguration.mapping)) {
-      return i18n.MAPPING_EMPTY;
-    }
-
-    configurationUtilities.ensureUriAllowed(configObject.apiUrl);
-  } catch (allowListError) {
-    return i18n.WHITE_LISTED_ERROR(allowListError.message);
-  }
-};
-
-export const validateCommonSecrets = (
-  configurationUtilities: ActionsConfigurationUtilities,
-  secrets: ExternalIncidentServiceSecretConfiguration
-) => {};
diff --git a/x-pack/plugins/actions/server/builtin_action_types/jira/api.ts b/x-pack/plugins/actions/server/builtin_action_types/jira/api.ts
index da47a4bfb839b..a64eb7a2036ca 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/jira/api.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/jira/api.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { flow } from 'lodash';
 import {
   ExternalServiceParams,
   PushToServiceApiHandlerArgs,
@@ -15,14 +14,11 @@ import {
   GetFieldsByIssueTypeHandlerArgs,
   GetIssueTypesHandlerArgs,
   PushToServiceApiParams,
+  PushToServiceResponse,
 } from './types';
 
 // TODO: to remove, need to support Case
-import { transformers } from '../case/transformers';
-import { TransformFieldsArgs, Comment, EntityInformation } from '../case/common_types';
-
-import { PushToServiceResponse } from './types';
-import { prepareFieldsForTransformation } from '../case/utils';
+import { prepareFieldsForTransformation, transformFields, transformComments } from '../case/utils';
 
 const handshakeHandler = async ({
   externalService,
@@ -81,7 +77,7 @@ const pushToServiceHandler = async ({
       defaultPipes,
     });
 
-    incident = transformFields({
+    incident = transformFields<PushToServiceApiParams, ExternalServiceParams, Incident>({
       params,
       fields,
       currentIncident,
@@ -132,47 +128,6 @@ const pushToServiceHandler = async ({
   return res;
 };
 
-export const transformFields = ({
-  params,
-  fields,
-  currentIncident,
-}: TransformFieldsArgs<PushToServiceApiParams, ExternalServiceParams>): Incident => {
-  return fields.reduce((prev, cur) => {
-    const transform = flow(...cur.pipes.map((p) => transformers[p]));
-    return {
-      ...prev,
-      [cur.key]: transform({
-        value: cur.value,
-        date: params.updatedAt ?? params.createdAt,
-        user: getEntity(params),
-        previousValue: currentIncident ? currentIncident[cur.key] : '',
-      }).value,
-    };
-  }, {} as Incident);
-};
-
-export const transformComments = (comments: Comment[], pipes: string[]): Comment[] => {
-  return comments.map((c) => ({
-    ...c,
-    comment: flow(...pipes.map((p) => transformers[p]))({
-      value: c.comment,
-      date: c.updatedAt ?? c.createdAt,
-      user: getEntity(c),
-    }).value,
-  }));
-};
-
-export const getEntity = (entity: EntityInformation): string =>
-  (entity.updatedBy != null
-    ? entity.updatedBy.fullName
-      ? entity.updatedBy.fullName
-      : entity.updatedBy.username
-    : entity.createdBy != null
-    ? entity.createdBy.fullName
-      ? entity.createdBy.fullName
-      : entity.createdBy.username
-    : '') ?? '';
-
 export const api: ExternalServiceApi = {
   handshake: handshakeHandler,
   pushToService: pushToServiceHandler,
diff --git a/x-pack/plugins/actions/server/builtin_action_types/jira/mocks.ts b/x-pack/plugins/actions/server/builtin_action_types/jira/mocks.ts
index e7841996fedef..53f8d43ebc2d8 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/jira/mocks.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/jira/mocks.ts
@@ -6,7 +6,7 @@
 
 import { ExternalService, PushToServiceApiParams, ExecutorSubActionPushParams } from './types';
 
-import { MapRecord } from '../case/common_types';
+import { MapRecord } from '../case/types';
 
 const createMock = (): jest.Mocked<ExternalService> => {
   const service = {
diff --git a/x-pack/plugins/actions/server/builtin_action_types/jira/schema.ts b/x-pack/plugins/actions/server/builtin_action_types/jira/schema.ts
index 07c8e22812b27..9fee465e72efc 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/jira/schema.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/jira/schema.ts
@@ -5,11 +5,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import {
-  CommentSchema,
-  EntityInformation,
-  IncidentConfigurationSchema,
-} from '../case/common_schema';
+import { CommentSchema, EntityInformation, IncidentConfigurationSchema } from '../case/schema';
 
 export const ExternalIncidentServiceConfiguration = {
   apiUrl: schema.string(),
diff --git a/x-pack/plugins/actions/server/builtin_action_types/jira/types.ts b/x-pack/plugins/actions/server/builtin_action_types/jira/types.ts
index 5e97f5309f8ee..6fe7c62976f22 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/jira/types.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/jira/types.ts
@@ -19,8 +19,8 @@ import {
   ExecutorSubActionGetFieldsByIssueTypeParamsSchema,
 } from './schema';
 import { ActionsConfigurationUtilities } from '../../actions_config';
-import { IncidentConfigurationSchema } from '../case/common_schema';
-import { Comment } from '../case/common_types';
+import { IncidentConfigurationSchema } from '../case/schema';
+import { Comment } from '../case/types';
 import { Logger } from '../../../../../../src/core/server';
 
 export type JiraPublicConfigurationType = TypeOf<typeof ExternalIncidentServiceConfigurationSchema>;
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/api.test.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/api.test.ts
index 734f6be382629..e974fedd0775b 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/api.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/api.test.ts
@@ -4,9 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { api } from '../case/api';
+import { Logger } from '../../../../../../src/core/server';
+import { api } from './api';
 import { externalServiceMock, mapping, apiParams } from './mocks';
-import { ExternalService } from '../case/types';
+import { ExternalService } from './types';
+
+let mockedLogger: jest.Mocked<Logger>;
 
 describe('api', () => {
   let externalService: jest.Mocked<ExternalService>;
@@ -23,7 +26,12 @@ describe('api', () => {
     describe('create incident', () => {
       test('it creates an incident', async () => {
         const params = { ...apiParams, externalId: null };
-        const res = await api.pushToService({ externalService, mapping, params });
+        const res = await api.pushToService({
+          externalService,
+          mapping,
+          params,
+          logger: mockedLogger,
+        });
 
         expect(res).toEqual({
           id: '1',
@@ -45,7 +53,12 @@ describe('api', () => {
 
       test('it creates an incident without comments', async () => {
         const params = { ...apiParams, externalId: null, comments: [] };
-        const res = await api.pushToService({ externalService, mapping, params });
+        const res = await api.pushToService({
+          externalService,
+          mapping,
+          params,
+          logger: mockedLogger,
+        });
 
         expect(res).toEqual({
           id: '1',
@@ -57,7 +70,7 @@ describe('api', () => {
 
       test('it calls createIncident correctly', async () => {
         const params = { ...apiParams, externalId: null };
-        await api.pushToService({ externalService, mapping, params });
+        await api.pushToService({ externalService, mapping, params, logger: mockedLogger });
 
         expect(externalService.createIncident).toHaveBeenCalledWith({
           incident: {
@@ -71,7 +84,7 @@ describe('api', () => {
 
       test('it calls createComment correctly', async () => {
         const params = { ...apiParams, externalId: null };
-        await api.pushToService({ externalService, mapping, params });
+        await api.pushToService({ externalService, mapping, params, logger: mockedLogger });
         expect(externalService.createComment).toHaveBeenCalledTimes(2);
         expect(externalService.createComment).toHaveBeenNthCalledWith(1, {
           incidentId: '1',
@@ -89,7 +102,6 @@ describe('api', () => {
               username: 'elastic',
             },
           },
-          field: 'comments',
         });
 
         expect(externalService.createComment).toHaveBeenNthCalledWith(2, {
@@ -108,14 +120,18 @@ describe('api', () => {
               username: 'elastic',
             },
           },
-          field: 'comments',
         });
       });
     });
 
     describe('update incident', () => {
       test('it updates an incident', async () => {
-        const res = await api.pushToService({ externalService, mapping, params: apiParams });
+        const res = await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
 
         expect(res).toEqual({
           id: '1',
@@ -137,7 +153,12 @@ describe('api', () => {
 
       test('it updates an incident without comments', async () => {
         const params = { ...apiParams, comments: [] };
-        const res = await api.pushToService({ externalService, mapping, params });
+        const res = await api.pushToService({
+          externalService,
+          mapping,
+          params,
+          logger: mockedLogger,
+        });
 
         expect(res).toEqual({
           id: '1',
@@ -149,7 +170,7 @@ describe('api', () => {
 
       test('it calls updateIncident correctly', async () => {
         const params = { ...apiParams };
-        await api.pushToService({ externalService, mapping, params });
+        await api.pushToService({ externalService, mapping, params, logger: mockedLogger });
 
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
@@ -164,7 +185,7 @@ describe('api', () => {
 
       test('it calls createComment correctly', async () => {
         const params = { ...apiParams };
-        await api.pushToService({ externalService, mapping, params });
+        await api.pushToService({ externalService, mapping, params, logger: mockedLogger });
         expect(externalService.createComment).toHaveBeenCalledTimes(2);
         expect(externalService.createComment).toHaveBeenNthCalledWith(1, {
           incidentId: '1',
@@ -182,7 +203,6 @@ describe('api', () => {
               username: 'elastic',
             },
           },
-          field: 'comments',
         });
 
         expect(externalService.createComment).toHaveBeenNthCalledWith(2, {
@@ -201,11 +221,52 @@ describe('api', () => {
               username: 'elastic',
             },
           },
-          field: 'comments',
         });
       });
     });
 
+    describe('incidentTypes', () => {
+      test('it returns the incident types correctly', async () => {
+        const res = await api.incidentTypes({
+          externalService,
+          params: {},
+        });
+        expect(res).toEqual([
+          {
+            id: 17,
+            name: 'Communication error (fax; email)',
+          },
+          {
+            id: 1001,
+            name: 'Custom type',
+          },
+        ]);
+      });
+    });
+
+    describe('severity', () => {
+      test('it returns the severity correctly', async () => {
+        const res = await api.severity({
+          externalService,
+          params: { id: '10006' },
+        });
+        expect(res).toEqual([
+          {
+            id: 4,
+            name: 'Low',
+          },
+          {
+            id: 5,
+            name: 'Medium',
+          },
+          {
+            id: 6,
+            name: 'High',
+          },
+        ]);
+      });
+    });
+
     describe('mapping variations', () => {
       test('overwrite & append', async () => {
         mapping.set('title', {
@@ -228,7 +289,12 @@ describe('api', () => {
           actionType: 'overwrite',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -260,7 +326,12 @@ describe('api', () => {
           actionType: 'nothing',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -291,7 +362,12 @@ describe('api', () => {
           actionType: 'append',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -324,7 +400,12 @@ describe('api', () => {
           actionType: 'nothing',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {},
@@ -352,7 +433,12 @@ describe('api', () => {
           actionType: 'overwrite',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -382,7 +468,12 @@ describe('api', () => {
           actionType: 'overwrite',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -414,7 +505,12 @@ describe('api', () => {
           actionType: 'nothing',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -445,7 +541,12 @@ describe('api', () => {
           actionType: 'append',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -478,7 +579,12 @@ describe('api', () => {
           actionType: 'append',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.updateIncident).toHaveBeenCalledWith({
           incidentId: 'incident-3',
           incident: {
@@ -509,7 +615,12 @@ describe('api', () => {
           actionType: 'overwrite',
         });
 
-        await api.pushToService({ externalService, mapping, params: apiParams });
+        await api.pushToService({
+          externalService,
+          mapping,
+          params: apiParams,
+          logger: mockedLogger,
+        });
         expect(externalService.createComment).not.toHaveBeenCalled();
       });
     });
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/api.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/api.ts
index 3db66e5884af4..af3984bf5f0fa 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/api.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/api.ts
@@ -4,4 +4,129 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { api } from '../case/api';
+import {
+  ExternalServiceParams,
+  PushToServiceApiHandlerArgs,
+  HandshakeApiHandlerArgs,
+  GetIncidentApiHandlerArgs,
+  ExternalServiceApi,
+  Incident,
+  GetIncidentTypesHandlerArgs,
+  GetSeverityHandlerArgs,
+  PushToServiceApiParams,
+  PushToServiceResponse,
+} from './types';
+
+// TODO: to remove, need to support Case
+import { transformFields, prepareFieldsForTransformation, transformComments } from '../case/utils';
+
+const handshakeHandler = async ({
+  externalService,
+  mapping,
+  params,
+}: HandshakeApiHandlerArgs) => {};
+
+const getIncidentHandler = async ({
+  externalService,
+  mapping,
+  params,
+}: GetIncidentApiHandlerArgs) => {};
+
+const getIncidentTypesHandler = async ({ externalService }: GetIncidentTypesHandlerArgs) => {
+  const res = await externalService.getIncidentTypes();
+  return res;
+};
+
+const getSeverityHandler = async ({ externalService }: GetSeverityHandlerArgs) => {
+  const res = await externalService.getSeverity();
+  return res;
+};
+
+const pushToServiceHandler = async ({
+  externalService,
+  mapping,
+  params,
+  logger,
+}: PushToServiceApiHandlerArgs): Promise<PushToServiceResponse> => {
+  const { externalId, comments } = params;
+  const updateIncident = externalId ? true : false;
+  const defaultPipes = updateIncident ? ['informationUpdated'] : ['informationCreated'];
+  let currentIncident: ExternalServiceParams | undefined;
+  let res: PushToServiceResponse;
+
+  if (externalId) {
+    try {
+      currentIncident = await externalService.getIncident(externalId);
+    } catch (ex) {
+      logger.debug(
+        `Retrieving Incident by id ${externalId} from IBM Resilient was failed with exception: ${ex}`
+      );
+    }
+  }
+
+  let incident: Incident;
+  // TODO: should be removed later but currently keep it for the Case implementation support
+  if (mapping) {
+    const fields = prepareFieldsForTransformation({
+      externalCase: params.externalObject,
+      mapping,
+      defaultPipes,
+    });
+
+    incident = transformFields<PushToServiceApiParams, ExternalServiceParams, Incident>({
+      params,
+      fields,
+      currentIncident,
+    });
+  } else {
+    const { title, description, incidentTypes, severityCode } = params;
+    incident = { name: title, description, incidentTypes, severityCode };
+  }
+
+  if (externalId != null) {
+    res = await externalService.updateIncident({
+      incidentId: externalId,
+      incident,
+    });
+  } else {
+    res = await externalService.createIncident({
+      incident: {
+        ...incident,
+      },
+    });
+  }
+
+  if (comments && Array.isArray(comments) && comments.length > 0) {
+    if (mapping && mapping.get('comments')?.actionType === 'nothing') {
+      return res;
+    }
+    const commentsTransformed = mapping
+      ? transformComments(comments, ['informationAdded'])
+      : comments;
+
+    res.comments = [];
+    for (const currentComment of commentsTransformed) {
+      const comment = await externalService.createComment({
+        incidentId: res.id,
+        comment: currentComment,
+      });
+      res.comments = [
+        ...(res.comments ?? []),
+        {
+          commentId: comment.commentId,
+          pushedDate: comment.pushedDate,
+        },
+      ];
+    }
+  }
+
+  return res;
+};
+
+export const api: ExternalServiceApi = {
+  handshake: handshakeHandler,
+  pushToService: pushToServiceHandler,
+  getIncident: getIncidentHandler,
+  incidentTypes: getIncidentTypesHandler,
+  severity: getSeverityHandler,
+};
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/config.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/config.ts
deleted file mode 100644
index 4ce9417bfa9a1..0000000000000
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/config.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ExternalServiceConfiguration } from '../case/types';
-import * as i18n from './translations';
-
-export const config: ExternalServiceConfiguration = {
-  id: '.resilient',
-  name: i18n.NAME,
-  minimumLicenseRequired: 'platinum',
-};
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/index.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/index.ts
index 1e9cb15589702..53285a2a350af 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/index.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/index.ts
@@ -4,33 +4,139 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Logger } from '../../../../../../src/core/server';
-import { createConnector } from '../case/utils';
+import { curry } from 'lodash';
+import { schema } from '@kbn/config-schema';
 
-import { api } from './api';
-import { config } from './config';
 import { validate } from './validators';
-import { createExternalService } from './service';
-import { ResilientSecretConfiguration, ResilientPublicConfiguration } from './schema';
+import {
+  ExternalIncidentServiceConfiguration,
+  ExternalIncidentServiceSecretConfiguration,
+  ExecutorParamsSchema,
+} from './schema';
 import { ActionsConfigurationUtilities } from '../../actions_config';
-import { ActionType } from '../../types';
+import { ActionType, ActionTypeExecutorOptions, ActionTypeExecutorResult } from '../../types';
+import { createExternalService } from './service';
+import { api } from './api';
+import {
+  ExecutorParams,
+  ExecutorSubActionPushParams,
+  ResilientPublicConfigurationType,
+  ResilientSecretConfigurationType,
+  ResilientExecutorResultData,
+  ExecutorSubActionGetIncidentTypesParams,
+  ExecutorSubActionGetSeverityParams,
+} from './types';
+import * as i18n from './translations';
+import { Logger } from '../../../../../../src/core/server';
 
-export function getActionType({
-  logger,
-  configurationUtilities,
-}: {
+// TODO: to remove, need to support Case
+import { buildMap, mapParams } from '../case/utils';
+
+interface GetActionTypeParams {
   logger: Logger;
   configurationUtilities: ActionsConfigurationUtilities;
-}): ActionType {
-  return createConnector({
-    api,
-    config,
-    validate,
-    createExternalService,
-    validationSchema: {
-      config: ResilientPublicConfiguration,
-      secrets: ResilientSecretConfiguration,
+}
+
+const supportedSubActions: string[] = ['pushToService', 'incidentTypes', 'severity'];
+
+// action type definition
+export function getActionType(
+  params: GetActionTypeParams
+): ActionType<
+  ResilientPublicConfigurationType,
+  ResilientSecretConfigurationType,
+  ExecutorParams,
+  ResilientExecutorResultData | {}
+> {
+  const { logger, configurationUtilities } = params;
+  return {
+    id: '.resilient',
+    minimumLicenseRequired: 'platinum',
+    name: i18n.NAME,
+    validate: {
+      config: schema.object(ExternalIncidentServiceConfiguration, {
+        validate: curry(validate.config)(configurationUtilities),
+      }),
+      secrets: schema.object(ExternalIncidentServiceSecretConfiguration, {
+        validate: curry(validate.secrets)(configurationUtilities),
+      }),
+      params: ExecutorParamsSchema,
+    },
+    executor: curry(executor)({ logger }),
+  };
+}
+
+// action executor
+async function executor(
+  { logger }: { logger: Logger },
+  execOptions: ActionTypeExecutorOptions<
+    ResilientPublicConfigurationType,
+    ResilientSecretConfigurationType,
+    ExecutorParams
+  >
+): Promise<ActionTypeExecutorResult<ResilientExecutorResultData | {}>> {
+  const { actionId, config, params, secrets } = execOptions;
+  const { subAction, subActionParams } = params as ExecutorParams;
+  let data: ResilientExecutorResultData | null = null;
+
+  const externalService = createExternalService(
+    {
+      config,
+      secrets,
     },
     logger,
-  })({ configurationUtilities });
+    execOptions.proxySettings
+  );
+
+  if (!api[subAction]) {
+    const errorMessage = `[Action][ExternalService] Unsupported subAction type ${subAction}.`;
+    logger.error(errorMessage);
+    throw new Error(errorMessage);
+  }
+
+  if (!supportedSubActions.includes(subAction)) {
+    const errorMessage = `[Action][ExternalService] subAction ${subAction} not implemented.`;
+    logger.error(errorMessage);
+    throw new Error(errorMessage);
+  }
+
+  if (subAction === 'pushToService') {
+    const pushToServiceParams = subActionParams as ExecutorSubActionPushParams;
+
+    const { comments, externalId, ...restParams } = pushToServiceParams;
+    const mapping = config.incidentConfiguration
+      ? buildMap(config.incidentConfiguration.mapping)
+      : null;
+    const externalObject =
+      config.incidentConfiguration && mapping
+        ? mapParams<ExecutorSubActionPushParams>(restParams as ExecutorSubActionPushParams, mapping)
+        : {};
+
+    data = await api.pushToService({
+      externalService,
+      mapping,
+      params: { ...pushToServiceParams, externalObject },
+      logger,
+    });
+
+    logger.debug(`response push to service for incident id: ${data.id}`);
+  }
+
+  if (subAction === 'incidentTypes') {
+    const incidentTypesParams = subActionParams as ExecutorSubActionGetIncidentTypesParams;
+    data = await api.incidentTypes({
+      externalService,
+      params: incidentTypesParams,
+    });
+  }
+
+  if (subAction === 'severity') {
+    const severityParams = subActionParams as ExecutorSubActionGetSeverityParams;
+    data = await api.severity({
+      externalService,
+      params: severityParams,
+    });
+  }
+
+  return { status: 'ok', data: data ?? {}, actionId };
 }
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/mocks.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/mocks.ts
index bba9c58bf28c9..2e841728159a3 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/mocks.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/mocks.ts
@@ -4,12 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  ExternalService,
-  PushToServiceApiParams,
-  ExecutorSubActionPushParams,
-  MapRecord,
-} from '../case/types';
+import { ExternalService, PushToServiceApiParams, ExecutorSubActionPushParams } from './types';
+
+import { MapRecord } from '../case/types';
 
 const createMock = (): jest.Mocked<ExternalService> => {
   const service = {
@@ -40,6 +37,25 @@ const createMock = (): jest.Mocked<ExternalService> => {
       })
     ),
     createComment: jest.fn(),
+    findIncidents: jest.fn(),
+    getIncidentTypes: jest.fn().mockImplementation(() => [
+      { id: 17, name: 'Communication error (fax; email)' },
+      { id: 1001, name: 'Custom type' },
+    ]),
+    getSeverity: jest.fn().mockImplementation(() => [
+      {
+        id: 4,
+        name: 'Low',
+      },
+      {
+        id: 5,
+        name: 'Medium',
+      },
+      {
+        id: 6,
+        name: 'High',
+      },
+    ]),
   };
 
   service.createComment.mockImplementationOnce(() =>
@@ -96,6 +112,8 @@ const executorParams: ExecutorSubActionPushParams = {
   updatedBy: { fullName: 'Elastic User', username: 'elastic' },
   title: 'Incident title',
   description: 'Incident description',
+  incidentTypes: [1001],
+  severityCode: 6,
   comments: [
     {
       commentId: 'case-comment-1',
@@ -118,7 +136,58 @@ const executorParams: ExecutorSubActionPushParams = {
 
 const apiParams: PushToServiceApiParams = {
   ...executorParams,
-  externalCase: { name: 'Incident title', description: 'Incident description' },
+  externalObject: { name: 'Incident title', description: 'Incident description' },
 };
 
-export { externalServiceMock, mapping, executorParams, apiParams };
+const incidentTypes = [
+  {
+    value: 17,
+    label: 'Communication error (fax; email)',
+    enabled: true,
+    properties: null,
+    uuid: '4a8d22f7-d89e-4403-85c7-2bafe3b7f2ae',
+    hidden: false,
+    default: false,
+  },
+  {
+    value: 1001,
+    label: 'Custom type',
+    enabled: true,
+    properties: null,
+    uuid: '3b51c8c2-9758-48f8-b013-bd141f1d2ec9',
+    hidden: false,
+    default: false,
+  },
+];
+
+const severity = [
+  {
+    value: 4,
+    label: 'Low',
+    enabled: true,
+    properties: null,
+    uuid: '97cae239-963d-4e36-be34-07e47ef2cc86',
+    hidden: false,
+    default: true,
+  },
+  {
+    value: 5,
+    label: 'Medium',
+    enabled: true,
+    properties: null,
+    uuid: 'c2c354c9-6d1e-4a48-82e5-bd5dc5068339',
+    hidden: false,
+    default: false,
+  },
+  {
+    value: 6,
+    label: 'High',
+    enabled: true,
+    properties: null,
+    uuid: '93e5c99c-563b-48b9-80a3-9572307622d8',
+    hidden: false,
+    default: false,
+  },
+];
+
+export { externalServiceMock, mapping, executorParams, apiParams, incidentTypes, severity };
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/schema.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/schema.ts
index c13de2b27e2b9..151f703dcc07e 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/schema.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/schema.ts
@@ -5,18 +5,77 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { ExternalIncidentServiceConfiguration } from '../case/schema';
+import { CommentSchema, EntityInformation, IncidentConfigurationSchema } from '../case/schema';
 
-export const ResilientPublicConfiguration = {
+export const ExternalIncidentServiceConfiguration = {
+  apiUrl: schema.string(),
   orgId: schema.string(),
-  ...ExternalIncidentServiceConfiguration,
+  // TODO: to remove - set it optional for the current stage to support Case implementation
+  incidentConfiguration: schema.nullable(IncidentConfigurationSchema),
+  isCaseOwned: schema.nullable(schema.boolean()),
 };
 
-export const ResilientPublicConfigurationSchema = schema.object(ResilientPublicConfiguration);
+export const ExternalIncidentServiceConfigurationSchema = schema.object(
+  ExternalIncidentServiceConfiguration
+);
 
-export const ResilientSecretConfiguration = {
+export const ExternalIncidentServiceSecretConfiguration = {
   apiKeyId: schema.string(),
   apiKeySecret: schema.string(),
 };
 
-export const ResilientSecretConfigurationSchema = schema.object(ResilientSecretConfiguration);
+export const ExternalIncidentServiceSecretConfigurationSchema = schema.object(
+  ExternalIncidentServiceSecretConfiguration
+);
+
+export const ExecutorSubActionSchema = schema.oneOf([
+  schema.literal('getIncident'),
+  schema.literal('pushToService'),
+  schema.literal('handshake'),
+  schema.literal('incidentTypes'),
+  schema.literal('severity'),
+]);
+
+export const ExecutorSubActionPushParamsSchema = schema.object({
+  savedObjectId: schema.string(),
+  title: schema.string(),
+  description: schema.nullable(schema.string()),
+  externalId: schema.nullable(schema.string()),
+  incidentTypes: schema.nullable(schema.arrayOf(schema.number())),
+  severityCode: schema.nullable(schema.number()),
+  // TODO: remove later  - need for support Case push multiple comments
+  comments: schema.nullable(schema.arrayOf(CommentSchema)),
+  ...EntityInformation,
+});
+
+export const ExecutorSubActionGetIncidentParamsSchema = schema.object({
+  externalId: schema.string(),
+});
+
+// Reserved for future implementation
+export const ExecutorSubActionHandshakeParamsSchema = schema.object({});
+export const ExecutorSubActionGetIncidentTypesParamsSchema = schema.object({});
+export const ExecutorSubActionGetSeverityParamsSchema = schema.object({});
+
+export const ExecutorParamsSchema = schema.oneOf([
+  schema.object({
+    subAction: schema.literal('getIncident'),
+    subActionParams: ExecutorSubActionGetIncidentParamsSchema,
+  }),
+  schema.object({
+    subAction: schema.literal('handshake'),
+    subActionParams: ExecutorSubActionHandshakeParamsSchema,
+  }),
+  schema.object({
+    subAction: schema.literal('pushToService'),
+    subActionParams: ExecutorSubActionPushParamsSchema,
+  }),
+  schema.object({
+    subAction: schema.literal('incidentTypes'),
+    subActionParams: ExecutorSubActionGetIncidentTypesParamsSchema,
+  }),
+  schema.object({
+    subAction: schema.literal('severity'),
+    subActionParams: ExecutorSubActionGetSeverityParamsSchema,
+  }),
+]);
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/service.test.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/service.test.ts
index a9271671f68b9..86ea352625a5b 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/service.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/service.test.ts
@@ -8,9 +8,11 @@ import axios from 'axios';
 
 import { createExternalService, getValueTextContent, formatUpdateRequest } from './service';
 import * as utils from '../lib/axios_utils';
-import { ExternalService } from '../case/types';
+import { ExternalService } from './types';
 import { Logger } from '../../../../../../src/core/server';
 import { loggingSystemMock } from '../../../../../../src/core/server/mocks';
+import { incidentTypes, severity } from './mocks';
+
 const logger = loggingSystemMock.create().get() as jest.Mocked<Logger>;
 
 jest.mock('axios');
@@ -41,6 +43,8 @@ const mockIncidentUpdate = (withUpdateError = false) => {
         format: 'html',
         content: 'description',
       },
+      incident_type_ids: [1001, 16, 12],
+      severity_code: 6,
     },
   }));
 
@@ -246,7 +250,12 @@ describe('IBM Resilient service', () => {
       }));
 
       const res = await service.createIncident({
-        incident: { name: 'title', description: 'desc' },
+        incident: {
+          name: 'title',
+          description: 'desc',
+          incidentTypes: [1001],
+          severityCode: 6,
+        },
       });
 
       expect(res).toEqual({
@@ -269,12 +278,18 @@ describe('IBM Resilient service', () => {
       }));
 
       await service.createIncident({
-        incident: { name: 'title', description: 'desc' },
+        incident: {
+          name: 'title',
+          description: 'desc',
+          incidentTypes: [1001],
+          severityCode: 6,
+        },
       });
 
       expect(requestMock).toHaveBeenCalledWith({
         axios,
-        url: 'https://resilient.elastic.co/rest/orgs/201/incidents',
+        url:
+          'https://resilient.elastic.co/rest/orgs/201/incidents?text_content_output_format=objects_convert',
         logger,
         method: 'post',
         data: {
@@ -284,6 +299,8 @@ describe('IBM Resilient service', () => {
             content: 'desc',
           },
           discovered_date: TIMESTAMP,
+          incident_type_ids: [{ id: 1001 }],
+          severity_code: { id: 6 },
         },
       });
     });
@@ -295,7 +312,12 @@ describe('IBM Resilient service', () => {
 
       expect(
         service.createIncident({
-          incident: { name: 'title', description: 'desc' },
+          incident: {
+            name: 'title',
+            description: 'desc',
+            incidentTypes: [1001],
+            severityCode: 6,
+          },
         })
       ).rejects.toThrow(
         '[Action][IBM Resilient]: Unable to create incident. Error: An error has occurred'
@@ -308,7 +330,12 @@ describe('IBM Resilient service', () => {
       mockIncidentUpdate();
       const res = await service.updateIncident({
         incidentId: '1',
-        incident: { name: 'title_updated', description: 'desc_updated' },
+        incident: {
+          name: 'title',
+          description: 'desc',
+          incidentTypes: [1001],
+          severityCode: 6,
+        },
       });
 
       expect(res).toEqual({
@@ -324,7 +351,12 @@ describe('IBM Resilient service', () => {
 
       await service.updateIncident({
         incidentId: '1',
-        incident: { name: 'title_updated', description: 'desc_updated' },
+        incident: {
+          name: 'title_updated',
+          description: 'desc_updated',
+          incidentTypes: [1001],
+          severityCode: 5,
+        },
       });
 
       // Incident update makes three calls to the API.
@@ -356,6 +388,28 @@ describe('IBM Resilient service', () => {
                 },
               },
             },
+            {
+              field: {
+                name: 'incident_type_ids',
+              },
+              old_value: {
+                ids: [1001, 16, 12],
+              },
+              new_value: {
+                ids: [1001],
+              },
+            },
+            {
+              field: {
+                name: 'severity_code',
+              },
+              old_value: {
+                id: 6,
+              },
+              new_value: {
+                id: 5,
+              },
+            },
           ],
         },
       });
@@ -367,7 +421,12 @@ describe('IBM Resilient service', () => {
       expect(
         service.updateIncident({
           incidentId: '1',
-          incident: { name: 'title', description: 'desc' },
+          incident: {
+            name: 'title',
+            description: 'desc',
+            incidentTypes: [1001],
+            severityCode: 5,
+          },
         })
       ).rejects.toThrow(
         '[Action][IBM Resilient]: Unable to update incident with id 1. Error: An error has occurred'
@@ -386,8 +445,14 @@ describe('IBM Resilient service', () => {
 
       const res = await service.createComment({
         incidentId: '1',
-        comment: { comment: 'comment', commentId: 'comment-1' },
-        field: 'comments',
+        comment: {
+          comment: 'comment',
+          commentId: 'comment-1',
+          createdBy: null,
+          createdAt: null,
+          updatedAt: null,
+          updatedBy: null,
+        },
       });
 
       expect(res).toEqual({
@@ -407,8 +472,14 @@ describe('IBM Resilient service', () => {
 
       await service.createComment({
         incidentId: '1',
-        comment: { comment: 'comment', commentId: 'comment-1' },
-        field: 'my_field',
+        comment: {
+          comment: 'comment',
+          commentId: 'comment-1',
+          createdBy: null,
+          createdAt: null,
+          updatedAt: null,
+          updatedBy: null,
+        },
       });
 
       expect(requestMock).toHaveBeenCalledWith({
@@ -434,12 +505,82 @@ describe('IBM Resilient service', () => {
       expect(
         service.createComment({
           incidentId: '1',
-          comment: { comment: 'comment', commentId: 'comment-1' },
-          field: 'comments',
+          comment: {
+            comment: 'comment',
+            commentId: 'comment-1',
+            createdBy: null,
+            createdAt: null,
+            updatedAt: null,
+            updatedBy: null,
+          },
         })
       ).rejects.toThrow(
         '[Action][IBM Resilient]: Unable to create comment at incident with id 1. Error: An error has occurred'
       );
     });
   });
+
+  describe('getIncidentTypes', () => {
+    test('it creates the incident correctly', async () => {
+      requestMock.mockImplementation(() => ({
+        data: {
+          values: incidentTypes,
+        },
+      }));
+
+      const res = await service.getIncidentTypes();
+
+      expect(res).toEqual([
+        { id: 17, name: 'Communication error (fax; email)' },
+        { id: 1001, name: 'Custom type' },
+      ]);
+    });
+
+    test('it should throw an error', async () => {
+      requestMock.mockImplementation(() => {
+        throw new Error('An error has occurred');
+      });
+
+      expect(service.getIncidentTypes()).rejects.toThrow(
+        '[Action][IBM Resilient]: Unable to get incident types. Error: An error has occurred.'
+      );
+    });
+  });
+
+  describe('getSeverity', () => {
+    test('it creates the incident correctly', async () => {
+      requestMock.mockImplementation(() => ({
+        data: {
+          values: severity,
+        },
+      }));
+
+      const res = await service.getSeverity();
+
+      expect(res).toEqual([
+        {
+          id: 4,
+          name: 'Low',
+        },
+        {
+          id: 5,
+          name: 'Medium',
+        },
+        {
+          id: 6,
+          name: 'High',
+        },
+      ]);
+    });
+
+    test('it should throw an error', async () => {
+      requestMock.mockImplementation(() => {
+        throw new Error('An error has occurred');
+      });
+
+      expect(service.getIncidentTypes()).rejects.toThrow(
+        '[Action][IBM Resilient]: Unable to get incident types. Error: An error has occurred.'
+      );
+    });
+  });
 });
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/service.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/service.ts
index b2150081f2c89..4bf1453641e42 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/service.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/service.ts
@@ -5,44 +5,56 @@
  */
 
 import axios from 'axios';
+import { omitBy, isNil } from 'lodash/fp';
 
 import { Logger } from '../../../../../../src/core/server';
-import { ExternalServiceCredentials, ExternalService, ExternalServiceParams } from '../case/types';
 import {
+  ExternalServiceCredentials,
+  ExternalService,
+  ExternalServiceParams,
+  CreateCommentParams,
+  UpdateIncidentParams,
+  CreateIncidentParams,
+  CreateIncidentData,
   ResilientPublicConfigurationType,
   ResilientSecretConfigurationType,
-  CreateIncidentRequest,
   UpdateIncidentRequest,
-  CreateCommentRequest,
-  UpdateFieldText,
-  UpdateFieldTextArea,
+  GetValueTextContentResponse,
 } from './types';
 
 import * as i18n from './translations';
 import { getErrorMessage, request } from '../lib/axios_utils';
 import { ProxySettings } from '../../types';
 
-const BASE_URL = `rest`;
-const INCIDENT_URL = `incidents`;
-const COMMENT_URL = `comments`;
-
 const VIEW_INCIDENT_URL = `#incidents`;
 
 export const getValueTextContent = (
   field: string,
-  value: string
-): UpdateFieldText | UpdateFieldTextArea => {
+  value: string | number | number[]
+): GetValueTextContentResponse => {
   if (field === 'description') {
     return {
       textarea: {
         format: 'html',
-        content: value,
+        content: value as string,
       },
     };
   }
 
+  if (field === 'incidentTypes') {
+    return {
+      ids: value as number[],
+    };
+  }
+
+  if (field === 'severityCode') {
+    return {
+      id: value as number,
+    };
+  }
+
   return {
-    text: value,
+    text: value as string,
   };
 };
 
@@ -51,11 +63,30 @@ export const formatUpdateRequest = ({
   newIncident,
 }: ExternalServiceParams): UpdateIncidentRequest => {
   return {
-    changes: Object.keys(newIncident).map((key) => ({
-      field: { name: key },
-      old_value: getValueTextContent(key, oldIncident[key]),
-      new_value: getValueTextContent(key, newIncident[key]),
-    })),
+    changes: Object.keys(newIncident as Record<string, unknown>).map((key) => {
+      let name = key;
+
+      if (key === 'incidentTypes') {
+        name = 'incident_type_ids';
+      }
+
+      if (key === 'severityCode') {
+        name = 'severity_code';
+      }
+
+      return {
+        field: { name },
+        // TODO: Fix ugly casting
+        old_value: getValueTextContent(
+          key,
+          (oldIncident as Record<string, unknown>)[name] as string
+        ),
+        new_value: getValueTextContent(
+          key,
+          (newIncident as Record<string, unknown>)[key] as string
+        ),
+      };
+    }),
   };
 };
 
@@ -72,8 +103,12 @@ export const createExternalService = (
   }
 
   const urlWithoutTrailingSlash = url.endsWith('/') ? url.slice(0, -1) : url;
-  const incidentUrl = `${urlWithoutTrailingSlash}/${BASE_URL}/orgs/${orgId}/${INCIDENT_URL}`;
-  const commentUrl = `${incidentUrl}/{inc_id}/${COMMENT_URL}`;
+  const orgUrl = `${urlWithoutTrailingSlash}/rest/orgs/${orgId}`;
+  const incidentUrl = `${orgUrl}/incidents`;
+  const commentUrl = `${incidentUrl}/{inc_id}/comments`;
+  const incidentFieldsUrl = `${orgUrl}/types/incident/fields`;
+  const incidentTypesUrl = `${incidentFieldsUrl}/incident_type_ids`;
+  const severityUrl = `${incidentFieldsUrl}/severity_code`;
   const axiosInstance = axios.create({
     auth: { username: apiKeyId, password: apiKeySecret },
   });
@@ -101,26 +136,48 @@ export const createExternalService = (
       return { ...res.data, description: res.data.description?.content ?? '' };
     } catch (error) {
       throw new Error(
-        getErrorMessage(i18n.NAME, `Unable to get incident with id ${id}. Error: ${error.message}`)
+        getErrorMessage(i18n.NAME, `Unable to get incident with id ${id}. Error: ${error.message}.`)
       );
     }
   };
 
-  const createIncident = async ({ incident }: ExternalServiceParams) => {
+  const createIncident = async ({ incident }: CreateIncidentParams) => {
+    let data: CreateIncidentData = {
+      name: incident.name,
+      discovered_date: Date.now(),
+    };
+
+    if (incident.description) {
+      data = {
+        ...data,
+        description: {
+          format: 'html',
+          content: incident.description ?? '',
+        },
+      };
+    }
+
+    if (incident.incidentTypes) {
+      data = {
+        ...data,
+        incident_type_ids: incident.incidentTypes.map((id) => ({ id })),
+      };
+    }
+
+    if (incident.severityCode) {
+      data = {
+        ...data,
+        severity_code: { id: incident.severityCode },
+      };
+    }
+
     try {
-      const res = await request<CreateIncidentRequest>({
+      const res = await request({
         axios: axiosInstance,
-        url: `${incidentUrl}`,
+        url: `${incidentUrl}?text_content_output_format=objects_convert`,
         method: 'post',
         logger,
-        data: {
-          ...incident,
-          description: {
-            format: 'html',
-            content: incident.description ?? '',
-          },
-          discovered_date: Date.now(),
-        },
+        data,
         proxySettings,
       });
 
@@ -132,17 +189,20 @@ export const createExternalService = (
       };
     } catch (error) {
       throw new Error(
-        getErrorMessage(i18n.NAME, `Unable to create incident. Error: ${error.message}`)
+        getErrorMessage(i18n.NAME, `Unable to create incident. Error: ${error.message}.`)
       );
     }
   };
 
-  const updateIncident = async ({ incidentId, incident }: ExternalServiceParams) => {
+  const updateIncident = async ({ incidentId, incident }: UpdateIncidentParams) => {
     try {
       const latestIncident = await getIncident(incidentId);
 
-      const data = formatUpdateRequest({ oldIncident: latestIncident, newIncident: incident });
-      const res = await request<UpdateIncidentRequest>({
+      // Remove null or undefined values. Allowing null values sets the field in IBM Resilient to empty.
+      const newIncident = omitBy(isNil, incident);
+      const data = formatUpdateRequest({ oldIncident: latestIncident, newIncident });
+
+      const res = await request({
         axios: axiosInstance,
         method: 'patch',
         url: `${incidentUrl}/${incidentId}`,
@@ -173,9 +233,9 @@ export const createExternalService = (
     }
   };
 
-  const createComment = async ({ incidentId, comment, field }: ExternalServiceParams) => {
+  const createComment = async ({ incidentId, comment }: CreateCommentParams) => {
     try {
-      const res = await request<CreateCommentRequest>({
+      const res = await request({
         axios: axiosInstance,
         method: 'post',
         url: getCommentsURL(incidentId),
@@ -193,16 +253,62 @@ export const createExternalService = (
       throw new Error(
         getErrorMessage(
           i18n.NAME,
-          `Unable to create comment at incident with id ${incidentId}. Error: ${error.message}`
+          `Unable to create comment at incident with id ${incidentId}. Error: ${error.message}.`
         )
       );
     }
   };
 
+  const getIncidentTypes = async () => {
+    try {
+      const res = await request({
+        axios: axiosInstance,
+        method: 'get',
+        url: incidentTypesUrl,
+        logger,
+        proxySettings,
+      });
+
+      const incidentTypes = res.data?.values ?? [];
+      return incidentTypes.map((type: { value: string; label: string }) => ({
+        id: type.value,
+        name: type.label,
+      }));
+    } catch (error) {
+      throw new Error(
+        getErrorMessage(i18n.NAME, `Unable to get incident types. Error: ${error.message}.`)
+      );
+    }
+  };
+
+  const getSeverity = async () => {
+    try {
+      const res = await request({
+        axios: axiosInstance,
+        method: 'get',
+        url: severityUrl,
+        logger,
+        proxySettings,
+      });
+
+      const incidentTypes = res.data?.values ?? [];
+      return incidentTypes.map((type: { value: string; label: string }) => ({
+        id: type.value,
+        name: type.label,
+      }));
+    } catch (error) {
+      throw new Error(
+        getErrorMessage(i18n.NAME, `Unable to get severity. Error: ${error.message}.`)
+      );
+    }
+  };
+
   return {
     getIncident,
     createIncident,
     updateIncident,
     createComment,
+    getIncidentTypes,
+    getSeverity,
   };
 };
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/translations.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/translations.ts
index d952838d5a2b3..8c6ce9902da81 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/translations.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/translations.ts
@@ -9,3 +9,19 @@ import { i18n } from '@kbn/i18n';
 export const NAME = i18n.translate('xpack.actions.builtin.case.resilientTitle', {
   defaultMessage: 'IBM Resilient',
 });
+
+export const ALLOWED_HOSTS_ERROR = (message: string) =>
+  i18n.translate('xpack.actions.builtin.configuration.apiAllowedHostsError', {
+    defaultMessage: 'error configuring connector action: {message}',
+    values: {
+      message,
+    },
+  });
+
+// TODO: remove when Case mappings will be removed
+export const MAPPING_EMPTY = i18n.translate(
+  'xpack.actions.builtin.servicenow.configuration.emptyMapping',
+  {
+    defaultMessage: '[incidentConfiguration.mapping]: expected non-empty but got empty',
+  }
+);
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/types.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/types.ts
index 6869e2ff3a105..ed622ee473b65 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/types.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/types.ts
@@ -4,29 +4,175 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
 import { TypeOf } from '@kbn/config-schema';
-import { ResilientPublicConfigurationSchema, ResilientSecretConfigurationSchema } from './schema';
+import {
+  ExternalIncidentServiceConfigurationSchema,
+  ExternalIncidentServiceSecretConfigurationSchema,
+  ExecutorParamsSchema,
+  ExecutorSubActionPushParamsSchema,
+  ExecutorSubActionGetIncidentParamsSchema,
+  ExecutorSubActionHandshakeParamsSchema,
+  ExecutorSubActionGetIncidentTypesParamsSchema,
+  ExecutorSubActionGetSeverityParamsSchema,
+} from './schema';
+
+import { ActionsConfigurationUtilities } from '../../actions_config';
+import { Logger } from '../../../../../../src/core/server';
+
+import { IncidentConfigurationSchema } from '../case/schema';
+import { Comment } from '../case/types';
+
+export type ResilientPublicConfigurationType = TypeOf<
+  typeof ExternalIncidentServiceConfigurationSchema
+>;
+export type ResilientSecretConfigurationType = TypeOf<
+  typeof ExternalIncidentServiceSecretConfigurationSchema
+>;
+
+export type ExecutorParams = TypeOf<typeof ExecutorParamsSchema>;
+export type ExecutorSubActionPushParams = TypeOf<typeof ExecutorSubActionPushParamsSchema>;
+
+export type IncidentConfiguration = TypeOf<typeof IncidentConfigurationSchema>;
+
+export interface ExternalServiceCredentials {
+  config: Record<string, unknown>;
+  secrets: Record<string, unknown>;
+}
+
+export interface ExternalServiceValidation {
+  config: (configurationUtilities: ActionsConfigurationUtilities, configObject: any) => void;
+  secrets: (configurationUtilities: ActionsConfigurationUtilities, secrets: any) => void;
+}
+
+export interface ExternalServiceIncidentResponse {
+  id: string;
+  title: string;
+  url: string;
+  pushedDate: string;
+}
+
+export interface ExternalServiceCommentResponse {
+  commentId: string;
+  pushedDate: string;
+  externalCommentId?: string;
+}
 
-export type ResilientPublicConfigurationType = TypeOf<typeof ResilientPublicConfigurationSchema>;
-export type ResilientSecretConfigurationType = TypeOf<typeof ResilientSecretConfigurationSchema>;
+export type ExternalServiceParams = Record<string, unknown>;
 
-interface CreateIncidentBasicRequestArgs {
+export type Incident = Pick<
+  ExecutorSubActionPushParams,
+  'description' | 'incidentTypes' | 'severityCode'
+> & {
   name: string;
-  description: string;
-  discovered_date: number;
+};
+
+export interface CreateIncidentParams {
+  incident: Incident;
+}
+
+export interface UpdateIncidentParams {
+  incidentId: string;
+  incident: Incident;
+}
+
+export interface CreateCommentParams {
+  incidentId: string;
+  comment: Comment;
+}
+
+export type GetIncidentTypesResponse = Array<{ id: string; name: string }>;
+export type GetSeverityResponse = Array<{ id: string; name: string }>;
+
+export interface ExternalService {
+  getIncident: (id: string) => Promise<ExternalServiceParams | undefined>;
+  createIncident: (params: CreateIncidentParams) => Promise<ExternalServiceIncidentResponse>;
+  updateIncident: (params: UpdateIncidentParams) => Promise<ExternalServiceIncidentResponse>;
+  createComment: (params: CreateCommentParams) => Promise<ExternalServiceCommentResponse>;
+  getIncidentTypes: () => Promise<GetIncidentTypesResponse>;
+  getSeverity: () => Promise<GetSeverityResponse>;
 }
 
-interface Comment {
-  text: { format: string; content: string };
+export interface PushToServiceApiParams extends ExecutorSubActionPushParams {
+  externalObject: Record<string, any>;
 }
 
-interface CreateIncidentRequestArgs extends CreateIncidentBasicRequestArgs {
-  comments?: Comment[];
+export type ExecutorSubActionGetIncidentTypesParams = TypeOf<
+  typeof ExecutorSubActionGetIncidentTypesParamsSchema
+>;
+
+export type ExecutorSubActionGetSeverityParams = TypeOf<
+  typeof ExecutorSubActionGetSeverityParamsSchema
+>;
+
+export interface ExternalServiceApiHandlerArgs {
+  externalService: ExternalService;
+  mapping: Map<string, any> | null;
 }
 
+export type ExecutorSubActionGetIncidentParams = TypeOf<
+  typeof ExecutorSubActionGetIncidentParamsSchema
+>;
+
+export type ExecutorSubActionHandshakeParams = TypeOf<
+  typeof ExecutorSubActionHandshakeParamsSchema
+>;
+
+export interface PushToServiceApiHandlerArgs extends ExternalServiceApiHandlerArgs {
+  params: PushToServiceApiParams;
+  logger: Logger;
+}
+
+export interface GetIncidentApiHandlerArgs extends ExternalServiceApiHandlerArgs {
+  params: ExecutorSubActionGetIncidentParams;
+}
+
+export interface HandshakeApiHandlerArgs extends ExternalServiceApiHandlerArgs {
+  params: ExecutorSubActionHandshakeParams;
+}
+
+export interface GetIncidentTypesHandlerArgs {
+  externalService: ExternalService;
+  params: ExecutorSubActionGetIncidentTypesParams;
+}
+
+export interface GetSeverityHandlerArgs {
+  externalService: ExternalService;
+  params: ExecutorSubActionGetSeverityParams;
+}
+
+export interface PushToServiceResponse extends ExternalServiceIncidentResponse {
+  comments?: ExternalServiceCommentResponse[];
+}
+
+export interface ExternalServiceApi {
+  handshake: (args: HandshakeApiHandlerArgs) => Promise<void>;
+  pushToService: (args: PushToServiceApiHandlerArgs) => Promise<PushToServiceResponse>;
+  getIncident: (args: GetIncidentApiHandlerArgs) => Promise<void>;
+  incidentTypes: (args: GetIncidentTypesHandlerArgs) => Promise<GetIncidentTypesResponse>;
+  severity: (args: GetSeverityHandlerArgs) => Promise<GetSeverityResponse>;
+}
+
+export type ResilientExecutorResultData =
+  | PushToServiceResponse
+  | GetIncidentTypesResponse
+  | GetSeverityResponse;
+
 export interface UpdateFieldText {
   text: string;
 }
+export interface UpdateFieldText {
+  text: string;
+}
+
+export interface UpdateIdsField {
+  ids: number[];
+}
+
+export interface UpdateIdField {
+  id: number;
+}
 
 export interface UpdateFieldTextArea {
   textarea: { format: 'html' | 'text'; content: string };
@@ -34,13 +180,24 @@ export interface UpdateFieldTextArea {
 
 interface UpdateField {
   field: { name: string };
-  old_value: UpdateFieldText | UpdateFieldTextArea;
-  new_value: UpdateFieldText | UpdateFieldTextArea;
+  old_value: UpdateFieldText | UpdateFieldTextArea | UpdateIdsField | UpdateIdField;
+  new_value: UpdateFieldText | UpdateFieldTextArea | UpdateIdsField | UpdateIdField;
 }
 
-export type CreateIncidentRequest = CreateIncidentRequestArgs;
-export type CreateCommentRequest = Comment;
-
 export interface UpdateIncidentRequest {
   changes: UpdateField[];
 }
+
+export type GetValueTextContentResponse =
+  | UpdateFieldText
+  | UpdateFieldTextArea
+  | UpdateIdsField
+  | UpdateIdField;
+
+export interface CreateIncidentData {
+  name: string;
+  discovered_date: number;
+  description?: { format: string; content: string };
+  incident_type_ids?: Array<{ id: number }>;
+  severity_code?: { id: number };
+}
diff --git a/x-pack/plugins/actions/server/builtin_action_types/resilient/validators.ts b/x-pack/plugins/actions/server/builtin_action_types/resilient/validators.ts
index 7226071392bc6..a50e868cdda3d 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/resilient/validators.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/resilient/validators.ts
@@ -4,8 +4,38 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { validateCommonConfig, validateCommonSecrets } from '../case/validators';
-import { ExternalServiceValidation } from '../case/types';
+import { isEmpty } from 'lodash';
+import { ActionsConfigurationUtilities } from '../../actions_config';
+import {
+  ResilientPublicConfigurationType,
+  ResilientSecretConfigurationType,
+  ExternalServiceValidation,
+} from './types';
+
+import * as i18n from './translations';
+
+export const validateCommonConfig = (
+  configurationUtilities: ActionsConfigurationUtilities,
+  configObject: ResilientPublicConfigurationType
+) => {
+  if (
+    configObject.incidentConfiguration !== null &&
+    isEmpty(configObject.incidentConfiguration.mapping)
+  ) {
+    return i18n.MAPPING_EMPTY;
+  }
+
+  try {
+    configurationUtilities.ensureUriAllowed(configObject.apiUrl);
+  } catch (allowedListError) {
+    return i18n.ALLOWED_HOSTS_ERROR(allowedListError.message);
+  }
+};
+
+export const validateCommonSecrets = (
+  configurationUtilities: ActionsConfigurationUtilities,
+  secrets: ResilientSecretConfigurationType
+) => {};
 
 export const validate: ExternalServiceValidation = {
   config: validateCommonConfig,
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
index c8e6147ecef46..455a71517fb4a 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { flow } from 'lodash';
 import {
   ExternalServiceParams,
   PushToServiceApiHandlerArgs,
@@ -12,12 +11,11 @@ import {
   ExternalServiceApi,
   PushToServiceApiParams,
   PushToServiceResponse,
+  Incident,
 } from './types';
 
 // TODO: to remove, need to support Case
-import { transformers } from '../case/transformers';
-import { TransformFieldsArgs, Comment, EntityInformation } from '../case/common_types';
-import { prepareFieldsForTransformation } from '../case/utils';
+import { transformFields, transformComments, prepareFieldsForTransformation } from '../case/utils';
 
 const handshakeHandler = async ({
   externalService,
@@ -62,7 +60,7 @@ const pushToServiceHandler = async ({
       defaultPipes,
     });
 
-    incident = transformFields({
+    incident = transformFields<PushToServiceApiParams, ExternalServiceParams, Incident>({
       params,
       fields,
       currentIncident,
@@ -117,47 +115,6 @@ const pushToServiceHandler = async ({
   return res;
 };
 
-export const transformFields = ({
-  params,
-  fields,
-  currentIncident,
-}: TransformFieldsArgs<PushToServiceApiParams, ExternalServiceParams>): Record<string, string> => {
-  return fields.reduce((prev, cur) => {
-    const transform = flow(...cur.pipes.map((p) => transformers[p]));
-    return {
-      ...prev,
-      [cur.key]: transform({
-        value: cur.value,
-        date: params.updatedAt ?? params.createdAt,
-        user: getEntity(params),
-        previousValue: currentIncident ? currentIncident[cur.key] : '',
-      }).value,
-    };
-  }, {});
-};
-
-export const transformComments = (comments: Comment[], pipes: string[]): Comment[] => {
-  return comments.map((c) => ({
-    ...c,
-    comment: flow(...pipes.map((p) => transformers[p]))({
-      value: c.comment,
-      date: c.updatedAt ?? c.createdAt,
-      user: getEntity(c),
-    }).value,
-  }));
-};
-
-export const getEntity = (entity: EntityInformation): string =>
-  (entity.updatedBy != null
-    ? entity.updatedBy.fullName
-      ? entity.updatedBy.fullName
-      : entity.updatedBy.username
-    : entity.createdBy != null
-    ? entity.createdBy.fullName
-      ? entity.createdBy.fullName
-      : entity.createdBy.username
-    : '') ?? '';
-
 export const api: ExternalServiceApi = {
   handshake: handshakeHandler,
   pushToService: pushToServiceHandler,
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts
index 55a14e4528acf..f34e9714b22ce 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/mocks.ts
@@ -5,7 +5,7 @@
  */
 
 import { ExternalService, PushToServiceApiParams, ExecutorSubActionPushParams } from './types';
-import { MapRecord } from '../case/common_types';
+import { MapRecord } from '../case/types';
 
 const createMock = (): jest.Mocked<ExternalService> => {
   const service = {
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
index 921de42adfcaf..9896d4175954c 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
@@ -5,11 +5,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import {
-  CommentSchema,
-  EntityInformation,
-  IncidentConfigurationSchema,
-} from '../case/common_schema';
+import { CommentSchema, EntityInformation, IncidentConfigurationSchema } from '../case/schema';
 
 export const ExternalIncidentServiceConfiguration = {
   apiUrl: schema.string(),
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts
index e8fcfac45d789..a6a0ac946fe96 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/types.ts
@@ -16,8 +16,8 @@ import {
   ExecutorSubActionHandshakeParamsSchema,
 } from './schema';
 import { ActionsConfigurationUtilities } from '../../actions_config';
-import { ExternalServiceCommentResponse } from '../case/common_types';
-import { IncidentConfigurationSchema } from '../case/common_schema';
+import { ExternalServiceCommentResponse } from '../case/types';
+import { IncidentConfigurationSchema } from '../case/schema';
 import { Logger } from '../../../../../../src/core/server';
 
 export type ServiceNowPublicConfigurationType = TypeOf<
@@ -82,6 +82,13 @@ export type ExecutorSubActionHandshakeParams = TypeOf<
   typeof ExecutorSubActionHandshakeParamsSchema
 >;
 
+export type Incident = Pick<
+  ExecutorSubActionPushParams,
+  'description' | 'severity' | 'urgency' | 'impact'
+> & {
+  short_description: string;
+};
+
 export interface PushToServiceApiHandlerArgs extends ExternalServiceApiHandlerArgs {
   params: PushToServiceApiParams;
   secrets: Record<string, unknown>;
diff --git a/x-pack/plugins/case/server/routes/api/cases/configure/get_connectors.ts b/x-pack/plugins/case/server/routes/api/cases/configure/get_connectors.ts
index a22d7ae5cea21..545ccf82c3d78 100644
--- a/x-pack/plugins/case/server/routes/api/cases/configure/get_connectors.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/configure/get_connectors.ts
@@ -13,6 +13,7 @@ import {
   SUPPORTED_CONNECTORS,
   SERVICENOW_ACTION_TYPE_ID,
   JIRA_ACTION_TYPE_ID,
+  RESILIENT_ACTION_TYPE_ID,
 } from '../../../../../common/constants';
 
 /*
@@ -37,8 +38,12 @@ export function initCaseConfigureGetActionConnector({ caseService, router }: Rou
           (action) =>
             SUPPORTED_CONNECTORS.includes(action.actionTypeId) &&
             // Need this filtering temporary to display only Case owned ServiceNow connectors
-            (![SERVICENOW_ACTION_TYPE_ID, JIRA_ACTION_TYPE_ID].includes(action.actionTypeId) ||
-              ([SERVICENOW_ACTION_TYPE_ID, JIRA_ACTION_TYPE_ID].includes(action.actionTypeId) &&
+            (![SERVICENOW_ACTION_TYPE_ID, JIRA_ACTION_TYPE_ID, RESILIENT_ACTION_TYPE_ID].includes(
+              action.actionTypeId
+            ) ||
+              ([SERVICENOW_ACTION_TYPE_ID, JIRA_ACTION_TYPE_ID, RESILIENT_ACTION_TYPE_ID].includes(
+                action.actionTypeId
+              ) &&
                 action.config?.isCaseOwned === true))
         );
         return response.ok({ body: results });
diff --git a/x-pack/plugins/data_enhanced/kibana.json b/x-pack/plugins/data_enhanced/kibana.json
index 637af39339e27..5ded0f8f0dec3 100644
--- a/x-pack/plugins/data_enhanced/kibana.json
+++ b/x-pack/plugins/data_enhanced/kibana.json
@@ -6,10 +6,11 @@
     "xpack", "data_enhanced"
   ],
   "requiredPlugins": [
-    "data"
+    "data",
+    "features"
   ],
-  "optionalPlugins": ["kibanaReact", "kibanaUtils", "usageCollection"],
+  "optionalPlugins": ["kibanaUtils", "usageCollection"],
   "server": true,
   "ui": true,
-  "requiredBundles": ["kibanaReact", "kibanaUtils"]
+  "requiredBundles": ["kibanaUtils"]
 }
diff --git a/x-pack/plugins/data_enhanced/public/search/long_query_notification.tsx b/x-pack/plugins/data_enhanced/public/search/long_query_notification.tsx
deleted file mode 100644
index 325cf1145fa5f..0000000000000
--- a/x-pack/plugins/data_enhanced/public/search/long_query_notification.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { EuiButton, EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-import React from 'react';
-import { toMountPoint } from '../../../../../src/plugins/kibana_react/public';
-
-interface Props {
-  cancel: () => void;
-  runBeyondTimeout: () => void;
-}
-
-export function getLongQueryNotification(props: Props) {
-  return toMountPoint(
-    <LongQueryNotification cancel={props.cancel} runBeyondTimeout={props.runBeyondTimeout} />
-  );
-}
-
-export function LongQueryNotification(props: Props) {
-  return (
-    <div>
-      <EuiSpacer size="s" />
-      <EuiFlexGroup justifyContent="flexEnd" gutterSize="s">
-        <EuiFlexItem grow={false}>
-          <EuiButtonEmpty size="s" onClick={props.cancel}>
-            <FormattedMessage
-              id="xpack.data.query.queryBar.cancelLongQuery"
-              defaultMessage="Cancel"
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiButton size="s" fill onClick={props.runBeyondTimeout}>
-            <FormattedMessage
-              id="xpack.data.query.queryBar.runBeyond"
-              defaultMessage="Run beyond timeout"
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </div>
-  );
-}
diff --git a/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts b/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
index 261e03887acdb..af2fc85602541 100644
--- a/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
+++ b/x-pack/plugins/data_enhanced/public/search/search_interceptor.test.ts
@@ -60,9 +60,6 @@ describe('EnhancedSearchInterceptor', () => {
     mockUsageCollector = {
       trackQueryTimedOut: jest.fn(),
       trackQueriesCancelled: jest.fn(),
-      trackLongQueryPopupShown: jest.fn(),
-      trackLongQueryDialogDismissed: jest.fn(),
-      trackLongQueryRunBeyondTimeout: jest.fn(),
     };
 
     const mockPromise = new Promise((resolve) => {
@@ -390,88 +387,4 @@ describe('EnhancedSearchInterceptor', () => {
       expect(mockUsageCollector.trackQueriesCancelled).toBeCalledTimes(1);
     });
   });
-
-  describe('runBeyondTimeout', () => {
-    const timedResponses = [
-      {
-        time: 250,
-        value: {
-          isPartial: true,
-          isRunning: true,
-          id: 1,
-          rawResponse: {
-            took: 1,
-          },
-        },
-      },
-      {
-        time: 2000,
-        value: {
-          isPartial: false,
-          isRunning: false,
-          id: 1,
-          rawResponse: {
-            took: 1,
-          },
-        },
-      },
-    ];
-
-    test('times out if runBeyondTimeout is not called', async () => {
-      mockFetchImplementation(timedResponses);
-
-      const response = searchInterceptor.search({});
-      response.subscribe({ next, error });
-
-      await timeTravel(250);
-
-      expect(next).toHaveBeenCalled();
-      expect(next.mock.calls[0][0]).toStrictEqual(timedResponses[0].value);
-
-      await timeTravel(750);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
-    });
-
-    test('times out if runBeyondTimeout is called too late', async () => {
-      mockFetchImplementation(timedResponses);
-
-      const response = searchInterceptor.search({});
-      response.subscribe({ next, error });
-      setTimeout(() => searchInterceptor.runBeyondTimeout(), 1100);
-
-      await timeTravel(250);
-
-      expect(next).toHaveBeenCalled();
-      expect(next.mock.calls[0][0]).toStrictEqual(timedResponses[0].value);
-
-      await timeTravel(750);
-
-      expect(error).toHaveBeenCalled();
-      expect(error.mock.calls[0][0]).toBeInstanceOf(AbortError);
-    });
-
-    test('should prevent the request from timing out', async () => {
-      mockFetchImplementation(timedResponses);
-
-      const response = searchInterceptor.search({}, { pollInterval: 0 });
-      response.subscribe({ next, error, complete });
-      setTimeout(() => searchInterceptor.runBeyondTimeout(), 500);
-
-      await timeTravel(250);
-
-      expect(next).toHaveBeenCalled();
-      expect(next.mock.calls[0][0]).toStrictEqual(timedResponses[0].value);
-
-      await timeTravel(250); // Run beyond timeout
-      await timeTravel(1750); // Final response
-
-      expect(next).toHaveBeenCalledTimes(2);
-      expect(next.mock.calls[0][0]).toStrictEqual(timedResponses[0].value);
-      expect(next.mock.calls[1][0]).toStrictEqual(timedResponses[1].value);
-      expect(error).not.toHaveBeenCalled();
-      expect(mockUsageCollector.trackLongQueryRunBeyondTimeout).toBeCalledTimes(1);
-    });
-  });
 });
diff --git a/x-pack/plugins/data_enhanced/public/search/search_interceptor.ts b/x-pack/plugins/data_enhanced/public/search/search_interceptor.ts
index 61cf579d3136b..f7ae9fc6d0f91 100644
--- a/x-pack/plugins/data_enhanced/public/search/search_interceptor.ts
+++ b/x-pack/plugins/data_enhanced/public/search/search_interceptor.ts
@@ -6,7 +6,8 @@
 
 import { throwError, EMPTY, timer, from, Subscription } from 'rxjs';
 import { mergeMap, expand, takeUntil, finalize, tap } from 'rxjs/operators';
-import { getLongQueryNotification } from './long_query_notification';
+import { debounce } from 'lodash';
+import { i18n } from '@kbn/i18n';
 import {
   SearchInterceptor,
   SearchInterceptorDeps,
@@ -42,38 +43,11 @@ export class EnhancedSearchInterceptor extends SearchInterceptor {
    * Abort our `AbortController`, which in turn aborts any intercepted searches.
    */
   public cancelPending = () => {
-    this.hideToast();
     this.abortController.abort();
     this.abortController = new AbortController();
     if (this.deps.usageCollector) this.deps.usageCollector.trackQueriesCancelled();
   };
 
-  /**
-   * Un-schedule timing out all of the searches intercepted.
-   */
-  public runBeyondTimeout = () => {
-    this.hideToast();
-    this.timeoutSubscriptions.unsubscribe();
-    if (this.deps.usageCollector) this.deps.usageCollector.trackLongQueryRunBeyondTimeout();
-  };
-
-  protected showToast = () => {
-    if (this.longRunningToast) return;
-    this.longRunningToast = this.deps.toasts.addInfo(
-      {
-        title: 'Your query is taking a while',
-        text: getLongQueryNotification({
-          cancel: this.cancelPending,
-          runBeyondTimeout: this.runBeyondTimeout,
-        }),
-      },
-      {
-        toastLifeTimeMs: 1000000,
-      }
-    );
-    if (this.deps.usageCollector) this.deps.usageCollector.trackLongQueryPopupShown();
-  };
-
   public search(
     request: IAsyncSearchRequest,
     { pollInterval = 1000, ...options }: IAsyncSearchOptions = {}
@@ -127,4 +101,28 @@ export class EnhancedSearchInterceptor extends SearchInterceptor {
       })
     );
   }
+
+  // Right now we are debouncing but we will hook this up with background sessions to show only one
+  // error notification per session.
+  protected showTimeoutError = debounce(
+    (e: Error) => {
+      const message = this.application.capabilities.advancedSettings?.save
+        ? i18n.translate('xpack.data.search.timeoutIncreaseSetting', {
+            defaultMessage:
+              'One or more queries timed out. Increase run time with the search.timeout advanced setting.',
+          })
+        : i18n.translate('xpack.data.search.timeoutContactAdmin', {
+            defaultMessage:
+              'One or more queries timed out. Contact your system administrator to increase the run time.',
+          });
+      this.deps.toasts.addError(e, {
+        title: 'Timed out',
+        toastMessage: message,
+      });
+    },
+    60000,
+    {
+      leading: true,
+    }
+  );
 }
diff --git a/x-pack/plugins/data_enhanced/server/plugin.ts b/x-pack/plugins/data_enhanced/server/plugin.ts
index 3b05e83d208b7..a1dff00ddfdd3 100644
--- a/x-pack/plugins/data_enhanced/server/plugin.ts
+++ b/x-pack/plugins/data_enhanced/server/plugin.ts
@@ -18,8 +18,8 @@ import {
 } from '../../../../src/plugins/data/server';
 import { enhancedEsSearchStrategyProvider } from './search';
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
-import { ENHANCED_ES_SEARCH_STRATEGY } from '../common';
 import { getUiSettings } from './ui_settings';
+import { ENHANCED_ES_SEARCH_STRATEGY } from '../common';
 
 interface SetupDependencies {
   data: DataPluginSetup;
diff --git a/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts b/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts
index eda6178dc8e5b..72ea1f096e8fb 100644
--- a/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts
+++ b/x-pack/plugins/data_enhanced/server/search/es_search_strategy.ts
@@ -7,6 +7,7 @@
 import { first } from 'rxjs/operators';
 import { SearchResponse } from 'elasticsearch';
 import { Observable } from 'rxjs';
+import { TransportRequestPromise } from '@elastic/elasticsearch/lib/Transport';
 import { SharedGlobalConfig, RequestHandlerContext, Logger } from '../../../../../src/core/server';
 import {
   getTotalLoaded,
@@ -40,8 +41,8 @@ export const enhancedEsSearchStrategyProvider = (
 
     try {
       const response = isAsync
-        ? await asyncSearch(context, request)
-        : await rollupSearch(context, request);
+        ? await asyncSearch(context, request, options)
+        : await rollupSearch(context, request, options);
 
       if (
         usage &&
@@ -69,9 +70,10 @@ export const enhancedEsSearchStrategyProvider = (
 
   async function asyncSearch(
     context: RequestHandlerContext,
-    request: IEnhancedEsSearchRequest
+    request: IEnhancedEsSearchRequest,
+    options?: ISearchOptions
   ): Promise<IEsSearchResponse> {
-    let esResponse;
+    let promise: TransportRequestPromise<any>;
     const esClient = context.core.elasticsearch.client.asCurrentUser;
     const uiSettingsClient = await context.core.uiSettings.client;
 
@@ -89,14 +91,17 @@ export const enhancedEsSearchStrategyProvider = (
         ...request.params,
       });
 
-      esResponse = await esClient.asyncSearch.submit(submitOptions);
+      promise = esClient.asyncSearch.submit(submitOptions);
     } else {
-      esResponse = await esClient.asyncSearch.get({
+      promise = esClient.asyncSearch.get({
         id: request.id,
         ...toSnakeCase(asyncOptions),
       });
     }
 
+    // Temporary workaround until https://github.com/elastic/elasticsearch-js/issues/1297
+    if (options?.abortSignal) options.abortSignal.addEventListener('abort', () => promise.abort());
+    const esResponse = await promise;
     const { id, response, is_partial: isPartial, is_running: isRunning } = esResponse.body;
     return {
       id,
@@ -109,7 +114,8 @@ export const enhancedEsSearchStrategyProvider = (
 
   const rollupSearch = async function (
     context: RequestHandlerContext,
-    request: IEnhancedEsSearchRequest
+    request: IEnhancedEsSearchRequest,
+    options?: ISearchOptions
   ): Promise<IEsSearchResponse> {
     const esClient = context.core.elasticsearch.client.asCurrentUser;
     const uiSettingsClient = await context.core.uiSettings.client;
@@ -123,13 +129,17 @@ export const enhancedEsSearchStrategyProvider = (
       ...params,
     });
 
-    const esResponse = await esClient.transport.request({
+    const promise = esClient.transport.request({
       method,
       path,
       body,
       querystring,
     });
 
+    // Temporary workaround until https://github.com/elastic/elasticsearch-js/issues/1297
+    if (options?.abortSignal) options.abortSignal.addEventListener('abort', () => promise.abort());
+    const esResponse = await promise;
+
     const response = esResponse.body as SearchResponse<any>;
     return {
       rawResponse: response,
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
index f8d66b8ecac27..18834f55af0a5 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.test.ts
@@ -555,7 +555,18 @@ describe('#bulkUpdate', () => {
   });
 
   describe('namespace', () => {
-    const doTest = async (namespace: string, expectNamespaceInDescriptor: boolean) => {
+    interface TestParams {
+      optionsNamespace: string | undefined;
+      objectNamespace: string | undefined;
+      expectOptionsNamespaceInDescriptor: boolean;
+      expectObjectNamespaceInDescriptor: boolean;
+    }
+    const doTest = async ({
+      optionsNamespace,
+      objectNamespace,
+      expectOptionsNamespaceInDescriptor,
+      expectObjectNamespaceInDescriptor,
+    }: TestParams) => {
       const docs = [
         {
           id: 'some-id',
@@ -566,12 +577,13 @@ describe('#bulkUpdate', () => {
             attrThree: 'three',
           },
           version: 'some-version',
+          namespace: objectNamespace,
         },
       ];
-      const options = { namespace };
+      const options = { namespace: optionsNamespace };
 
       mockBaseClient.bulkUpdate.mockResolvedValue({
-        saved_objects: docs.map((doc) => ({ ...doc, references: undefined })),
+        saved_objects: docs.map(({ namespace, ...doc }) => ({ ...doc, references: undefined })),
       });
 
       await expect(wrapper.bulkUpdate(docs, options)).resolves.toEqual({
@@ -594,7 +606,11 @@ describe('#bulkUpdate', () => {
         {
           type: 'known-type',
           id: 'some-id',
-          namespace: expectNamespaceInDescriptor ? namespace : undefined,
+          namespace: expectObjectNamespaceInDescriptor
+            ? objectNamespace
+            : expectOptionsNamespaceInDescriptor
+            ? optionsNamespace
+            : undefined,
         },
         { attrOne: 'one', attrSecret: 'secret', attrThree: 'three' },
         { user: mockAuthenticatedUser() }
@@ -612,7 +628,7 @@ describe('#bulkUpdate', () => {
               attrThree: 'three',
             },
             version: 'some-version',
-
+            namespace: objectNamespace,
             references: undefined,
           },
         ],
@@ -620,13 +636,46 @@ describe('#bulkUpdate', () => {
       );
     };
 
-    it('uses `namespace` to encrypt attributes if it is specified when type is single-namespace', async () => {
-      await doTest('some-namespace', true);
+    it('does not use options `namespace` or object `namespace` to encrypt attributes if neither are specified', async () => {
+      await doTest({
+        optionsNamespace: undefined,
+        objectNamespace: undefined,
+        expectOptionsNamespaceInDescriptor: false,
+        expectObjectNamespaceInDescriptor: false,
+      });
     });
 
-    it('does not use `namespace` to encrypt attributes if it is specified when type is not single-namespace', async () => {
-      mockBaseTypeRegistry.isSingleNamespace.mockReturnValue(false);
-      await doTest('some-namespace', false);
+    describe('with a single-namespace type', () => {
+      it('uses options `namespace` to encrypt attributes if it is specified and object `namespace` is not', async () => {
+        await doTest({
+          optionsNamespace: 'some-namespace',
+          objectNamespace: undefined,
+          expectOptionsNamespaceInDescriptor: true,
+          expectObjectNamespaceInDescriptor: false,
+        });
+      });
+
+      it('uses object `namespace` to encrypt attributes if it is specified', async () => {
+        // object namespace supersedes options namespace
+        await doTest({
+          optionsNamespace: 'some-namespace',
+          objectNamespace: 'another-namespace',
+          expectOptionsNamespaceInDescriptor: false,
+          expectObjectNamespaceInDescriptor: true,
+        });
+      });
+    });
+
+    describe('with a non-single-namespace type', () => {
+      it('does not use object `namespace` or options `namespace` to encrypt attributes if it is specified', async () => {
+        mockBaseTypeRegistry.isSingleNamespace.mockReturnValue(false);
+        await doTest({
+          optionsNamespace: 'some-namespace',
+          objectNamespace: 'another-namespace',
+          expectOptionsNamespaceInDescriptor: false,
+          expectObjectNamespaceInDescriptor: false,
+        });
+      });
     });
   });
 
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts
index a2725cbc6a274..0eeb9943b5be9 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts
@@ -150,14 +150,14 @@ export class EncryptedSavedObjectsClientWrapper implements SavedObjectsClientCon
     // sequential processing.
     const encryptedObjects = await Promise.all(
       objects.map(async (object) => {
-        const { type, id, attributes } = object;
+        const { type, id, attributes, namespace: objectNamespace } = object;
         if (!this.options.service.isRegistered(type)) {
           return object;
         }
         const namespace = getDescriptorNamespace(
           this.options.baseTypeRegistry,
           type,
-          options?.namespace
+          objectNamespace ?? options?.namespace
         );
         return {
           ...object,
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/get_descriptor_namespace.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/get_descriptor_namespace.ts
index b2842df909a1d..7201f13fb930b 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/get_descriptor_namespace.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/get_descriptor_namespace.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ISavedObjectTypeRegistry } from 'kibana/server';
+import { ISavedObjectTypeRegistry, SavedObjectsUtils } from '../../../../../src/core/server';
 
 export const getDescriptorNamespace = (
   typeRegistry: ISavedObjectTypeRegistry,
@@ -12,5 +12,12 @@ export const getDescriptorNamespace = (
   namespace?: string
 ) => {
   const descriptorNamespace = typeRegistry.isSingleNamespace(type) ? namespace : undefined;
-  return descriptorNamespace === 'default' ? undefined : descriptorNamespace;
+  return normalizeNamespace(descriptorNamespace);
 };
+
+/**
+ * Ensure that a namespace is always in its namespace ID representation.
+ * This allows `'default'` to be used interchangeably with `undefined`.
+ */
+const normalizeNamespace = (namespace?: string) =>
+  namespace === undefined ? namespace : SavedObjectsUtils.namespaceStringToId(namespace);
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.test.ts
index bc31b7df5d971..c52eceb2d2fdd 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.test.ts
@@ -16,7 +16,28 @@ describe('AppLogic', () => {
   });
 
   const DEFAULT_VALUES = {
+    account: {},
     hasInitialized: false,
+    isFederatedAuth: true,
+    organization: {},
+  };
+
+  const expectedLogicValues = {
+    account: {
+      canCreateInvitations: true,
+      canCreatePersonalSources: true,
+      groups: ['Default', 'Cats'],
+      id: 'some-id-string',
+      isAdmin: true,
+      isCurated: false,
+      viewedOnboardingPage: true,
+    },
+    hasInitialized: true,
+    isFederatedAuth: false,
+    organization: {
+      defaultOrgName: 'My Organization',
+      name: 'ACME Donuts',
+    },
   };
 
   it('has expected default values', () => {
@@ -27,9 +48,7 @@ describe('AppLogic', () => {
     it('sets values based on passed props', () => {
       AppLogic.actions.initializeAppData(DEFAULT_INITIAL_APP_DATA);
 
-      expect(AppLogic.values).toEqual({
-        hasInitialized: true,
-      });
+      expect(AppLogic.values).toEqual(expectedLogicValues);
     });
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts
index 5bf2b41cfc264..f88a00f63f487 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/app_logic.ts
@@ -7,18 +7,26 @@
 import { kea, MakeLogicType } from 'kea';
 
 import { IInitialAppData } from '../../../common/types';
-import { IWorkplaceSearchInitialData } from '../../../common/types/workplace_search';
+import {
+  IOrganization,
+  IWorkplaceSearchInitialData,
+  IAccount,
+} from '../../../common/types/workplace_search';
 
 export interface IAppValues extends IWorkplaceSearchInitialData {
   hasInitialized: boolean;
+  isFederatedAuth: boolean;
 }
 export interface IAppActions {
-  initializeAppData(props: IInitialAppData): void;
+  initializeAppData(props: IInitialAppData): IInitialAppData;
 }
 
 export const AppLogic = kea<MakeLogicType<IAppValues, IAppActions>>({
   actions: {
-    initializeAppData: ({ workplaceSearch }) => workplaceSearch,
+    initializeAppData: ({ workplaceSearch, isFederatedAuth }) => ({
+      workplaceSearch,
+      isFederatedAuth,
+    }),
   },
   reducers: {
     hasInitialized: [
@@ -27,5 +35,23 @@ export const AppLogic = kea<MakeLogicType<IAppValues, IAppActions>>({
         initializeAppData: () => true,
       },
     ],
+    isFederatedAuth: [
+      true,
+      {
+        initializeAppData: (_, { isFederatedAuth }) => !!isFederatedAuth,
+      },
+    ],
+    organization: [
+      {} as IOrganization,
+      {
+        initializeAppData: (_, { workplaceSearch }) => workplaceSearch!.organization,
+      },
+    ],
+    account: [
+      {} as IAccount,
+      {
+        initializeAppData: (_, { workplaceSearch }) => workplaceSearch!.account,
+      },
+    ],
   },
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/index.ts
index 9e86993a5289d..9f281a541334e 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { setMockValues, mockValues, mockActions } from './overview_logic.mock';
+export { setMockValues, mockOverviewValues, mockActions } from './overview_logic.mock';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/overview_logic.mock.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/overview_logic.mock.ts
index 9ce3021917a21..569e6543ee869 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/overview_logic.mock.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/__mocks__/overview_logic.mock.ts
@@ -5,19 +5,18 @@
  */
 
 import { IOverviewValues } from '../overview_logic';
-import { IAccount, IOrganization } from '../../../types';
 
-export const mockValues = {
+import { DEFAULT_INITIAL_APP_DATA } from '../../../../../../common/__mocks__';
+
+const { workplaceSearch: mockAppValues } = DEFAULT_INITIAL_APP_DATA;
+
+export const mockOverviewValues = {
   accountsCount: 0,
   activityFeed: [],
   canCreateContentSources: false,
-  canCreateInvitations: false,
-  fpAccount: {} as IAccount,
   hasOrgSources: false,
   hasUsers: false,
-  isFederatedAuth: true,
   isOldAccount: false,
-  organization: {} as IOrganization,
   pendingInvitationsCount: 0,
   personalSourcesCount: 0,
   sourcesCount: 0,
@@ -28,6 +27,8 @@ export const mockActions = {
   initializeOverview: jest.fn(() => ({})),
 };
 
+const mockValues = { ...mockOverviewValues, ...mockAppValues, isFederatedAuth: true };
+
 jest.mock('kea', () => ({
   ...(jest.requireActual('kea') as object),
   useActions: jest.fn(() => ({ ...mockActions })),
@@ -37,8 +38,5 @@ jest.mock('kea', () => ({
 import { useValues } from 'kea';
 
 export const setMockValues = (values: object) => {
-  (useValues as jest.Mock).mockImplementationOnce(() => ({
-    ...mockValues,
-    ...values,
-  }));
+  (useValues as jest.Mock).mockImplementation(() => ({ ...mockValues, ...values }));
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.test.tsx
index acbc66259c2a1..0f3eee074caef 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.test.tsx
@@ -25,6 +25,7 @@ const account = {
   canCreatePersonalSources: true,
   groups: [],
   isCurated: false,
+  canCreateInvitations: true,
 };
 
 describe('OnboardingSteps', () => {
@@ -60,9 +61,8 @@ describe('OnboardingSteps', () => {
   describe('Users & Invitations', () => {
     it('renders 0 users when not on federated auth', () => {
       setMockValues({
-        canCreateInvitations: true,
         isFederatedAuth: false,
-        fpAccount: account,
+        account,
         accountsCount: 0,
         hasUsers: false,
       });
@@ -78,7 +78,7 @@ describe('OnboardingSteps', () => {
     it('renders completed users state', () => {
       setMockValues({
         isFederatedAuth: false,
-        fpAccount: account,
+        account,
         accountsCount: 1,
         hasUsers: true,
       });
@@ -90,7 +90,13 @@ describe('OnboardingSteps', () => {
     });
 
     it('disables link when the user cannot create invitations', () => {
-      setMockValues({ isFederatedAuth: false, canCreateInvitations: false });
+      setMockValues({
+        isFederatedAuth: false,
+        account: {
+          ...account,
+          canCreateInvitations: false,
+        },
+      });
       const wrapper = shallow(<OnboardingSteps />);
       expect(wrapper.find(OnboardingCard).last().prop('actionPath')).toBe(undefined);
     });
@@ -98,6 +104,12 @@ describe('OnboardingSteps', () => {
 
   describe('Org Name', () => {
     it('renders button to change name', () => {
+      setMockValues({
+        organization: {
+          name: 'foo',
+          defaultOrgName: 'foo',
+        },
+      });
       const wrapper = shallow(<OnboardingSteps />);
 
       const button = wrapper
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.tsx
index 5598123f1c286..0baadfc912ad5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/onboarding_steps.tsx
@@ -28,6 +28,7 @@ import { ORG_SOURCES_PATH, USERS_PATH, ORG_SETTINGS_PATH } from '../../routes';
 
 import { ContentSection } from '../../components/shared/content_section';
 
+import { AppLogic } from '../../app_logic';
 import { OverviewLogic } from './overview_logic';
 
 import { OnboardingCard } from './onboarding_card';
@@ -58,16 +59,18 @@ const ONBOARDING_USERS_CARD_DESCRIPTION = i18n.translate(
 );
 
 export const OnboardingSteps: React.FC = () => {
+  const {
+    isFederatedAuth,
+    organization: { name, defaultOrgName },
+    account: { isCurated, canCreateInvitations },
+  } = useValues(AppLogic);
+
   const {
     hasUsers,
     hasOrgSources,
     canCreateContentSources,
-    canCreateInvitations,
     accountsCount,
     sourcesCount,
-    fpAccount: { isCurated },
-    organization: { name, defaultOrgName },
-    isFederatedAuth,
   } = useValues(OverviewLogic);
 
   const accountsPath =
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/organization_stats.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/organization_stats.tsx
index 4dc762e29deba..6614ac58b0744 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/organization_stats.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/organization_stats.tsx
@@ -14,18 +14,17 @@ import { i18n } from '@kbn/i18n';
 import { ContentSection } from '../../components/shared/content_section';
 import { ORG_SOURCES_PATH, USERS_PATH } from '../../routes';
 
+import { AppLogic } from '../../app_logic';
 import { OverviewLogic } from './overview_logic';
 
 import { StatisticCard } from './statistic_card';
 
 export const OrganizationStats: React.FC = () => {
-  const {
-    sourcesCount,
-    pendingInvitationsCount,
-    accountsCount,
-    personalSourcesCount,
-    isFederatedAuth,
-  } = useValues(OverviewLogic);
+  const { isFederatedAuth } = useValues(AppLogic);
+
+  const { sourcesCount, pendingInvitationsCount, accountsCount, personalSourcesCount } = useValues(
+    OverviewLogic
+  );
 
   return (
     <ContentSection
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview.tsx
index dbc007c2aa97d..f3736c0a21551 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview.tsx
@@ -14,6 +14,7 @@ import { useActions, useValues } from 'kea';
 import { SetWorkplaceSearchChrome as SetPageChrome } from '../../../shared/kibana_chrome';
 import { SendWorkplaceSearchTelemetry as SendTelemetry } from '../../../shared/telemetry';
 
+import { AppLogic } from '../../app_logic';
 import { OverviewLogic } from './overview_logic';
 
 import { Loading } from '../../components/shared/loading';
@@ -44,15 +45,12 @@ const HEADER_DESCRIPTION = i18n.translate(
 );
 
 export const Overview: React.FC = () => {
-  const { initializeOverview } = useActions(OverviewLogic);
-
   const {
-    dataLoading,
-    hasUsers,
-    hasOrgSources,
-    isOldAccount,
     organization: { name: orgName, defaultOrgName },
-  } = useValues(OverviewLogic);
+  } = useValues(AppLogic);
+
+  const { initializeOverview } = useActions(OverviewLogic);
+  const { dataLoading, hasUsers, hasOrgSources, isOldAccount } = useValues(OverviewLogic);
 
   useEffect(() => {
     initializeOverview();
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.test.ts
index 6989635064ca9..1ec770e9defce 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.test.ts
@@ -9,7 +9,7 @@ import { resetContext } from 'kea';
 jest.mock('../../../shared/http', () => ({ HttpLogic: { values: { http: { get: jest.fn() } } } }));
 import { HttpLogic } from '../../../shared/http';
 
-import { mockValues } from './__mocks__';
+import { mockOverviewValues } from './__mocks__';
 import { OverviewLogic } from './overview_logic';
 
 describe('OverviewLogic', () => {
@@ -20,32 +20,19 @@ describe('OverviewLogic', () => {
   });
 
   it('has expected default values', () => {
-    expect(OverviewLogic.values).toEqual(mockValues);
+    expect(OverviewLogic.values).toEqual(mockOverviewValues);
   });
 
   describe('setServerData', () => {
     const feed = [{ foo: 'bar' }] as any;
-    const account = {
-      id: '1243',
-      groups: ['Default'],
-      isAdmin: true,
-      isCurated: false,
-      canCreatePersonalSources: true,
-      viewedOnboardingPage: false,
-    };
-    const org = { name: 'ACME', defaultOrgName: 'Org' };
 
     const data = {
       accountsCount: 1,
       activityFeed: feed,
       canCreateContentSources: true,
-      canCreateInvitations: true,
-      fpAccount: account,
       hasOrgSources: true,
       hasUsers: true,
-      isFederatedAuth: false,
       isOldAccount: true,
-      organization: org,
       pendingInvitationsCount: 1,
       personalSourcesCount: 1,
       sourcesCount: 1,
@@ -60,10 +47,6 @@ describe('OverviewLogic', () => {
     });
 
     it('will set server values', () => {
-      expect(OverviewLogic.values.organization).toEqual(org);
-      expect(OverviewLogic.values.isFederatedAuth).toEqual(false);
-      expect(OverviewLogic.values.fpAccount).toEqual(account);
-      expect(OverviewLogic.values.canCreateInvitations).toEqual(true);
       expect(OverviewLogic.values.hasUsers).toEqual(true);
       expect(OverviewLogic.values.hasOrgSources).toEqual(true);
       expect(OverviewLogic.values.canCreateContentSources).toEqual(true);
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts
index 2c6846b6db7db..787d5295db1cf 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/overview_logic.ts
@@ -7,24 +7,18 @@
 import { kea, MakeLogicType } from 'kea';
 import { HttpLogic } from '../../../shared/http';
 
-import { IAccount, IOrganization } from '../../types';
-
 import { IFeedActivity } from './recent_activity';
 
 export interface IOverviewServerData {
   hasUsers: boolean;
   hasOrgSources: boolean;
   canCreateContentSources: boolean;
-  canCreateInvitations: boolean;
   isOldAccount: boolean;
   sourcesCount: number;
   pendingInvitationsCount: number;
   accountsCount: number;
   personalSourcesCount: number;
   activityFeed: IFeedActivity[];
-  organization: IOrganization;
-  isFederatedAuth: boolean;
-  fpAccount: IAccount;
 }
 
 export interface IOverviewActions {
@@ -42,30 +36,6 @@ export const OverviewLogic = kea<MakeLogicType<IOverviewValues, IOverviewActions
     initializeOverview: () => null,
   },
   reducers: {
-    organization: [
-      {} as IOrganization,
-      {
-        setServerData: (_, { organization }) => organization,
-      },
-    ],
-    isFederatedAuth: [
-      true,
-      {
-        setServerData: (_, { isFederatedAuth }) => isFederatedAuth,
-      },
-    ],
-    fpAccount: [
-      {} as IAccount,
-      {
-        setServerData: (_, { fpAccount }) => fpAccount,
-      },
-    ],
-    canCreateInvitations: [
-      false,
-      {
-        setServerData: (_, { canCreateInvitations }) => canCreateInvitations,
-      },
-    ],
     hasUsers: [
       false,
       {
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.test.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.test.tsx
index 22a82af18527d..31613098f9fcc 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.test.tsx
@@ -12,6 +12,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 
 import { EuiEmptyPrompt, EuiLink } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 
 import { RecentActivity, RecentActivityItem } from './recent_activity';
 
@@ -61,4 +62,19 @@ describe('RecentActivity', () => {
     expect(wrapper.find('.activity--error__label')).toHaveLength(1);
     expect(wrapper.find(EuiLink).prop('color')).toEqual('danger');
   });
+
+  it('renders recent activity message for default org name', () => {
+    setMockValues({
+      organization: {
+        name: 'foo',
+        defaultOrgName: 'foo',
+      },
+    });
+    const wrapper = shallow(<RecentActivity />);
+    const emptyPrompt = wrapper.find(EuiEmptyPrompt).dive();
+
+    expect(emptyPrompt.find(FormattedMessage).prop('defaultMessage')).toEqual(
+      'Your organization has no recent activity'
+    );
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx
index 441f45a947a49..0813999c9a078 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/overview/recent_activity.tsx
@@ -17,6 +17,7 @@ import { sendTelemetry } from '../../../shared/telemetry';
 import { KibanaContext, IKibanaContext } from '../../../index';
 import { SOURCE_DETAILS_PATH, getContentSourcePath } from '../../routes';
 
+import { AppLogic } from '../../app_logic';
 import { OverviewLogic } from './overview_logic';
 
 import './recent_activity.scss';
@@ -32,8 +33,9 @@ export interface IFeedActivity {
 export const RecentActivity: React.FC = () => {
   const {
     organization: { name, defaultOrgName },
-    activityFeed,
-  } = useValues(OverviewLogic);
+  } = useValues(AppLogic);
+
+  const { activityFeed } = useValues(OverviewLogic);
 
   return (
     <ContentSection
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
index 6f80afccbff5e..6a22d8716514c 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_allocation.tsx
@@ -52,7 +52,7 @@ export const NodeAllocation = <T extends PhaseWithAllocationAction>({
   phaseData,
   isShowingErrors,
 }: React.PropsWithChildren<Props<T>>) => {
-  const { isLoading, data: nodes, error, sendRequest } = useLoadNodes();
+  const { isLoading, data: nodes, error, resendRequest } = useLoadNodes();
 
   const [selectedNodeAttrsForDetails, setSelectedNodeAttrsForDetails] = useState<string | null>(
     null
@@ -84,7 +84,7 @@ export const NodeAllocation = <T extends PhaseWithAllocationAction>({
           <p>
             {message} ({statusCode})
           </p>
-          <EuiButton onClick={sendRequest} iconType="refresh" color="danger">
+          <EuiButton onClick={resendRequest} iconType="refresh" color="danger">
             <FormattedMessage
               id="xpack.indexLifecycleMgmt.editPolicy.nodeAttributesReloadButton"
               defaultMessage="Try again"
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_attrs_details.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_attrs_details.tsx
index cd87cc324a414..af8833c8082b3 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_attrs_details.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/node_attrs_details.tsx
@@ -28,7 +28,7 @@ interface Props {
 }
 
 export const NodeAttrsDetails: React.FunctionComponent<Props> = ({ close, selectedNodeAttrs }) => {
-  const { data, isLoading, error, sendRequest } = useLoadNodeDetails(selectedNodeAttrs);
+  const { data, isLoading, error, resendRequest } = useLoadNodeDetails(selectedNodeAttrs);
   let content;
   if (isLoading) {
     content = <EuiLoadingContent lines={3} />;
@@ -47,7 +47,7 @@ export const NodeAttrsDetails: React.FunctionComponent<Props> = ({ close, select
         <p>
           {message} ({statusCode})
         </p>
-        <EuiButton onClick={sendRequest} iconType="refresh" color="danger">
+        <EuiButton onClick={resendRequest} iconType="refresh" color="danger">
           <FormattedMessage
             id="xpack.indexLifecycleMgmt.editPolicy.nodeDetailsReloadButton"
             defaultMessage="Try again"
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/snapshot_policies.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/snapshot_policies.tsx
index 5a5e696ca8333..cc2849b5c8e9c 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/snapshot_policies.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/snapshot_policies.tsx
@@ -31,7 +31,7 @@ export const SnapshotPolicies: React.FunctionComponent<Props> = ({
   onChange,
   getUrlForApp,
 }) => {
-  const { error, isLoading, data, sendRequest } = useLoadSnapshotPolicies();
+  const { error, isLoading, data, resendRequest } = useLoadSnapshotPolicies();
 
   const policies = data.map((name: string) => ({
     label: name,
@@ -75,7 +75,7 @@ export const SnapshotPolicies: React.FunctionComponent<Props> = ({
               <EuiButtonIcon
                 size="s"
                 color="warning"
-                onClick={sendRequest}
+                onClick={resendRequest}
                 iconType="refresh"
                 aria-label={i18n.translate(
                   'xpack.indexLifecycleMgmt.editPolicy.deletePhase.reloadPoliciesLabel',
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx
index f4697693b86c6..dfc3e7194da06 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/edit_policy.container.tsx
@@ -33,7 +33,7 @@ export const EditPolicy: React.FunctionComponent<Props & RouteComponentProps<Rou
   getUrlForApp,
   history,
 }) => {
-  const { error, isLoading, data: policies, sendRequest } = useLoadPoliciesList(false);
+  const { error, isLoading, data: policies, resendRequest } = useLoadPoliciesList(false);
   if (isLoading) {
     return (
       <EuiEmptyPrompt
@@ -65,7 +65,7 @@ export const EditPolicy: React.FunctionComponent<Props & RouteComponentProps<Rou
           </p>
         }
         actions={
-          <EuiButton onClick={sendRequest} iconType="refresh" color="danger">
+          <EuiButton onClick={resendRequest} iconType="refresh" color="danger">
             <FormattedMessage
               id="xpack.indexLifecycleMgmt.editPolicy.lifecyclePoliciesReloadButton"
               defaultMessage="Try again"
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx
index f6471ff2da4d3..8f8b76602ac57 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx
@@ -20,7 +20,7 @@ export const PolicyTable: React.FunctionComponent<Props & RouteComponentProps> =
   navigateToApp,
   history,
 }) => {
-  const { data: policies, isLoading, error, sendRequest } = useLoadPoliciesList(true);
+  const { data: policies, isLoading, error, resendRequest } = useLoadPoliciesList(true);
 
   if (isLoading) {
     return (
@@ -53,7 +53,7 @@ export const PolicyTable: React.FunctionComponent<Props & RouteComponentProps> =
           </p>
         }
         actions={
-          <EuiButton onClick={sendRequest} iconType="refresh" color="danger">
+          <EuiButton onClick={resendRequest} iconType="refresh" color="danger">
             <FormattedMessage
               id="xpack.indexLifecycleMgmt.policyTable.policiesReloadButton"
               defaultMessage="Try again"
@@ -69,7 +69,7 @@ export const PolicyTable: React.FunctionComponent<Props & RouteComponentProps> =
       policies={policies || []}
       history={history}
       navigateToApp={navigateToApp}
-      updatePolicies={sendRequest}
+      updatePolicies={resendRequest}
     />
   );
 };
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_list/component_template_list.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_list/component_template_list.tsx
index 8ba7409a9ac57..05f7f53969ded 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_list/component_template_list.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_list/component_template_list.tsx
@@ -42,7 +42,7 @@ export const ComponentTemplateList: React.FunctionComponent<Props> = ({
   } = useGlobalFlyout();
   const { api, trackMetric, documentation } = useComponentTemplatesContext();
 
-  const { data, isLoading, error, sendRequest } = api.useLoadComponentTemplates();
+  const { data, isLoading, error, resendRequest } = api.useLoadComponentTemplates();
 
   const [componentTemplatesToDelete, setComponentTemplatesToDelete] = useState<string[]>([]);
 
@@ -170,7 +170,7 @@ export const ComponentTemplateList: React.FunctionComponent<Props> = ({
 
         <ComponentTable
           componentTemplates={data}
-          onReloadClick={sendRequest}
+          onReloadClick={resendRequest}
           onDeleteClick={setComponentTemplatesToDelete}
           onEditClick={goToEditComponentTemplate}
           onCloneClick={goToCloneComponentTemplate}
@@ -181,7 +181,7 @@ export const ComponentTemplateList: React.FunctionComponent<Props> = ({
   } else if (data && data.length === 0) {
     content = <EmptyPrompt history={history} />;
   } else if (error) {
-    content = <LoadError onReloadClick={sendRequest} />;
+    content = <LoadError onReloadClick={resendRequest} />;
   }
 
   return (
@@ -194,7 +194,7 @@ export const ComponentTemplateList: React.FunctionComponent<Props> = ({
           callback={(deleteResponse) => {
             if (deleteResponse?.hasDeletedComponentTemplates) {
               // refetch the component templates
-              sendRequest();
+              resendRequest();
               // go back to list view (if deleted from details flyout)
               goToComponentTemplateList();
             }
diff --git a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_list.tsx b/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_list.tsx
index d37576f18e849..4f2a5c4a27b7a 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_list.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_list.tsx
@@ -49,7 +49,7 @@ export const DataStreamList: React.FunctionComponent<RouteComponentProps<MatchPa
   } = useAppContext();
 
   const [isIncludeStatsChecked, setIsIncludeStatsChecked] = useState(false);
-  const { error, isLoading, data: dataStreams, sendRequest: reload } = useLoadDataStreams({
+  const { error, isLoading, data: dataStreams, resendRequest: reload } = useLoadDataStreams({
     includeStats: isIncludeStatsChecked,
   });
 
diff --git a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_table/data_stream_table.tsx b/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_table/data_stream_table.tsx
index a586e9495cf71..642123c511419 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_table/data_stream_table.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/data_stream_list/data_stream_table/data_stream_table.tsx
@@ -11,7 +11,7 @@ import { EuiInMemoryTable, EuiBasicTableColumn, EuiButton, EuiLink } from '@elas
 import { ScopedHistory } from 'kibana/public';
 
 import { DataStream } from '../../../../../../common/types';
-import { reactRouterNavigate } from '../../../../../shared_imports';
+import { UseRequestResponse, reactRouterNavigate } from '../../../../../shared_imports';
 import { encodePathForReactRouter } from '../../../../services/routing';
 import { DataHealth } from '../../../../components';
 import { Section } from '../../../home';
@@ -20,7 +20,7 @@ import { humanizeTimeStamp } from '../humanize_time_stamp';
 
 interface Props {
   dataStreams?: DataStream[];
-  reload: () => {};
+  reload: UseRequestResponse['resendRequest'];
   history: ScopedHistory;
   includeStats: boolean;
   filters?: string;
diff --git a/x-pack/plugins/index_management/public/application/sections/home/template_list/legacy_templates/template_table/template_table.tsx b/x-pack/plugins/index_management/public/application/sections/home/template_list/legacy_templates/template_table/template_table.tsx
index 9203e76fce787..7ec6f1f94a2ab 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/template_list/legacy_templates/template_table/template_table.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/template_list/legacy_templates/template_table/template_table.tsx
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiInMemoryTable, EuiButton, EuiLink, EuiBasicTableColumn } from '@elastic/eui';
 import { ScopedHistory } from 'kibana/public';
-import { SendRequestResponse, reactRouterNavigate } from '../../../../../../shared_imports';
+import { UseRequestResponse, reactRouterNavigate } from '../../../../../../shared_imports';
 import { TemplateListItem } from '../../../../../../../common';
 import { UIM_TEMPLATE_SHOW_DETAILS_CLICK } from '../../../../../../../common/constants';
 import { TemplateDeleteModal } from '../../../../../components';
@@ -20,7 +20,7 @@ import { TemplateTypeIndicator } from '../../components';
 
 interface Props {
   templates: TemplateListItem[];
-  reload: () => Promise<SendRequestResponse>;
+  reload: UseRequestResponse['resendRequest'];
   editTemplate: (name: string, isLegacy?: boolean) => void;
   cloneTemplate: (name: string, isLegacy?: boolean) => void;
   history: ScopedHistory;
diff --git a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/template_details_content.tsx b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/template_details_content.tsx
index 5bacffc4c2404..94891297c857e 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/template_details_content.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_details/template_details_content.tsx
@@ -31,7 +31,7 @@ import {
   UIM_TEMPLATE_DETAIL_PANEL_ALIASES_TAB,
   UIM_TEMPLATE_DETAIL_PANEL_PREVIEW_TAB,
 } from '../../../../../../common/constants';
-import { SendRequestResponse } from '../../../../../shared_imports';
+import { UseRequestResponse } from '../../../../../shared_imports';
 import { TemplateDeleteModal, SectionLoading, SectionError, Error } from '../../../../components';
 import { useLoadIndexTemplate } from '../../../../services/api';
 import { decodePathFromReactRouter } from '../../../../services/routing';
@@ -92,7 +92,7 @@ export interface Props {
   onClose: () => void;
   editTemplate: (name: string, isLegacy?: boolean) => void;
   cloneTemplate: (name: string, isLegacy?: boolean) => void;
-  reload: () => Promise<SendRequestResponse>;
+  reload: UseRequestResponse['resendRequest'];
 }
 
 export const TemplateDetailsContent = ({
diff --git a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_list.tsx b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_list.tsx
index f421bc5d87a54..c711f457123fb 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_list.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_list.tsx
@@ -59,7 +59,7 @@ export const TemplateList: React.FunctionComponent<RouteComponentProps<MatchPara
   history,
 }) => {
   const { uiMetricService } = useServices();
-  const { error, isLoading, data: allTemplates, sendRequest: reload } = useLoadIndexTemplates();
+  const { error, isLoading, data: allTemplates, resendRequest: reload } = useLoadIndexTemplates();
 
   const [filters, setFilters] = useState<Filters<FilterName>>({
     managed: {
diff --git a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_table/template_table.tsx b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_table/template_table.tsx
index 3dffdcde160f1..c32fd29cf9f92 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/template_list/template_table/template_table.tsx
+++ b/x-pack/plugins/index_management/public/application/sections/home/template_list/template_table/template_table.tsx
@@ -12,7 +12,7 @@ import { ScopedHistory } from 'kibana/public';
 
 import { TemplateListItem } from '../../../../../../common';
 import { UIM_TEMPLATE_SHOW_DETAILS_CLICK } from '../../../../../../common/constants';
-import { SendRequestResponse, reactRouterNavigate } from '../../../../../shared_imports';
+import { UseRequestResponse, reactRouterNavigate } from '../../../../../shared_imports';
 import { encodePathForReactRouter } from '../../../../services/routing';
 import { useServices } from '../../../../app_context';
 import { TemplateDeleteModal } from '../../../../components';
@@ -21,7 +21,7 @@ import { TemplateTypeIndicator } from '../components';
 
 interface Props {
   templates: TemplateListItem[];
-  reload: () => Promise<SendRequestResponse>;
+  reload: UseRequestResponse['resendRequest'];
   editTemplate: (name: string) => void;
   cloneTemplate: (name: string) => void;
   history: ScopedHistory;
diff --git a/x-pack/plugins/index_management/public/shared_imports.ts b/x-pack/plugins/index_management/public/shared_imports.ts
index f7f992a090501..d58545768732e 100644
--- a/x-pack/plugins/index_management/public/shared_imports.ts
+++ b/x-pack/plugins/index_management/public/shared_imports.ts
@@ -8,6 +8,7 @@ export {
   SendRequestConfig,
   SendRequestResponse,
   UseRequestConfig,
+  UseRequestResponse,
   sendRequest,
   useRequest,
   Forms,
diff --git a/x-pack/plugins/ingest_manager/common/types/models/agent.ts b/x-pack/plugins/ingest_manager/common/types/models/agent.ts
index 2b8a306577e7d..a204373fe2e56 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/agent.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/agent.ts
@@ -21,7 +21,8 @@ export type AgentStatus =
   | 'unenrolling'
   | 'degraded';
 
-export type AgentActionType = 'CONFIG_CHANGE' | 'DATA_DUMP' | 'RESUME' | 'PAUSE' | 'UNENROLL';
+export type AgentActionType = 'CONFIG_CHANGE' | 'UNENROLL';
+
 export interface NewAgentAction {
   type: AgentActionType;
   data?: any;
@@ -29,20 +30,44 @@ export interface NewAgentAction {
 }
 
 export interface AgentAction extends NewAgentAction {
+  type: AgentActionType;
+  data?: any;
+  sent_at?: string;
   id: string;
   agent_id: string;
   created_at: string;
+  ack_data?: any;
+}
+
+export interface AgentPolicyAction extends NewAgentAction {
+  id: string;
+  type: AgentActionType;
+  data?: any;
+  policy_id: string;
+  policy_revision: number;
+  created_at: string;
+  ack_data?: any;
 }
 
-export interface AgentActionSOAttributes {
+interface CommonAgentActionSOAttributes {
   type: AgentActionType;
   sent_at?: string;
   timestamp?: string;
   created_at: string;
-  agent_id: string;
   data?: string;
+  ack_data?: string;
 }
 
+export type AgentActionSOAttributes = CommonAgentActionSOAttributes & {
+  agent_id: string;
+};
+export type AgentPolicyActionSOAttributes = CommonAgentActionSOAttributes & {
+  policy_id: string;
+  policy_revision: number;
+};
+
+export type BaseAgentActionSOAttributes = AgentActionSOAttributes | AgentPolicyActionSOAttributes;
+
 export interface NewAgentEvent {
   type: 'STATE' | 'ERROR' | 'ACTION_RESULT' | 'ACTION';
   subtype: // State
diff --git a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
index cf8d3ab1c908a..54cdeade3764e 100644
--- a/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
+++ b/x-pack/plugins/ingest_manager/common/types/rest_spec/agent.ts
@@ -7,11 +7,11 @@
 import {
   Agent,
   AgentAction,
+  NewAgentAction,
   NewAgentEvent,
   AgentEvent,
   AgentStatus,
   AgentType,
-  NewAgentAction,
 } from '../models';
 
 export interface GetAgentsRequest {
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx
index 9f48be54f866d..ccf9e45ebc4fa 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/create_package_policy_page/step_select_agent_policy.tsx
@@ -83,7 +83,7 @@ export const StepSelectAgentPolicy: React.FunctionComponent<{
     data: agentPoliciesData,
     error: agentPoliciesError,
     isLoading: isAgentPoliciesLoading,
-    sendRequest: refreshAgentPolicies,
+    resendRequest: refreshAgentPolicies,
   } = useGetAgentPolicies({
     page: 1,
     perPage: 1000,
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/hooks/use_agent_status.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/hooks/use_agent_status.tsx
index 71dcd728d5d1b..3483d8dee045a 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/hooks/use_agent_status.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/details_page/hooks/use_agent_status.tsx
@@ -25,7 +25,7 @@ export function useGetAgentStatus(policyId?: string, options?: RequestOptions) {
     isLoading: agentStatusRequest.isLoading,
     data: agentStatusRequest.data,
     error: agentStatusRequest.error,
-    refreshAgentStatus: () => agentStatusRequest.sendRequest,
+    refreshAgentStatus: () => agentStatusRequest.resendRequest,
   };
 }
 
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/index.tsx
index 361b1c33f1a04..fb963dc67ae1c 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_policy/list_page/index.tsx
@@ -108,7 +108,7 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
   );
 
   // Fetch agent policies
-  const { isLoading, data: agentPolicyData, sendRequest } = useGetAgentPolicies({
+  const { isLoading, data: agentPolicyData, resendRequest } = useGetAgentPolicies({
     page: pagination.currentPage,
     perPage: pagination.pageSize,
     sortField: sorting?.field,
@@ -204,7 +204,7 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
             render: (agentPolicy: AgentPolicy) => (
               <AgentPolicyActionMenu
                 agentPolicy={agentPolicy}
-                onCopySuccess={() => sendRequest()}
+                onCopySuccess={() => resendRequest()}
               />
             ),
           },
@@ -218,7 +218,7 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
     }
 
     return cols;
-  }, [getHref, isFleetEnabled, sendRequest]);
+  }, [getHref, isFleetEnabled, resendRequest]);
 
   const createAgentPolicyButton = useMemo(
     () => (
@@ -270,7 +270,7 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
         <CreateAgentPolicyFlyout
           onClose={() => {
             setIsCreateAgentPolicyFlyoutOpen(false);
-            sendRequest();
+            resendRequest();
           }}
         />
       ) : null}
@@ -289,7 +289,7 @@ export const AgentPolicyListPage: React.FunctionComponent<{}> = () => {
           />
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
-          <EuiButton color="primary" iconType="refresh" onClick={() => sendRequest()}>
+          <EuiButton color="primary" iconType="refresh" onClick={() => resendRequest()}>
             <FormattedMessage
               id="xpack.ingestManager.agentPolicyList.reloadAgentPoliciesButtonText"
               defaultMessage="Reload"
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/data_stream/list_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/data_stream/list_page/index.tsx
index 53fd6a713b523..bb109d766c50a 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/data_stream/list_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/data_stream/list_page/index.tsx
@@ -64,7 +64,7 @@ export const DataStreamListPage: React.FunctionComponent<{}> = () => {
   const { pagination, pageSizeOptions } = usePagination();
 
   // Fetch data streams
-  const { isLoading, data: dataStreamsData, sendRequest } = useGetDataStreams();
+  const { isLoading, data: dataStreamsData, resendRequest } = useGetDataStreams();
 
   // Some policies retrieved, set up table props
   const columns = useMemo(() => {
@@ -241,7 +241,7 @@ export const DataStreamListPage: React.FunctionComponent<{}> = () => {
               key="reloadButton"
               color="primary"
               iconType="refresh"
-              onClick={() => sendRequest()}
+              onClick={() => resendRequest()}
             >
               <FormattedMessage
                 id="xpack.ingestManager.dataStreamList.reloadDataStreamsButtonText"
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/agent_events_table.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/agent_events_table.tsx
index 5806cbdcd6811..e11863a2db85f 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/agent_events_table.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/agent_events_table.tsx
@@ -50,13 +50,13 @@ export const AgentEventsTable: React.FunctionComponent<{ agent: Agent }> = ({ ag
     [key: string]: JSX.Element;
   }>({});
 
-  const { isLoading, data, sendRequest } = useGetOneAgentEvents(agent.id, {
+  const { isLoading, data, resendRequest } = useGetOneAgentEvents(agent.id, {
     page: pagination.currentPage,
     perPage: pagination.pageSize,
     kuery: search && search.trim() !== '' ? search.trim() : undefined,
   });
 
-  const refresh = () => sendRequest();
+  const refresh = () => resendRequest();
 
   const total = data ? data.total : 0;
   const list = data ? data.list : [];
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/index.tsx
index 219b343eba41b..fe0781f4a240b 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/index.tsx
@@ -51,7 +51,7 @@ export const AgentDetailsPage: React.FunctionComponent = () => {
     isInitialRequest,
     error,
     data: agentData,
-    sendRequest: sendAgentRequest,
+    resendRequest: sendAgentRequest,
   } = useGetOneAgent(agentId, {
     pollIntervalMs: 5000,
   });
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
index 9548340df5b30..46f7ffb85b21f 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
@@ -344,7 +344,7 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
             return (
               <RowActions
                 agent={agent}
-                refresh={() => agentsRequest.sendRequest()}
+                refresh={() => agentsRequest.resendRequest()}
                 onReassignClick={() => setAgentToReassignId(agent.id)}
               />
             );
@@ -394,7 +394,7 @@ export const AgentListPage: React.FunctionComponent<{}> = () => {
             agent={agentToReassign}
             onClose={() => {
               setAgentToReassignId(undefined);
-              agentsRequest.sendRequest();
+              agentsRequest.resendRequest();
             }}
           />
         </EuiPortal>
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/enrollment_token_list_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/enrollment_token_list_page/index.tsx
index b3a4938b22310..d85a6e8b5b833 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/enrollment_token_list_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/enrollment_token_list_page/index.tsx
@@ -244,7 +244,10 @@ export const EnrollmentTokenListPage: React.FunctionComponent<{}> = () => {
       render: (_: any, apiKey: EnrollmentAPIKey) => {
         return (
           apiKey.active && (
-            <DeleteButton apiKey={apiKey} refresh={() => enrollmentAPIKeysRequest.sendRequest()} />
+            <DeleteButton
+              apiKey={apiKey}
+              refresh={() => enrollmentAPIKeysRequest.resendRequest()}
+            />
           )
         );
       },
@@ -258,7 +261,7 @@ export const EnrollmentTokenListPage: React.FunctionComponent<{}> = () => {
           agentPolicies={agentPolicies}
           onClose={() => {
             setFlyoutOpen(false);
-            enrollmentAPIKeysRequest.sendRequest();
+            enrollmentAPIKeysRequest.resendRequest();
           }}
         />
       )}
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
index b81d44c40f8eb..12a0956b79155 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
@@ -10,7 +10,6 @@ import { RequestHandler } from 'kibana/server';
 import { TypeOf } from '@kbn/config-schema';
 import { PostNewAgentActionRequestSchema } from '../../types/rest_spec';
 import { ActionsService } from '../../services/agents';
-import { NewAgentAction } from '../../../common/types/models';
 import { PostNewAgentActionResponse } from '../../../common/types/rest_spec';
 
 export const postNewAgentActionHandlerBuilder = function (
@@ -26,7 +25,7 @@ export const postNewAgentActionHandlerBuilder = function (
 
       const agent = await actionsService.getAgent(soClient, request.params.agentId);
 
-      const newAgentAction = request.body.action as NewAgentAction;
+      const newAgentAction = request.body.action;
 
       const savedAgentAction = await actionsService.createAgentAction(soClient, {
         created_at: new Date().toISOString(),
diff --git a/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts
index b19960cc90228..385e256933c12 100644
--- a/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/epm/handlers.ts
@@ -167,7 +167,7 @@ export const installPackageHandler: RequestHandler<
         await removeInstallation({ savedObjectsClient, pkgkey, callCluster });
       }
       if (installType === 'update') {
-        // @ts-ignore installType conditions already check for existence of installedPkg
+        // @ts-ignore getInstallType ensures we have installedPkg
         const prevVersion = `${pkgName}-${installedPkg.attributes.version}`;
         logger.error(`rolling back to ${prevVersion} after error installing ${pkgkey}`);
         await installPackage({
diff --git a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
index aff8e607622d4..e86f7b24e2c78 100644
--- a/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
+++ b/x-pack/plugins/ingest_manager/server/saved_objects/index.ts
@@ -98,8 +98,11 @@ const savedObjectTypes: { [key: string]: SavedObjectsType } = {
     mappings: {
       properties: {
         agent_id: { type: 'keyword' },
+        policy_id: { type: 'keyword' },
+        policy_revision: { type: 'integer' },
         type: { type: 'keyword' },
         data: { type: 'binary' },
+        ack_data: { type: 'text' },
         sent_at: { type: 'date' },
         created_at: { type: 'date' },
       },
diff --git a/x-pack/plugins/ingest_manager/server/services/agent_policy.ts b/x-pack/plugins/ingest_manager/server/services/agent_policy.ts
index a03a3b7f59fba..938cfb4351630 100644
--- a/x-pack/plugins/ingest_manager/server/services/agent_policy.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agent_policy.ts
@@ -21,7 +21,7 @@ import {
   ListWithKuery,
 } from '../types';
 import { DeleteAgentPolicyResponse, storedPackagePoliciesToAgentInputs } from '../../common';
-import { listAgents } from './agents';
+import { createAgentPolicyAction, listAgents } from './agents';
 import { packagePolicyService } from './package_policy';
 import { outputService } from './output';
 import { agentPolicyUpdateEventHandler } from './agent_policy_update';
@@ -67,6 +67,10 @@ class AgentPolicyService {
       updated_by: user ? user.username : 'system',
     });
 
+    if (options.bumpRevision) {
+      await this.triggerAgentPolicyUpdatedEvent(soClient, 'updated', id);
+    }
+
     return (await this.get(soClient, id)) as AgentPolicy;
   }
 
@@ -383,6 +387,32 @@ class AgentPolicyService {
     };
   }
 
+  public async createFleetPolicyChangeAction(
+    soClient: SavedObjectsClientContract,
+    agentPolicyId: string
+  ) {
+    const policy = await agentPolicyService.getFullAgentPolicy(soClient, agentPolicyId);
+    if (!policy || !policy.revision) {
+      return;
+    }
+    const packages = policy.inputs.reduce<string[]>((acc, input) => {
+      const packageName = input.meta?.package?.name;
+      if (packageName && acc.indexOf(packageName) < 0) {
+        acc.push(packageName);
+      }
+      return acc;
+    }, []);
+
+    await createAgentPolicyAction(soClient, {
+      type: 'CONFIG_CHANGE',
+      data: { config: policy } as any,
+      ack_data: { packages },
+      created_at: new Date().toISOString(),
+      policy_id: policy.id,
+      policy_revision: policy.revision,
+    });
+  }
+
   public async getFullAgentPolicy(
     soClient: SavedObjectsClientContract,
     id: string,
diff --git a/x-pack/plugins/ingest_manager/server/services/agent_policy_update.ts b/x-pack/plugins/ingest_manager/server/services/agent_policy_update.ts
index 3c743dd957f62..ff20e25e5bf0d 100644
--- a/x-pack/plugins/ingest_manager/server/services/agent_policy_update.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agent_policy_update.ts
@@ -8,6 +8,7 @@ import { SavedObjectsClientContract } from 'src/core/server';
 import { generateEnrollmentAPIKey, deleteEnrollmentApiKeyForAgentPolicyId } from './api_keys';
 import { unenrollForAgentPolicyId } from './agents';
 import { outputService } from './output';
+import { agentPolicyService } from './agent_policy';
 
 export async function agentPolicyUpdateEventHandler(
   soClient: SavedObjectsClientContract,
@@ -15,8 +16,9 @@ export async function agentPolicyUpdateEventHandler(
   agentPolicyId: string
 ) {
   const adminUser = await outputService.getAdminUser(soClient);
-  // If no admin user fleet is not enabled just skip this hook
-  if (!adminUser) {
+  const outputId = await outputService.getDefaultOutputId(soClient);
+  // If no admin user and no default output fleet is not enabled just skip this hook
+  if (!adminUser || !outputId) {
     return;
   }
 
@@ -24,6 +26,11 @@ export async function agentPolicyUpdateEventHandler(
     await generateEnrollmentAPIKey(soClient, {
       agentPolicyId,
     });
+    await agentPolicyService.createFleetPolicyChangeAction(soClient, agentPolicyId);
+  }
+
+  if (action === 'updated') {
+    await agentPolicyService.createFleetPolicyChangeAction(soClient, agentPolicyId);
   }
 
   if (action === 'deleted') {
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts b/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts
index 80fdc305d0ba7..866aa587b8a56 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts
@@ -6,45 +6,19 @@
 import Boom from 'boom';
 import { SavedObjectsBulkResponse } from 'kibana/server';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
-import { encryptedSavedObjectsMock } from '../../../../../plugins/encrypted_saved_objects/server/mocks';
 
 import {
   Agent,
-  AgentAction,
   AgentActionSOAttributes,
+  BaseAgentActionSOAttributes,
   AgentEvent,
 } from '../../../common/types/models';
 import { AGENT_TYPE_PERMANENT, AGENT_ACTION_SAVED_OBJECT_TYPE } from '../../../common/constants';
 import { acknowledgeAgentActions } from './acks';
-import { appContextService } from '../app_context';
-import { IngestManagerAppContext } from '../../plugin';
 
 describe('test agent acks services', () => {
   it('should succeed on valid and matched actions', async () => {
     const mockSavedObjectsClient = savedObjectsClientMock.create();
-    const mockStartEncryptedSOPlugin = encryptedSavedObjectsMock.createStart();
-    appContextService.start(({
-      encryptedSavedObjectsStart: mockStartEncryptedSOPlugin,
-    } as unknown) as IngestManagerAppContext);
-
-    const [
-      { value: mockStartEncryptedSOClient },
-    ] = mockStartEncryptedSOPlugin.getClient.mock.results;
-
-    mockStartEncryptedSOClient.getDecryptedAsInternalUser.mockReturnValue(
-      Promise.resolve({
-        id: 'action1',
-        references: [],
-        type: AGENT_ACTION_SAVED_OBJECT_TYPE,
-        attributes: {
-          type: 'CONFIG_CHANGE',
-          agent_id: 'id',
-          sent_at: '2020-03-14T19:45:02.620Z',
-          timestamp: '2019-01-04T14:32:03.36764-05:00',
-          created_at: '2020-03-14T19:45:02.620Z',
-        },
-      })
-    );
 
     mockSavedObjectsClient.bulkGet.mockReturnValue(
       Promise.resolve({
@@ -65,7 +39,7 @@ describe('test agent acks services', () => {
       } as SavedObjectsBulkResponse<AgentActionSOAttributes>)
     );
 
-    const agentActions = await acknowledgeAgentActions(
+    await acknowledgeAgentActions(
       mockSavedObjectsClient,
       ({
         id: 'id',
@@ -81,125 +55,32 @@ describe('test agent acks services', () => {
         } as AgentEvent,
       ]
     );
-    expect(agentActions).toEqual([
-      ({
-        type: 'CONFIG_CHANGE',
-        id: 'action1',
-        agent_id: 'id',
-        sent_at: '2020-03-14T19:45:02.620Z',
-        timestamp: '2019-01-04T14:32:03.36764-05:00',
-        created_at: '2020-03-14T19:45:02.620Z',
-      } as unknown) as AgentAction,
-    ]);
   });
 
   it('should update config field on the agent if a policy change is acknowledged', async () => {
     const mockSavedObjectsClient = savedObjectsClientMock.create();
-    const mockStartEncryptedSOPlugin = encryptedSavedObjectsMock.createStart();
-    appContextService.start(({
-      encryptedSavedObjectsStart: mockStartEncryptedSOPlugin,
-    } as unknown) as IngestManagerAppContext);
 
-    const [
-      { value: mockStartEncryptedSOClient },
-    ] = mockStartEncryptedSOPlugin.getClient.mock.results;
-
-    mockStartEncryptedSOClient.getDecryptedAsInternalUser.mockReturnValue(
-      Promise.resolve({
-        id: 'action1',
-        references: [],
-        type: AGENT_ACTION_SAVED_OBJECT_TYPE,
-        attributes: {
-          type: 'CONFIG_CHANGE',
-          agent_id: 'id',
-          sent_at: '2020-03-14T19:45:02.620Z',
-          timestamp: '2019-01-04T14:32:03.36764-05:00',
-          created_at: '2020-03-14T19:45:02.620Z',
-          data: JSON.stringify({
-            config: {
-              id: 'policy1',
-              revision: 4,
-              settings: {
-                monitoring: {
-                  enabled: true,
-                  use_output: 'default',
-                  logs: true,
-                  metrics: true,
-                },
-              },
-              outputs: {
-                default: {
-                  type: 'elasticsearch',
-                  hosts: ['http://localhost:9200'],
-                },
-              },
-              inputs: [
-                {
-                  id: 'f2293360-b57c-11ea-8bd3-7bd51e425399',
-                  name: 'system-1',
-                  type: 'logs',
-                  use_output: 'default',
-                  meta: {
-                    package: {
-                      name: 'system',
-                      version: '0.3.0',
-                    },
-                  },
-                  dataset: {
-                    namespace: 'default',
-                  },
-                  streams: [
-                    {
-                      id: 'logs-system.syslog',
-                      dataset: {
-                        name: 'system.syslog',
-                      },
-                      paths: ['/var/log/messages*', '/var/log/syslog*'],
-                      exclude_files: ['.gz$'],
-                      multiline: {
-                        pattern: '^\\s',
-                        match: 'after',
-                      },
-                      processors: [
-                        {
-                          add_locale: null,
-                        },
-                        {
-                          add_fields: {
-                            target: '',
-                            fields: {
-                              'ecs.version': '1.5.0',
-                            },
-                          },
-                        },
-                      ],
-                    },
-                  ],
-                },
-              ],
-            },
-          }),
-        },
-      })
-    );
+    const actionAttributes = {
+      type: 'CONFIG_CHANGE',
+      policy_id: 'policy1',
+      policy_revision: 4,
+      sent_at: '2020-03-14T19:45:02.620Z',
+      timestamp: '2019-01-04T14:32:03.36764-05:00',
+      created_at: '2020-03-14T19:45:02.620Z',
+      ack_data: JSON.stringify({ packages: ['system'] }),
+    };
 
     mockSavedObjectsClient.bulkGet.mockReturnValue(
       Promise.resolve({
         saved_objects: [
           {
-            id: 'action1',
+            id: 'action2',
             references: [],
             type: AGENT_ACTION_SAVED_OBJECT_TYPE,
-            attributes: {
-              type: 'CONFIG_CHANGE',
-              agent_id: 'id',
-              sent_at: '2020-03-14T19:45:02.620Z',
-              timestamp: '2019-01-04T14:32:03.36764-05:00',
-              created_at: '2020-03-14T19:45:02.620Z',
-            },
+            attributes: actionAttributes,
           },
         ],
-      } as SavedObjectsBulkResponse<AgentActionSOAttributes>)
+      } as SavedObjectsBulkResponse<BaseAgentActionSOAttributes>)
     );
 
     await acknowledgeAgentActions(
@@ -214,13 +95,13 @@ describe('test agent acks services', () => {
           type: 'ACTION_RESULT',
           subtype: 'CONFIG',
           timestamp: '2019-01-04T14:32:03.36764-05:00',
-          action_id: 'action1',
+          action_id: 'action2',
           agent_id: 'id',
         } as AgentEvent,
       ]
     );
     expect(mockSavedObjectsClient.bulkUpdate).toBeCalled();
-    expect(mockSavedObjectsClient.bulkUpdate.mock.calls[0][0]).toHaveLength(2);
+    expect(mockSavedObjectsClient.bulkUpdate.mock.calls[0][0]).toHaveLength(1);
     expect(mockSavedObjectsClient.bulkUpdate.mock.calls[0][0][0]).toMatchInlineSnapshot(`
       Object {
         "attributes": Object {
@@ -237,111 +118,25 @@ describe('test agent acks services', () => {
 
   it('should not update config field on the agent if a policy change for an old revision is acknowledged', async () => {
     const mockSavedObjectsClient = savedObjectsClientMock.create();
-    const mockStartEncryptedSOPlugin = encryptedSavedObjectsMock.createStart();
-    appContextService.start(({
-      encryptedSavedObjectsStart: mockStartEncryptedSOPlugin,
-    } as unknown) as IngestManagerAppContext);
-
-    const [
-      { value: mockStartEncryptedSOClient },
-    ] = mockStartEncryptedSOPlugin.getClient.mock.results;
-
-    mockStartEncryptedSOClient.getDecryptedAsInternalUser.mockReturnValue(
-      Promise.resolve({
-        id: 'action1',
-        references: [],
-        type: AGENT_ACTION_SAVED_OBJECT_TYPE,
-        attributes: {
-          type: 'CONFIG_CHANGE',
-          agent_id: 'id',
-          sent_at: '2020-03-14T19:45:02.620Z',
-          timestamp: '2019-01-04T14:32:03.36764-05:00',
-          created_at: '2020-03-14T19:45:02.620Z',
-          data: JSON.stringify({
-            config: {
-              id: 'policy1',
-              revision: 4,
-              settings: {
-                monitoring: {
-                  enabled: true,
-                  use_output: 'default',
-                  logs: true,
-                  metrics: true,
-                },
-              },
-              outputs: {
-                default: {
-                  type: 'elasticsearch',
-                  hosts: ['http://localhost:9200'],
-                },
-              },
-              inputs: [
-                {
-                  id: 'f2293360-b57c-11ea-8bd3-7bd51e425399',
-                  name: 'system-1',
-                  type: 'logs',
-                  use_output: 'default',
-                  meta: {
-                    package: {
-                      name: 'system',
-                      version: '0.3.0',
-                    },
-                  },
-                  dataset: {
-                    namespace: 'default',
-                  },
-                  streams: [
-                    {
-                      id: 'logs-system.syslog',
-                      dataset: {
-                        name: 'system.syslog',
-                      },
-                      paths: ['/var/log/messages*', '/var/log/syslog*'],
-                      exclude_files: ['.gz$'],
-                      multiline: {
-                        pattern: '^\\s',
-                        match: 'after',
-                      },
-                      processors: [
-                        {
-                          add_locale: null,
-                        },
-                        {
-                          add_fields: {
-                            target: '',
-                            fields: {
-                              'ecs.version': '1.5.0',
-                            },
-                          },
-                        },
-                      ],
-                    },
-                  ],
-                },
-              ],
-            },
-          }),
-        },
-      })
-    );
 
     mockSavedObjectsClient.bulkGet.mockReturnValue(
       Promise.resolve({
         saved_objects: [
           {
-            id: 'action1',
+            id: 'action3',
             references: [],
             type: AGENT_ACTION_SAVED_OBJECT_TYPE,
             attributes: {
               type: 'CONFIG_CHANGE',
-              agent_id: 'id',
               sent_at: '2020-03-14T19:45:02.620Z',
               timestamp: '2019-01-04T14:32:03.36764-05:00',
               created_at: '2020-03-14T19:45:02.620Z',
+              policy_id: 'policy1',
+              policy_revision: 99,
             },
           },
         ],
-      } as SavedObjectsBulkResponse<AgentActionSOAttributes>)
+      } as SavedObjectsBulkResponse<BaseAgentActionSOAttributes>)
     );
 
     await acknowledgeAgentActions(
@@ -357,13 +152,13 @@ describe('test agent acks services', () => {
           type: 'ACTION_RESULT',
           subtype: 'CONFIG',
           timestamp: '2019-01-04T14:32:03.36764-05:00',
-          action_id: 'action1',
+          action_id: 'action3',
           agent_id: 'id',
         } as AgentEvent,
       ]
     );
     expect(mockSavedObjectsClient.bulkUpdate).toBeCalled();
-    expect(mockSavedObjectsClient.bulkUpdate.mock.calls[0][0]).toHaveLength(1);
+    expect(mockSavedObjectsClient.bulkUpdate.mock.calls[0][0]).toHaveLength(0);
   });
 
   it('should fail for actions that cannot be found on agent actions list', async () => {
@@ -372,7 +167,7 @@ describe('test agent acks services', () => {
       Promise.resolve({
         saved_objects: [
           {
-            id: 'action1',
+            id: 'action4',
             error: {
               message: 'Not found',
               statusCode: 404,
@@ -394,7 +189,7 @@ describe('test agent acks services', () => {
             type: 'ACTION_RESULT',
             subtype: 'CONFIG',
             timestamp: '2019-01-04T14:32:03.36764-05:00',
-            action_id: 'action2',
+            action_id: 'action4',
             agent_id: 'id',
           } as unknown) as AgentEvent,
         ]
@@ -412,7 +207,7 @@ describe('test agent acks services', () => {
       Promise.resolve({
         saved_objects: [
           {
-            id: 'action1',
+            id: 'action5',
             references: [],
             type: AGENT_ACTION_SAVED_OBJECT_TYPE,
             attributes: {
@@ -439,7 +234,7 @@ describe('test agent acks services', () => {
             type: 'ACTION',
             subtype: 'FAILED',
             timestamp: '2019-01-04T14:32:03.36764-05:00',
-            action_id: 'action1',
+            action_id: 'action5',
             agent_id: 'id',
           } as unknown) as AgentEvent,
         ]
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/acks.ts b/x-pack/plugins/ingest_manager/server/services/agents/acks.ts
index 87572ce405ee7..d29dfcec7ef30 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/acks.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/acks.ts
@@ -11,14 +11,15 @@ import {
   SavedObjectsClientContract,
 } from 'src/core/server';
 import Boom from 'boom';
+import LRU from 'lru-cache';
 import {
   Agent,
   AgentAction,
+  AgentPolicyAction,
   AgentEvent,
   AgentEventSOAttributes,
   AgentSOAttributes,
   AgentActionSOAttributes,
-  FullAgentPolicy,
 } from '../../types';
 import {
   AGENT_EVENT_SAVED_OBJECT_TYPE,
@@ -30,11 +31,20 @@ import { forceUnenrollAgent } from './unenroll';
 
 const ALLOWED_ACKNOWLEDGEMENT_TYPE: string[] = ['ACTION_RESULT'];
 
+const actionCache = new LRU<string, AgentAction>({
+  max: 20,
+  maxAge: 10 * 60 * 1000, // 10 minutes
+});
+
 export async function acknowledgeAgentActions(
   soClient: SavedObjectsClientContract,
   agent: Agent,
   agentEvents: AgentEvent[]
 ): Promise<AgentAction[]> {
+  if (agentEvents.length === 0) {
+    return [];
+  }
+
   for (const agentEvent of agentEvents) {
     if (!isAllowedType(agentEvent.type)) {
       throw Boom.badRequest(`${agentEvent.type} not allowed for acknowledgment only ACTION_RESULT`);
@@ -45,9 +55,9 @@ export async function acknowledgeAgentActions(
     .map((event) => event.action_id)
     .filter((actionId) => actionId !== undefined) as string[];
 
-  let actions;
+  let actions: AgentAction[];
   try {
-    actions = await getAgentActionByIds(soClient, actionIds);
+    actions = await fetchActionsUsingCache(soClient, actionIds);
   } catch (error) {
     if (Boom.isBoom(error) && error.output.statusCode === 404) {
       throw Boom.badRequest(`One or more actions cannot be found`);
@@ -55,65 +65,91 @@ export async function acknowledgeAgentActions(
     throw error;
   }
 
+  const agentActionsIds: string[] = [];
   for (const action of actions) {
-    if (action.agent_id !== agent.id) {
+    if (action.agent_id) {
+      agentActionsIds.push(action.id);
+    }
+    if (action.agent_id && action.agent_id !== agent.id) {
       throw Boom.badRequest(`${action.id} not found`);
     }
   }
 
-  if (actions.length === 0) {
-    return [];
-  }
-
   const isAgentUnenrolled = actions.some((action) => action.type === 'UNENROLL');
   if (isAgentUnenrolled) {
     await forceUnenrollAgent(soClient, agent.id);
   }
 
-  const agentPolicy = getLatestAgentPolicyIfUpdated(agent, actions);
+  const configChangeAction = getLatestConfigChangePolicyActionIfUpdated(agent, actions);
 
   await soClient.bulkUpdate<AgentSOAttributes | AgentActionSOAttributes>([
-    ...(agentPolicy ? [buildUpdateAgentPolicy(agent.id, agentPolicy)] : []),
-    ...buildUpdateAgentActionSentAt(actionIds),
+    ...(configChangeAction
+      ? [
+          {
+            type: AGENT_SAVED_OBJECT_TYPE,
+            id: agent.id,
+            attributes: {
+              policy_revision: configChangeAction.policy_revision,
+              packages: configChangeAction?.ack_data?.packages,
+            },
+          },
+        ]
+      : []),
+    ...buildUpdateAgentActionSentAt(agentActionsIds),
   ]);
 
   return actions;
 }
 
-function getLatestAgentPolicyIfUpdated(agent: Agent, actions: AgentAction[]) {
-  return actions.reduce<null | FullAgentPolicy>((acc, action) => {
-    if (action.type !== 'CONFIG_CHANGE') {
-      return acc;
-    }
-    const data = action.data || {};
+async function fetchActionsUsingCache(
+  soClient: SavedObjectsClientContract,
+  actionIds: string[]
+): Promise<AgentAction[]> {
+  const missingActionIds: string[] = [];
+  const actions = actionIds
+    .map((actionId) => {
+      const action = actionCache.get(actionId);
+      if (!action) {
+        missingActionIds.push(actionId);
+      }
+      return action;
+    })
+    .filter((action): action is AgentAction => action !== undefined);
+
+  if (missingActionIds.length === 0) {
+    return actions;
+  }
 
-    if (data?.config?.id !== agent.policy_id) {
-      return acc;
-    }
+  const freshActions = await getAgentActionByIds(soClient, actionIds, false);
+  freshActions.forEach((action) => actionCache.set(action.id, action));
 
-    const currentRevision = (acc && acc.revision) || agent.policy_revision || 0;
+  return [...freshActions, ...actions];
+}
 
-    return data?.config?.revision > currentRevision ? data?.config : acc;
-  }, null);
+function isAgentPolicyAction(action: AgentAction | AgentPolicyAction): action is AgentPolicyAction {
+  return (action as AgentPolicyAction).policy_id !== undefined;
 }
 
-function buildUpdateAgentPolicy(agentId: string, agentPolicy: FullAgentPolicy) {
-  const packages = agentPolicy.inputs.reduce<string[]>((acc, input) => {
-    const packageName = input.meta?.package?.name;
-    if (packageName && acc.indexOf(packageName) < 0) {
-      return [packageName, ...acc];
+function getLatestConfigChangePolicyActionIfUpdated(
+  agent: Agent,
+  actions: Array<AgentAction | AgentPolicyAction>
+): AgentPolicyAction | null {
+  return actions.reduce<null | AgentPolicyAction>((acc, action) => {
+    if (
+      !isAgentPolicyAction(action) ||
+      action.type !== 'CONFIG_CHANGE' ||
+      action.policy_id !== agent.policy_id ||
+      (acc?.policy_revision ?? 0) < (agent.policy_revision || 0)
+    ) {
+      return acc;
     }
-    return acc;
-  }, []);
 
-  return {
-    type: AGENT_SAVED_OBJECT_TYPE,
-    id: agentId,
-    attributes: {
-      policy_revision: agentPolicy.revision,
-      packages,
-    },
-  };
+    if (action.policy_revision > (acc?.policy_revision ?? 0)) {
+      return action;
+    }
+
+    return acc;
+  }, null);
 }
 
 function buildUpdateAgentActionSentAt(
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts b/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts
index c739007952389..bcb3fc7fdc7bd 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts
@@ -22,7 +22,13 @@ describe('test agent actions services', () => {
     };
     mockSavedObjectsClient.create.mockReturnValue(
       Promise.resolve({
-        attributes: {},
+        attributes: {
+          agent_id: 'agentid',
+          type: 'CONFIG_CHANGE',
+          data: JSON.stringify({ content: 'data' }),
+          sent_at: '2020-03-14T19:45:02.620Z',
+          created_at: '2020-03-14T19:45:02.620Z',
+        },
       } as SavedObject)
     );
     await createAgentAction(mockSavedObjectsClient, newAgentAction);
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/actions.ts b/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
index cd0dd92131230..8519714334986 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
@@ -5,9 +5,20 @@
  */
 
 import { SavedObjectsClientContract } from 'kibana/server';
-import { Agent, AgentAction, AgentActionSOAttributes } from '../../../common/types/models';
+import {
+  Agent,
+  AgentAction,
+  AgentPolicyAction,
+  BaseAgentActionSOAttributes,
+  AgentActionSOAttributes,
+  AgentPolicyActionSOAttributes,
+} from '../../../common/types/models';
 import { AGENT_ACTION_SAVED_OBJECT_TYPE } from '../../../common/constants';
-import { savedObjectToAgentAction } from './saved_objects';
+import {
+  isAgentActionSavedObject,
+  isPolicyActionSavedObject,
+  savedObjectToAgentAction,
+} from './saved_objects';
 import { appContextService } from '../app_context';
 import { nodeTypes } from '../../../../../../src/plugins/data/common';
 
@@ -15,15 +26,45 @@ export async function createAgentAction(
   soClient: SavedObjectsClientContract,
   newAgentAction: Omit<AgentAction, 'id'>
 ): Promise<AgentAction> {
-  const so = await soClient.create<AgentActionSOAttributes>(AGENT_ACTION_SAVED_OBJECT_TYPE, {
+  return createAction(soClient, newAgentAction);
+}
+
+export function createAgentPolicyAction(
+  soClient: SavedObjectsClientContract,
+  newAgentAction: Omit<AgentPolicyAction, 'id'>
+): Promise<AgentPolicyAction> {
+  return createAction(soClient, newAgentAction);
+}
+async function createAction(
+  soClient: SavedObjectsClientContract,
+  newAgentAction: Omit<AgentPolicyAction, 'id'>
+): Promise<AgentPolicyAction>;
+async function createAction(
+  soClient: SavedObjectsClientContract,
+  newAgentAction: Omit<AgentAction, 'id'>
+): Promise<AgentAction>;
+async function createAction(
+  soClient: SavedObjectsClientContract,
+  newAgentAction: Omit<AgentPolicyAction, 'id'> | Omit<AgentAction, 'id'>
+): Promise<AgentPolicyAction | AgentAction> {
+  const so = await soClient.create<BaseAgentActionSOAttributes>(AGENT_ACTION_SAVED_OBJECT_TYPE, {
     ...newAgentAction,
     data: newAgentAction.data ? JSON.stringify(newAgentAction.data) : undefined,
+    ack_data: newAgentAction.ack_data ? JSON.stringify(newAgentAction.ack_data) : undefined,
   });
 
-  const agentAction = savedObjectToAgentAction(so);
-  agentAction.data = newAgentAction.data;
+  if (isAgentActionSavedObject(so)) {
+    const agentAction = savedObjectToAgentAction(so);
+    agentAction.data = newAgentAction.data;
+
+    return agentAction;
+  } else if (isPolicyActionSavedObject(so)) {
+    const agentAction = savedObjectToAgentAction(so);
+    agentAction.data = newAgentAction.data;
 
-  return agentAction;
+    return agentAction;
+  }
+  throw new Error('Invalid action');
 }
 
 export async function getAgentActionsForCheckin(
@@ -67,7 +108,8 @@ export async function getAgentActionsForCheckin(
 
 export async function getAgentActionByIds(
   soClient: SavedObjectsClientContract,
-  actionIds: string[]
+  actionIds: string[],
+  decryptData: boolean = true
 ) {
   const actions = (
     await soClient.bulkGet<AgentActionSOAttributes>(
@@ -76,7 +118,11 @@ export async function getAgentActionByIds(
         type: AGENT_ACTION_SAVED_OBJECT_TYPE,
       }))
     )
-  ).saved_objects.map(savedObjectToAgentAction);
+  ).saved_objects.map((action) => savedObjectToAgentAction(action));
+
+  if (!decryptData) {
+    return actions;
+  }
 
   return Promise.all(
     actions.map(async (action) => {
@@ -93,6 +139,39 @@ export async function getAgentActionByIds(
   );
 }
 
+export async function getAgentPolicyActionByIds(
+  soClient: SavedObjectsClientContract,
+  actionIds: string[],
+  decryptData: boolean = true
+) {
+  const actions = (
+    await soClient.bulkGet<AgentPolicyActionSOAttributes>(
+      actionIds.map((actionId) => ({
+        id: actionId,
+        type: AGENT_ACTION_SAVED_OBJECT_TYPE,
+      }))
+    )
+  ).saved_objects.map((action) => savedObjectToAgentAction(action));
+
+  if (!decryptData) {
+    return actions;
+  }
+
+  return Promise.all(
+    actions.map(async (action) => {
+      // Get decrypted actions
+      return savedObjectToAgentAction(
+        await appContextService
+          .getEncryptedSavedObjects()
+          .getDecryptedAsInternalUser<AgentPolicyActionSOAttributes>(
+            AGENT_ACTION_SAVED_OBJECT_TYPE,
+            action.id
+          )
+      );
+    })
+  );
+}
+
 export async function getNewActionsSince(soClient: SavedObjectsClientContract, timestamp: string) {
   const filter = nodeTypes.function.buildNode('and', [
     nodeTypes.function.buildNode(
@@ -116,7 +195,26 @@ export async function getNewActionsSince(soClient: SavedObjectsClientContract, t
     filter,
   });
 
-  return res.saved_objects.map(savedObjectToAgentAction);
+  return res.saved_objects
+    .filter(isAgentActionSavedObject)
+    .map((so) => savedObjectToAgentAction(so));
+}
+
+export async function getLatestConfigChangeAction(
+  soClient: SavedObjectsClientContract,
+  policyId: string
+) {
+  const res = await soClient.find<AgentPolicyActionSOAttributes>({
+    type: AGENT_ACTION_SAVED_OBJECT_TYPE,
+    search: policyId,
+    searchFields: ['policy_id'],
+    sortField: 'created_at',
+    sortOrder: 'DESC',
+  });
+
+  if (res.saved_objects[0]) {
+    return savedObjectToAgentAction(res.saved_objects[0]);
+  }
 }
 
 export interface ActionsService {
@@ -124,6 +222,6 @@ export interface ActionsService {
 
   createAgentAction: (
     soClient: SavedObjectsClientContract,
-    newAgentAction: AgentActionSOAttributes
+    newAgentAction: Omit<AgentAction, 'id'>
   ) => Promise<AgentAction>;
 }
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts b/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts
index eddfb0e64b84b..8f586420c3ecb 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/checkin/state_new_actions.ts
@@ -5,6 +5,7 @@
  */
 
 import { timer, from, Observable, TimeoutError } from 'rxjs';
+import { omit } from 'lodash';
 import {
   shareReplay,
   distinctUntilKeyChanged,
@@ -16,14 +17,7 @@ import {
   take,
 } from 'rxjs/operators';
 import { SavedObjectsClientContract, KibanaRequest } from 'src/core/server';
-import {
-  Agent,
-  AgentAction,
-  AgentSOAttributes,
-  AgentPolicy,
-  FullAgentPolicy,
-} from '../../../types';
-import { agentPolicyService } from '../../agent_policy';
+import { Agent, AgentAction, AgentPolicyAction, AgentSOAttributes } from '../../../types';
 import * as APIKeysService from '../../api_keys';
 import {
   AGENT_SAVED_OBJECT_TYPE,
@@ -31,7 +25,11 @@ import {
   AGENT_POLICY_ROLLOUT_RATE_LIMIT_INTERVAL_MS,
   AGENT_POLICY_ROLLOUT_RATE_LIMIT_REQUEST_PER_INTERVAL,
 } from '../../../constants';
-import { createAgentAction, getNewActionsSince } from '../actions';
+import {
+  getNewActionsSince,
+  getLatestConfigChangeAction,
+  getAgentPolicyActionByIds,
+} from '../actions';
 import { appContextService } from '../../app_context';
 import { toPromiseAbortable, AbortError, createRateLimiter } from './rxjs_utils';
 
@@ -54,27 +52,27 @@ function getInternalUserSOClient() {
   return appContextService.getInternalUserSOClient(fakeRequest);
 }
 
-function createAgentPolicySharedObservable(agentPolicyId: string) {
+function createNewActionsSharedObservable(): Observable<AgentAction[]> {
   const internalSOClient = getInternalUserSOClient();
+
   return timer(0, AGENT_UPDATE_ACTIONS_INTERVAL_MS).pipe(
-    switchMap(() =>
-      from(agentPolicyService.get(internalSOClient, agentPolicyId) as Promise<AgentPolicy>)
-    ),
-    distinctUntilKeyChanged('revision'),
-    switchMap((data) =>
-      from(agentPolicyService.getFullAgentPolicy(internalSOClient, agentPolicyId))
-    ),
+    switchMap(() => {
+      return from(getNewActionsSince(internalSOClient, new Date().toISOString()));
+    }),
     shareReplay({ refCount: true, bufferSize: 1 })
   );
 }
 
-function createNewActionsSharedObservable(): Observable<AgentAction[]> {
-  return timer(0, AGENT_UPDATE_ACTIONS_INTERVAL_MS).pipe(
-    switchMap(() => {
-      const internalSOClient = getInternalUserSOClient();
+function createAgentPolicyActionSharedObservable(agentPolicyId: string) {
+  const internalSOClient = getInternalUserSOClient();
 
-      return from(getNewActionsSince(internalSOClient, new Date().toISOString()));
-    }),
+  return timer(0, AGENT_UPDATE_ACTIONS_INTERVAL_MS).pipe(
+    switchMap(() => from(getLatestConfigChangeAction(internalSOClient, agentPolicyId))),
+    filter((data): data is AgentPolicyAction => data !== undefined),
+    distinctUntilKeyChanged('id'),
+    switchMap((data) =>
+      from(getAgentPolicyActionByIds(internalSOClient, [data.id]).then((r) => r[0]))
+    ),
     shareReplay({ refCount: true, bufferSize: 1 })
   );
 }
@@ -102,47 +100,35 @@ async function getOrCreateAgentDefaultOutputAPIKey(
   return outputAPIKey.key;
 }
 
-function shouldCreateAgentPolicyAction(agent: Agent, agentPolicy: FullAgentPolicy | null): boolean {
-  if (!agentPolicy || !agentPolicy.revision) {
-    return false;
-  }
-  const isAgentPolicyOutdated =
-    !agent.policy_revision || agent.policy_revision < agentPolicy.revision;
-  if (!isAgentPolicyOutdated) {
-    return false;
-  }
-
-  return true;
-}
-
-async function createAgentActionFromAgentPolicy(
+async function createAgentActionFromPolicyAction(
   soClient: SavedObjectsClientContract,
   agent: Agent,
-  policy: FullAgentPolicy | null
+  policyAction: AgentPolicyAction
 ) {
-  // Deep clone !not supporting Date, and undefined value.
-  const newAgentPolicy = JSON.parse(JSON.stringify(policy));
+  const newAgentAction: AgentAction = Object.assign(
+    omit(
+      // Faster than clone
+      JSON.parse(JSON.stringify(policyAction)) as AgentPolicyAction,
+      'policy_id',
+      'policy_revision'
+    ),
+    {
+      agent_id: agent.id,
+    }
+  );
 
   // Mutate the policy to set the api token for this agent
-  newAgentPolicy.outputs.default.api_key = await getOrCreateAgentDefaultOutputAPIKey(
+  newAgentAction.data.config.outputs.default.api_key = await getOrCreateAgentDefaultOutputAPIKey(
     soClient,
     agent
   );
 
-  const policyChangeAction = await createAgentAction(soClient, {
-    agent_id: agent.id,
-    type: 'CONFIG_CHANGE',
-    data: { config: newAgentPolicy } as any,
-    created_at: new Date().toISOString(),
-    sent_at: undefined,
-  });
-
-  return [policyChangeAction];
+  return [newAgentAction];
 }
 
 export function agentCheckinStateNewActionsFactory() {
   // Shared Observables
-  const agentPolicies$ = new Map<string, Observable<FullAgentPolicy | null>>();
+  const agentPolicies$ = new Map<string, Observable<AgentPolicyAction>>();
   const newActions$ = createNewActionsSharedObservable();
   // Rx operators
   const rateLimiter = createRateLimiter(
@@ -162,7 +148,7 @@ export function agentCheckinStateNewActionsFactory() {
     }
     const agentPolicyId = agent.policy_id;
     if (!agentPolicies$.has(agentPolicyId)) {
-      agentPolicies$.set(agentPolicyId, createAgentPolicySharedObservable(agentPolicyId));
+      agentPolicies$.set(agentPolicyId, createAgentPolicyActionSharedObservable(agentPolicyId));
     }
     const agentPolicy$ = agentPolicies$.get(agentPolicyId);
     if (!agentPolicy$) {
@@ -174,15 +160,22 @@ export function agentCheckinStateNewActionsFactory() {
         // Set a timeout 3s before the real timeout to have a chance to respond an empty response before socket timeout
         Math.max((appContextService.getConfig()?.fleet.pollingRequestTimeout ?? 0) - 3000, 3000)
       ),
-      filter((agentPolicy) => shouldCreateAgentPolicyAction(agent, agentPolicy)),
+      filter(
+        (action) =>
+          agent.policy_id !== undefined &&
+          action.policy_revision !== undefined &&
+          action.policy_id !== undefined &&
+          action.policy_id === agent.policy_id &&
+          (!agent.policy_revision || action.policy_revision > agent.policy_revision)
+      ),
       rateLimiter(),
-      mergeMap((agentPolicy) => createAgentActionFromAgentPolicy(soClient, agent, agentPolicy)),
+      mergeMap((policyAction) => createAgentActionFromPolicyAction(soClient, agent, policyAction)),
       merge(newActions$),
       mergeMap(async (data) => {
         if (!data) {
           return;
         }
-        const newActions = data.filter((action) => action.agent_id);
+        const newActions = data.filter((action) => action.agent_id === agent.id);
         if (newActions.length === 0) {
           return;
         }
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts b/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts
index 2ab5cc8139f69..3ae664c086da9 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts
@@ -6,7 +6,15 @@
 
 import Boom from 'boom';
 import { SavedObject } from 'src/core/server';
-import { Agent, AgentSOAttributes, AgentAction, AgentActionSOAttributes } from '../../types';
+import {
+  Agent,
+  AgentSOAttributes,
+  AgentAction,
+  AgentPolicyAction,
+  AgentActionSOAttributes,
+  AgentPolicyActionSOAttributes,
+  BaseAgentActionSOAttributes,
+} from '../../types';
 
 export function savedObjectToAgent(so: SavedObject<AgentSOAttributes>): Agent {
   if (so.error) {
@@ -27,7 +35,13 @@ export function savedObjectToAgent(so: SavedObject<AgentSOAttributes>): Agent {
   };
 }
 
-export function savedObjectToAgentAction(so: SavedObject<AgentActionSOAttributes>): AgentAction {
+export function savedObjectToAgentAction(so: SavedObject<AgentActionSOAttributes>): AgentAction;
+export function savedObjectToAgentAction(
+  so: SavedObject<AgentPolicyActionSOAttributes>
+): AgentPolicyAction;
+export function savedObjectToAgentAction(
+  so: SavedObject<BaseAgentActionSOAttributes>
+): AgentAction | AgentPolicyAction {
   if (so.error) {
     if (so.error.statusCode === 404) {
       throw Boom.notFound(so.error.message);
@@ -36,9 +50,42 @@ export function savedObjectToAgentAction(so: SavedObject<AgentActionSOAttributes
     throw new Error(so.error.message);
   }
 
+  // If it's an AgentPolicyAction
+  if (isPolicyActionSavedObject(so)) {
+    return {
+      id: so.id,
+      type: so.attributes.type,
+      created_at: so.attributes.created_at,
+      policy_id: so.attributes.policy_id,
+      policy_revision: so.attributes.policy_revision,
+      data: so.attributes.data ? JSON.parse(so.attributes.data) : undefined,
+      ack_data: so.attributes.ack_data ? JSON.parse(so.attributes.ack_data) : undefined,
+    };
+  }
+
+  if (!isAgentActionSavedObject(so)) {
+    throw new Error(`Malformed saved object AgentAction ${so.id}`);
+  }
+
+  // If it's an AgentAction
   return {
     id: so.id,
-    ...so.attributes,
+    type: so.attributes.type,
+    created_at: so.attributes.created_at,
+    agent_id: so.attributes.agent_id,
     data: so.attributes.data ? JSON.parse(so.attributes.data) : undefined,
+    ack_data: so.attributes.ack_data ? JSON.parse(so.attributes.ack_data) : undefined,
   };
 }
+
+export function isAgentActionSavedObject(
+  so: SavedObject<BaseAgentActionSOAttributes>
+): so is SavedObject<AgentActionSOAttributes> {
+  return (so.attributes as AgentActionSOAttributes).agent_id !== undefined;
+}
+
+export function isPolicyActionSavedObject(
+  so: SavedObject<BaseAgentActionSOAttributes>
+): so is SavedObject<AgentPolicyActionSOAttributes> {
+  return (so.attributes as AgentPolicyActionSOAttributes).policy_id !== undefined;
+}
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.test.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.test.ts
index cc26e631a6215..2f60c74d3514f 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.test.ts
@@ -42,36 +42,62 @@ const mockInstallationUpdateFail: SavedObject<Installation> = {
 };
 describe('install', () => {
   describe('getInstallType', () => {
-    it('should return correct type when installing and no other version is currently installed', () => {});
-    const installTypeInstall = getInstallType({ pkgVersion: '1.0.0', installedPkg: undefined });
-    expect(installTypeInstall).toBe('install');
+    it('should return correct type when installing and no other version is currently installed', () => {
+      const installTypeInstall = getInstallType({ pkgVersion: '1.0.0', installedPkg: undefined });
+      expect(installTypeInstall).toBe('install');
 
-    it('should return correct type when installing the same version', () => {});
-    const installTypeReinstall = getInstallType({
-      pkgVersion: '1.0.0',
-      installedPkg: mockInstallation,
+      // @ts-expect-error can only be 'install' if no installedPkg given
+      expect(installTypeInstall === 'update').toBe(false);
+      // @ts-expect-error can only be 'install' if no installedPkg given
+      expect(installTypeInstall === 'reinstall').toBe(false);
+      // @ts-expect-error can only be 'install' if no installedPkg given
+      expect(installTypeInstall === 'reupdate').toBe(false);
+      // @ts-expect-error can only be 'install' if no installedPkg given
+      expect(installTypeInstall === 'rollback').toBe(false);
     });
-    expect(installTypeReinstall).toBe('reinstall');
 
-    it('should return correct type when moving from one version to another', () => {});
-    const installTypeUpdate = getInstallType({
-      pkgVersion: '1.0.1',
-      installedPkg: mockInstallation,
+    it('should return correct type when installing the same version', () => {
+      const installTypeReinstall = getInstallType({
+        pkgVersion: '1.0.0',
+        installedPkg: mockInstallation,
+      });
+      expect(installTypeReinstall).toBe('reinstall');
+
+      // @ts-expect-error cannot be 'install' if given installedPkg
+      expect(installTypeReinstall === 'install').toBe(false);
+    });
+
+    it('should return correct type when moving from one version to another', () => {
+      const installTypeUpdate = getInstallType({
+        pkgVersion: '1.0.1',
+        installedPkg: mockInstallation,
+      });
+      expect(installTypeUpdate).toBe('update');
+
+      // @ts-expect-error cannot be 'install' if given installedPkg
+      expect(installTypeUpdate === 'install').toBe(false);
     });
-    expect(installTypeUpdate).toBe('update');
 
-    it('should return correct type when update fails and trys again', () => {});
-    const installTypeReupdate = getInstallType({
-      pkgVersion: '1.0.1',
-      installedPkg: mockInstallationUpdateFail,
+    it('should return correct type when update fails and trys again', () => {
+      const installTypeReupdate = getInstallType({
+        pkgVersion: '1.0.1',
+        installedPkg: mockInstallationUpdateFail,
+      });
+      expect(installTypeReupdate).toBe('reupdate');
+
+      // @ts-expect-error cannot be 'install' if given installedPkg
+      expect(installTypeReupdate === 'install').toBe(false);
     });
-    expect(installTypeReupdate).toBe('reupdate');
 
-    it('should return correct type when attempting to rollback from a failed update', () => {});
-    const installTypeRollback = getInstallType({
-      pkgVersion: '1.0.0',
-      installedPkg: mockInstallationUpdateFail,
+    it('should return correct type when attempting to rollback from a failed update', () => {
+      const installTypeRollback = getInstallType({
+        pkgVersion: '1.0.0',
+        installedPkg: mockInstallationUpdateFail,
+      });
+      expect(installTypeRollback).toBe('rollback');
+
+      // @ts-expect-error cannot be 'install' if given installedPkg
+      expect(installTypeRollback === 'install').toBe(false);
     });
-    expect(installTypeRollback).toBe('rollback');
   });
 });
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
index e6144e0309594..54b9c4d3fbb17 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
@@ -200,22 +200,20 @@ export async function installPackage({
   );
 
   // if this is an update or retrying an update, delete the previous version's pipelines
-  if (installType === 'update' || installType === 'reupdate') {
+  if ((installType === 'update' || installType === 'reupdate') && installedPkg) {
     await deletePreviousPipelines(
       callCluster,
       savedObjectsClient,
       pkgName,
-      // @ts-ignore installType conditions already check for existence of installedPkg
       installedPkg.attributes.version
     );
   }
   // pipelines from a different version may have installed during a failed update
-  if (installType === 'rollback') {
+  if (installType === 'rollback' && installedPkg) {
     await deletePreviousPipelines(
       callCluster,
       savedObjectsClient,
       pkgName,
-      // @ts-ignore installType conditions already check for existence of installedPkg
       installedPkg.attributes.install_version
     );
   }
@@ -354,17 +352,32 @@ export async function ensurePackagesCompletedInstall(
   return installingPackages;
 }
 
-export function getInstallType({
-  pkgVersion,
-  installedPkg,
-}: {
+interface NoPkgArgs {
   pkgVersion: string;
-  installedPkg: SavedObject<Installation> | undefined;
-}): InstallType {
-  const isInstalledPkg = !!installedPkg;
-  const currentPkgVersion = installedPkg?.attributes.version;
-  const lastStartedInstallVersion = installedPkg?.attributes.install_version;
-  if (!isInstalledPkg) return 'install';
+  installedPkg?: undefined;
+}
+
+interface HasPkgArgs {
+  pkgVersion: string;
+  installedPkg: SavedObject<Installation>;
+}
+
+type OnlyInstall = Extract<InstallType, 'install'>;
+type NotInstall = Exclude<InstallType, 'install'>;
+
+// overloads
+export function getInstallType(args: NoPkgArgs): OnlyInstall;
+export function getInstallType(args: HasPkgArgs): NotInstall;
+export function getInstallType(args: NoPkgArgs | HasPkgArgs): OnlyInstall | NotInstall;
+
+// implementation
+export function getInstallType(args: NoPkgArgs | HasPkgArgs): OnlyInstall | NotInstall {
+  const { pkgVersion, installedPkg } = args;
+  if (!installedPkg) return 'install';
+
+  const currentPkgVersion = installedPkg.attributes.version;
+  const lastStartedInstallVersion = installedPkg.attributes.install_version;
+
   if (pkgVersion === currentPkgVersion && pkgVersion !== lastStartedInstallVersion)
     return 'rollback';
   if (pkgVersion === currentPkgVersion) return 'reinstall';
diff --git a/x-pack/plugins/ingest_manager/server/services/setup.ts b/x-pack/plugins/ingest_manager/server/services/setup.ts
index ec3a05a4fa390..f02057bae1598 100644
--- a/x-pack/plugins/ingest_manager/server/services/setup.ts
+++ b/x-pack/plugins/ingest_manager/server/services/setup.ts
@@ -170,6 +170,12 @@ export async function setupFleet(
       });
     })
   );
+
+  await Promise.all(
+    agentPolicies.map((agentPolicy) =>
+      agentPolicyService.createFleetPolicyChangeAction(soClient, agentPolicy.id)
+    )
+  );
 }
 
 function generateRandomPassword() {
diff --git a/x-pack/plugins/ingest_manager/server/types/index.tsx b/x-pack/plugins/ingest_manager/server/types/index.tsx
index 2746dfcd00ce3..d00491afef72b 100644
--- a/x-pack/plugins/ingest_manager/server/types/index.tsx
+++ b/x-pack/plugins/ingest_manager/server/types/index.tsx
@@ -16,7 +16,10 @@ export {
   AgentEvent,
   AgentEventSOAttributes,
   AgentAction,
+  AgentPolicyAction,
+  BaseAgentActionSOAttributes,
   AgentActionSOAttributes,
+  AgentPolicyActionSOAttributes,
   PackagePolicy,
   PackagePolicyInput,
   PackagePolicyInputStream,
diff --git a/x-pack/plugins/ingest_manager/server/types/models/agent.ts b/x-pack/plugins/ingest_manager/server/types/models/agent.ts
index 5ad98cfd40622..b249705fe6c2f 100644
--- a/x-pack/plugins/ingest_manager/server/types/models/agent.ts
+++ b/x-pack/plugins/ingest_manager/server/types/models/agent.ts
@@ -62,12 +62,7 @@ export const AgentEventSchema = schema.object({
 });
 
 export const NewAgentActionSchema = schema.object({
-  type: schema.oneOf([
-    schema.literal('CONFIG_CHANGE'),
-    schema.literal('DATA_DUMP'),
-    schema.literal('RESUME'),
-    schema.literal('PAUSE'),
-  ]),
+  type: schema.oneOf([schema.literal('CONFIG_CHANGE'), schema.literal('UNENROLL')]),
   data: schema.maybe(schema.any()),
   sent_at: schema.maybe(schema.string()),
 });
diff --git a/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/main.tsx b/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/main.tsx
index ccb50376dddb7..88148f1bc5746 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/main.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/sections/pipelines_list/main.tsx
@@ -51,7 +51,7 @@ export const PipelinesList: React.FunctionComponent<RouteComponentProps> = ({
 
   const [pipelinesToDelete, setPipelinesToDelete] = useState<string[]>([]);
 
-  const { data, isLoading, error, sendRequest } = services.api.useLoadPipelines();
+  const { data, isLoading, error, resendRequest } = services.api.useLoadPipelines();
 
   // Track component loaded
   useEffect(() => {
@@ -98,7 +98,7 @@ export const PipelinesList: React.FunctionComponent<RouteComponentProps> = ({
   } else if (data?.length) {
     content = (
       <PipelineTable
-        onReloadClick={sendRequest}
+        onReloadClick={resendRequest}
         onEditPipelineClick={goToEditPipeline}
         onDeletePipelineClick={setPipelinesToDelete}
         onClonePipelineClick={goToClonePipeline}
@@ -182,7 +182,7 @@ export const PipelinesList: React.FunctionComponent<RouteComponentProps> = ({
                   defaultMessage="Unable to load pipelines. {reloadLink}"
                   values={{
                     reloadLink: (
-                      <EuiLink onClick={sendRequest}>
+                      <EuiLink onClick={resendRequest}>
                         <FormattedMessage
                           id="xpack.ingestPipelines.list.loadErrorReloadLinkLabel"
                           defaultMessage="Try again."
@@ -204,7 +204,7 @@ export const PipelinesList: React.FunctionComponent<RouteComponentProps> = ({
           callback={(deleteResponse) => {
             if (deleteResponse?.hasDeletedPipelines) {
               // reload pipelines list
-              sendRequest();
+              resendRequest();
               setSelectedPipeline(undefined);
               goHome();
             }
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_index.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_index.scss
index 5b968abd0c061..954fbfadf159b 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_index.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_index.scss
@@ -1,3 +1,2 @@
 @import 'config_panel';
-@import 'dimension_popover';
 @import 'layer_panel';
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss
index 62bc6d7ed7cc8..ab53ff983ca26 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_layer_panel.scss
@@ -43,6 +43,14 @@
   min-height: $euiSizeXXL;
 }
 
+.lnsLayerPanel__anchor {
+  width: 100%;
+}
+
+.lnsLayerPanel__dndGrab {
+  padding: $euiSizeS;
+}
+
 .lnsLayerPanel__styleEditor {
   width: $euiSize * 30;
   padding: $euiSizeS;
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_dimension_popover.scss b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_popover.scss
similarity index 51%
rename from x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_dimension_popover.scss
rename to x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_popover.scss
index 691cda9ff0d79..98036c7f31bd9 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/_dimension_popover.scss
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_popover.scss
@@ -9,3 +9,10 @@
   display: block;
   word-break: break-word;
 }
+
+// todo: remove after closing https://github.com/elastic/eui/issues/3548
+.lnsDimensionPopover__fixTranslateDnd {
+  // sass-lint:disable-block no-important
+  transform: none !important;
+}
+
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_popover.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_popover.tsx
index 8d31e1bcc2e6a..a90bd8122d18e 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_popover.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/dimension_popover.tsx
@@ -3,6 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import './dimension_popover.scss';
 
 import React from 'react';
 import { EuiPopover } from '@elastic/eui';
@@ -31,6 +32,7 @@ export function DimensionPopover({
     <EuiPopover
       className="lnsDimensionPopover"
       anchorClassName="lnsDimensionPopover__trigger"
+      panelClassName="lnsDimensionPopover__fixTranslateDnd"
       isOpen={
         popoverState.isOpen &&
         (popoverState.openId === accessor || (noMatch && popoverState.addingToGroupId === groupId))
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx
index e5d63f1f92e19..10ae1936291c4 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/bucket_nesting_editor.tsx
@@ -40,6 +40,7 @@ export function BucketNestingEditor({
       value,
       text: c.label,
       fieldName: hasField(c) ? fieldMap[c.sourceField].displayName : '',
+      operationType: c.operationType,
     }));
 
   if (!column || !column.isBucketed || !aggColumns.length) {
@@ -61,6 +62,36 @@ export function BucketNestingEditor({
       }
     }
 
+    // todo: move the copy to operations
+    const topLevelCopy: Record<string, string> = {
+      terms: i18n.translate('xpack.lens.indexPattern.groupingOverallTerms', {
+        defaultMessage: 'Overall top {field}',
+        values: { field: fieldName },
+      }),
+      filters: i18n.translate('xpack.lens.indexPattern.groupingOverallFilters', {
+        defaultMessage: 'Top values for each custom query',
+      }),
+      date_histogram: i18n.translate('xpack.lens.indexPattern.groupingOverallDateHistogram', {
+        defaultMessage: 'Top values for each {field}',
+        values: { field: fieldName },
+      }),
+    };
+
+    const bottomLevelCopy: Record<string, string> = {
+      terms: i18n.translate('xpack.lens.indexPattern.groupingSecondTerms', {
+        defaultMessage: 'Top values for each {target}',
+        values: { target: target.fieldName },
+      }),
+      filters: i18n.translate('xpack.lens.indexPattern.groupingSecondFilters', {
+        defaultMessage: 'Overall top {target}',
+        values: { target: target.fieldName },
+      }),
+      date_histogram: i18n.translate('xpack.lens.indexPattern.groupingSecondDateHistogram', {
+        defaultMessage: 'Overall top {target}',
+        values: { target: target.fieldName },
+      }),
+    };
+
     return (
       <>
         <EuiHorizontalRule margin="m" />
@@ -73,34 +104,14 @@ export function BucketNestingEditor({
             <EuiRadio
               id={generator('topLevel')}
               data-test-subj="indexPattern-nesting-topLevel"
-              label={
-                column.operationType === 'terms'
-                  ? i18n.translate('xpack.lens.indexPattern.groupingOverallTerms', {
-                      defaultMessage: 'Overall top {field}',
-                      values: { field: fieldName },
-                    })
-                  : i18n.translate('xpack.lens.indexPattern.groupingOverallDateHistogram', {
-                      defaultMessage: 'Top values for each {field}',
-                      values: { field: fieldName },
-                    })
-              }
+              label={topLevelCopy[column.operationType]}
               checked={!prevColumn}
               onChange={toggleNesting}
             />
             <EuiRadio
               id={generator('bottomLevel')}
               data-test-subj="indexPattern-nesting-bottomLevel"
-              label={
-                column.operationType === 'terms'
-                  ? i18n.translate('xpack.lens.indexPattern.groupingSecondTerms', {
-                      defaultMessage: 'Top values for each {target}',
-                      values: { target: target.fieldName },
-                    })
-                  : i18n.translate('xpack.lens.indexPattern.groupingSecondDateHistogram', {
-                      defaultMessage: 'Overall top {target}',
-                      values: { target: target.fieldName },
-                    })
-              }
+              label={bottomLevelCopy[column.operationType]}
               checked={!!prevColumn}
               onChange={toggleNesting}
             />
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
index 038b51b922286..d5f0110f071f1 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
@@ -160,6 +160,11 @@ export function PopoverEditor(props: PopoverEditorProps) {
           compatibleWithCurrentField ? '' : ' incompatible'
         }`,
         onClick() {
+          // todo: when moving from terms agg to filters, we want to create a filter `$field.name : *`
+          // it probably has to be re-thought when removing the field name.
+          const isTermsToFilters =
+            selectedColumn?.operationType === 'terms' && operationType === 'filters';
+
           if (!selectedColumn || !compatibleWithCurrentField) {
             const possibleFields = fieldByOperation[operationType] || [];
 
@@ -186,7 +191,7 @@ export function PopoverEditor(props: PopoverEditorProps) {
             trackUiEvent(`indexpattern_dimension_operation_${operationType}`);
             return;
           }
-          if (incompatibleSelectedOperationType) {
+          if (incompatibleSelectedOperationType && !isTermsToFilters) {
             setInvalidOperationType(null);
           }
           if (selectedColumn.operationType === operationType) {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
index e2ca933504849..3b3750cf7c560 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
@@ -263,6 +263,7 @@ export function getIndexPatternDatasource({
               data,
               savedObjects: core.savedObjects,
               docLinks: core.docLinks,
+              http: core.http,
             }}
           >
             <IndexPatternDimensionEditor
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/cardinality.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/cardinality.tsx
index ad04891b637d4..b0777c7febd7d 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/cardinality.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/cardinality.tsx
@@ -59,7 +59,11 @@ export const cardinalityOperation: OperationDefinition<CardinalityIndexPatternCo
       sourceField: field.name,
       isBucketed: IS_BUCKETED,
       params:
-        previousColumn && previousColumn.dataType === 'number' ? previousColumn.params : undefined,
+        previousColumn?.dataType === 'number' &&
+        previousColumn.params &&
+        'format' in previousColumn.params
+          ? previousColumn.params
+          : undefined,
     };
   },
   toEsAggsConfig: (column, columnId) => ({
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/count.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/count.tsx
index 4e081da2c6dc9..bb1aef856de78 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/count.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/count.tsx
@@ -49,7 +49,11 @@ export const countOperation: OperationDefinition<CountIndexPatternColumn> = {
       scale: 'ratio',
       sourceField: field.name,
       params:
-        previousColumn && previousColumn.dataType === 'number' ? previousColumn.params : undefined,
+        previousColumn?.dataType === 'number' &&
+        previousColumn.params &&
+        'format' in previousColumn.params
+          ? previousColumn.params
+          : undefined,
     };
   },
   toEsAggsConfig: (column, columnId) => ({
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.scss b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.scss
new file mode 100644
index 0000000000000..6838812e4b999
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.scss
@@ -0,0 +1,3 @@
+.lnsIndexPatternDimensionEditor__filtersEditor {
+  width: $euiSize * 60;
+}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.test.tsx
new file mode 100644
index 0000000000000..4d4b4018d75a7
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.test.tsx
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { MouseEventHandler } from 'react';
+import { shallow } from 'enzyme';
+import { act } from 'react-dom/test-utils';
+import { EuiPopover, EuiLink } from '@elastic/eui';
+import { createMockedIndexPattern } from '../../../mocks';
+import { FilterPopover, QueryInput, LabelInput } from './filter_popover';
+
+jest.mock('.', () => ({
+  isQueryValid: () => true,
+  defaultLabel: 'label',
+}));
+
+const defaultProps = {
+  filter: {
+    input: { query: 'bytes >= 1', language: 'kuery' },
+    label: 'More than one',
+    id: '1',
+  },
+  setFilter: jest.fn(),
+  indexPattern: createMockedIndexPattern(),
+  Button: ({ onClick }: { onClick: MouseEventHandler }) => (
+    <EuiLink onClick={onClick}>trigger</EuiLink>
+  ),
+  isOpenByCreation: true,
+  setIsOpenByCreation: jest.fn(),
+};
+
+describe('filter popover', () => {
+  jest.mock('../../../../../../../../src/plugins/data/public', () => ({
+    QueryStringInput: () => {
+      return 'QueryStringInput';
+    },
+  }));
+  it('should be open if is open by creation', () => {
+    const setIsOpenByCreation = jest.fn();
+    const instance = shallow(
+      <FilterPopover {...defaultProps} setIsOpenByCreation={setIsOpenByCreation} />
+    );
+    expect(instance.find(EuiPopover).prop('isOpen')).toEqual(true);
+    act(() => {
+      instance.find(EuiPopover).prop('closePopover')!();
+    });
+    instance.update();
+    expect(setIsOpenByCreation).toHaveBeenCalledWith(false);
+  });
+  it('should call setFilter when modifying QueryInput', () => {
+    const setFilter = jest.fn();
+    const instance = shallow(<FilterPopover {...defaultProps} setFilter={setFilter} />);
+    instance.find(QueryInput).prop('onChange')!({
+      query: 'modified : query',
+      language: 'lucene',
+    });
+    expect(setFilter).toHaveBeenCalledWith({
+      input: {
+        language: 'lucene',
+        query: 'modified : query',
+      },
+      label: 'More than one',
+      id: '1',
+    });
+  });
+  it('should call setFilter when modifying LabelInput', () => {
+    const setFilter = jest.fn();
+    const instance = shallow(<FilterPopover {...defaultProps} setFilter={setFilter} />);
+    instance.find(LabelInput).prop('onChange')!('Modified label');
+    expect(setFilter).toHaveBeenCalledWith({
+      input: {
+        language: 'kuery',
+        query: 'bytes >= 1',
+      },
+      label: 'Modified label',
+      id: '1',
+    });
+  });
+});
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.tsx
new file mode 100644
index 0000000000000..cdfa19f53a13a
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filter_popover.tsx
@@ -0,0 +1,193 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import './filter_popover.scss';
+
+import React, { MouseEventHandler, useState } from 'react';
+import { useDebounce } from 'react-use';
+import { EuiPopover, EuiFieldText, EuiSpacer, keys } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FilterValue, defaultLabel, isQueryValid } from '.';
+import { IndexPattern } from '../../../types';
+import { QueryStringInput, Query } from '../../../../../../../../src/plugins/data/public';
+
+export const FilterPopover = ({
+  filter,
+  setFilter,
+  indexPattern,
+  Button,
+  isOpenByCreation,
+  setIsOpenByCreation,
+}: {
+  filter: FilterValue;
+  setFilter: Function;
+  indexPattern: IndexPattern;
+  Button: React.FunctionComponent<{ onClick: MouseEventHandler }>;
+  isOpenByCreation: boolean;
+  setIsOpenByCreation: Function;
+}) => {
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+  const inputRef = React.useRef<HTMLInputElement>();
+
+  const setPopoverOpen = (isOpen: boolean) => {
+    setIsPopoverOpen(isOpen);
+    setIsOpenByCreation(isOpen);
+  };
+
+  const setFilterLabel = (label: string) => setFilter({ ...filter, label });
+  const setFilterQuery = (input: Query) => setFilter({ ...filter, input });
+
+  const getPlaceholder = (query: Query['query']) => {
+    if (query === '') {
+      return defaultLabel;
+    }
+    if (query === 'object') return JSON.stringify(query);
+    else {
+      return String(query);
+    }
+  };
+
+  return (
+    <EuiPopover
+      anchorClassName="eui-fullWidth"
+      panelClassName="lnsIndexPatternDimensionEditor__filtersEditor"
+      isOpen={isOpenByCreation || isPopoverOpen}
+      ownFocus
+      closePopover={() => {
+        setPopoverOpen(false);
+      }}
+      button={
+        <Button
+          onClick={() => {
+            setIsPopoverOpen((open) => !open);
+            setIsOpenByCreation(false);
+          }}
+        />
+      }
+    >
+      <QueryInput
+        isInvalid={!isQueryValid(filter.input, indexPattern)}
+        value={filter.input}
+        indexPattern={indexPattern}
+        onChange={setFilterQuery}
+        onSubmit={() => {
+          if (inputRef.current) inputRef.current.focus();
+        }}
+      />
+      <EuiSpacer size="s" />
+      <LabelInput
+        value={filter.label || ''}
+        onChange={setFilterLabel}
+        placeholder={getPlaceholder(filter.input.query)}
+        inputRef={inputRef}
+        onSubmit={() => setPopoverOpen(false)}
+      />
+    </EuiPopover>
+  );
+};
+
+export const QueryInput = ({
+  value,
+  onChange,
+  indexPattern,
+  isInvalid,
+  onSubmit,
+}: {
+  value: Query;
+  onChange: (input: Query) => void;
+  indexPattern: IndexPattern;
+  isInvalid: boolean;
+  onSubmit: () => void;
+}) => {
+  const [inputValue, setInputValue] = useState(value);
+
+  React.useEffect(() => {
+    setInputValue(value);
+  }, [value, setInputValue]);
+
+  useDebounce(() => onChange(inputValue), 256, [inputValue]);
+
+  const handleInputChange = (input: Query) => {
+    setInputValue(input);
+  };
+
+  return (
+    <QueryStringInput
+      size="s"
+      isInvalid={isInvalid}
+      bubbleSubmitEvent={false}
+      indexPatterns={[indexPattern]}
+      query={inputValue}
+      onChange={handleInputChange}
+      onSubmit={() => {
+        if (inputValue.query) {
+          onSubmit();
+        }
+      }}
+      placeholder={
+        inputValue.language === 'kuery'
+          ? i18n.translate('xpack.lens.indexPattern.filters.queryPlaceholderKql', {
+              defaultMessage: '{example}',
+              values: { example: 'method : "GET" or status : "404"' },
+            })
+          : i18n.translate('xpack.lens.indexPattern.filters.queryPlaceholderLucene', {
+              defaultMessage: '{example}',
+              values: { example: 'method:GET OR status:404' },
+            })
+      }
+      languageSwitcherPopoverAnchorPosition="rightDown"
+    />
+  );
+};
+
+export const LabelInput = ({
+  value,
+  onChange,
+  placeholder,
+  inputRef,
+  onSubmit,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  placeholder: string;
+  inputRef: React.MutableRefObject<HTMLInputElement | undefined>;
+  onSubmit: () => void;
+}) => {
+  const [inputValue, setInputValue] = useState(value);
+
+  React.useEffect(() => {
+    setInputValue(value);
+  }, [value, setInputValue]);
+
+  useDebounce(() => onChange(inputValue), 256, [inputValue]);
+
+  const handleInputChange = (e: React.ChangeEvent<HTMLInputElement>) => {
+    const val = String(e.target.value);
+    setInputValue(val);
+  };
+
+  return (
+    <EuiFieldText
+      data-test-subj="indexPattern-filters-label"
+      value={inputValue}
+      onChange={handleInputChange}
+      fullWidth
+      placeholder={placeholder}
+      inputRef={(node) => {
+        if (node) {
+          inputRef.current = node;
+        }
+      }}
+      onKeyDown={({ key }: React.KeyboardEvent<HTMLInputElement>) => {
+        if (keys.ENTER === key) {
+          onSubmit();
+        }
+      }}
+      prepend={i18n.translate('xpack.lens.indexPattern.filters.label', {
+        defaultMessage: 'Label',
+      })}
+    />
+  );
+};
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.scss b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.scss
new file mode 100644
index 0000000000000..37cf1ee582768
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.scss
@@ -0,0 +1,6 @@
+.lnsFiltersOperation__popoverButton {
+  @include euiTextBreakWord;
+  @include euiFontSizeS;
+  min-height: $euiSizeXL;
+  width: 100%;
+}
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.test.tsx
new file mode 100644
index 0000000000000..13854d1ca91d6
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.test.tsx
@@ -0,0 +1,284 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { act } from 'react-dom/test-utils';
+import { IUiSettingsClient, SavedObjectsClientContract, HttpSetup } from 'kibana/public';
+import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
+import { dataPluginMock } from '../../../../../../../../src/plugins/data/public/mocks';
+import { FiltersIndexPatternColumn } from '.';
+import { filtersOperation } from '../index';
+import { IndexPatternPrivateState } from '../../../types';
+import { FilterPopover } from './filter_popover';
+
+const defaultProps = {
+  storage: {} as IStorageWrapper,
+  uiSettings: {} as IUiSettingsClient,
+  savedObjectsClient: {} as SavedObjectsClientContract,
+  dateRange: { fromDate: 'now-1d', toDate: 'now' },
+  data: dataPluginMock.createStartContract(),
+  http: {} as HttpSetup,
+};
+
+// mocking random id generator function
+jest.mock('@elastic/eui', () => {
+  const original = jest.requireActual('@elastic/eui');
+
+  return {
+    ...original,
+    htmlIdGenerator: (fn: unknown) => {
+      let counter = 0;
+      return () => counter++;
+    },
+  };
+});
+
+describe('filters', () => {
+  let state: IndexPatternPrivateState;
+  const InlineOptions = filtersOperation.paramEditor!;
+
+  beforeEach(() => {
+    state = {
+      indexPatternRefs: [],
+      indexPatterns: {},
+      existingFields: {},
+      currentIndexPatternId: '1',
+      isFirstExistenceFetch: false,
+      layers: {
+        first: {
+          indexPatternId: '1',
+          columnOrder: ['col1', 'col2'],
+          columns: {
+            col1: {
+              label: 'Custom query',
+              dataType: 'document',
+              operationType: 'filters',
+              scale: 'ordinal',
+              isBucketed: true,
+              sourceField: 'Records',
+              params: {
+                filters: [
+                  {
+                    input: { query: 'bytes >= 1', language: 'kuery' },
+                    label: 'More than one',
+                  },
+                  {
+                    input: { query: 'src : 2', language: 'kuery' },
+                    label: '',
+                  },
+                ],
+              },
+            },
+            col2: {
+              label: 'Count',
+              dataType: 'number',
+              isBucketed: false,
+              sourceField: 'Records',
+              operationType: 'count',
+            },
+          },
+        },
+      },
+    };
+  });
+
+  describe('toEsAggsConfig', () => {
+    it('should reflect params correctly', () => {
+      const esAggsConfig = filtersOperation.toEsAggsConfig(
+        state.layers.first.columns.col1 as FiltersIndexPatternColumn,
+        'col1',
+        state.indexPatterns['1']
+      );
+      expect(esAggsConfig).toEqual(
+        expect.objectContaining({
+          params: expect.objectContaining({
+            filters: [
+              {
+                input: { query: 'bytes >= 1', language: 'kuery' },
+                label: 'More than one',
+              },
+              {
+                input: { query: 'src : 2', language: 'kuery' },
+                label: '',
+              },
+            ],
+          }),
+        })
+      );
+    });
+  });
+
+  describe('getPossibleOperationForField', () => {
+    it('should return operation with the right type for document', () => {
+      expect(
+        filtersOperation.getPossibleOperationForField({
+          aggregatable: true,
+          searchable: true,
+          name: 'test',
+          displayName: 'test',
+          type: 'document',
+        })
+      ).toEqual({
+        dataType: 'string',
+        isBucketed: true,
+        scale: 'ordinal',
+      });
+    });
+
+    it('should not return operation if field type is not document', () => {
+      expect(
+        filtersOperation.getPossibleOperationForField({
+          aggregatable: false,
+          searchable: true,
+          name: 'test',
+          displayName: 'test',
+          type: 'string',
+        })
+      ).toEqual(undefined);
+    });
+  });
+
+  describe('popover param editor', () => {
+    // @ts-expect-error
+    window['__react-beautiful-dnd-disable-dev-warnings'] = true; // issue with enzyme & react-beautiful-dnd throwing errors: https://github.com/atlassian/react-beautiful-dnd/issues/1593
+    jest.mock('../../../../../../../../src/plugins/data/public', () => ({
+      QueryStringInput: () => {
+        return 'QueryStringInput';
+      },
+    }));
+
+    it('should update state when changing a filter', () => {
+      const setStateSpy = jest.fn();
+      const instance = mount(
+        <InlineOptions
+          {...defaultProps}
+          state={state}
+          setState={setStateSpy}
+          columnId="col1"
+          currentColumn={state.layers.first.columns.col1 as FiltersIndexPatternColumn}
+          layerId="first"
+        />
+      );
+
+      act(() => {
+        instance.find(FilterPopover).first().prop('setFilter')!({
+          input: {
+            query: 'dest : 5',
+            language: 'lucene',
+          },
+          label: 'Dest5',
+          id: 0,
+        });
+      });
+      instance.update();
+      expect(setStateSpy).toHaveBeenCalledWith({
+        ...state,
+        layers: {
+          first: {
+            ...state.layers.first,
+            columns: {
+              ...state.layers.first.columns,
+              col1: {
+                ...state.layers.first.columns.col1,
+                params: {
+                  filters: [
+                    {
+                      input: {
+                        query: 'dest : 5',
+                        language: 'lucene',
+                      },
+                      label: 'Dest5',
+                    },
+                    {
+                      input: {
+                        language: 'kuery',
+                        query: 'src : 2',
+                      },
+                      label: '',
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      });
+    });
+
+    describe('Modify custom query', () => {
+      it('should correctly show existing filters ', () => {
+        const setStateSpy = jest.fn();
+        const instance = mount(
+          <InlineOptions
+            {...defaultProps}
+            state={state}
+            setState={setStateSpy}
+            columnId="col1"
+            currentColumn={state.layers.first.columns.col1 as FiltersIndexPatternColumn}
+            layerId="first"
+          />
+        );
+        expect(
+          instance
+            .find('[data-test-subj="indexPattern-filters-existingFilterContainer"]')
+            .at(0)
+            .text()
+        ).toEqual('More than one');
+        expect(
+          instance
+            .find('[data-test-subj="indexPattern-filters-existingFilterContainer"]')
+            .at(2)
+            .text()
+        ).toEqual('src : 2');
+      });
+
+      it('should remove custom query', () => {
+        const setStateSpy = jest.fn();
+        const instance = mount(
+          <InlineOptions
+            {...defaultProps}
+            state={state}
+            setState={setStateSpy}
+            columnId="col1"
+            currentColumn={state.layers.first.columns.col1 as FiltersIndexPatternColumn}
+            layerId="first"
+          />
+        );
+
+        instance
+          .find('[data-test-subj="indexPattern-filters-existingFilterDelete"]')
+          .at(2)
+          .simulate('click');
+        expect(setStateSpy).toHaveBeenCalledWith({
+          ...state,
+          layers: {
+            first: {
+              ...state.layers.first,
+              columns: {
+                ...state.layers.first.columns,
+                col1: {
+                  ...state.layers.first.columns.col1,
+                  params: {
+                    filters: [
+                      {
+                        input: {
+                          language: 'kuery',
+                          query: 'bytes >= 1',
+                        },
+                        label: 'More than one',
+                      },
+                    ],
+                  },
+                },
+              },
+            },
+          },
+        });
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.tsx
new file mode 100644
index 0000000000000..c740f8466e1b1
--- /dev/null
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/filters.tsx
@@ -0,0 +1,341 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import './filters.scss';
+
+import React, { MouseEventHandler, useState } from 'react';
+import { omit } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiDragDropContext,
+  EuiDraggable,
+  EuiDroppable,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPanel,
+  euiDragDropReorder,
+  EuiButtonIcon,
+  EuiButtonEmpty,
+  EuiIcon,
+  EuiFormRow,
+  EuiLink,
+  htmlIdGenerator,
+} from '@elastic/eui';
+import { updateColumnParam } from '../../../state_helpers';
+import { OperationDefinition } from '../index';
+import { FieldBasedIndexPatternColumn } from '../column_types';
+import { FilterPopover } from './filter_popover';
+import { IndexPattern } from '../../../types';
+import { Query, esKuery, esQuery } from '../../../../../../../../src/plugins/data/public';
+
+const generateId = htmlIdGenerator();
+
+// references types from src/plugins/data/common/search/aggs/buckets/filters.ts
+export interface Filter {
+  input: Query;
+  label: string;
+}
+export interface FilterValue {
+  input: Query;
+  label: string;
+  id: string;
+}
+
+const customQueryLabel = i18n.translate('xpack.lens.indexPattern.customQuery', {
+  defaultMessage: 'Custom query',
+});
+
+export const defaultLabel = i18n.translate('xpack.lens.indexPattern.filters.label.placeholder', {
+  defaultMessage: 'All records',
+});
+
+// to do: get the language from uiSettings
+const defaultFilter: Filter = {
+  input: {
+    query: '',
+    language: 'kuery',
+  },
+  label: '',
+};
+
+export const isQueryValid = (input: Query, indexPattern: IndexPattern) => {
+  try {
+    if (input.language === 'kuery') {
+      esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(input.query), indexPattern);
+    } else {
+      esQuery.luceneStringToDsl(input.query);
+    }
+    return true;
+  } catch (e) {
+    return false;
+  }
+};
+
+interface DraggableLocation {
+  droppableId: string;
+  index: number;
+}
+
+export interface FiltersIndexPatternColumn extends FieldBasedIndexPatternColumn {
+  operationType: 'filters';
+  params: {
+    filters: Filter[];
+  };
+}
+
+export const filtersOperation: OperationDefinition<FiltersIndexPatternColumn> = {
+  type: 'filters',
+  displayName: customQueryLabel,
+  priority: 3, // Higher than any metric
+  getPossibleOperationForField: ({ type }) => {
+    if (type === 'document') {
+      return {
+        dataType: 'string',
+        isBucketed: true,
+        scale: 'ordinal',
+      };
+    }
+  },
+  isTransferable: () => false,
+
+  onFieldChange: (oldColumn, indexPattern, field) => oldColumn,
+
+  buildColumn({ suggestedPriority, field, previousColumn }) {
+    let params = { filters: [defaultFilter] };
+    if (previousColumn?.operationType === 'terms') {
+      params = {
+        filters: [
+          {
+            label: '',
+            input: {
+              query: `${previousColumn.sourceField} : *`,
+              language: 'kuery',
+            },
+          },
+        ],
+      };
+    }
+
+    return {
+      label: customQueryLabel,
+      dataType: 'string',
+      operationType: 'filters',
+      scale: 'ordinal',
+      suggestedPriority,
+      isBucketed: true,
+      sourceField: field.name,
+      params,
+    };
+  },
+
+  toEsAggsConfig: (column, columnId, indexPattern) => {
+    const validFilters = column.params.filters?.filter((f: Filter) =>
+      isQueryValid(f.input, indexPattern)
+    );
+    return {
+      id: columnId,
+      enabled: true,
+      type: 'filters',
+      schema: 'segment',
+      params: {
+        filters: validFilters?.length > 0 ? validFilters : [defaultFilter],
+      },
+    };
+  },
+
+  paramEditor: ({ state, setState, currentColumn, layerId, data }) => {
+    const indexPattern = state.indexPatterns[state.layers[layerId].indexPatternId];
+    const filters = currentColumn.params.filters;
+
+    const setFilters = (newFilters: Filter[]) =>
+      setState(
+        updateColumnParam({
+          state,
+          layerId,
+          currentColumn,
+          paramName: 'filters',
+          value: newFilters,
+        })
+      );
+
+    return (
+      <EuiFormRow>
+        <FilterList
+          filters={filters}
+          setFilters={setFilters}
+          indexPattern={indexPattern}
+          defaultQuery={defaultFilter}
+        />
+      </EuiFormRow>
+    );
+  },
+};
+
+export const FilterList = ({
+  filters,
+  setFilters,
+  indexPattern,
+  defaultQuery,
+}: {
+  filters: Filter[];
+  setFilters: Function;
+  indexPattern: IndexPattern;
+  defaultQuery: Filter;
+}) => {
+  const [isOpenByCreation, setIsOpenByCreation] = useState(false);
+  const [localFilters, setLocalFilters] = useState(() =>
+    filters.map((filter) => ({ ...filter, id: generateId() }))
+  );
+
+  const updateFilters = (updatedFilters: FilterValue[]) => {
+    // do not set internal id parameter into saved object
+    setFilters(updatedFilters.map((filter) => omit(filter, 'id')));
+    setLocalFilters(updatedFilters);
+  };
+
+  const onAddFilter = () =>
+    updateFilters([
+      ...localFilters,
+      {
+        ...defaultQuery,
+        id: generateId(),
+      },
+    ]);
+  const onRemoveFilter = (id: string) =>
+    updateFilters(localFilters.filter((filter) => filter.id !== id));
+
+  const onChangeValue = (id: string, query: Query, label: string) =>
+    updateFilters(
+      localFilters.map((filter) =>
+        filter.id === id
+          ? {
+              ...filter,
+              input: query,
+              label,
+            }
+          : filter
+      )
+    );
+
+  const onDragEnd = ({
+    source,
+    destination,
+  }: {
+    source?: DraggableLocation;
+    destination?: DraggableLocation;
+  }) => {
+    if (source && destination) {
+      const items = euiDragDropReorder(localFilters, source.index, destination.index);
+      updateFilters(items);
+    }
+  };
+
+  return (
+    <>
+      <EuiDragDropContext onDragEnd={onDragEnd} onDragStart={() => setIsOpenByCreation(false)}>
+        <EuiDroppable droppableId="FILTERS_DROPPABLE_AREA" spacing="s">
+          {localFilters?.map((filter: FilterValue, idx: number) => {
+            const { input, label, id } = filter;
+            const queryIsValid = isQueryValid(input, indexPattern);
+
+            return (
+              <EuiDraggable
+                spacing="m"
+                key={id}
+                index={idx}
+                draggableId={id}
+                disableInteractiveElementBlocking
+              >
+                {(provided) => (
+                  <EuiPanel paddingSize="none">
+                    <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
+                      <EuiFlexItem grow={false}>{/* Empty for spacing */}</EuiFlexItem>
+                      <EuiFlexItem grow={false}>
+                        <EuiIcon
+                          size="s"
+                          color={queryIsValid ? 'subdued' : 'danger'}
+                          type={queryIsValid ? 'grab' : 'alert'}
+                          title={
+                            queryIsValid
+                              ? i18n.translate('xpack.lens.indexPattern.filters.dragToReorder', {
+                                  defaultMessage: 'Drag to reorder',
+                                })
+                              : i18n.translate('xpack.lens.indexPattern.filters.isInvalid', {
+                                  defaultMessage: 'This query is invalid',
+                                })
+                          }
+                        />
+                      </EuiFlexItem>
+                      <EuiFlexItem
+                        grow={true}
+                        data-test-subj="indexPattern-filters-existingFilterContainer"
+                      >
+                        <FilterPopover
+                          isOpenByCreation={idx === localFilters.length - 1 && isOpenByCreation}
+                          setIsOpenByCreation={setIsOpenByCreation}
+                          indexPattern={indexPattern}
+                          filter={filter}
+                          Button={({ onClick }: { onClick: MouseEventHandler }) => (
+                            <EuiLink
+                              className="lnsFiltersOperation__popoverButton"
+                              data-test-subj="indexPattern-filters-existingFilterTrigger"
+                              onClick={onClick}
+                              color={queryIsValid ? 'text' : 'danger'}
+                              title={i18n.translate('xpack.lens.indexPattern.filters.clickToEdit', {
+                                defaultMessage: 'Click to edit',
+                              })}
+                            >
+                              {label || input.query || defaultLabel}
+                            </EuiLink>
+                          )}
+                          setFilter={(f: FilterValue) => {
+                            onChangeValue(f.id, f.input, f.label);
+                          }}
+                        />
+                      </EuiFlexItem>
+                      <EuiFlexItem grow={false}>
+                        <EuiButtonIcon
+                          iconSize="s"
+                          iconType="cross"
+                          color="danger"
+                          data-test-subj="indexPattern-filters-existingFilterDelete"
+                          onClick={() => {
+                            onRemoveFilter(filter.id);
+                          }}
+                          aria-label={i18n.translate(
+                            'xpack.lens.indexPattern.filters.removeCustomQuery',
+                            {
+                              defaultMessage: 'Remove custom query',
+                            }
+                          )}
+                          title={i18n.translate('xpack.lens.indexPattern.filters.remove', {
+                            defaultMessage: 'Remove',
+                          })}
+                        />
+                      </EuiFlexItem>
+                    </EuiFlexGroup>
+                  </EuiPanel>
+                )}
+              </EuiDraggable>
+            );
+          })}
+        </EuiDroppable>
+      </EuiDragDropContext>
+
+      <EuiButtonEmpty
+        size="xs"
+        iconType="plusInCircle"
+        onClick={() => {
+          onAddFilter();
+          setIsOpenByCreation(true);
+        }}
+      >
+        {i18n.translate('xpack.lens.indexPattern.filters.addCustomQuery', {
+          defaultMessage: 'Add a custom query',
+        })}
+      </EuiButtonEmpty>
+    </>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/validators.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/index.tsx
similarity index 81%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/validators.ts
rename to x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/index.tsx
index 2989cf4d98f85..30577bfde8c99 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/validators.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/filters/index.tsx
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { isUrlInvalid } from '../../utils/validators';
+export * from './filters';
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
index 8ef53c1e0b425..3dd8b659fe0a5 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
@@ -6,11 +6,21 @@
 
 import { IUiSettingsClient, SavedObjectsClientContract, HttpSetup } from 'kibana/public';
 import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
-import { termsOperation } from './terms';
-import { cardinalityOperation } from './cardinality';
-import { minOperation, averageOperation, sumOperation, maxOperation } from './metrics';
-import { dateHistogramOperation } from './date_histogram';
-import { countOperation } from './count';
+import { termsOperation, TermsIndexPatternColumn } from './terms';
+import { filtersOperation, FiltersIndexPatternColumn } from './filters';
+import { cardinalityOperation, CardinalityIndexPatternColumn } from './cardinality';
+import {
+  minOperation,
+  MinIndexPatternColumn,
+  averageOperation,
+  AvgIndexPatternColumn,
+  sumOperation,
+  SumIndexPatternColumn,
+  maxOperation,
+  MaxIndexPatternColumn,
+} from './metrics';
+import { dateHistogramOperation, DateHistogramIndexPatternColumn } from './date_histogram';
+import { countOperation, CountIndexPatternColumn } from './count';
 import { DimensionPriority, StateSetter, OperationMetadata } from '../../../types';
 import { BaseIndexPatternColumn } from './column_types';
 import { IndexPatternPrivateState, IndexPattern, IndexPatternField } from '../../types';
@@ -18,9 +28,10 @@ import { DateRange } from '../../../../common';
 import { DataPublicPluginStart } from '../../../../../../../src/plugins/data/public';
 
 // List of all operation definitions registered to this data source.
-// If you want to implement a new operation, add it to this array and
-// its type will get propagated to everything else
+// If you want to implement a new operation, add the definition to this array and
+// the column type to the `IndexPatternColumn` union type below.
 const internalOperationDefinitions = [
+  filtersOperation,
   termsOperation,
   dateHistogramOperation,
   minOperation,
@@ -31,7 +42,24 @@ const internalOperationDefinitions = [
   countOperation,
 ];
 
+/**
+ * A union type of all available column types. If a column is of an unknown type somewhere
+ * withing the indexpattern data source it should be typed as `IndexPatternColumn` to make
+ * typeguards possible that consider all available column types.
+ */
+export type IndexPatternColumn =
+  | FiltersIndexPatternColumn
+  | TermsIndexPatternColumn
+  | DateHistogramIndexPatternColumn
+  | MinIndexPatternColumn
+  | MaxIndexPatternColumn
+  | AvgIndexPatternColumn
+  | CardinalityIndexPatternColumn
+  | SumIndexPatternColumn
+  | CountIndexPatternColumn;
+
 export { termsOperation } from './terms';
+export { filtersOperation } from './filters';
 export { dateHistogramOperation } from './date_histogram';
 export { minOperation, averageOperation, sumOperation, maxOperation } from './metrics';
 export { countOperation } from './count';
@@ -106,7 +134,12 @@ interface BaseBuildColumnArgs {
   indexPattern: IndexPattern;
 }
 
-interface FieldBasedOperationDefinition<C extends BaseIndexPatternColumn>
+/**
+ * Shape of an operation definition. If the type parameter of the definition
+ * indicates a field based column, `getPossibleOperationForField` has to be
+ * specified, otherwise `getPossibleOperationForDocument` has to be defined.
+ */
+export interface OperationDefinition<C extends BaseIndexPatternColumn>
   extends BaseOperationDefinitionProps<C> {
   /**
    * Returns the meta data of the operation if applied to the given field. Undefined
@@ -119,7 +152,7 @@ interface FieldBasedOperationDefinition<C extends BaseIndexPatternColumn>
   buildColumn: (
     arg: BaseBuildColumnArgs & {
       field: IndexPatternField;
-      previousColumn?: C;
+      previousColumn?: IndexPatternColumn;
     }
   ) => C;
   /**
@@ -141,29 +174,6 @@ interface FieldBasedOperationDefinition<C extends BaseIndexPatternColumn>
   onFieldChange: (oldColumn: C, indexPattern: IndexPattern, field: IndexPatternField) => C;
 }
 
-/**
- * Shape of an operation definition. If the type parameter of the definition
- * indicates a field based column, `getPossibleOperationForField` has to be
- * specified, otherwise `getPossibleOperationForDocument` has to be defined.
- */
-export type OperationDefinition<C extends BaseIndexPatternColumn> = FieldBasedOperationDefinition<
-  C
->;
-
-// Helper to to infer the column type out of the operation definition.
-// This is done to avoid it to have to list out the column types along with
-// the operation definition types
-type ColumnFromOperationDefinition<D> = D extends OperationDefinition<infer C> ? C : never;
-
-/**
- * A union type of all available column types. If a column is of an unknown type somewhere
- * withing the indexpattern data source it should be typed as `IndexPatternColumn` to make
- * typeguards possible that consider all available column types.
- */
-export type IndexPatternColumn = ColumnFromOperationDefinition<
-  typeof internalOperationDefinitions[number]
->;
-
 /**
  * A union type of all available operation types. The operation type is a unique id of an operation.
  * Each column is assigned to exactly one operation type.
@@ -174,7 +184,7 @@ export type OperationType = typeof internalOperationDefinitions[number]['type'];
  * This is an operation definition of an unspecified column out of all possible
  * column types.
  */
-export type GenericOperationDefinition = FieldBasedOperationDefinition<IndexPatternColumn>;
+export type GenericOperationDefinition = OperationDefinition<IndexPatternColumn>;
 
 /**
  * List of all available operation definitions
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
index 21ca41234fdf1..b691c5b5c4c40 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
@@ -12,7 +12,7 @@ export interface IndexPattern {
   id: string;
   fields: IndexPatternField[];
   title: string;
-  timeFieldName?: string | null;
+  timeFieldName?: string;
   fieldFormatMap?: Record<
     string,
     {
diff --git a/x-pack/plugins/ml/common/types/data_frame_analytics.ts b/x-pack/plugins/ml/common/types/data_frame_analytics.ts
index 60d2ca63dda59..96d6c81a3d309 100644
--- a/x-pack/plugins/ml/common/types/data_frame_analytics.ts
+++ b/x-pack/plugins/ml/common/types/data_frame_analytics.ts
@@ -4,11 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CustomHttpResponseOptions, ResponseError } from 'kibana/server';
+import Boom from 'boom';
+import { EsErrorBody } from '../util/errors';
 
 export interface DeleteDataFrameAnalyticsWithIndexStatus {
   success: boolean;
-  error?: CustomHttpResponseOptions<ResponseError>;
+  error?: EsErrorBody | Boom;
 }
 
 export type IndexName = string;
diff --git a/x-pack/plugins/ml/common/util/errors.test.ts b/x-pack/plugins/ml/common/util/errors.test.ts
deleted file mode 100644
index 0b99799e3b6ec..0000000000000
--- a/x-pack/plugins/ml/common/util/errors.test.ts
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  BoomResponse,
-  extractErrorMessage,
-  MLCustomHttpResponseOptions,
-  MLResponseError,
-} from './errors';
-import { ResponseError } from 'kibana/server';
-
-describe('ML - error message utils', () => {
-  describe('extractErrorMessage', () => {
-    test('returns just the error message', () => {
-      const testMsg = 'Saved object [index-pattern/blahblahblah] not found';
-
-      const bodyWithNestedErrorMsg: MLCustomHttpResponseOptions<MLResponseError> = {
-        body: {
-          message: {
-            msg: testMsg,
-          },
-        },
-        statusCode: 404,
-      };
-      expect(extractErrorMessage(bodyWithNestedErrorMsg)).toBe(testMsg);
-
-      const bodyWithStringMsg: MLCustomHttpResponseOptions<MLResponseError> = {
-        body: {
-          msg: testMsg,
-          statusCode: 404,
-          response: `{"error":{"reason":"${testMsg}"}}`,
-        },
-        statusCode: 404,
-      };
-      expect(extractErrorMessage(bodyWithStringMsg)).toBe(testMsg);
-
-      const bodyWithStringMessage: MLCustomHttpResponseOptions<ResponseError> = {
-        body: {
-          message: testMsg,
-        },
-        statusCode: 404,
-      };
-      expect(extractErrorMessage(bodyWithStringMessage)).toBe(testMsg);
-
-      const bodyWithString: MLCustomHttpResponseOptions<ResponseError> = {
-        body: testMsg,
-        statusCode: 404,
-      };
-      expect(extractErrorMessage(bodyWithString)).toBe(testMsg);
-
-      const bodyWithError: MLCustomHttpResponseOptions<ResponseError> = {
-        body: new Error(testMsg),
-        statusCode: 404,
-      };
-      expect(extractErrorMessage(bodyWithError)).toBe(testMsg);
-
-      const bodyWithBoomError: MLCustomHttpResponseOptions<BoomResponse> = {
-        statusCode: 404,
-        body: {
-          data: [],
-          isBoom: true,
-          isServer: false,
-          output: {
-            statusCode: 404,
-            payload: {
-              statusCode: 404,
-              error: testMsg,
-              message: testMsg,
-            },
-            headers: {},
-          },
-        },
-      };
-      expect(extractErrorMessage(bodyWithBoomError)).toBe(testMsg);
-    });
-  });
-});
diff --git a/x-pack/plugins/ml/common/util/errors.ts b/x-pack/plugins/ml/common/util/errors.ts
deleted file mode 100644
index a5f89db96cfd7..0000000000000
--- a/x-pack/plugins/ml/common/util/errors.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ResponseError, ResponseHeaders } from 'kibana/server';
-import { isErrorResponse } from '../types/errors';
-
-export function getErrorMessage(error: any) {
-  if (isErrorResponse(error)) {
-    return `${error.body.error}: ${error.body.message}`;
-  }
-
-  if (typeof error === 'object' && typeof error.message === 'string') {
-    return error.message;
-  }
-
-  return JSON.stringify(error);
-}
-
-// Adding temporary types until Kibana ResponseError is updated
-
-export interface BoomResponse {
-  data: any;
-  isBoom: boolean;
-  isServer: boolean;
-  output: {
-    statusCode: number;
-    payload: {
-      statusCode: number;
-      error: string;
-      message: string;
-    };
-    headers: {};
-  };
-}
-export type MLResponseError =
-  | {
-      message: {
-        msg: string;
-      };
-    }
-  | { msg: string; statusCode: number; response: string };
-
-export interface MLCustomHttpResponseOptions<
-  T extends ResponseError | MLResponseError | BoomResponse
-> {
-  /** HTTP message to send to the client */
-  body?: T;
-  /** HTTP Headers with additional information about response */
-  headers?: ResponseHeaders;
-  statusCode: number;
-}
-
-export interface MLErrorObject {
-  message: string;
-  fullErrorMessage?: string; // For use in a 'See full error' popover.
-  statusCode?: number;
-}
-
-export const extractErrorProperties = (
-  error:
-    | MLCustomHttpResponseOptions<MLResponseError | ResponseError | BoomResponse>
-    | string
-    | undefined
-): MLErrorObject => {
-  // extract properties of the error object from within the response error
-  // coming from Kibana, Elasticsearch, and our own ML messages
-  let message = '';
-  let fullErrorMessage;
-  let statusCode;
-
-  if (typeof error === 'string') {
-    return {
-      message: error,
-    };
-  }
-  if (error?.body === undefined) {
-    return {
-      message: '',
-    };
-  }
-
-  if (typeof error.body === 'string') {
-    return {
-      message: error.body,
-    };
-  }
-  if (
-    typeof error.body === 'object' &&
-    'output' in error.body &&
-    error.body.output.payload.message
-  ) {
-    return {
-      message: error.body.output.payload.message,
-    };
-  }
-
-  if (
-    typeof error.body === 'object' &&
-    'response' in error.body &&
-    typeof error.body.response === 'string'
-  ) {
-    const errorResponse = JSON.parse(error.body.response);
-    if ('error' in errorResponse && typeof errorResponse === 'object') {
-      const errorResponseError = errorResponse.error;
-      if ('reason' in errorResponseError) {
-        message = errorResponseError.reason;
-      }
-      if ('caused_by' in errorResponseError) {
-        const causedByMessage = JSON.stringify(errorResponseError.caused_by);
-        // Only add a fullErrorMessage if different to the message.
-        if (causedByMessage !== message) {
-          fullErrorMessage = causedByMessage;
-        }
-      }
-      return {
-        message,
-        fullErrorMessage,
-        statusCode: error.statusCode,
-      };
-    }
-  }
-
-  if (typeof error.body === 'object' && 'msg' in error.body && typeof error.body.msg === 'string') {
-    return {
-      message: error.body.msg,
-    };
-  }
-
-  if (typeof error.body === 'object' && 'message' in error.body) {
-    if (
-      'attributes' in error.body &&
-      typeof error.body.attributes === 'object' &&
-      error.body.attributes.body?.status !== undefined
-    ) {
-      statusCode = error.body.attributes.body.status;
-
-      if (typeof error.body.attributes.body.error?.reason === 'string') {
-        return {
-          message: error.body.attributes.body.error.reason,
-          statusCode,
-        };
-      }
-    }
-
-    if (typeof error.body.message === 'string') {
-      return {
-        message: error.body.message,
-        statusCode,
-      };
-    }
-    if (!(error.body.message instanceof Error) && typeof (error.body.message.msg === 'string')) {
-      return {
-        message: error.body.message.msg,
-        statusCode,
-      };
-    }
-  }
-
-  // If all else fail return an empty message instead of JSON.stringify
-  return {
-    message: '',
-  };
-};
-
-export const extractErrorMessage = (
-  error:
-    | MLCustomHttpResponseOptions<MLResponseError | ResponseError | BoomResponse>
-    | undefined
-    | string
-): string => {
-  // extract only the error message within the response error coming from Kibana, Elasticsearch, and our own ML messages
-  const errorObj = extractErrorProperties(error);
-  return errorObj.message;
-};
diff --git a/x-pack/plugins/ml/common/util/errors/errors.test.ts b/x-pack/plugins/ml/common/util/errors/errors.test.ts
new file mode 100644
index 0000000000000..ddaf0b04dd12b
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/errors/errors.test.ts
@@ -0,0 +1,99 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+
+import { extractErrorMessage, MLHttpFetchError, MLResponseError, EsErrorBody } from './index';
+
+describe('ML - error message utils', () => {
+  describe('extractErrorMessage', () => {
+    test('returns just the error message', () => {
+      const testMsg = 'Saved object [index-pattern/indexpattern] not found';
+
+      // bad error, return empty string
+      const badError = {} as any;
+      expect(extractErrorMessage(badError)).toBe('');
+
+      // raw es error
+      const esErrorMsg: EsErrorBody = {
+        error: {
+          root_cause: [
+            {
+              type: 'type',
+              reason: 'reason',
+            },
+          ],
+          type: 'type',
+          reason: testMsg,
+        },
+        status: 404,
+      };
+      expect(extractErrorMessage(esErrorMsg)).toBe(testMsg);
+
+      // error is basic string
+      const stringMessage = testMsg;
+      expect(extractErrorMessage(stringMessage)).toBe(testMsg);
+
+      // kibana error without attributes
+      const bodyWithoutAttributes: MLHttpFetchError<MLResponseError> = {
+        name: 'name',
+        req: {} as Request,
+        request: {} as Request,
+        message: 'Something else',
+        body: {
+          statusCode: 404,
+          error: 'error',
+          message: testMsg,
+        },
+      };
+      expect(extractErrorMessage(bodyWithoutAttributes)).toBe(testMsg);
+
+      // kibana error with attributes
+      const bodyWithAttributes: MLHttpFetchError<MLResponseError> = {
+        name: 'name',
+        req: {} as Request,
+        request: {} as Request,
+        message: 'Something else',
+        body: {
+          statusCode: 404,
+          error: 'error',
+          message: 'Something else',
+          attributes: {
+            body: {
+              status: 404,
+              error: {
+                reason: testMsg,
+                type: 'type',
+                root_cause: [{ type: 'type', reason: 'reason' }],
+              },
+            },
+          },
+        },
+      };
+      expect(extractErrorMessage(bodyWithAttributes)).toBe(testMsg);
+
+      // boom error
+      const boomError: Boom<any> = {
+        message: '',
+        reformat: () => '',
+        name: '',
+        data: [],
+        isBoom: true,
+        isServer: false,
+        output: {
+          statusCode: 404,
+          payload: {
+            statusCode: 404,
+            error: testMsg,
+            message: testMsg,
+          },
+          headers: {},
+        },
+      };
+      expect(extractErrorMessage(boomError)).toBe(testMsg);
+    });
+  });
+});
diff --git a/x-pack/plugins/ml/common/util/errors/index.ts b/x-pack/plugins/ml/common/util/errors/index.ts
new file mode 100644
index 0000000000000..d6d33b86e6fa9
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/errors/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { MLRequestFailure } from './request_error';
+export { extractErrorMessage, extractErrorProperties } from './process_errors';
+export {
+  ErrorType,
+  EsErrorBody,
+  EsErrorRootCause,
+  MLErrorObject,
+  MLHttpFetchError,
+  MLResponseError,
+  isBoomError,
+  isErrorString,
+  isEsErrorBody,
+  isMLResponseError,
+} from './types';
diff --git a/x-pack/plugins/ml/common/util/errors/process_errors.ts b/x-pack/plugins/ml/common/util/errors/process_errors.ts
new file mode 100644
index 0000000000000..4addfa414ef56
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/errors/process_errors.ts
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  ErrorType,
+  MLErrorObject,
+  isBoomError,
+  isErrorString,
+  isEsErrorBody,
+  isMLResponseError,
+} from './types';
+
+export const extractErrorProperties = (error: ErrorType): MLErrorObject => {
+  // extract properties of the error object from within the response error
+  // coming from Kibana, Elasticsearch, and our own ML messages
+
+  // some responses contain raw es errors as part of a bulk response
+  // e.g. if some jobs fail the action in a bulk request
+  if (isEsErrorBody(error)) {
+    return {
+      message: error.error.reason,
+      statusCode: error.status,
+      fullError: error,
+    };
+  }
+
+  if (isErrorString(error)) {
+    return {
+      message: error,
+    };
+  }
+
+  if (isBoomError(error)) {
+    return {
+      message: error.output.payload.message,
+      statusCode: error.output.payload.statusCode,
+    };
+  }
+
+  if (error?.body === undefined) {
+    return {
+      message: '',
+    };
+  }
+
+  if (typeof error.body === 'string') {
+    return {
+      message: error.body,
+    };
+  }
+
+  if (isMLResponseError(error)) {
+    if (
+      typeof error.body.attributes === 'object' &&
+      typeof error.body.attributes.body?.error?.reason === 'string'
+    ) {
+      return {
+        message: error.body.attributes.body.error.reason,
+        statusCode: error.body.statusCode,
+        fullError: error.body.attributes.body,
+      };
+    } else {
+      return {
+        message: error.body.message,
+        statusCode: error.body.statusCode,
+      };
+    }
+  }
+
+  // If all else fail return an empty message instead of JSON.stringify
+  return {
+    message: '',
+  };
+};
+
+export const extractErrorMessage = (error: ErrorType): string => {
+  // extract only the error message within the response error coming from Kibana, Elasticsearch, and our own ML messages
+  const errorObj = extractErrorProperties(error);
+  return errorObj.message;
+};
diff --git a/x-pack/plugins/ml/common/util/errors/request_error.ts b/x-pack/plugins/ml/common/util/errors/request_error.ts
new file mode 100644
index 0000000000000..faa8a8e2dc0d4
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/errors/request_error.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MLErrorObject, ErrorType } from './types';
+
+export class MLRequestFailure extends Error {
+  constructor(error: MLErrorObject, resp: ErrorType) {
+    super(error.message);
+    Object.setPrototypeOf(this, new.target.prototype);
+
+    if (typeof resp !== 'string' && typeof resp !== 'undefined') {
+      if ('body' in resp) {
+        this.stack = JSON.stringify(resp.body, null, 2);
+      } else {
+        try {
+          this.stack = JSON.stringify(resp, null, 2);
+        } catch (e) {
+          // fail silently
+        }
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/ml/common/util/errors/types.ts b/x-pack/plugins/ml/common/util/errors/types.ts
new file mode 100644
index 0000000000000..3d9fc82be8d85
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/errors/types.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HttpFetchError } from 'kibana/public';
+import Boom from 'boom';
+
+export interface EsErrorRootCause {
+  type: string;
+  reason: string;
+}
+
+export interface EsErrorBody {
+  error: {
+    root_cause?: EsErrorRootCause[];
+    caused_by?: EsErrorRootCause;
+    type: string;
+    reason: string;
+  };
+  status: number;
+}
+
+export interface MLResponseError {
+  statusCode: number;
+  error: string;
+  message: string;
+  attributes?: {
+    body: EsErrorBody;
+  };
+}
+
+export interface MLErrorObject {
+  message: string;
+  statusCode?: number;
+  fullError?: EsErrorBody;
+}
+
+export interface MLHttpFetchError<T> extends HttpFetchError {
+  body: T;
+}
+
+export type ErrorType = MLHttpFetchError<MLResponseError> | EsErrorBody | Boom | string | undefined;
+
+export function isEsErrorBody(error: any): error is EsErrorBody {
+  return error && error.error?.reason !== undefined;
+}
+
+export function isErrorString(error: any): error is string {
+  return typeof error === 'string';
+}
+
+export function isMLResponseError(error: any): error is MLResponseError {
+  return typeof error.body === 'object' && 'message' in error.body;
+}
+
+export function isBoomError(error: any): error is Boom {
+  return error.isBoom === true;
+}
diff --git a/x-pack/plugins/ml/public/application/components/messagebar/messagebar_service.js b/x-pack/plugins/ml/public/application/components/messagebar/messagebar_service.js
deleted file mode 100644
index 1dc7140bd2687..0000000000000
--- a/x-pack/plugins/ml/public/application/components/messagebar/messagebar_service.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { getToastNotifications } from '../../util/dependency_cache';
-import { MLRequestFailure } from '../../util/ml_error';
-import { i18n } from '@kbn/i18n';
-
-function errorNotify(text, resp) {
-  let err = null;
-  if (typeof text === 'object' && text.response !== undefined) {
-    resp = text.response;
-  } else if (typeof text === 'object' && text.message !== undefined) {
-    err = new Error(text.message);
-  } else {
-    err = new Error(text);
-  }
-
-  const toastNotifications = getToastNotifications();
-  toastNotifications.addError(new MLRequestFailure(err, resp), {
-    title: i18n.translate('xpack.ml.messagebarService.errorTitle', {
-      defaultMessage: 'An error has occurred',
-    }),
-  });
-}
-
-export const mlMessageBarService = {
-  notify: {
-    error: errorNotify,
-  },
-};
diff --git a/x-pack/plugins/ml/public/application/components/rule_editor/rule_editor_flyout.js b/x-pack/plugins/ml/public/application/components/rule_editor/rule_editor_flyout.js
index eed57aaf1b491..5b0224c8e9f0a 100644
--- a/x-pack/plugins/ml/public/application/components/rule_editor/rule_editor_flyout.js
+++ b/x-pack/plugins/ml/public/application/components/rule_editor/rule_editor_flyout.js
@@ -10,6 +10,8 @@
 
 import PropTypes from 'prop-types';
 import React, { Component } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
 
 import {
   EuiButton,
@@ -51,8 +53,7 @@ import { getPartitioningFieldNames } from '../../../../common/util/job_utils';
 import { withKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { mlJobService } from '../../services/job_service';
 import { ml } from '../../services/ml_api_service';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
+import { extractErrorMessage } from '../../../../common/util/errors';
 
 class RuleEditorFlyoutUI extends Component {
   static propTypes = {
@@ -431,8 +432,8 @@ class RuleEditorFlyoutUI extends Component {
             values: { jobId },
           }
         );
-        if (error.message) {
-          errorMessage += ` : ${error.message}`;
+        if (error.error) {
+          errorMessage += ` : ${extractErrorMessage(error.error)}`;
         }
         toasts.addDanger(errorMessage);
       });
diff --git a/x-pack/plugins/ml/public/application/components/rule_editor/utils.js b/x-pack/plugins/ml/public/application/components/rule_editor/utils.js
index a697eed00fd66..6a8e20647cdbe 100644
--- a/x-pack/plugins/ml/public/application/components/rule_editor/utils.js
+++ b/x-pack/plugins/ml/public/application/components/rule_editor/utils.js
@@ -146,22 +146,17 @@ export function updateJobRules(job, detectorIndex, rules) {
   }
 
   return new Promise((resolve, reject) => {
-    mlJobService
-      .updateJob(jobId, jobData)
-      .then((resp) => {
-        if (resp.success) {
-          // Refresh the job data in the job service before resolving.
-          mlJobService
-            .refreshJob(jobId)
-            .then(() => {
-              resolve({ success: true });
-            })
-            .catch((refreshResp) => {
-              reject(refreshResp);
-            });
-        } else {
-          reject(resp);
-        }
+    ml.updateJob({ jobId: jobId, job: jobData })
+      .then(() => {
+        // Refresh the job data in the job service before resolving.
+        mlJobService
+          .refreshJob(jobId)
+          .then(() => {
+            resolve({ success: true });
+          })
+          .catch((refreshResp) => {
+            reject(refreshResp);
+          });
       })
       .catch((resp) => {
         reject(resp);
diff --git a/x-pack/plugins/ml/public/application/components/validate_job/__snapshots__/validate_job_view.test.js.snap b/x-pack/plugins/ml/public/application/components/validate_job/__snapshots__/validate_job_view.test.js.snap
index cbbf84b9e51ec..f6a161cc01999 100644
--- a/x-pack/plugins/ml/public/application/components/validate_job/__snapshots__/validate_job_view.test.js.snap
+++ b/x-pack/plugins/ml/public/application/components/validate_job/__snapshots__/validate_job_view.test.js.snap
@@ -8,7 +8,7 @@ exports[`ValidateJob renders button and modal with a message 1`] = `
       iconSide="right"
       iconType="questionInCircle"
       isDisabled={false}
-      isLoading={false}
+      isLoading={true}
       onClick={[Function]}
       size="s"
     >
@@ -18,62 +18,6 @@ exports[`ValidateJob renders button and modal with a message 1`] = `
         values={Object {}}
       />
     </EuiButton>
-    <Modal
-      close={[Function]}
-      title={
-        <FormattedMessage
-          defaultMessage="Validate job {title}"
-          id="xpack.ml.validateJob.modal.validateJobTitle"
-          values={
-            Object {
-              "title": "test-id",
-            }
-          }
-        />
-      }
-    >
-      <MessageList
-        idFilterList={Array []}
-        messages={
-          Array [
-            Object {
-              "fieldName": "airline",
-              "id": "over_field_low_cardinality",
-              "status": "warning",
-              "text": "Cardinality of over_field \\"airline\\" is low and therefore less suitable for population analysis.",
-              "url": "https://www.elastic.co/blog/sizing-machine-learning-with-elasticsearch",
-            },
-          ]
-        }
-      />
-      <EuiText>
-        <FormattedMessage
-          defaultMessage="Job validation performs certain checks against job configurations and underlying source data and provides specific advice on how to adjust settings that are more likely to produce insightful results."
-          id="xpack.ml.validateJob.modal.jobValidationDescriptionText"
-          values={Object {}}
-        />
-      </EuiText>
-      <EuiText>
-        <FormattedMessage
-          defaultMessage="For more information, see {mlJobTipsLink}."
-          id="xpack.ml.validateJob.modal.linkToJobTipsText"
-          values={
-            Object {
-              "mlJobTipsLink": <EuiLink
-                href="https://www.elastic.co/guide/en/machine-learning/jest-metadata-mock-branch/create-jobs.html#job-tips"
-                target="_blank"
-              >
-                <FormattedMessage
-                  defaultMessage="Machine Learning Job Tips"
-                  id="xpack.ml.validateJob.modal.linkToJobTipsText.mlJobTipsLinkText"
-                  values={Object {}}
-                />
-              </EuiLink>,
-            }
-          }
-        />
-      </EuiText>
-    </Modal>
   </div>
 </Fragment>
 `;
@@ -108,7 +52,7 @@ exports[`ValidateJob renders the button and modal with a success message 1`] = `
       iconSide="right"
       iconType="questionInCircle"
       isDisabled={false}
-      isLoading={false}
+      isLoading={true}
       onClick={[Function]}
       size="s"
     >
@@ -118,52 +62,6 @@ exports[`ValidateJob renders the button and modal with a success message 1`] = `
         values={Object {}}
       />
     </EuiButton>
-    <Modal
-      close={[Function]}
-      title={
-        <FormattedMessage
-          defaultMessage="Validate job {title}"
-          id="xpack.ml.validateJob.modal.validateJobTitle"
-          values={
-            Object {
-              "title": "test-id",
-            }
-          }
-        />
-      }
-    >
-      <MessageList
-        idFilterList={Array []}
-        messages={Array []}
-      />
-      <EuiText>
-        <FormattedMessage
-          defaultMessage="Job validation performs certain checks against job configurations and underlying source data and provides specific advice on how to adjust settings that are more likely to produce insightful results."
-          id="xpack.ml.validateJob.modal.jobValidationDescriptionText"
-          values={Object {}}
-        />
-      </EuiText>
-      <EuiText>
-        <FormattedMessage
-          defaultMessage="For more information, see {mlJobTipsLink}."
-          id="xpack.ml.validateJob.modal.linkToJobTipsText"
-          values={
-            Object {
-              "mlJobTipsLink": <EuiLink
-                href="https://www.elastic.co/guide/en/machine-learning/jest-metadata-mock-branch/create-jobs.html#job-tips"
-                target="_blank"
-              >
-                <FormattedMessage
-                  defaultMessage="Machine Learning Job Tips"
-                  id="xpack.ml.validateJob.modal.linkToJobTipsText.mlJobTipsLinkText"
-                  values={Object {}}
-                />
-              </EuiLink>,
-            }
-          }
-        />
-      </EuiText>
-    </Modal>
   </div>
 </Fragment>
 `;
diff --git a/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.d.ts b/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.d.ts
index 43e0a5f3eac78..35e4e189b4326 100644
--- a/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.d.ts
+++ b/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.d.ts
@@ -8,7 +8,7 @@ import { FC } from 'react';
 declare const ValidateJob: FC<{
   getJobConfig: any;
   getDuration: any;
-  mlJobService: any;
+  ml: any;
   embedded?: boolean;
   setIsValid?: (valid: boolean) => void;
   idFilterList?: string[];
diff --git a/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.js b/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.js
index dde6925631d3e..0c079bc11cffc 100644
--- a/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.js
+++ b/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.js
@@ -32,6 +32,8 @@ import { getDocLinks } from '../../util/dependency_cache';
 
 import { VALIDATION_STATUS } from '../../../../common/constants/validation';
 import { getMostSevereMessageStatus } from '../../../../common/util/validation_utils';
+import { toastNotificationServiceProvider } from '../../services/toast_notification_service';
+import { withKibana } from '../../../../../../../src/plugins/kibana_react/public';
 
 const defaultIconType = 'questionInCircle';
 const getDefaultState = () => ({
@@ -182,7 +184,7 @@ Modal.propType = {
   title: PropTypes.string,
 };
 
-export class ValidateJob extends Component {
+export class ValidateJobUI extends Component {
   constructor(props) {
     super(props);
     this.state = getDefaultState();
@@ -209,25 +211,40 @@ export class ValidateJob extends Component {
     if (typeof job === 'object') {
       let shouldShowLoadingIndicator = true;
 
-      this.props.mlJobService.validateJob({ duration, fields, job }).then((data) => {
-        shouldShowLoadingIndicator = false;
-        this.setState({
-          ...this.state,
-          ui: {
-            ...this.state.ui,
-            iconType: statusToEuiIconType(getMostSevereMessageStatus(data.messages)),
-            isLoading: false,
-            isModalVisible: true,
-          },
-          data,
-          title: job.job_id,
-        });
-        if (typeof this.props.setIsValid === 'function') {
-          this.props.setIsValid(
-            data.messages.some((m) => m.status === VALIDATION_STATUS.ERROR) === false
+      this.props.ml
+        .validateJob({ duration, fields, job })
+        .then((messages) => {
+          shouldShowLoadingIndicator = false;
+          this.setState({
+            ...this.state,
+            ui: {
+              ...this.state.ui,
+              iconType: statusToEuiIconType(getMostSevereMessageStatus(messages)),
+              isLoading: false,
+              isModalVisible: true,
+            },
+            data: {
+              messages,
+              success: true,
+            },
+            title: job.job_id,
+          });
+          if (typeof this.props.setIsValid === 'function') {
+            this.props.setIsValid(
+              messages.some((m) => m.status === VALIDATION_STATUS.ERROR) === false
+            );
+          }
+        })
+        .catch((error) => {
+          const { toasts } = this.props.kibana.services.notifications;
+          const toastNotificationService = toastNotificationServiceProvider(toasts);
+          toastNotificationService.displayErrorToast(
+            error,
+            i18n.translate('xpack.ml.jobService.validateJobErrorTitle', {
+              defaultMessage: 'Job Validation Error',
+            })
           );
-        }
-      });
+        });
 
       // wait for 250ms before triggering the loading indicator
       // to avoid flickering when there's a loading time below
@@ -335,15 +352,17 @@ export class ValidateJob extends Component {
     );
   }
 }
-ValidateJob.propTypes = {
+ValidateJobUI.propTypes = {
   fields: PropTypes.object,
   fill: PropTypes.bool,
   getDuration: PropTypes.func,
   getJobConfig: PropTypes.func.isRequired,
   isCurrentJobConfig: PropTypes.bool,
   isDisabled: PropTypes.bool,
-  mlJobService: PropTypes.object.isRequired,
+  ml: PropTypes.object.isRequired,
   embedded: PropTypes.bool,
   setIsValid: PropTypes.func,
   idFilterList: PropTypes.array,
 };
+
+export const ValidateJob = withKibana(ValidateJobUI);
diff --git a/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.test.js b/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.test.js
index cc8a5abb4e9ab..280dbd76d5487 100644
--- a/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.test.js
+++ b/x-pack/plugins/ml/public/application/components/validate_job/validate_job_view.test.js
@@ -16,6 +16,12 @@ jest.mock('../../util/dependency_cache', () => ({
   }),
 }));
 
+jest.mock('../../../../../../../src/plugins/kibana_react/public', () => ({
+  withKibana: (comp) => {
+    return comp;
+  },
+}));
+
 const job = {
   job_id: 'test-id',
 };
@@ -25,11 +31,16 @@ const getJobConfig = () => job;
 function prepareTest(messages) {
   const p = Promise.resolve(messages);
 
-  const mlJobService = {
-    validateJob: () => p,
+  const ml = {
+    validateJob: () => Promise.resolve(messages),
+  };
+  const kibana = {
+    services: {
+      notifications: { toasts: { addDanger: jest.fn() } },
+    },
   };
 
-  const component = <ValidateJob getJobConfig={getJobConfig} mlJobService={mlJobService} />;
+  const component = <ValidateJob getJobConfig={getJobConfig} ml={ml} kibana={kibana} />;
 
   const wrapper = shallowWithIntl(component);
 
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts
index 97098ea9e75c6..60681fb6e7bbe 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/common/analytics.ts
@@ -10,7 +10,7 @@ import { distinctUntilChanged, filter } from 'rxjs/operators';
 import { cloneDeep } from 'lodash';
 import { ml } from '../../services/ml_api_service';
 import { Dictionary } from '../../../../common/types/common';
-import { getErrorMessage } from '../../../../common/util/errors';
+import { extractErrorMessage } from '../../../../common/util/errors';
 import { SavedSearchQuery } from '../../contexts/ml';
 import {
   AnalysisConfig,
@@ -486,7 +486,7 @@ export const loadEvalData = async ({
     results.eval = evalResult;
     return results;
   } catch (e) {
-    results.error = getErrorMessage(e);
+    results.error = extractErrorMessage(e);
     return results;
   }
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/common/get_index_data.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/common/get_index_data.ts
index c162cb2754c10..53c0f02fd9a80 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/common/get_index_data.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/common/get_index_data.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getErrorMessage } from '../../../../common/util/errors';
+import { extractErrorMessage } from '../../../../common/util/errors';
 
 import { EsSorting, SearchResponse7, UseDataGridReturnType } from '../../components/data_grid';
 import { ml } from '../../services/ml_api_service';
@@ -62,7 +62,7 @@ export const getIndexData = async (
       setTableItems(docs);
       setStatus(INDEX_STATUS.LOADED);
     } catch (e) {
-      setErrorMessage(getErrorMessage(e));
+      setErrorMessage(extractErrorMessage(e));
       setStatus(INDEX_STATUS.ERROR);
     }
   }
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts
index fde1b26106508..b0e73edff7476 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/common/use_results_view_config.ts
@@ -8,7 +8,7 @@ import { useEffect, useState } from 'react';
 
 import { IndexPattern } from '../../../../../../../src/plugins/data/public';
 
-import { getErrorMessage } from '../../../../common/util/errors';
+import { extractErrorMessage } from '../../../../common/util/errors';
 
 import { getIndexPatternIdFromName } from '../../util/index_utils';
 import { ml } from '../../services/ml_api_service';
@@ -83,12 +83,12 @@ export const useResultsViewConfig = (jobId: string) => {
               setIsLoadingJobConfig(false);
             }
           } catch (e) {
-            setJobCapsServiceErrorMessage(getErrorMessage(e));
+            setJobCapsServiceErrorMessage(extractErrorMessage(e));
             setIsLoadingJobConfig(false);
           }
         }
       } catch (e) {
-        setJobConfigErrorMessage(getErrorMessage(e));
+        setJobConfigErrorMessage(extractErrorMessage(e));
         setIsLoadingJobConfig(false);
       }
     })();
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
index eab5165a42137..ea958c8c4a3a3 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts
@@ -25,7 +25,7 @@ import {
   SearchResponse7,
   UseIndexDataReturnType,
 } from '../../../../components/data_grid';
-import { getErrorMessage } from '../../../../../../common/util/errors';
+import { extractErrorMessage } from '../../../../../../common/util/errors';
 import { INDEX_STATUS } from '../../../common/analytics';
 import { ml } from '../../../../services/ml_api_service';
 
@@ -94,7 +94,7 @@ export const useIndexData = (
       setTableItems(docs);
       setStatus(INDEX_STATUS.LOADED);
     } catch (e) {
-      setErrorMessage(getErrorMessage(e));
+      setErrorMessage(extractErrorMessage(e));
       setStatus(INDEX_STATUS.ERROR);
     }
   };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.test.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.test.tsx
index ac1c710e1d106..f833cf4708cec 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.test.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.test.tsx
@@ -11,7 +11,6 @@ import { MlContext } from '../../../../../contexts/ml';
 import { kibanaContextValueMock } from '../../../../../contexts/ml/__mocks__/kibana_context_value';
 
 import { useCreateAnalyticsForm } from './use_create_analytics_form';
-import { getErrorMessage } from '../../../../../../../common/util/errors';
 
 const getMountedHook = () =>
   mountHook(
@@ -21,28 +20,6 @@ const getMountedHook = () =>
     )
   );
 
-describe('getErrorMessage()', () => {
-  test('verify error message response formats', () => {
-    const customError1 = {
-      body: { statusCode: 403, error: 'Forbidden', message: 'the-error-message' },
-    };
-    const errorMessage1 = getErrorMessage(customError1);
-    expect(errorMessage1).toBe('Forbidden: the-error-message');
-
-    const customError2 = new Error('the-error-message');
-    const errorMessage2 = getErrorMessage(customError2);
-    expect(errorMessage2).toBe('the-error-message');
-
-    const customError3 = { customErrorMessage: 'the-error-message' };
-    const errorMessage3 = getErrorMessage(customError3);
-    expect(errorMessage3).toBe('{"customErrorMessage":"the-error-message"}');
-
-    const customError4 = { message: 'the-error-message' };
-    const errorMessage4 = getErrorMessage(customError4);
-    expect(errorMessage4).toBe('the-error-message');
-  });
-});
-
 describe('useCreateAnalyticsForm()', () => {
   test('initialization', () => {
     const { getLastHookValue } = getMountedHook();
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts
index 9612b9213d120..161dde51df43e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/use_create_analytics_form.ts
@@ -8,7 +8,7 @@ import { useReducer } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { getErrorMessage } from '../../../../../../../common/util/errors';
+import { extractErrorMessage } from '../../../../../../../common/util/errors';
 import { DeepReadonly } from '../../../../../../../common/types/common';
 import { ml } from '../../../../../services/ml_api_service';
 import { useMlContext } from '../../../../../contexts/ml';
@@ -115,7 +115,7 @@ export const useCreateAnalyticsForm = (): CreateAnalyticsFormProps => {
       refresh();
     } catch (e) {
       addRequestMessage({
-        error: getErrorMessage(e),
+        error: extractErrorMessage(e),
         message: i18n.translate(
           'xpack.ml.dataframe.analytics.create.errorCreatingDataFrameAnalyticsJob',
           {
@@ -178,7 +178,7 @@ export const useCreateAnalyticsForm = (): CreateAnalyticsFormProps => {
       });
     } catch (e) {
       addRequestMessage({
-        error: getErrorMessage(e),
+        error: extractErrorMessage(e),
         message: i18n.translate(
           'xpack.ml.dataframe.analytics.create.createIndexPatternErrorMessage',
           {
@@ -199,7 +199,7 @@ export const useCreateAnalyticsForm = (): CreateAnalyticsFormProps => {
       );
     } catch (e) {
       addRequestMessage({
-        error: getErrorMessage(e),
+        error: extractErrorMessage(e),
         message: i18n.translate(
           'xpack.ml.dataframe.analytics.create.errorGettingDataFrameAnalyticsList',
           {
@@ -225,7 +225,7 @@ export const useCreateAnalyticsForm = (): CreateAnalyticsFormProps => {
       });
     } catch (e) {
       addRequestMessage({
-        error: getErrorMessage(e),
+        error: extractErrorMessage(e),
         message: i18n.translate(
           'xpack.ml.dataframe.analytics.create.errorGettingIndexPatternTitles',
           {
@@ -260,7 +260,7 @@ export const useCreateAnalyticsForm = (): CreateAnalyticsFormProps => {
       refresh();
     } catch (e) {
       addRequestMessage({
-        error: getErrorMessage(e),
+        error: extractErrorMessage(e),
         message: i18n.translate(
           'xpack.ml.dataframe.analytics.create.errorStartingDataFrameAnalyticsJob',
           {
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/delete_analytics.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/delete_analytics.ts
index 9de859742438e..a21be83732613 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/delete_analytics.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/delete_analytics.ts
@@ -85,12 +85,11 @@ export const deleteAnalyticsAndDestIndex = async (
       );
     }
     if (status.destIndexDeleted?.error) {
-      const error = extractErrorMessage(status.destIndexDeleted.error);
-      toastNotificationService.displayDangerToast(
+      toastNotificationService.displayErrorToast(
+        status.destIndexDeleted.error,
         i18n.translate('xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexErrorMessage', {
-          defaultMessage:
-            'An error occurred deleting destination index {destinationIndex}: {error}',
-          values: { destinationIndex, error },
+          defaultMessage: 'An error occurred deleting destination index {destinationIndex}',
+          values: { destinationIndex },
         })
       );
     }
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_config_builder.test.js b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_config_builder.test.js
index d705e47a5e906..58adf3d892f66 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_config_builder.test.js
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_charts/explorer_chart_config_builder.test.js
@@ -8,8 +8,6 @@ import mockAnomalyRecord from './__mocks__/mock_anomaly_record.json';
 import mockDetectorsByJob from './__mocks__/mock_detectors_by_job.json';
 import mockJobConfig from './__mocks__/mock_job_config.json';
 
-jest.mock('../../util/ml_error', () => class MLRequestFailure {});
-
 jest.mock('../../services/job_service', () => ({
   mlJobService: {
     getJob() {
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js
index 9d0082ffcb568..bd781d32a6b06 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js
@@ -7,6 +7,8 @@
 import PropTypes from 'prop-types';
 import React, { Component } from 'react';
 import { cloneDeep, isEqual, pick } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
 import {
   EuiButton,
   EuiButtonEmpty,
@@ -28,8 +30,6 @@ import { loadFullJob } from '../utils';
 import { validateModelMemoryLimit, validateGroupNames, isValidCustomUrls } from '../validate_job';
 import { toastNotificationServiceProvider } from '../../../../services/toast_notification_service';
 import { withKibana } from '../../../../../../../../../src/plugins/kibana_react/public';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
 import { collapseLiteralStrings } from '../../../../../../shared_imports';
 import { DATAFEED_STATE } from '../../../../../../common/constants/states';
 
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js
index 5030c48a4e367..adcc576c5e356 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_utils.js
@@ -6,9 +6,9 @@
 
 import { difference } from 'lodash';
 import { getNewJobLimits } from '../../../../services/ml_server_info';
-import { mlJobService } from '../../../../services/job_service';
 import { processCreatedBy } from '../../../../../../common/util/job_utils';
 import { getSavedObjectsClient } from '../../../../util/dependency_cache';
+import { ml } from '../../../../services/ml_api_service';
 
 export function saveJob(job, newJobData, finish) {
   return new Promise((resolve, reject) => {
@@ -41,14 +41,9 @@ export function saveJob(job, newJobData, finish) {
 
     // if anything has changed, post the changes
     if (Object.keys(jobData).length) {
-      mlJobService
-        .updateJob(job.job_id, jobData)
-        .then((resp) => {
-          if (resp.success) {
-            saveDatafeedWrapper();
-          } else {
-            reject(resp);
-          }
+      ml.updateJob({ jobId: job.job_id, job: jobData })
+        .then(() => {
+          saveDatafeedWrapper();
         })
         .catch((error) => {
           reject(error);
@@ -59,17 +54,17 @@ export function saveJob(job, newJobData, finish) {
   });
 }
 
-function saveDatafeed(datafeedData, job) {
+function saveDatafeed(datafeedConfig, job) {
   return new Promise((resolve, reject) => {
-    if (Object.keys(datafeedData).length) {
+    if (Object.keys(datafeedConfig).length) {
       const datafeedId = job.datafeed_config.datafeed_id;
-      mlJobService.updateDatafeed(datafeedId, datafeedData).then((resp) => {
-        if (resp.success) {
+      ml.updateDatafeed({ datafeedId, datafeedConfig })
+        .then(() => {
           resolve();
-        } else {
-          reject(resp);
-        }
-      });
+        })
+        .catch((error) => {
+          reject(error);
+        });
     } else {
       resolve();
     }
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js
index f73dde69a3d4c..a379f49a83159 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/multi_job_actions/group_selector/group_selector.js
@@ -6,6 +6,8 @@
 
 import PropTypes from 'prop-types';
 import React, { Component } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
 
 import {
   EuiButton,
@@ -25,9 +27,7 @@ import { ml } from '../../../../../services/ml_api_service';
 import { checkPermission } from '../../../../../capabilities/check_capabilities';
 import { GroupList } from './group_list';
 import { NewGroupInput } from './new_group_input';
-import { mlMessageBarService } from '../../../../../components/messagebar';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
+import { getToastNotificationService } from '../../../../../services/toast_notification_service';
 
 function createSelectedGroups(jobs, groups) {
   const jobIds = jobs.map((j) => j.id);
@@ -160,7 +160,7 @@ export class GroupSelector extends Component {
           // check success of each job update
           if (resp.hasOwnProperty(jobId)) {
             if (resp[jobId].success === false) {
-              mlMessageBarService.notify.error(resp[jobId].error);
+              getToastNotificationService().displayErrorToast(resp[jobId].error);
               success = false;
             }
           }
@@ -175,7 +175,7 @@ export class GroupSelector extends Component {
         }
       })
       .catch((error) => {
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
         console.error(error);
       });
   };
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js
index 913727bda67df..21824aac18cdd 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/utils.js
@@ -5,17 +5,19 @@
  */
 
 import { each } from 'lodash';
-import { mlMessageBarService } from '../../../components/messagebar';
+import { i18n } from '@kbn/i18n';
 import rison from 'rison-node';
 
 import { mlJobService } from '../../../services/job_service';
-import { toastNotificationServiceProvider } from '../../../services/toast_notification_service';
-import { ml } from '../../../services/ml_api_service';
+import {
+  getToastNotificationService,
+  toastNotificationServiceProvider,
+} from '../../../services/toast_notification_service';
 import { getToastNotifications } from '../../../util/dependency_cache';
+import { ml } from '../../../services/ml_api_service';
 import { stringMatch } from '../../../util/string_utils';
 import { JOB_STATE, DATAFEED_STATE } from '../../../../../common/constants/states';
 import { parseInterval } from '../../../../../common/util/parse_interval';
-import { i18n } from '@kbn/i18n';
 import { mlCalendarService } from '../../../services/calendar_service';
 
 export function loadFullJob(jobId) {
@@ -60,7 +62,6 @@ export function forceStartDatafeeds(jobs, start, end, finish = () => {}) {
       finish();
     })
     .catch((error) => {
-      mlMessageBarService.notify.error(error);
       const toastNotifications = getToastNotifications();
       toastNotifications.addDanger(
         i18n.translate('xpack.ml.jobsList.startJobErrorMessage', {
@@ -81,7 +82,6 @@ export function stopDatafeeds(jobs, finish = () => {}) {
       finish();
     })
     .catch((error) => {
-      mlMessageBarService.notify.error(error);
       const toastNotifications = getToastNotifications();
       toastNotifications.addDanger(
         i18n.translate('xpack.ml.jobsList.stopJobErrorMessage', {
@@ -219,9 +219,8 @@ export async function cloneJob(jobId) {
 
     window.location.href = '#/jobs/new_job';
   } catch (error) {
-    mlMessageBarService.notify.error(error);
-    const toastNotifications = getToastNotifications();
-    toastNotifications.addDanger(
+    getToastNotificationService().displayErrorToast(
+      error,
       i18n.translate('xpack.ml.jobsList.cloneJobErrorMessage', {
         defaultMessage: 'Could not clone {jobId}. Job could not be found',
         values: { jobId },
@@ -239,13 +238,11 @@ export function closeJobs(jobs, finish = () => {}) {
       finish();
     })
     .catch((error) => {
-      mlMessageBarService.notify.error(error);
-      const toastNotifications = getToastNotifications();
-      toastNotifications.addDanger(
+      getToastNotificationService().displayErrorToast(
+        error,
         i18n.translate('xpack.ml.jobsList.closeJobErrorMessage', {
           defaultMessage: 'Jobs failed to close',
-        }),
-        error
+        })
       );
       finish();
     });
@@ -260,13 +257,11 @@ export function deleteJobs(jobs, finish = () => {}) {
       finish();
     })
     .catch((error) => {
-      mlMessageBarService.notify.error(error);
-      const toastNotifications = getToastNotifications();
-      toastNotifications.addDanger(
+      getToastNotificationService().displayErrorToast(
+        error,
         i18n.translate('xpack.ml.jobsList.deleteJobErrorMessage', {
           defaultMessage: 'Jobs failed to delete',
-        }),
-        error
+        })
       );
       finish();
     });
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/model_memory_estimator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/model_memory_estimator.ts
index 0011c88d2b524..6671aaa83abe0 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/model_memory_estimator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/model_memory_estimator.ts
@@ -23,7 +23,7 @@ import { useEffect, useMemo } from 'react';
 import { DEFAULT_MODEL_MEMORY_LIMIT } from '../../../../../../../common/constants/new_job';
 import { ml } from '../../../../../services/ml_api_service';
 import { JobValidator, VALIDATION_DELAY_MS } from '../../job_validator/job_validator';
-import { ErrorResponse } from '../../../../../../../common/types/errors';
+import { MLHttpFetchError, MLResponseError } from '../../../../../../../common/util/errors';
 import { useMlKibana } from '../../../../../contexts/kibana';
 import { JobCreator } from '../job_creator';
 
@@ -36,10 +36,10 @@ export const modelMemoryEstimatorProvider = (
   jobValidator: JobValidator
 ) => {
   const modelMemoryCheck$ = new Subject<CalculatePayload>();
-  const error$ = new Subject<ErrorResponse['body']>();
+  const error$ = new Subject<MLHttpFetchError<MLResponseError>>();
 
   return {
-    get error$(): Observable<ErrorResponse['body']> {
+    get error$(): Observable<MLHttpFetchError<MLResponseError>> {
       return error$.asObservable();
     },
     get updates$(): Observable<string> {
@@ -64,7 +64,7 @@ export const modelMemoryEstimatorProvider = (
             catchError((error) => {
               // eslint-disable-next-line no-console
               console.error('Model memory limit could not be calculated', error.body);
-              error$.next(error.body);
+              error$.next(error);
               // fallback to the default in case estimation failed
               return of(DEFAULT_MODEL_MEMORY_LIMIT);
             })
@@ -120,7 +120,8 @@ export const useModelMemoryEstimator = (
           title: i18n.translate('xpack.ml.newJob.wizard.estimateModelMemoryError', {
             defaultMessage: 'Model memory limit could not be calculated',
           }),
-          text: error.message,
+          text:
+            error.body.attributes?.body.error.caused_by?.reason || error.body.message || undefined,
         });
       })
     );
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts
index 0ec3b609b604f..a87ba4c29baa9 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts
@@ -15,7 +15,7 @@ import {
 } from '../../../../../common/job_creator';
 import { ml, BucketSpanEstimatorData } from '../../../../../../../services/ml_api_service';
 import { useMlContext } from '../../../../../../../contexts/ml';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 export enum ESTIMATE_STATUS {
   NOT_RUNNING,
@@ -68,7 +68,7 @@ export function useEstimateBucketSpan() {
     const { name, error, message } = await ml.estimateBucketSpan(data);
     setStatus(ESTIMATE_STATUS.NOT_RUNNING);
     if (error === true) {
-      mlMessageBarService.notify.error(message);
+      getToastNotificationService().displayErrorToast(message);
     } else {
       jobCreator.bucketSpan = name;
       jobCreatorUpdate();
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_view/metric_selection.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_view/metric_selection.tsx
index cbbddb5bbc5b8..da2e5cc0e63d9 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_view/metric_selection.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_view/metric_selection.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC, useContext, useEffect, useState } from 'react';
 import { EuiHorizontalRule } from '@elastic/eui';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 import { JobCreatorContext } from '../../../job_creator_context';
 import { CategorizationJobCreator } from '../../../../../common/job_creator';
@@ -94,7 +94,7 @@ export const CategorizationDetectors: FC<Props> = ({ setIsValid }) => {
         setFieldExamples(null);
         setValidationChecks([]);
         setOverallValidStatus(CATEGORY_EXAMPLES_VALIDATION_STATUS.INVALID);
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
       }
     } else {
       setFieldExamples(null);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection.tsx
index 684cb5b4e0dda..762d18a5367f1 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection.tsx
@@ -15,7 +15,7 @@ import { AggFieldPair } from '../../../../../../../../../common/types/fields';
 import { getChartSettings, defaultChartSettings } from '../../../charts/common/settings';
 import { MetricSelector } from './metric_selector';
 import { ChartGrid } from './chart_grid';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 interface Props {
   setIsValid: (na: boolean) => void;
@@ -109,7 +109,7 @@ export const MultiMetricDetectors: FC<Props> = ({ setIsValid }) => {
         .loadFieldExampleValues(splitField)
         .then(setFieldValues)
         .catch((error) => {
-          mlMessageBarService.notify.error(error);
+          getToastNotificationService().displayErrorToast(error);
         });
     } else {
       setFieldValues([]);
@@ -138,7 +138,7 @@ export const MultiMetricDetectors: FC<Props> = ({ setIsValid }) => {
         );
         setLineChartsData(resp);
       } catch (error) {
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
         setLineChartsData([]);
       }
       setLoadingData(false);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection_summary.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection_summary.tsx
index f39a316440e74..cc0fbf2fc0a04 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection_summary.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/multi_metric_view/metric_selection_summary.tsx
@@ -12,7 +12,7 @@ import { Results, ModelItem, Anomaly } from '../../../../../common/results_loade
 import { LineChartData } from '../../../../../common/chart_loader';
 import { getChartSettings, defaultChartSettings } from '../../../charts/common/settings';
 import { ChartGrid } from './chart_grid';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 export const MultiMetricDetectorsSummary: FC = () => {
   const { jobCreator: jc, chartLoader, resultsLoader, chartInterval } = useContext(
@@ -43,7 +43,7 @@ export const MultiMetricDetectorsSummary: FC = () => {
           const tempFieldValues = await chartLoader.loadFieldExampleValues(jobCreator.splitField);
           setFieldValues(tempFieldValues);
         } catch (error) {
-          mlMessageBarService.notify.error(error);
+          getToastNotificationService().displayErrorToast(error);
         }
       }
     })();
@@ -75,7 +75,7 @@ export const MultiMetricDetectorsSummary: FC = () => {
         );
         setLineChartsData(resp);
       } catch (error) {
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
         setLineChartsData({});
       }
       setLoadingData(false);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection.tsx
index e5f5ba48900d9..46f91550f6e32 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection.tsx
@@ -17,7 +17,7 @@ import { getChartSettings, defaultChartSettings } from '../../../charts/common/s
 import { MetricSelector } from './metric_selector';
 import { SplitFieldSelector } from '../split_field';
 import { ChartGrid } from './chart_grid';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 interface Props {
   setIsValid: (na: boolean) => void;
@@ -159,7 +159,7 @@ export const PopulationDetectors: FC<Props> = ({ setIsValid }) => {
 
         setLineChartsData(resp);
       } catch (error) {
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
         setLineChartsData([]);
       }
       setLoadingData(false);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection_summary.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection_summary.tsx
index 06f7092e8ac06..c32cc6ecc445a 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection_summary.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/population_view/metric_selection_summary.tsx
@@ -15,7 +15,7 @@ import { LineChartData } from '../../../../../common/chart_loader';
 import { Field, AggFieldPair } from '../../../../../../../../../common/types/fields';
 import { getChartSettings, defaultChartSettings } from '../../../charts/common/settings';
 import { ChartGrid } from './chart_grid';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 type DetectorFieldValues = Record<number, string[]>;
 
@@ -81,7 +81,7 @@ export const PopulationDetectorsSummary: FC = () => {
 
         setLineChartsData(resp);
       } catch (error) {
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
         setLineChartsData({});
       }
       setLoadingData(false);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection.tsx
index f04b63f47789e..5844e59225ab5 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection.tsx
@@ -13,7 +13,7 @@ import { newJobCapsService } from '../../../../../../../services/new_job_capabil
 import { AggFieldPair } from '../../../../../../../../../common/types/fields';
 import { AnomalyChart, CHART_TYPE } from '../../../charts/anomaly_chart';
 import { getChartSettings } from '../../../charts/common/settings';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 interface Props {
   setIsValid: (na: boolean) => void;
@@ -93,7 +93,7 @@ export const SingleMetricDetectors: FC<Props> = ({ setIsValid }) => {
           setLineChartData(resp);
         }
       } catch (error) {
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
         setLineChartData({});
       }
       setLoadingData(false);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection_summary.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection_summary.tsx
index 85fb5890307ba..ae019ee1bbf84 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection_summary.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/single_metric_view/metric_selection_summary.tsx
@@ -11,7 +11,7 @@ import { Results, ModelItem, Anomaly } from '../../../../../common/results_loade
 import { LineChartData } from '../../../../../common/chart_loader';
 import { AnomalyChart, CHART_TYPE } from '../../../charts/anomaly_chart';
 import { getChartSettings } from '../../../charts/common/settings';
-import { mlMessageBarService } from '../../../../../../../components/messagebar';
+import { getToastNotificationService } from '../../../../../../../services/toast_notification_service';
 
 const DTR_IDX = 0;
 
@@ -63,7 +63,7 @@ export const SingleMetricDetectorsSummary: FC = () => {
           setLineChartData(resp);
         }
       } catch (error) {
-        mlMessageBarService.notify.error(error);
+        getToastNotificationService().displayErrorToast(error);
         setLineChartData({});
       }
       setLoadingData(false);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/post_save_options/post_save_options.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/post_save_options/post_save_options.tsx
index 2e7cc9c413a25..82a023cd1779b 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/post_save_options/post_save_options.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/components/post_save_options/post_save_options.tsx
@@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { JobRunner } from '../../../../../common/job_runner';
 import { useMlKibana } from '../../../../../../../contexts/kibana';
-import { getErrorMessage } from '../../../../../../../../../common/util/errors';
+import { extractErrorMessage } from '../../../../../../../../../common/util/errors';
 
 // @ts-ignore
 import { CreateWatchFlyout } from '../../../../../../jobs_list/components/create_watch_flyout/index';
@@ -70,7 +70,7 @@ export const PostSaveOptions: FC<Props> = ({ jobRunner }) => {
               defaultMessage: `Error starting job`,
             }
           ),
-          text: getErrorMessage(error),
+          text: extractErrorMessage(error),
         });
       }
     }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx
index 24d7fb9fc2a40..3000ce8449138 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/summary_step/summary.tsx
@@ -22,13 +22,13 @@ import { JobCreatorContext } from '../job_creator_context';
 import { JobRunner } from '../../../common/job_runner';
 import { mlJobService } from '../../../../../services/job_service';
 import { JsonEditorFlyout, EDITOR_MODE } from '../common/json_editor_flyout';
-import { getErrorMessage } from '../../../../../../../common/util/errors';
 import { isSingleMetricJobCreator, isAdvancedJobCreator } from '../../../common/job_creator';
 import { JobDetails } from './components/job_details';
 import { DatafeedDetails } from './components/datafeed_details';
 import { DetectorChart } from './components/detector_chart';
 import { JobProgress } from './components/job_progress';
 import { PostSaveOptions } from './components/post_save_options';
+import { toastNotificationServiceProvider } from '../../../../../services/toast_notification_service';
 import {
   convertToAdvancedJob,
   resetJob,
@@ -72,15 +72,7 @@ export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =>
       const jr = await jobCreator.createAndStartJob();
       setJobRunner(jr);
     } catch (error) {
-      // catch and display all job creation errors
-      const { toasts } = notifications;
-      toasts.addDanger({
-        title: i18n.translate('xpack.ml.newJob.wizard.summaryStep.createJobError', {
-          defaultMessage: `Job creation error`,
-        }),
-        text: getErrorMessage(error),
-      });
-      setCreatingJob(false);
+      handleJobCreationError(error);
     }
   }
 
@@ -91,18 +83,21 @@ export const SummaryStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep }) =>
       await jobCreator.createDatafeed();
       advancedStartDatafeed(jobCreator, navigateToPath);
     } catch (error) {
-      // catch and display all job creation errors
-      const { toasts } = notifications;
-      toasts.addDanger({
-        title: i18n.translate('xpack.ml.newJob.wizard.summaryStep.createJobError', {
-          defaultMessage: `Job creation error`,
-        }),
-        text: getErrorMessage(error),
-      });
-      setCreatingJob(false);
+      handleJobCreationError(error);
     }
   }
 
+  function handleJobCreationError(error: any) {
+    const { displayErrorToast } = toastNotificationServiceProvider(notifications.toasts);
+    displayErrorToast(
+      error,
+      i18n.translate('xpack.ml.newJob.wizard.summaryStep.createJobError', {
+        defaultMessage: `Job creation error`,
+      })
+    );
+    setCreatingJob(false);
+  }
+
   function viewResults() {
     const url = mlJobService.createResultsUrl(
       [jobCreator.jobId],
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/validation_step/validation.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/validation_step/validation.tsx
index 19b89ffec02ac..3bde32f40eeb5 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/validation_step/validation.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/validation_step/validation.tsx
@@ -8,7 +8,7 @@ import React, { Fragment, FC, useContext, useState, useEffect } from 'react';
 import { WizardNav } from '../wizard_nav';
 import { WIZARD_STEPS, StepProps } from '../step_types';
 import { JobCreatorContext } from '../job_creator_context';
-import { mlJobService } from '../../../../../services/job_service';
+import { ml } from '../../../../../services/ml_api_service';
 import { ValidateJob } from '../../../../../components/validate_job';
 import { JOB_TYPE } from '../../../../../../../common/constants/new_job';
 
@@ -66,7 +66,7 @@ export const ValidationStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep })
           <ValidateJob
             getJobConfig={getJobConfig}
             getDuration={getDuration}
-            mlJobService={mlJobService}
+            ml={ml}
             embedded={true}
             setIsValid={setIsValid}
             idFilterList={idFilterList}
diff --git a/x-pack/plugins/ml/public/application/services/job_service.js b/x-pack/plugins/ml/public/application/services/job_service.js
index 640f63617b7d4..dfa1b5f4e68cd 100644
--- a/x-pack/plugins/ml/public/application/services/job_service.js
+++ b/x-pack/plugins/ml/public/application/services/job_service.js
@@ -14,15 +14,13 @@ import { i18n } from '@kbn/i18n';
 
 import { ml } from './ml_api_service';
 
-import { mlMessageBarService } from '../components/messagebar';
-import { getToastNotifications } from '../util/dependency_cache';
+import { getToastNotificationService } from '../services/toast_notification_service';
 import { isWebUrl } from '../util/url_utils';
 import { ML_DATA_PREVIEW_COUNT } from '../../../common/util/job_utils';
 import { TIME_FORMAT } from '../../../common/constants/time_format';
 import { parseInterval } from '../../../common/util/parse_interval';
-import { toastNotificationServiceProvider } from '../services/toast_notification_service';
 import { validateTimeRange } from '../util/date_utils';
-const msgs = mlMessageBarService;
+
 let jobs = [];
 let datafeedIds = {};
 
@@ -119,7 +117,6 @@ class JobService {
     return new Promise((resolve, reject) => {
       jobs = [];
       datafeedIds = {};
-
       ml.getJobs()
         .then((resp) => {
           jobs = resp.jobs;
@@ -162,7 +159,6 @@ class JobService {
                 }
                 processBasicJobInfo(this, jobs);
                 this.jobs = jobs;
-                createJobStats(this.jobs, this.jobStats);
                 resolve({ jobs: this.jobs });
               });
             })
@@ -176,12 +172,7 @@ class JobService {
 
       function error(err) {
         console.log('jobService error getting list of jobs:', err);
-        msgs.notify.error(
-          i18n.translate('xpack.ml.jobService.jobsListCouldNotBeRetrievedErrorMessage', {
-            defaultMessage: 'Jobs list could not be retrieved',
-          })
-        );
-        msgs.notify.error('', err);
+        getToastNotificationService().displayErrorToast(err);
         reject({ jobs, err });
       }
     });
@@ -248,7 +239,6 @@ class JobService {
                     }
                   }
                   this.jobs = jobs;
-                  createJobStats(this.jobs, this.jobStats);
                   resolve({ jobs: this.jobs });
                 });
               })
@@ -263,12 +253,7 @@ class JobService {
 
       function error(err) {
         console.log('JobService error getting list of jobs:', err);
-        msgs.notify.error(
-          i18n.translate('xpack.ml.jobService.jobsListCouldNotBeRetrievedErrorMessage', {
-            defaultMessage: 'Jobs list could not be retrieved',
-          })
-        );
-        msgs.notify.error('', err);
+        getToastNotificationService().displayErrorToast(err);
         reject({ jobs, err });
       }
     });
@@ -280,9 +265,6 @@ class JobService {
 
       ml.getDatafeeds(sId)
         .then((resp) => {
-          // console.log('loadDatafeeds query response:', resp);
-
-          // make deep copy of datafeeds
           const datafeeds = resp.datafeeds;
 
           // load datafeeds stats
@@ -309,12 +291,7 @@ class JobService {
 
       function error(err) {
         console.log('loadDatafeeds error getting list of datafeeds:', err);
-        msgs.notify.error(
-          i18n.translate('xpack.ml.jobService.datafeedsListCouldNotBeRetrievedErrorMessage', {
-            defaultMessage: 'datafeeds list could not be retrieved',
-          })
-        );
-        msgs.notify.error('', err);
+        getToastNotificationService().displayErrorToast(err);
         reject({ jobs, err });
       }
     });
@@ -415,62 +392,6 @@ class JobService {
     return tempJob;
   }
 
-  updateJob(jobId, job) {
-    // return the promise chain
-    return ml
-      .updateJob({ jobId, job })
-      .then(() => {
-        return { success: true };
-      })
-      .catch((err) => {
-        // TODO - all the functions in here should just return the error and not
-        // display the toast, as currently both the component and this service display
-        // errors, so we end up with duplicate toasts.
-        const toastNotifications = getToastNotifications();
-        const toastNotificationService = toastNotificationServiceProvider(toastNotifications);
-        toastNotificationService.displayErrorToast(
-          err,
-          i18n.translate('xpack.ml.jobService.updateJobErrorTitle', {
-            defaultMessage: 'Could not update job: {jobId}',
-            values: { jobId },
-          })
-        );
-
-        console.error('update job', err);
-        return { success: false, message: err };
-      });
-  }
-
-  validateJob(obj) {
-    // return the promise chain
-    return ml
-      .validateJob(obj)
-      .then((messages) => {
-        return { success: true, messages };
-      })
-      .catch((err) => {
-        const toastNotifications = getToastNotifications();
-        const toastNotificationService = toastNotificationServiceProvider(toastNotifications);
-        toastNotificationService.displayErrorToast(
-          err,
-          i18n.translate('xpack.ml.jobService.validateJobErrorTitle', {
-            defaultMessage: 'Job Validation Error',
-          })
-        );
-
-        console.log('validate job', err);
-        return {
-          success: false,
-          messages: [
-            {
-              status: 'error',
-              text: err.message,
-            },
-          ],
-        };
-      });
-  }
-
   // find a job based on the id
   getJob(jobId) {
     const job = find(jobs, (j) => {
@@ -638,25 +559,6 @@ class JobService {
     });
   }
 
-  updateDatafeed(datafeedId, datafeedConfig) {
-    return ml
-      .updateDatafeed({ datafeedId, datafeedConfig })
-      .then((resp) => {
-        console.log('update datafeed', resp);
-        return { success: true };
-      })
-      .catch((err) => {
-        msgs.notify.error(
-          i18n.translate('xpack.ml.jobService.couldNotUpdateDatafeedErrorMessage', {
-            defaultMessage: 'Could not update datafeed: {datafeedId}',
-            values: { datafeedId },
-          })
-        );
-        console.log('update datafeed', err);
-        return { success: false, message: err.message };
-      });
-  }
-
   // start the datafeed for a given job
   // refresh the job state on start success
   startDatafeed(datafeedId, jobId, start, end) {
@@ -677,49 +579,6 @@ class JobService {
         })
         .catch((err) => {
           console.log('jobService error starting datafeed:', err);
-          msgs.notify.error(
-            i18n.translate('xpack.ml.jobService.couldNotStartDatafeedErrorMessage', {
-              defaultMessage: 'Could not start datafeed for {jobId}',
-              values: { jobId },
-            }),
-            err
-          );
-          reject(err);
-        });
-    });
-  }
-
-  // stop the datafeed for a given job
-  // refresh the job state on stop success
-  stopDatafeed(datafeedId, jobId) {
-    return new Promise((resolve, reject) => {
-      ml.stopDatafeed({
-        datafeedId,
-      })
-        .then((resp) => {
-          resolve(resp);
-        })
-        .catch((err) => {
-          console.log('jobService error stopping datafeed:', err);
-          const couldNotStopDatafeedErrorMessage = i18n.translate(
-            'xpack.ml.jobService.couldNotStopDatafeedErrorMessage',
-            {
-              defaultMessage: 'Could not stop datafeed for {jobId}',
-              values: { jobId },
-            }
-          );
-
-          if (err.statusCode === 500) {
-            msgs.notify.error(couldNotStopDatafeedErrorMessage);
-            msgs.notify.error(
-              i18n.translate('xpack.ml.jobService.requestMayHaveTimedOutErrorMessage', {
-                defaultMessage:
-                  'Request may have timed out and may still be running in the background.',
-              })
-            );
-          } else {
-            msgs.notify.error(couldNotStopDatafeedErrorMessage, err);
-          }
           reject(err);
         });
     });
@@ -887,51 +746,6 @@ function processBasicJobInfo(localJobService, jobsList) {
   return processedJobsList;
 }
 
-// Loop through the jobs list and create basic stats
-// stats are displayed along the top of the Jobs Management page
-function createJobStats(jobsList, jobStats) {
-  jobStats.activeNodes.value = 0;
-  jobStats.total.value = 0;
-  jobStats.open.value = 0;
-  jobStats.closed.value = 0;
-  jobStats.failed.value = 0;
-  jobStats.activeDatafeeds.value = 0;
-
-  // object to keep track of nodes being used by jobs
-  const mlNodes = {};
-  let failedJobs = 0;
-
-  each(jobsList, (job) => {
-    if (job.state === 'opened') {
-      jobStats.open.value++;
-    } else if (job.state === 'closed') {
-      jobStats.closed.value++;
-    } else if (job.state === 'failed') {
-      failedJobs++;
-    }
-
-    if (job.datafeed_config && job.datafeed_config.state === 'started') {
-      jobStats.activeDatafeeds.value++;
-    }
-
-    if (job.node && job.node.name) {
-      mlNodes[job.node.name] = {};
-    }
-  });
-
-  jobStats.total.value = jobsList.length;
-
-  // // Only show failed jobs if it is non-zero
-  if (failedJobs) {
-    jobStats.failed.value = failedJobs;
-    jobStats.failed.show = true;
-  } else {
-    jobStats.failed.show = false;
-  }
-
-  jobStats.activeNodes.value = Object.keys(mlNodes).length;
-}
-
 function createResultsUrlForJobs(jobsList, resultsPage, userTimeRange) {
   let from = undefined;
   let to = undefined;
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
index 9d7ce4f3df59b..0deda455df771 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
@@ -62,7 +62,7 @@ export interface BucketSpanEstimatorResponse {
   name: string;
   ms: number;
   error?: boolean;
-  message?: { msg: string } | string;
+  message?: string;
 }
 
 export interface GetTimeFieldRangeResponse {
diff --git a/x-pack/plugins/ml/public/application/services/toast_notification_service.ts b/x-pack/plugins/ml/public/application/services/toast_notification_service.ts
deleted file mode 100644
index 94381ae3f1e51..0000000000000
--- a/x-pack/plugins/ml/public/application/services/toast_notification_service.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ToastInput, ToastOptions, ToastsStart } from 'kibana/public';
-import { ResponseError } from 'kibana/server';
-import { useMemo } from 'react';
-import { useNotifications } from '../contexts/kibana';
-import {
-  BoomResponse,
-  extractErrorProperties,
-  MLCustomHttpResponseOptions,
-  MLErrorObject,
-  MLResponseError,
-} from '../../../common/util/errors';
-
-export type ToastNotificationService = ReturnType<typeof toastNotificationServiceProvider>;
-
-export function toastNotificationServiceProvider(toastNotifications: ToastsStart) {
-  return {
-    displayDangerToast(toastOrTitle: ToastInput, options?: ToastOptions) {
-      toastNotifications.addDanger(toastOrTitle, options);
-    },
-
-    displaySuccessToast(toastOrTitle: ToastInput, options?: ToastOptions) {
-      toastNotifications.addSuccess(toastOrTitle, options);
-    },
-
-    displayErrorToast(error: any, toastTitle: string) {
-      const errorObj = this.parseErrorMessage(error);
-      if (errorObj.fullErrorMessage !== undefined) {
-        // Provide access to the full error message via the 'See full error' button.
-        toastNotifications.addError(new Error(errorObj.fullErrorMessage), {
-          title: toastTitle,
-          toastMessage: errorObj.message,
-        });
-      } else {
-        toastNotifications.addDanger(
-          {
-            title: toastTitle,
-            text: errorObj.message,
-          },
-          { toastLifeTimeMs: 30000 }
-        );
-      }
-    },
-
-    parseErrorMessage(
-      error:
-        | MLCustomHttpResponseOptions<MLResponseError | ResponseError | BoomResponse>
-        | undefined
-        | string
-        | MLResponseError
-    ): MLErrorObject {
-      if (
-        typeof error === 'object' &&
-        'response' in error &&
-        typeof error.response === 'string' &&
-        error.statusCode !== undefined
-      ) {
-        // MLResponseError which has been received back as part of a 'successful' response
-        // where the error was passed in a separate property in the response.
-        const wrapMlResponseError = {
-          body: error,
-          statusCode: error.statusCode,
-        };
-        return extractErrorProperties(wrapMlResponseError);
-      }
-
-      return extractErrorProperties(
-        error as
-          | MLCustomHttpResponseOptions<MLResponseError | ResponseError | BoomResponse>
-          | undefined
-          | string
-      );
-    },
-  };
-}
-
-/**
- * Hook to use {@link ToastNotificationService} in React components.
- */
-export function useToastNotificationService(): ToastNotificationService {
-  const { toasts } = useNotifications();
-  return useMemo(() => toastNotificationServiceProvider(toasts), []);
-}
diff --git a/x-pack/plugins/ml/public/application/components/messagebar/messagebar_service.d.ts b/x-pack/plugins/ml/public/application/services/toast_notification_service/index.ts
similarity index 58%
rename from x-pack/plugins/ml/public/application/components/messagebar/messagebar_service.d.ts
rename to x-pack/plugins/ml/public/application/services/toast_notification_service/index.ts
index 29a537a7ca8d8..1259f3b47d8e0 100644
--- a/x-pack/plugins/ml/public/application/components/messagebar/messagebar_service.d.ts
+++ b/x-pack/plugins/ml/public/application/services/toast_notification_service/index.ts
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-declare interface MlMessageBarService {
-  notify: {
-    error(text: any, resp?: any): void;
-  };
-}
-
-export const mlMessageBarService: MlMessageBarService;
+export {
+  ToastNotificationService,
+  toastNotificationServiceProvider,
+  useToastNotificationService,
+  getToastNotificationService,
+} from './toast_notification_service';
diff --git a/x-pack/plugins/ml/public/application/services/toast_notification_service/toast_notification_service.ts b/x-pack/plugins/ml/public/application/services/toast_notification_service/toast_notification_service.ts
new file mode 100644
index 0000000000000..61e0480313ebe
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/services/toast_notification_service/toast_notification_service.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { ToastInput, ToastOptions, ToastsStart } from 'kibana/public';
+import { useMemo } from 'react';
+import { getToastNotifications } from '../../util/dependency_cache';
+import { useNotifications } from '../../contexts/kibana';
+import {
+  ErrorType,
+  extractErrorProperties,
+  MLRequestFailure,
+} from '../../../../common/util/errors';
+
+export type ToastNotificationService = ReturnType<typeof toastNotificationServiceProvider>;
+
+export function toastNotificationServiceProvider(toastNotifications: ToastsStart) {
+  function displayDangerToast(toastOrTitle: ToastInput, options?: ToastOptions) {
+    toastNotifications.addDanger(toastOrTitle, options);
+  }
+
+  function displayWarningToast(toastOrTitle: ToastInput, options?: ToastOptions) {
+    toastNotifications.addWarning(toastOrTitle, options);
+  }
+
+  function displaySuccessToast(toastOrTitle: ToastInput, options?: ToastOptions) {
+    toastNotifications.addSuccess(toastOrTitle, options);
+  }
+
+  function displayErrorToast(error: ErrorType, title?: string) {
+    const errorObj = extractErrorProperties(error);
+    toastNotifications.addError(new MLRequestFailure(errorObj, error), {
+      title:
+        title ??
+        i18n.translate('xpack.ml.toastNotificationService.errorTitle', {
+          defaultMessage: 'An error has occurred',
+        }),
+    });
+  }
+
+  return { displayDangerToast, displayWarningToast, displaySuccessToast, displayErrorToast };
+}
+
+export function getToastNotificationService() {
+  const toastNotifications = getToastNotifications();
+  return toastNotificationServiceProvider(toastNotifications);
+}
+
+/**
+ * Hook to use {@link ToastNotificationService} in React components.
+ */
+export function useToastNotificationService(): ToastNotificationService {
+  const { toasts } = useNotifications();
+  return useMemo(() => toastNotificationServiceProvider(toasts), []);
+}
diff --git a/x-pack/plugins/ml/public/application/settings/calendars/list/delete_calendars.js b/x-pack/plugins/ml/public/application/settings/calendars/list/delete_calendars.js
index 50777485903d2..e0c7a4db6e898 100644
--- a/x-pack/plugins/ml/public/application/settings/calendars/list/delete_calendars.js
+++ b/x-pack/plugins/ml/public/application/settings/calendars/list/delete_calendars.js
@@ -7,7 +7,7 @@
 import { getToastNotifications } from '../../../util/dependency_cache';
 import { ml } from '../../../services/ml_api_service';
 import { i18n } from '@kbn/i18n';
-import { getErrorMessage } from '../../../../../common/util/errors';
+import { extractErrorMessage } from '../../../../../common/util/errors';
 
 export async function deleteCalendars(calendarsToDelete, callback) {
   if (calendarsToDelete === undefined || calendarsToDelete.length === 0) {
@@ -47,7 +47,7 @@ export async function deleteCalendars(calendarsToDelete, callback) {
             },
           }
         ),
-        text: getErrorMessage(error),
+        text: extractErrorMessage(error),
       });
     }
   }
diff --git a/x-pack/plugins/ml/public/application/util/ml_error.ts b/x-pack/plugins/ml/public/application/util/ml_error.ts
deleted file mode 100644
index 2a0280404c189..0000000000000
--- a/x-pack/plugins/ml/public/application/util/ml_error.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KbnError } from '../../../../../../src/plugins/kibana_utils/public';
-
-export class MLRequestFailure extends KbnError {
-  origError: any;
-  resp: any;
-  // takes an Error object and and optional response object
-  // if error is falsy (null) the response object will be used
-  // notify will show the full expandable stack trace of the response if a response object is used and no error is passed in.
-  constructor(error: any, resp: any) {
-    error = error || {};
-    super(error.message || JSON.stringify(resp));
-
-    this.origError = error;
-    this.resp = typeof resp === 'string' ? JSON.parse(resp) : resp;
-  }
-}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/manifest.json
index 1e7fcdd4320f8..36d1df6db4c99 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/manifest.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/manifest.json
@@ -40,6 +40,46 @@
     {
       "id": "linux_anomalous_user_name_ecs",
       "file": "linux_anomalous_user_name_ecs.json"
+    },
+    {
+      "id": "linux_rare_metadata_process",
+      "file": "linux_rare_metadata_process.json"
+    },
+    {
+      "id": "linux_rare_metadata_user",
+      "file": "linux_rare_metadata_user.json"
+    },
+    {
+      "id": "linux_rare_user_compiler",
+      "file": "linux_rare_user_compiler.json"
+    },
+    {
+      "id": "linux_rare_kernel_module_arguments",
+      "file": "linux_rare_kernel_module_arguments.json"
+    },
+    {
+      "id": "linux_rare_sudo_user",
+      "file": "linux_rare_sudo_user.json"
+    },
+    {
+      "id": "linux_system_user_discovery",
+      "file": "linux_system_user_discovery.json"
+    },
+    {
+      "id": "linux_system_information_discovery",
+      "file": "linux_system_information_discovery.json"
+    },
+    {
+      "id": "linux_system_process_discovery",
+      "file": "linux_system_process_discovery.json"
+    },
+    {
+      "id": "linux_network_connection_discovery",
+      "file": "linux_network_connection_discovery.json"
+    },
+    {
+      "id": "linux_network_configuration_discovery",
+      "file": "linux_network_configuration_discovery.json"
     }
   ],
   "datafeeds": [
@@ -77,6 +117,56 @@
       "id": "datafeed-linux_anomalous_user_name_ecs",
       "file": "datafeed_linux_anomalous_user_name_ecs.json",
       "job_id": "linux_anomalous_user_name_ecs"
+    },
+    {
+      "id": "datafeed-linux_rare_metadata_process",
+      "file": "datafeed_linux_rare_metadata_process.json",
+      "job_id": "linux_rare_metadata_process"
+    },
+    {
+      "id": "datafeed-linux_rare_metadata_user",
+      "file": "datafeed_linux_rare_metadata_user.json",
+      "job_id": "linux_rare_metadata_user"
+    },
+    {
+      "id": "datafeed-linux_rare_user_compiler",
+      "file": "datafeed_linux_rare_user_compiler.json",
+      "job_id": "linux_rare_user_compiler"
+    },
+    {
+      "id": "datafeed-linux_rare_kernel_module_arguments",
+      "file": "datafeed_linux_rare_kernel_module_arguments.json",
+      "job_id": "linux_rare_kernel_module_arguments"
+    },
+    {
+      "id": "datafeed-linux_rare_sudo_user",
+      "file": "datafeed_linux_rare_sudo_user.json",
+      "job_id": "linux_rare_sudo_user"
+    },
+    {
+      "id": "datafeed-linux_system_information_discovery",
+      "file": "datafeed_linux_system_information_discovery.json",
+      "job_id": "linux_system_information_discovery"
+    },
+    {
+      "id": "datafeed-linux_system_process_discovery",
+      "file": "datafeed_linux_system_process_discovery.json",
+      "job_id": "linux_system_process_discovery"
+    },
+    {
+      "id": "datafeed-linux_system_user_discovery",
+      "file": "datafeed_linux_system_user_discovery.json",
+      "job_id": "linux_system_user_discovery"
+    },
+    {
+      "id": "datafeed-linux_network_configuration_discovery",
+      "file": "datafeed_linux_network_configuration_discovery.json",
+      "job_id": "linux_network_configuration_discovery"
+    },
+    {
+      "id": "datafeed-linux_network_connection_discovery",
+      "file": "datafeed_linux_network_connection_discovery.json",
+      "job_id": "linux_network_connection_discovery"
     }
   ]
 }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_network_configuration_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_network_configuration_discovery.json
new file mode 100644
index 0000000000000..d4a130770c920
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_network_configuration_discovery.json
@@ -0,0 +1,26 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+        "bool": {
+            "must": [
+              {
+                "bool": {
+                  "should": [
+                    {"term": {"process.name": "arp"}},
+                    {"term": {"process.name": "echo"}},
+                    {"term": {"process.name": "ethtool"}},
+                    {"term": {"process.name": "ifconfig"}},
+                    {"term": {"process.name": "ip"}},
+                    {"term": {"process.name": "iptables"}},
+                    {"term": {"process.name": "ufw"}}
+                  ]
+                }
+              }
+            ]
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_network_connection_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_network_connection_discovery.json
new file mode 100644
index 0000000000000..0ae80df4bd47d
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_network_connection_discovery.json
@@ -0,0 +1,23 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+        "bool": {
+            "must": [
+              {
+                "bool": {
+                  "should": [
+                    {"term": {"process.name": "netstat"}},
+                    {"term": {"process.name": "ss"}},
+                    {"term": {"process.name": "route"}},
+                    {"term": {"process.name": "showmount"}}
+                  ]
+                }
+              }
+            ]
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_kernel_module_arguments.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_kernel_module_arguments.json
new file mode 100644
index 0000000000000..99bb690c8d73d
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_kernel_module_arguments.json
@@ -0,0 +1,22 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+        "bool": {
+            "filter": [{"exists": {"field": "process.title"}}],
+            "must": [
+                {"bool": {
+                    "should": [
+                    {"term": {"process.name": "insmod"}},
+                    {"term": {"process.name": "kmod"}},
+                    {"term": {"process.name": "modprobe"}},
+                    {"term": {"process.name": "rmod"}}
+                    ]
+                }}
+            ]
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_metadata_process.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_metadata_process.json
new file mode 100644
index 0000000000000..dc0f6c4e81b33
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_metadata_process.json
@@ -0,0 +1,12 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+      "bool": {
+        "filter": [{"term": {"destination.ip": "169.254.169.254"}}]
+      }
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_metadata_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_metadata_user.json
new file mode 100644
index 0000000000000..dc0f6c4e81b33
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_metadata_user.json
@@ -0,0 +1,12 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+      "bool": {
+        "filter": [{"term": {"destination.ip": "169.254.169.254"}}]
+      }
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_sudo_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_sudo_user.json
new file mode 100644
index 0000000000000..544675f3d48dc
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_sudo_user.json
@@ -0,0 +1,15 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+      "bool": {
+        "filter": [
+          {"term": {"event.action": "executed"}},
+          {"term": {"process.name": "sudo"}}
+        ]
+      }
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_user_compiler.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_user_compiler.json
new file mode 100644
index 0000000000000..027b124010001
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_rare_user_compiler.json
@@ -0,0 +1,22 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+        "bool": {
+            "filter": [{"term": {"event.action": "executed"}}],
+            "must": [
+              {"bool": {
+                  "should": [
+                    {"term": {"process.name": "compile"}},
+                    {"term": {"process.name": "gcc"}},
+                    {"term": {"process.name": "make"}},
+                    {"term": {"process.name": "yasm"}}
+                  ]
+                }}
+            ]
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_information_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_information_discovery.json
new file mode 100644
index 0000000000000..6e7ce26763f79
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_information_discovery.json
@@ -0,0 +1,31 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+        "bool": {
+            "must": [
+              {
+                "bool": {
+                  "should": [
+                    {"term": {"process.name": "cat"}},
+                    {"term": {"process.name": "grep"}},
+                    {"term": {"process.name": "head"}},
+                    {"term": {"process.name": "hostname"}},
+                    {"term": {"process.name": "less"}},
+                    {"term": {"process.name": "ls"}},
+                    {"term": {"process.name": "lsmod"}},
+                    {"term": {"process.name": "more"}},
+                    {"term": {"process.name": "strings"}},
+                    {"term": {"process.name": "tail"}},
+                    {"term": {"process.name": "uptime"}},
+                    {"term": {"process.name": "uname"}}
+                  ]
+                }
+              }
+            ]
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_process_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_process_discovery.json
new file mode 100644
index 0000000000000..dbd8f54ff9712
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_process_discovery.json
@@ -0,0 +1,21 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+        "bool": {
+            "must": [
+              {
+                "bool": {
+                  "should": [
+                    {"term": {"process.name": "ps"}},
+                    {"term": {"process.name": "top"}}
+                  ]
+                }
+              }
+            ]
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_user_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_user_discovery.json
new file mode 100644
index 0000000000000..24230094a47d2
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_system_user_discovery.json
@@ -0,0 +1,23 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+        "bool": {
+            "must": [
+              {
+                "bool": {
+                  "should": [
+                    {"term": {"process.name": "users"}},
+                    {"term": {"process.name": "w"}},
+                    {"term": {"process.name": "who"}},
+                    {"term": {"process.name": "whoami"}}
+                  ]
+                }
+              }
+            ]
+        }
+    }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_network_configuration_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_network_configuration_discovery.json
new file mode 100644
index 0000000000000..6d687764085e0
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_network_configuration_discovery.json
@@ -0,0 +1,53 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery in order to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "process.name",
+        "host.name",
+        "process.args",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "64mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_network_connection_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_network_connection_discovery.json
new file mode 100644
index 0000000000000..b41439548dd59
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_network_connection_discovery.json
@@ -0,0 +1,53 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for commands related to system network connection discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network connection discovery in order to increase their understanding of connected services and systems. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "process.name",
+        "host.name",
+        "process.args",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "64mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_kernel_module_arguments.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_kernel_module_arguments.json
new file mode 100644
index 0000000000000..1b79e83054251
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_kernel_module_arguments.json
@@ -0,0 +1,45 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for unusual kernel modules which are often used for stealth.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"process.title\"",
+          "function": "rare",
+          "by_field_name": "process.title"
+        }
+      ],
+      "influencers": [
+        "process.title",
+        "process.working_directory",
+        "host.name",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "32mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_metadata_process.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_metadata_process.json
new file mode 100644
index 0000000000000..7295f11e600d7
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_metadata_process.json
@@ -0,0 +1,52 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"process.name\"",
+          "function": "rare",
+          "by_field_name": "process.name"
+        }
+      ],
+      "influencers": [
+        "host.name",
+        "user.name",
+        "process.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "32mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_metadata_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_metadata_user.json
new file mode 100644
index 0000000000000..049d10920de00
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_metadata_user.json
@@ -0,0 +1,43 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for anomalous access to the metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "host.name",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "32mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_sudo_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_sudo_user.json
new file mode 100644
index 0000000000000..654f5c76e5698
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_sudo_user.json
@@ -0,0 +1,53 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for sudo activity from an unusual user context.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "process.name",
+        "host.name",
+        "process.args",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "32mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_user_compiler.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_user_compiler.json
new file mode 100644
index 0000000000000..245b7e0819c7d
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_rare_user_compiler.json
@@ -0,0 +1,45 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for compiler activity by a user context which does not normally run compilers. This can be ad-hoc software changes or unauthorized software deployment. This can also be due to local privliege elevation via locally run exploits or malware activity.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "process.title",
+        "host.name",
+        "process.working_directory",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "256mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_information_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_information_discovery.json
new file mode 100644
index 0000000000000..3a51223b4899c
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_information_discovery.json
@@ -0,0 +1,53 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for commands related to system information discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system information discovery in order to gather detailed information about system configuration and software versions. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "process.name",
+        "host.name",
+        "process.args",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "16mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_process_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_process_discovery.json
new file mode 100644
index 0000000000000..592bb5a717fc0
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_process_discovery.json
@@ -0,0 +1,53 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for commands related to system process discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system process discovery in order to increase their understanding of software applications running on a target host or network. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "process.name",
+        "host.name",
+        "process.args",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "16mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_user_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_user_discovery.json
new file mode 100644
index 0000000000000..33f42c274b337
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_system_user_discovery.json
@@ -0,0 +1,53 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Auditbeat - Looks for commands related to system user or owner discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system owner or user discovery in order to identify currently active or primary users of a system. This may be a precursor to additional discovery, credential dumping or privilege elevation activity.",
+    "groups": [
+      "security",
+      "auditbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "process.name",
+        "host.name",
+        "process.args",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "16mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-auditbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/manifest.json
index ffbf5aa7d8bb0..969873ead6d9c 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/manifest.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/manifest.json
@@ -48,6 +48,14 @@
     {
       "id": "windows_rare_user_runas_event",
       "file": "windows_rare_user_runas_event.json"
+    },
+    {
+      "id": "windows_rare_metadata_process",
+      "file": "windows_rare_metadata_process.json"
+    },
+    {
+      "id": "windows_rare_metadata_user",
+      "file": "windows_rare_metadata_user.json"
     }
   ],
   "datafeeds": [
@@ -95,6 +103,16 @@
       "id": "datafeed-windows_rare_user_runas_event",
       "file": "datafeed_windows_rare_user_runas_event.json",
       "job_id": "windows_rare_user_runas_event"
+    },
+    {
+      "id": "datafeed-windows_rare_metadata_process",
+      "file": "datafeed_windows_rare_metadata_process.json",
+      "job_id": "windows_rare_metadata_process"
+    },
+    {
+      "id": "datafeed-windows_rare_metadata_user",
+      "file": "datafeed_windows_rare_metadata_user.json",
+      "job_id": "windows_rare_metadata_user"
     }
   ]
-}
+}
\ No newline at end of file
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_rare_metadata_process.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_rare_metadata_process.json
new file mode 100644
index 0000000000000..dc0f6c4e81b33
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_rare_metadata_process.json
@@ -0,0 +1,12 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+      "bool": {
+        "filter": [{"term": {"destination.ip": "169.254.169.254"}}]
+      }
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_rare_metadata_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_rare_metadata_user.json
new file mode 100644
index 0000000000000..dc0f6c4e81b33
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_rare_metadata_user.json
@@ -0,0 +1,12 @@
+{
+    "job_id": "JOB_ID",
+    "indices": [
+      "INDEX_PATTERN_NAME"
+    ],
+    "max_empty_searches": 10,
+    "query": {
+      "bool": {
+        "filter": [{"term": {"destination.ip": "169.254.169.254"}}]
+      }
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_rare_metadata_process.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_rare_metadata_process.json
new file mode 100644
index 0000000000000..85fddbcc53e0f
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_rare_metadata_process.json
@@ -0,0 +1,52 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Winlogbeat - Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
+    "groups": [
+      "security",
+      "winlogbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"process.name\"",
+          "function": "rare",
+          "by_field_name": "process.name"
+        }
+      ],
+      "influencers": [
+        "process.name",
+        "host.name",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "64mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-winlogbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by process name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by process name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_rare_metadata_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_rare_metadata_user.json
new file mode 100644
index 0000000000000..767c2d5b30ad2
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_rare_metadata_user.json
@@ -0,0 +1,43 @@
+{
+    "job_type": "anomaly_detector",
+    "description": "Security: Winlogbeat - Looks for anomalous access to the metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
+    "groups": [
+      "security",
+      "winlogbeat",
+      "process"
+    ],
+    "analysis_config": {
+      "bucket_span": "15m",
+      "detectors": [
+        {
+          "detector_description": "rare by \"user.name\"",
+          "function": "rare",
+          "by_field_name": "user.name"
+        }
+      ],
+      "influencers": [
+        "host.name",
+        "user.name"
+      ]
+    },
+    "allow_lazy_open": true,
+    "analysis_limits": {
+      "model_memory_limit": "32mb"
+    },
+    "data_description": {
+      "time_field": "@timestamp"
+    },
+    "custom_settings": {
+      "created_by": "ml-module-siem-winlogbeat",
+      "custom_urls": [
+        {
+          "url_name": "Host Details by user name",
+          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        },
+        {
+          "url_name": "Hosts Overview by user name",
+          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
+        }
+      ]
+    }
+  }
diff --git a/x-pack/plugins/ml/server/models/job_service/datafeeds.ts b/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
index c0eb1b72825df..62ef9b3621610 100644
--- a/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
+++ b/x-pack/plugins/ml/server/models/job_service/datafeeds.ts
@@ -118,6 +118,11 @@ export function datafeedsProvider({ asInternalUser }: IScopedClusterClient) {
       } catch (error) {
         if (isRequestTimeout(error)) {
           return fillResultsWithTimeouts(results, datafeedId, datafeedIds, DATAFEED_STATE.STOPPED);
+        } else {
+          results[datafeedId] = {
+            started: false,
+            error: error.body,
+          };
         }
       }
     }
diff --git a/x-pack/plugins/ml/server/models/job_service/jobs.ts b/x-pack/plugins/ml/server/models/job_service/jobs.ts
index e047d31ba6eb7..f4378e29ef826 100644
--- a/x-pack/plugins/ml/server/models/job_service/jobs.ts
+++ b/x-pack/plugins/ml/server/models/job_service/jobs.ts
@@ -407,28 +407,21 @@ export function jobsProvider(client: IScopedClusterClient) {
   // Job IDs in supplied array may contain wildcard '*' characters
   // e.g. *_low_request_rate_ecs
   async function jobsExist(jobIds: string[] = []) {
-    // Get the list of job IDs.
-    const { body } = await asInternalUser.ml.getJobs<MlJobsResponse>({
-      job_id: jobIds.join(),
-    });
-
     const results: { [id: string]: boolean } = {};
-    if (body.count > 0) {
-      const allJobIds = body.jobs.map((job) => job.job_id);
-
-      // Check if each of the supplied IDs match existing jobs.
-      jobIds.forEach((jobId) => {
-        // Create a Regex for each supplied ID as wildcard * is allowed.
-        const regexp = new RegExp(`^${jobId.replace(/\*+/g, '.*')}$`);
-        const exists = allJobIds.some((existsJobId) => regexp.test(existsJobId));
-        results[jobId] = exists;
-      });
-    } else {
-      jobIds.forEach((jobId) => {
+    for (const jobId of jobIds) {
+      try {
+        const { body } = await asInternalUser.ml.getJobs<MlJobsResponse>({
+          job_id: jobId,
+        });
+        results[jobId] = body.count > 0;
+      } catch (e) {
+        // if a non-wildcarded job id is supplied, the get jobs endpoint will 404
+        if (e.body?.status !== 404) {
+          throw e;
+        }
         results[jobId] = false;
-      });
+      }
     }
-
     return results;
   }
 
diff --git a/x-pack/plugins/ml/server/routes/data_frame_analytics.ts b/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
index 7606420eacefc..4dad12af5e684 100644
--- a/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
+++ b/x-pack/plugins/ml/server/routes/data_frame_analytics.ts
@@ -325,19 +325,20 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
           success: false,
         };
 
-        // Check if analyticsId is valid and get destination index
-        if (deleteDestIndex || deleteDestIndexPattern) {
-          try {
-            const { body } = await client.asInternalUser.ml.getDataFrameAnalytics({
-              id: analyticsId,
-            });
-            if (Array.isArray(body.data_frame_analytics) && body.data_frame_analytics.length > 0) {
-              destinationIndex = body.data_frame_analytics[0].dest.index;
-            }
-          } catch (e) {
-            return response.customError(wrapError(e));
+        try {
+          // Check if analyticsId is valid and get destination index
+          const { body } = await client.asInternalUser.ml.getDataFrameAnalytics({
+            id: analyticsId,
+          });
+          if (Array.isArray(body.data_frame_analytics) && body.data_frame_analytics.length > 0) {
+            destinationIndex = body.data_frame_analytics[0].dest.index;
           }
+        } catch (e) {
+          // exist early if the job doesn't exist
+          return response.customError(wrapError(e));
+        }
 
+        if (deleteDestIndex || deleteDestIndexPattern) {
           // If user checks box to delete the destinationIndex associated with the job
           if (destinationIndex && deleteDestIndex) {
             // Verify if user has privilege to delete the destination index
@@ -349,8 +350,8 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
                   index: destinationIndex,
                 });
                 destIndexDeleted.success = true;
-              } catch (deleteIndexError) {
-                destIndexDeleted.error = wrapError(deleteIndexError);
+              } catch ({ body }) {
+                destIndexDeleted.error = body;
               }
             } else {
               return response.forbidden();
@@ -366,7 +367,7 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
               }
               destIndexPatternDeleted.success = true;
             } catch (deleteDestIndexPatternError) {
-              destIndexPatternDeleted.error = wrapError(deleteDestIndexPatternError);
+              destIndexPatternDeleted.error = deleteDestIndexPatternError;
             }
           }
         }
@@ -378,11 +379,8 @@ export function dataFrameAnalyticsRoutes({ router, mlLicense }: RouteInitializat
             id: analyticsId,
           });
           analyticsJobDeleted.success = true;
-        } catch (deleteDFAError) {
-          analyticsJobDeleted.error = wrapError(deleteDFAError);
-          if (analyticsJobDeleted.error.statusCode === 404) {
-            return response.notFound();
-          }
+        } catch ({ body }) {
+          analyticsJobDeleted.error = body;
         }
         const results = {
           analyticsJobDeleted,
diff --git a/x-pack/plugins/monitoring/public/alerts/cpu_usage_alert/cpu_usage_alert.tsx b/x-pack/plugins/monitoring/public/alerts/cpu_usage_alert/cpu_usage_alert.tsx
index 56cba83813a63..c9f82eb521433 100644
--- a/x-pack/plugins/monitoring/public/alerts/cpu_usage_alert/cpu_usage_alert.tsx
+++ b/x-pack/plugins/monitoring/public/alerts/cpu_usage_alert/cpu_usage_alert.tsx
@@ -23,6 +23,6 @@ export function createCpuUsageAlertType(): AlertTypeModel {
     ),
     validate,
     defaultActionMessage: '{{context.internalFullMessage}}',
-    requiresAppContext: false,
+    requiresAppContext: true,
   };
 }
diff --git a/x-pack/plugins/monitoring/public/alerts/legacy_alert/legacy_alert.tsx b/x-pack/plugins/monitoring/public/alerts/legacy_alert/legacy_alert.tsx
index 58b37e43085ff..f6223d41ab30e 100644
--- a/x-pack/plugins/monitoring/public/alerts/legacy_alert/legacy_alert.tsx
+++ b/x-pack/plugins/monitoring/public/alerts/legacy_alert/legacy_alert.tsx
@@ -33,7 +33,7 @@ export function createLegacyAlertTypes(): AlertTypeModel[] {
       ),
       defaultActionMessage: '{{context.internalFullMessage}}',
       validate: () => ({ errors: {} }),
-      requiresAppContext: false,
+      requiresAppContext: true,
     };
   });
 }
diff --git a/x-pack/plugins/monitoring/public/components/chart/monitoring_timeseries.js b/x-pack/plugins/monitoring/public/components/chart/monitoring_timeseries.js
index deaa4fd152cce..c4faf51dc000c 100644
--- a/x-pack/plugins/monitoring/public/components/chart/monitoring_timeseries.js
+++ b/x-pack/plugins/monitoring/public/components/chart/monitoring_timeseries.js
@@ -11,8 +11,8 @@ import { getColor } from './get_color';
 import { TimeseriesVisualization } from './timeseries_visualization';
 
 function formatTicksFor(series) {
-  const format = get(series, '.metric.format', '0,0.0');
-  const units = get(series, '.metric.units', '');
+  const format = get(series, 'metric.format', '0,0.0');
+  const units = get(series, 'metric.units', '');
 
   return function formatTicks(val) {
     let formatted = numeral(val).format(format);
diff --git a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
index 16d42d896ca11..e91679eff2817 100644
--- a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
+++ b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
@@ -119,67 +119,75 @@ export async function getClustersFromRequest(
     // add alerts data
     if (isInCodePath(codePaths, [CODE_PATH_ALERTS])) {
       const alertsClient = req.getAlertsClient();
-      if (alertsClient) {
-        for (const cluster of clusters) {
-          const verification = verifyMonitoringLicense(req.server);
-          if (!verification.enabled) {
-            // return metadata detailing that alerts is disabled because of the monitoring cluster license
-            cluster.alerts = {
-              alertsMeta: {
-                enabled: verification.enabled,
-                message: verification.message, // NOTE: this is only defined when the alert feature is disabled
-              },
-              list: {},
-            };
-            continue;
-          }
-
-          // check the license type of the production cluster for alerts feature support
-          const license = cluster.license || {};
-          const prodLicenseInfo = checkLicenseForAlerts(
-            license.type,
-            license.status === 'active',
-            'production'
-          );
-          if (prodLicenseInfo.clusterAlerts.enabled) {
-            cluster.alerts = {
-              list: await fetchStatus(
-                alertsClient,
-                req.server.plugins.monitoring.info,
-                undefined,
-                cluster.cluster_uuid,
-                start,
-                end,
-                []
-              ),
-              alertsMeta: {
-                enabled: true,
-              },
-            };
-            continue;
-          }
+      for (const cluster of clusters) {
+        const verification = verifyMonitoringLicense(req.server);
+        if (!verification.enabled) {
+          // return metadata detailing that alerts is disabled because of the monitoring cluster license
+          cluster.alerts = {
+            alertsMeta: {
+              enabled: verification.enabled,
+              message: verification.message, // NOTE: this is only defined when the alert feature is disabled
+            },
+            list: {},
+          };
+          continue;
+        }
 
+        if (!alertsClient) {
           cluster.alerts = {
             list: {},
             alertsMeta: {
-              enabled: true,
-            },
-            clusterMeta: {
               enabled: false,
-              message: i18n.translate(
-                'xpack.monitoring.clusterAlerts.unsupportedClusterAlertsDescription',
-                {
-                  defaultMessage:
-                    'Cluster [{clusterName}] license type [{licenseType}] does not support Cluster Alerts',
-                  values: {
-                    clusterName: cluster.cluster_name,
-                    licenseType: `${license.type}`,
-                  },
-                }
-              ),
             },
           };
+          continue;
+        }
+
+        // check the license type of the production cluster for alerts feature support
+        const license = cluster.license || {};
+        const prodLicenseInfo = checkLicenseForAlerts(
+          license.type,
+          license.status === 'active',
+          'production'
+        );
+        if (prodLicenseInfo.clusterAlerts.enabled) {
+          cluster.alerts = {
+            list: await fetchStatus(
+              alertsClient,
+              req.server.plugins.monitoring.info,
+              undefined,
+              cluster.cluster_uuid,
+              start,
+              end,
+              []
+            ),
+            alertsMeta: {
+              enabled: true,
+            },
+          };
+          continue;
         }
+
+        cluster.alerts = {
+          list: {},
+          alertsMeta: {
+            enabled: false,
+          },
+          clusterMeta: {
+            enabled: false,
+            message: i18n.translate(
+              'xpack.monitoring.clusterAlerts.unsupportedClusterAlertsDescription',
+              {
+                defaultMessage:
+                  'Cluster [{clusterName}] license type [{licenseType}] does not support Cluster Alerts',
+                values: {
+                  clusterName: cluster.cluster_name,
+                  licenseType: `${license.type}`,
+                },
+              }
+            ),
+          },
+        };
       }
     }
   }
diff --git a/x-pack/plugins/security/common/licensing/index.mock.ts b/x-pack/plugins/security/common/licensing/index.mock.ts
index 06a7057abb87c..87225f479ceed 100644
--- a/x-pack/plugins/security/common/licensing/index.mock.ts
+++ b/x-pack/plugins/security/common/licensing/index.mock.ts
@@ -9,6 +9,7 @@ import { SecurityLicense } from '.';
 
 export const licenseMock = {
   create: (): jest.Mocked<SecurityLicense> => ({
+    isLicenseAvailable: jest.fn(),
     isEnabled: jest.fn().mockReturnValue(true),
     getFeatures: jest.fn(),
     features$: of(),
diff --git a/x-pack/plugins/security/common/licensing/license_service.test.ts b/x-pack/plugins/security/common/licensing/license_service.test.ts
index 564b71a2e0fac..94aad8d3ac539 100644
--- a/x-pack/plugins/security/common/licensing/license_service.test.ts
+++ b/x-pack/plugins/security/common/licensing/license_service.test.ts
@@ -13,6 +13,7 @@ describe('license features', function () {
     const serviceSetup = new SecurityLicenseService().setup({
       license$: of(undefined as any),
     });
+    expect(serviceSetup.license.isLicenseAvailable()).toEqual(false);
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: false,
@@ -34,6 +35,7 @@ describe('license features', function () {
     const serviceSetup = new SecurityLicenseService().setup({
       license$: of(rawLicenseMock),
     });
+    expect(serviceSetup.license.isLicenseAvailable()).toEqual(false);
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: false,
@@ -60,6 +62,7 @@ describe('license features', function () {
     const subscriptionHandler = jest.fn();
     const subscription = serviceSetup.license.features$.subscribe(subscriptionHandler);
     try {
+      expect(serviceSetup.license.isLicenseAvailable()).toEqual(false);
       expect(subscriptionHandler).toHaveBeenCalledTimes(1);
       expect(subscriptionHandler.mock.calls[0]).toMatchInlineSnapshot(`
         Array [
@@ -80,6 +83,7 @@ describe('license features', function () {
       `);
 
       rawLicense$.next(licenseMock.createLicenseMock());
+      expect(serviceSetup.license.isLicenseAvailable()).toEqual(true);
       expect(subscriptionHandler).toHaveBeenCalledTimes(2);
       expect(subscriptionHandler.mock.calls[1]).toMatchInlineSnapshot(`
         Array [
@@ -112,6 +116,7 @@ describe('license features', function () {
     const serviceSetup = new SecurityLicenseService().setup({
       license$: of(mockRawLicense),
     });
+    expect(serviceSetup.license.isLicenseAvailable()).toEqual(true);
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: true,
@@ -136,6 +141,7 @@ describe('license features', function () {
     const serviceSetup = new SecurityLicenseService().setup({
       license$: of(mockRawLicense),
     });
+    expect(serviceSetup.license.isLicenseAvailable()).toEqual(true);
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: false,
       allowLogin: false,
@@ -159,6 +165,7 @@ describe('license features', function () {
     const serviceSetup = new SecurityLicenseService().setup({
       license$: of(mockRawLicense),
     });
+    expect(serviceSetup.license.isLicenseAvailable()).toEqual(true);
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: true,
@@ -182,6 +189,7 @@ describe('license features', function () {
     const serviceSetup = new SecurityLicenseService().setup({
       license$: of(mockRawLicense),
     });
+    expect(serviceSetup.license.isLicenseAvailable()).toEqual(true);
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: true,
@@ -205,6 +213,7 @@ describe('license features', function () {
     const serviceSetup = new SecurityLicenseService().setup({
       license$: of(mockRawLicense),
     });
+    expect(serviceSetup.license.isLicenseAvailable()).toEqual(true);
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: true,
diff --git a/x-pack/plugins/security/common/licensing/license_service.ts b/x-pack/plugins/security/common/licensing/license_service.ts
index 75c7670f28a67..09b6ae95c282c 100644
--- a/x-pack/plugins/security/common/licensing/license_service.ts
+++ b/x-pack/plugins/security/common/licensing/license_service.ts
@@ -10,6 +10,7 @@ import { ILicense } from '../../../licensing/common/types';
 import { SecurityLicenseFeatures } from './license_features';
 
 export interface SecurityLicense {
+  isLicenseAvailable(): boolean;
   isEnabled(): boolean;
   getFeatures(): SecurityLicenseFeatures;
   features$: Observable<SecurityLicenseFeatures>;
@@ -31,6 +32,8 @@ export class SecurityLicenseService {
 
     return {
       license: Object.freeze({
+        isLicenseAvailable: () => rawLicense?.isAvailable ?? false,
+
         isEnabled: () => this.isSecurityEnabledFromRawLicense(rawLicense),
 
         getFeatures: () => this.calculateFeaturesFromRawLicense(rawLicense),
diff --git a/x-pack/plugins/security/kibana.json b/x-pack/plugins/security/kibana.json
index 6a09e9e55a01b..40d7e293eaf66 100644
--- a/x-pack/plugins/security/kibana.json
+++ b/x-pack/plugins/security/kibana.json
@@ -4,7 +4,7 @@
   "kibanaVersion": "kibana",
   "configPath": ["xpack", "security"],
   "requiredPlugins": ["data", "features", "licensing", "taskManager"],
-  "optionalPlugins": ["home", "management"],
+  "optionalPlugins": ["home", "management", "usageCollection"],
   "server": true,
   "ui": true,
   "requiredBundles": [
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap
index 1c020685c246d..a2e46af19bf34 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/es/__snapshots__/elasticsearch_privileges.test.tsx.snap
@@ -184,6 +184,7 @@ exports[`it renders without crashing 1`] = `
         },
         "getFeatures": [MockFunction],
         "isEnabled": [MockFunction],
+        "isLicenseAvailable": [MockFunction],
       }
     }
     onChange={[MockFunction]}
diff --git a/x-pack/plugins/security/public/plugin.test.tsx b/x-pack/plugins/security/public/plugin.test.tsx
index 8cec4fbc2f5a2..8fe7d2805e18e 100644
--- a/x-pack/plugins/security/public/plugin.test.tsx
+++ b/x-pack/plugins/security/public/plugin.test.tsx
@@ -41,6 +41,7 @@ describe('Security Plugin', () => {
         __legacyCompat: { logoutUrl: '/some-base-path/logout', tenant: '/some-base-path' },
         authc: { getCurrentUser: expect.any(Function), areAPIKeysEnabled: expect.any(Function) },
         license: {
+          isLicenseAvailable: expect.any(Function),
           isEnabled: expect.any(Function),
           getFeatures: expect.any(Function),
           features$: expect.any(Observable),
@@ -67,6 +68,7 @@ describe('Security Plugin', () => {
       expect(setupManagementServiceMock).toHaveBeenCalledWith({
         authc: { getCurrentUser: expect.any(Function), areAPIKeysEnabled: expect.any(Function) },
         license: {
+          isLicenseAvailable: expect.any(Function),
           isEnabled: expect.any(Function),
           getFeatures: expect.any(Function),
           features$: expect.any(Observable),
diff --git a/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.test.ts b/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.test.ts
index 5e38045b88c74..b393c4a9e1a04 100644
--- a/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.test.ts
@@ -31,7 +31,9 @@ beforeEach(() => {
 
   mockSpacesService = {
     getSpaceId: jest.fn(),
-    namespaceToSpaceId: jest.fn().mockImplementation((namespace: string) => `${namespace}-id`),
+    namespaceToSpaceId: jest
+      .fn()
+      .mockImplementation((namespace: string = 'default') => `${namespace}-id`),
   };
 });
 
@@ -41,8 +43,6 @@ describe('#checkSavedObjectsPrivileges', () => {
   const namespace2 = 'qux';
 
   describe('when checking multiple namespaces', () => {
-    const namespaces = [namespace1, namespace2];
-
     test(`throws an error when using an empty namespaces array`, async () => {
       const checkSavedObjectsPrivileges = createFactory();
 
@@ -58,6 +58,7 @@ describe('#checkSavedObjectsPrivileges', () => {
       mockCheckPrivileges.atSpaces.mockReturnValue(expectedResult as any);
       const checkSavedObjectsPrivileges = createFactory();
 
+      const namespaces = [namespace1, namespace2];
       const result = await checkSavedObjectsPrivileges(actions, namespaces);
 
       expect(result).toBe(expectedResult);
@@ -70,6 +71,30 @@ describe('#checkSavedObjectsPrivileges', () => {
       const spaceIds = mockSpacesService!.namespaceToSpaceId.mock.results.map((x) => x.value);
       expect(mockCheckPrivileges.atSpaces).toHaveBeenCalledWith(spaceIds, actions);
     });
+
+    test(`de-duplicates namespaces`, async () => {
+      const expectedResult = Symbol();
+      mockCheckPrivileges.atSpaces.mockReturnValue(expectedResult as any);
+      const checkSavedObjectsPrivileges = createFactory();
+
+      const namespaces = [undefined, 'default', namespace1, namespace1];
+      const result = await checkSavedObjectsPrivileges(actions, namespaces);
+
+      expect(result).toBe(expectedResult);
+      expect(mockSpacesService!.namespaceToSpaceId).toHaveBeenCalledTimes(4);
+      expect(mockSpacesService!.namespaceToSpaceId).toHaveBeenNthCalledWith(1, undefined);
+      expect(mockSpacesService!.namespaceToSpaceId).toHaveBeenNthCalledWith(2, 'default');
+      expect(mockSpacesService!.namespaceToSpaceId).toHaveBeenNthCalledWith(3, namespace1);
+      expect(mockSpacesService!.namespaceToSpaceId).toHaveBeenNthCalledWith(4, namespace1);
+      expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledTimes(1);
+      expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledWith(request);
+      expect(mockCheckPrivileges.atSpaces).toHaveBeenCalledTimes(1);
+      const spaceIds = [
+        mockSpacesService!.namespaceToSpaceId(undefined), // deduplicated with 'default'
+        mockSpacesService!.namespaceToSpaceId(namespace1), // deduplicated with namespace1
+      ];
+      expect(mockCheckPrivileges.atSpaces).toHaveBeenCalledWith(spaceIds, actions);
+    });
   });
 
   describe('when checking a single namespace', () => {
diff --git a/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.ts b/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.ts
index 0c2260542bf72..6d2f724dae948 100644
--- a/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.ts
+++ b/x-pack/plugins/security/server/authorization/check_saved_objects_privileges.ts
@@ -14,9 +14,13 @@ export type CheckSavedObjectsPrivilegesWithRequest = (
 
 export type CheckSavedObjectsPrivileges = (
   actions: string | string[],
-  namespaceOrNamespaces?: string | string[]
+  namespaceOrNamespaces?: string | Array<undefined | string>
 ) => Promise<CheckPrivilegesResponse>;
 
+function uniq<T>(arr: T[]): T[] {
+  return Array.from(new Set<T>(arr));
+}
+
 export const checkSavedObjectsPrivilegesWithRequestFactory = (
   checkPrivilegesWithRequest: CheckPrivilegesWithRequest,
   getSpacesService: () => SpacesService | undefined
@@ -26,7 +30,7 @@ export const checkSavedObjectsPrivilegesWithRequestFactory = (
   ): CheckSavedObjectsPrivileges {
     return async function checkSavedObjectsPrivileges(
       actions: string | string[],
-      namespaceOrNamespaces?: string | string[]
+      namespaceOrNamespaces?: string | Array<undefined | string>
     ) {
       const spacesService = getSpacesService();
       if (!spacesService) {
@@ -37,7 +41,10 @@ export const checkSavedObjectsPrivilegesWithRequestFactory = (
         if (!namespaceOrNamespaces.length) {
           throw new Error(`Can't check saved object privileges for 0 namespaces`);
         }
-        const spaceIds = namespaceOrNamespaces.map((x) => spacesService.namespaceToSpaceId(x));
+        const spaceIds = uniq(
+          namespaceOrNamespaces.map((x) => spacesService.namespaceToSpaceId(x))
+        );
+
         return await checkPrivilegesWithRequest(request).atSpaces(spaceIds, actions);
       } else {
         // Spaces enabled, authorizing against a single space
diff --git a/x-pack/plugins/security/server/config.test.ts b/x-pack/plugins/security/server/config.test.ts
index 520081ae30d8d..093a7643fbf64 100644
--- a/x-pack/plugins/security/server/config.test.ts
+++ b/x-pack/plugins/security/server/config.test.ts
@@ -904,11 +904,13 @@ describe('createConfig()', () => {
         },
         "sortedProviders": Array [
           Object {
+            "hasAccessAgreement": false,
             "name": "saml",
             "order": 0,
             "type": "saml",
           },
           Object {
+            "hasAccessAgreement": false,
             "name": "basic",
             "order": 1,
             "type": "basic",
@@ -982,6 +984,63 @@ describe('createConfig()', () => {
     ).toBe(true);
   });
 
+  it('indicates which providers have the access agreement enabled', () => {
+    expect(
+      createConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: { basic1: { order: 3 } },
+              saml: {
+                saml1: { order: 2, realm: 'saml1', accessAgreement: { message: 'foo' } },
+                saml2: { order: 1, realm: 'saml2' },
+              },
+              oidc: {
+                oidc1: { order: 0, realm: 'oidc1', accessAgreement: { message: 'foo' } },
+                oidc2: { order: 4, realm: 'oidc2' },
+              },
+            },
+          },
+        }),
+        loggingSystemMock.create().get(),
+        { isTLSEnabled: true }
+      ).authc.sortedProviders
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "hasAccessAgreement": true,
+          "name": "oidc1",
+          "order": 0,
+          "type": "oidc",
+        },
+        Object {
+          "hasAccessAgreement": false,
+          "name": "saml2",
+          "order": 1,
+          "type": "saml",
+        },
+        Object {
+          "hasAccessAgreement": true,
+          "name": "saml1",
+          "order": 2,
+          "type": "saml",
+        },
+        Object {
+          "hasAccessAgreement": false,
+          "name": "basic1",
+          "order": 3,
+          "type": "basic",
+        },
+        Object {
+          "hasAccessAgreement": false,
+          "name": "oidc2",
+          "order": 4,
+          "type": "oidc",
+        },
+      ]
+    `);
+  });
+
   it('correctly sorts providers based on the `order`', () => {
     expect(
       createConfig(
@@ -1000,26 +1059,31 @@ describe('createConfig()', () => {
     ).toMatchInlineSnapshot(`
       Array [
         Object {
+          "hasAccessAgreement": false,
           "name": "oidc1",
           "order": 0,
           "type": "oidc",
         },
         Object {
+          "hasAccessAgreement": false,
           "name": "saml2",
           "order": 1,
           "type": "saml",
         },
         Object {
+          "hasAccessAgreement": false,
           "name": "saml1",
           "order": 2,
           "type": "saml",
         },
         Object {
+          "hasAccessAgreement": false,
           "name": "basic1",
           "order": 3,
           "type": "basic",
         },
         Object {
+          "hasAccessAgreement": false,
           "name": "oidc2",
           "order": 4,
           "type": "oidc",
diff --git a/x-pack/plugins/security/server/config.ts b/x-pack/plugins/security/server/config.ts
index dcfe4825fb035..9ccbdac5e09f4 100644
--- a/x-pack/plugins/security/server/config.ts
+++ b/x-pack/plugins/security/server/config.ts
@@ -255,13 +255,19 @@ export function createConfig(
     type: keyof ProvidersConfigType;
     name: string;
     order: number;
+    hasAccessAgreement: boolean;
   }> = [];
   for (const [type, providerGroup] of Object.entries(providers)) {
-    for (const [name, { enabled, order }] of Object.entries(providerGroup ?? {})) {
+    for (const [name, { enabled, order, accessAgreement }] of Object.entries(providerGroup ?? {})) {
       if (!enabled) {
         delete providerGroup![name];
       } else {
-        sortedProviders.push({ type: type as any, name, order });
+        sortedProviders.push({
+          type: type as any,
+          name,
+          order,
+          hasAccessAgreement: !!accessAgreement?.message,
+        });
       }
     }
   }
diff --git a/x-pack/plugins/security/server/plugin.test.ts b/x-pack/plugins/security/server/plugin.test.ts
index 8d13f81075714..9825e77b164c8 100644
--- a/x-pack/plugins/security/server/plugin.test.ts
+++ b/x-pack/plugins/security/server/plugin.test.ts
@@ -108,6 +108,7 @@ describe('Security Plugin', () => {
                   },
                   "getFeatures": [Function],
                   "isEnabled": [Function],
+                  "isLicenseAvailable": [Function],
                 },
                 "registerSpacesService": [Function],
               }
diff --git a/x-pack/plugins/security/server/plugin.ts b/x-pack/plugins/security/server/plugin.ts
index 7d94e03916fa1..1eb406dd2061b 100644
--- a/x-pack/plugins/security/server/plugin.ts
+++ b/x-pack/plugins/security/server/plugin.ts
@@ -7,6 +7,7 @@
 import { combineLatest } from 'rxjs';
 import { first, map } from 'rxjs/operators';
 import { TypeOf } from '@kbn/config-schema';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import {
   deepFreeze,
   CoreSetup,
@@ -32,6 +33,7 @@ import { AuditService, SecurityAuditLogger, AuditServiceSetup } from './audit';
 import { SecurityFeatureUsageService, SecurityFeatureUsageServiceStart } from './feature_usage';
 import { ElasticsearchService } from './elasticsearch';
 import { SessionManagementService } from './session_management';
+import { registerSecurityUsageCollector } from './usage_collector';
 
 export type SpacesService = Pick<
   SpacesPluginSetup['spacesService'],
@@ -74,6 +76,7 @@ export interface PluginSetupDependencies {
   features: FeaturesPluginSetup;
   licensing: LicensingPluginSetup;
   taskManager: TaskManagerSetupContract;
+  usageCollection?: UsageCollectionSetup;
 }
 
 export interface PluginStartDependencies {
@@ -123,7 +126,7 @@ export class Plugin {
 
   public async setup(
     core: CoreSetup<PluginStartDependencies>,
-    { features, licensing, taskManager }: PluginSetupDependencies
+    { features, licensing, taskManager, usageCollection }: PluginSetupDependencies
   ) {
     const [config, legacyConfig] = await combineLatest([
       this.initializerContext.config.create<TypeOf<typeof ConfigSchema>>().pipe(
@@ -151,6 +154,8 @@ export class Plugin {
 
     this.featureUsageService.setup({ featureUsage: licensing.featureUsage });
 
+    registerSecurityUsageCollector({ usageCollection, config, license });
+
     const audit = this.auditService.setup({ license, config: config.audit });
     const auditLogger = new SecurityAuditLogger(audit.getLogger());
 
diff --git a/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.test.ts b/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.test.ts
index 7f7f969e8b480..2cf072453a3c7 100644
--- a/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.test.ts
+++ b/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.test.ts
@@ -117,7 +117,11 @@ const expectSuccess = async (fn: Function, args: Record<string, any>, action?: s
   return result;
 };
 
-const expectPrivilegeCheck = async (fn: Function, args: Record<string, any>) => {
+const expectPrivilegeCheck = async (
+  fn: Function,
+  args: Record<string, any>,
+  namespacesOverride?: Array<undefined | string>
+) => {
   clientOpts.checkSavedObjectsPrivilegesAsCurrentUser.mockImplementation(
     getMockCheckPrivilegesFailure
   );
@@ -131,7 +135,7 @@ const expectPrivilegeCheck = async (fn: Function, args: Record<string, any>) =>
   expect(clientOpts.checkSavedObjectsPrivilegesAsCurrentUser).toHaveBeenCalledTimes(1);
   expect(clientOpts.checkSavedObjectsPrivilegesAsCurrentUser).toHaveBeenCalledWith(
     actions,
-    args.options?.namespace ?? args.options?.namespaces
+    namespacesOverride ?? args.options?.namespace ?? args.options?.namespaces
   );
 };
 
@@ -483,7 +487,18 @@ describe('#bulkUpdate', () => {
 
   test(`checks privileges for user, actions, and namespace`, async () => {
     const objects = [obj1, obj2];
-    await expectPrivilegeCheck(client.bulkUpdate, { objects, options });
+    const namespacesOverride = [options.namespace]; // the bulkCreate function checks privileges as an array
+    await expectPrivilegeCheck(client.bulkUpdate, { objects, options }, namespacesOverride);
+  });
+
+  test(`checks privileges for object namespaces if present`, async () => {
+    const objects = [
+      { ...obj1, namespace: 'foo-ns' },
+      { ...obj2, namespace: 'bar-ns' },
+    ];
+    const namespacesOverride = [undefined, 'foo-ns', 'bar-ns'];
+    // use the default namespace for the options
+    await expectPrivilegeCheck(client.bulkUpdate, { objects, options: {} }, namespacesOverride);
   });
 
   test(`filters namespaces that the user doesn't have access to`, async () => {
diff --git a/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.ts b/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.ts
index 68fe65d204d6d..bfa08a0116644 100644
--- a/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.ts
+++ b/x-pack/plugins/security/server/saved_objects/secure_saved_objects_client_wrapper.ts
@@ -199,12 +199,16 @@ export class SecureSavedObjectsClientWrapper implements SavedObjectsClientContra
     objects: Array<SavedObjectsBulkUpdateObject<T>> = [],
     options: SavedObjectsBaseOptions = {}
   ) {
-    await this.ensureAuthorized(
-      this.getUniqueObjectTypes(objects),
-      'bulk_update',
-      options && options.namespace,
-      { objects, options }
-    );
+    const objectNamespaces = objects
+      // The repository treats an `undefined` object namespace is treated as the absence of a namespace, falling back to options.namespace;
+      // in this case, filter it out here so we don't accidentally check for privileges in the Default space when we shouldn't be doing so.
+      .filter(({ namespace }) => namespace !== undefined)
+      .map(({ namespace }) => namespace!);
+    const namespaces = [options?.namespace, ...objectNamespaces];
+    await this.ensureAuthorized(this.getUniqueObjectTypes(objects), 'bulk_update', namespaces, {
+      objects,
+      options,
+    });
 
     const response = await this.baseClient.bulkUpdate<T>(objects, options);
     return await this.redactSavedObjectsNamespaces(response);
@@ -212,7 +216,7 @@ export class SecureSavedObjectsClientWrapper implements SavedObjectsClientContra
 
   private async checkPrivileges(
     actions: string | string[],
-    namespaceOrNamespaces?: string | string[]
+    namespaceOrNamespaces?: string | Array<undefined | string>
   ) {
     try {
       return await this.checkSavedObjectsPrivilegesAsCurrentUser(actions, namespaceOrNamespaces);
@@ -224,7 +228,7 @@ export class SecureSavedObjectsClientWrapper implements SavedObjectsClientContra
   private async ensureAuthorized(
     typeOrTypes: string | string[],
     action: string,
-    namespaceOrNamespaces?: string | string[],
+    namespaceOrNamespaces?: string | Array<undefined | string>,
     args?: Record<string, unknown>,
     auditAction: string = action,
     requiresAll = true
diff --git a/x-pack/plugins/ml/public/application/components/messagebar/index.ts b/x-pack/plugins/security/server/usage_collector/index.ts
similarity index 75%
rename from x-pack/plugins/ml/public/application/components/messagebar/index.ts
rename to x-pack/plugins/security/server/usage_collector/index.ts
index 35130d28a890d..dd405ebac4241 100644
--- a/x-pack/plugins/ml/public/application/components/messagebar/index.ts
+++ b/x-pack/plugins/security/server/usage_collector/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { mlMessageBarService } from './messagebar_service';
+export { registerSecurityUsageCollector } from './security_usage_collector';
diff --git a/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts b/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts
new file mode 100644
index 0000000000000..6c3dcddcdb418
--- /dev/null
+++ b/x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts
@@ -0,0 +1,465 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createConfig, ConfigSchema } from '../config';
+import { loggingSystemMock } from 'src/core/server/mocks';
+import { TypeOf } from '@kbn/config-schema';
+import { usageCollectionPluginMock } from 'src/plugins/usage_collection/server/mocks';
+import { registerSecurityUsageCollector } from './security_usage_collector';
+import { elasticsearchServiceMock } from 'src/core/server/mocks';
+import { licenseMock } from '../../common/licensing/index.mock';
+import { SecurityLicenseFeatures } from '../../common/licensing';
+
+describe('Security UsageCollector', () => {
+  const createSecurityConfig = (config: TypeOf<typeof ConfigSchema>) => {
+    return createConfig(config, loggingSystemMock.createLogger(), { isTLSEnabled: true });
+  };
+
+  const createSecurityLicense = ({
+    allowAccessAgreement = true,
+    allowAuditLogging = true,
+    allowRbac = true,
+    isLicenseAvailable,
+  }: Partial<SecurityLicenseFeatures> & { isLicenseAvailable: boolean }) => {
+    const license = licenseMock.create();
+    license.isLicenseAvailable.mockReturnValue(isLicenseAvailable);
+    license.getFeatures.mockReturnValue({
+      allowAccessAgreement,
+      allowAuditLogging,
+      allowRbac,
+    } as SecurityLicenseFeatures);
+    return license;
+  };
+
+  const clusterClient = elasticsearchServiceMock.createLegacyClusterClient();
+
+  describe('initialization', () => {
+    it('handles an undefined usage collector', () => {
+      const config = createSecurityConfig(ConfigSchema.validate({}));
+      const usageCollection = undefined;
+      const license = createSecurityLicense({ allowRbac: false, isLicenseAvailable: false });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+    });
+
+    it('registers itself and waits for the license to become available before reporting itself as ready', async () => {
+      const config = createSecurityConfig(ConfigSchema.validate({}));
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ allowRbac: false, isLicenseAvailable: false });
+
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      expect(usageCollection.getCollectorByType('security')?.isReady()).toBe(false);
+
+      license.isLicenseAvailable.mockReturnValue(true);
+      license.getFeatures.mockReturnValue({ allowRbac: true } as SecurityLicenseFeatures);
+
+      expect(usageCollection.getCollectorByType('security')?.isReady()).toBe(true);
+    });
+  });
+
+  it('reports correctly for a default configuration', async () => {
+    const config = createSecurityConfig(ConfigSchema.validate({}));
+    const usageCollection = usageCollectionPluginMock.createSetupContract();
+    const license = createSecurityLicense({ isLicenseAvailable: true });
+    registerSecurityUsageCollector({ usageCollection, config, license });
+
+    const usage = await usageCollection
+      .getCollectorByType('security')
+      ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+    expect(usage).toEqual({
+      auditLoggingEnabled: false,
+      accessAgreementEnabled: false,
+      authProviderCount: 1,
+      enabledAuthProviders: ['basic'],
+      loginSelectorEnabled: false,
+      httpAuthSchemes: ['apikey'],
+    });
+  });
+
+  it('reports correctly when security is disabled in Elasticsearch', async () => {
+    const config = createSecurityConfig(ConfigSchema.validate({}));
+    const usageCollection = usageCollectionPluginMock.createSetupContract();
+    const license = createSecurityLicense({ allowRbac: false, isLicenseAvailable: true });
+
+    registerSecurityUsageCollector({ usageCollection, config, license });
+
+    const usage = await usageCollection
+      .getCollectorByType('security')
+      ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+    expect(usage).toEqual({
+      auditLoggingEnabled: false,
+      accessAgreementEnabled: false,
+      authProviderCount: 0,
+      enabledAuthProviders: [],
+      loginSelectorEnabled: false,
+      httpAuthSchemes: [],
+    });
+  });
+
+  describe('auth providers', () => {
+    it('does not report disabled auth providers', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: {
+                basic: {
+                  order: 0,
+                },
+                disabledBasic: {
+                  enabled: false,
+                  order: 1,
+                },
+              },
+              saml: {
+                disabledSaml: {
+                  enabled: false,
+                  realm: 'foo',
+                  order: 2,
+                },
+              },
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['basic'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+
+    it('reports the types and count of enabled auth providers', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: {
+                basic: {
+                  order: 0,
+                  enabled: false,
+                },
+              },
+              saml: {
+                saml1: {
+                  realm: 'foo',
+                  order: 1,
+                },
+                saml2: {
+                  realm: 'bar',
+                  order: 2,
+                },
+              },
+              pki: {
+                pki1: {
+                  enabled: true,
+                  order: 3,
+                },
+              },
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 3,
+        enabledAuthProviders: ['saml', 'pki'],
+        loginSelectorEnabled: true,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+  });
+
+  describe('access agreement', () => {
+    it('reports if the access agreement message is configured for any provider', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              saml: {
+                saml1: {
+                  realm: 'foo',
+                  order: 1,
+                  accessAgreement: {
+                    message: 'foo message',
+                  },
+                },
+              },
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: true,
+        authProviderCount: 1,
+        enabledAuthProviders: ['saml'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+    it('does not report the access agreement if the license does not permit it', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              saml: {
+                saml1: {
+                  realm: 'foo',
+                  order: 1,
+                  accessAgreement: {
+                    message: 'foo message',
+                  },
+                },
+              },
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({
+        isLicenseAvailable: true,
+        allowAccessAgreement: false,
+      });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['saml'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+
+    it('does not report the access agreement for disabled providers', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              saml: {
+                saml1: {
+                  enabled: false,
+                  realm: 'foo',
+                  order: 1,
+                  accessAgreement: {
+                    message: 'foo message',
+                  },
+                },
+                saml2: {
+                  realm: 'foo',
+                  order: 2,
+                },
+              },
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['saml'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+  });
+
+  describe('login selector', () => {
+    it('reports when the login selector is enabled', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            selector: {
+              enabled: true,
+            },
+            providers: {
+              saml: {
+                saml1: {
+                  realm: 'foo',
+                  order: 1,
+                  showInSelector: true,
+                },
+              },
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['saml'],
+        loginSelectorEnabled: true,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+  });
+
+  describe('audit logging', () => {
+    it('reports when audit logging is enabled', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          audit: {
+            enabled: true,
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true, allowAuditLogging: true });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: true,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['basic'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+
+    it('does not report audit logging when the license does not permit it', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          audit: {
+            enabled: true,
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true, allowAuditLogging: false });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['basic'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['apikey'],
+      });
+    });
+  });
+
+  describe('http auth schemes', () => {
+    it('reports customized http auth schemes', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            http: {
+              schemes: ['basic', 'Negotiate'],
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true, allowAuditLogging: false });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['basic'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['basic', 'Negotiate'],
+      });
+    });
+
+    it('does not report auth schemes that are not "well known"', async () => {
+      const config = createSecurityConfig(
+        ConfigSchema.validate({
+          authc: {
+            http: {
+              schemes: ['basic', 'Negotiate', 'customScheme'],
+            },
+          },
+        })
+      );
+      const usageCollection = usageCollectionPluginMock.createSetupContract();
+      const license = createSecurityLicense({ isLicenseAvailable: true, allowAuditLogging: false });
+      registerSecurityUsageCollector({ usageCollection, config, license });
+
+      const usage = await usageCollection
+        .getCollectorByType('security')
+        ?.fetch(clusterClient.asScoped().callAsCurrentUser);
+
+      expect(usage).toEqual({
+        auditLoggingEnabled: false,
+        accessAgreementEnabled: false,
+        authProviderCount: 1,
+        enabledAuthProviders: ['basic'],
+        loginSelectorEnabled: false,
+        httpAuthSchemes: ['basic', 'Negotiate'],
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts b/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts
new file mode 100644
index 0000000000000..11e58f7f95fc2
--- /dev/null
+++ b/x-pack/plugins/security/server/usage_collector/security_usage_collector.ts
@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { ConfigType } from '../config';
+import { SecurityLicense } from '../../common/licensing';
+
+interface Usage {
+  auditLoggingEnabled: boolean;
+  loginSelectorEnabled: boolean;
+  accessAgreementEnabled: boolean;
+  authProviderCount: number;
+  enabledAuthProviders: string[];
+  httpAuthSchemes: string[];
+}
+
+interface Deps {
+  usageCollection?: UsageCollectionSetup;
+  config: ConfigType;
+  license: SecurityLicense;
+}
+
+// List of auth schemes collected from https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml
+const WELL_KNOWN_AUTH_SCHEMES = [
+  'basic',
+  'bearer',
+  'digest',
+  'hoba',
+  'mutual',
+  'negotiate',
+  'oauth',
+  'scram-sha-1',
+  'scram-sha-256',
+  'vapid',
+  'apikey', // not part of the spec, but used by the Elastic Stack for API Key authentication
+];
+
+export function registerSecurityUsageCollector({ usageCollection, config, license }: Deps): void {
+  // usageCollection is an optional dependency, so make sure to return if it is not registered.
+  if (!usageCollection) {
+    return;
+  }
+
+  // create usage collector
+  const securityCollector = usageCollection.makeUsageCollector<Usage>({
+    type: 'security',
+    isReady: () => license.isLicenseAvailable(),
+    schema: {
+      auditLoggingEnabled: {
+        type: 'boolean',
+      },
+      loginSelectorEnabled: {
+        type: 'boolean',
+      },
+      accessAgreementEnabled: {
+        type: 'boolean',
+      },
+      authProviderCount: {
+        type: 'number',
+      },
+      enabledAuthProviders: {
+        type: 'keyword',
+      },
+      httpAuthSchemes: {
+        type: 'keyword',
+      },
+    },
+    fetch: () => {
+      const { allowRbac, allowAccessAgreement, allowAuditLogging } = license.getFeatures();
+      if (!allowRbac) {
+        return {
+          auditLoggingEnabled: false,
+          loginSelectorEnabled: false,
+          accessAgreementEnabled: false,
+          authProviderCount: 0,
+          enabledAuthProviders: [],
+          httpAuthSchemes: [],
+        };
+      }
+
+      const auditLoggingEnabled = allowAuditLogging && config.audit.enabled;
+      const loginSelectorEnabled = config.authc.selector.enabled;
+      const authProviderCount = config.authc.sortedProviders.length;
+      const enabledAuthProviders = [
+        ...new Set(
+          config.authc.sortedProviders.reduce(
+            (acc, provider) => [...acc, provider.type],
+            [] as string[]
+          )
+        ),
+      ];
+      const accessAgreementEnabled =
+        allowAccessAgreement &&
+        config.authc.sortedProviders.some((provider) => provider.hasAccessAgreement);
+
+      const httpAuthSchemes = config.authc.http.schemes.filter((scheme) =>
+        WELL_KNOWN_AUTH_SCHEMES.includes(scheme.toLowerCase())
+      );
+
+      return {
+        auditLoggingEnabled,
+        loginSelectorEnabled,
+        accessAgreementEnabled,
+        authProviderCount,
+        enabledAuthProviders,
+        httpAuthSchemes,
+      };
+    },
+  });
+
+  // register usage collector
+  usageCollection.registerCollector(securityCollector);
+}
diff --git a/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts b/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts
index be3a1e82356c8..7e3b3d125fb5d 100644
--- a/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts
@@ -13,6 +13,12 @@ import {
   ECSCategory,
   ANCESTRY_LIMIT,
 } from './generate_data';
+import { firstNonNullValue, values } from './models/ecs_safety_helpers';
+import {
+  entityIDSafeVersion,
+  parentEntityIDSafeVersion,
+  timestampSafeVersion,
+} from './models/event';
 
 interface Node {
   events: Event[];
@@ -30,7 +36,7 @@ describe('data generator', () => {
     const event1 = generator.generateEvent();
     const event2 = generator.generateEvent();
 
-    expect(event2.event.sequence).toBe(event1.event.sequence + 1);
+    expect(event2.event?.sequence).toBe((firstNonNullValue(event1.event?.sequence) ?? 0) + 1);
   });
 
   it('creates the same documents with same random seed', () => {
@@ -76,37 +82,37 @@ describe('data generator', () => {
     const timestamp = new Date().getTime();
     const alert = generator.generateAlert(timestamp);
     expect(alert['@timestamp']).toEqual(timestamp);
-    expect(alert.event.action).not.toBeNull();
+    expect(alert.event?.action).not.toBeNull();
     expect(alert.Endpoint).not.toBeNull();
     expect(alert.agent).not.toBeNull();
     expect(alert.host).not.toBeNull();
-    expect(alert.process.entity_id).not.toBeNull();
+    expect(alert.process?.entity_id).not.toBeNull();
   });
 
   it('creates process event documents', () => {
     const timestamp = new Date().getTime();
     const processEvent = generator.generateEvent({ timestamp });
     expect(processEvent['@timestamp']).toEqual(timestamp);
-    expect(processEvent.event.category).toEqual(['process']);
-    expect(processEvent.event.kind).toEqual('event');
-    expect(processEvent.event.type).toEqual(['start']);
+    expect(processEvent.event?.category).toEqual(['process']);
+    expect(processEvent.event?.kind).toEqual('event');
+    expect(processEvent.event?.type).toEqual(['start']);
     expect(processEvent.agent).not.toBeNull();
     expect(processEvent.host).not.toBeNull();
-    expect(processEvent.process.entity_id).not.toBeNull();
-    expect(processEvent.process.name).not.toBeNull();
+    expect(processEvent.process?.entity_id).not.toBeNull();
+    expect(processEvent.process?.name).not.toBeNull();
   });
 
   it('creates other event documents', () => {
     const timestamp = new Date().getTime();
     const processEvent = generator.generateEvent({ timestamp, eventCategory: 'dns' });
     expect(processEvent['@timestamp']).toEqual(timestamp);
-    expect(processEvent.event.category).toEqual('dns');
-    expect(processEvent.event.kind).toEqual('event');
-    expect(processEvent.event.type).toEqual(['start']);
+    expect(processEvent.event?.category).toEqual('dns');
+    expect(processEvent.event?.kind).toEqual('event');
+    expect(processEvent.event?.type).toEqual(['start']);
     expect(processEvent.agent).not.toBeNull();
     expect(processEvent.host).not.toBeNull();
-    expect(processEvent.process.entity_id).not.toBeNull();
-    expect(processEvent.process.name).not.toBeNull();
+    expect(processEvent.process?.entity_id).not.toBeNull();
+    expect(processEvent.process?.name).not.toBeNull();
   });
 
   describe('creates events with an empty ancestry array', () => {
@@ -128,7 +134,7 @@ describe('data generator', () => {
 
     it('creates all events with an empty ancestry array', () => {
       for (const event of tree.allEvents) {
-        expect(event.process.Ext!.ancestry!.length).toEqual(0);
+        expect(event.process?.Ext?.ancestry?.length).toEqual(0);
       }
     });
   });
@@ -194,22 +200,23 @@ describe('data generator', () => {
       const inRelated = node.relatedEvents.includes(event);
       const inRelatedAlerts = node.relatedAlerts.includes(event);
 
-      return (inRelated || inRelatedAlerts || inLifecycle) && event.process.entity_id === node.id;
+      return (inRelated || inRelatedAlerts || inLifecycle) && event.process?.entity_id === node.id;
     };
 
     const verifyAncestry = (event: Event, genTree: Tree) => {
-      if (event.process.Ext!.ancestry!.length > 0) {
-        expect(event.process.parent?.entity_id).toBe(event.process.Ext!.ancestry![0]);
+      const ancestry = values(event.process?.Ext?.ancestry);
+      if (ancestry.length > 0) {
+        expect(event.process?.parent?.entity_id).toBe(ancestry[0]);
       }
-      for (let i = 0; i < event.process.Ext!.ancestry!.length; i++) {
-        const ancestor = event.process.Ext!.ancestry![i];
+      for (let i = 0; i < ancestry.length; i++) {
+        const ancestor = ancestry[i];
         const parent = genTree.children.get(ancestor) || genTree.ancestry.get(ancestor);
-        expect(ancestor).toBe(parent?.lifecycle[0].process.entity_id);
+        expect(ancestor).toBe(parent?.lifecycle[0].process?.entity_id);
 
         // the next ancestor should be the grandparent
-        if (i + 1 < event.process.Ext!.ancestry!.length) {
-          const grandparent = event.process.Ext!.ancestry![i + 1];
-          expect(grandparent).toBe(parent?.lifecycle[0].process.parent?.entity_id);
+        if (i + 1 < ancestry.length) {
+          const grandparent = ancestry[i + 1];
+          expect(grandparent).toBe(parent?.lifecycle[0].process?.parent?.entity_id);
         }
       }
     };
@@ -217,13 +224,14 @@ describe('data generator', () => {
     it('creates related events in ascending order', () => {
       // the order should not change since it should already be in ascending order
       const relatedEventsAsc = _.cloneDeep(tree.origin.relatedEvents).sort(
-        (event1, event2) => event1['@timestamp'] - event2['@timestamp']
+        (event1, event2) =>
+          (timestampSafeVersion(event1) ?? 0) - (timestampSafeVersion(event2) ?? 0)
       );
       expect(tree.origin.relatedEvents).toStrictEqual(relatedEventsAsc);
     });
 
     it('has ancestry array defined', () => {
-      expect(tree.origin.lifecycle[0].process.Ext!.ancestry!.length).toBe(ANCESTRY_LIMIT);
+      expect(values(tree.origin.lifecycle[0].process?.Ext?.ancestry).length).toBe(ANCESTRY_LIMIT);
       for (const event of tree.allEvents) {
         verifyAncestry(event, tree);
       }
@@ -252,12 +260,9 @@ describe('data generator', () => {
 
         const counts: Record<string, number> = {};
         for (const event of node.relatedEvents) {
-          if (Array.isArray(event.event.category)) {
-            for (const cat of event.event.category) {
-              counts[cat] = counts[cat] + 1 || 1;
-            }
-          } else {
-            counts[event.event.category] = counts[event.event.category] + 1 || 1;
+          const categories = values(event.event?.category);
+          for (const cat of categories) {
+            counts[cat] = counts[cat] + 1 || 1;
           }
         }
         expect(counts[ECSCategory.Driver]).toEqual(1);
@@ -316,15 +321,18 @@ describe('data generator', () => {
       expect(tree.allEvents.length).toBeGreaterThan(0);
 
       tree.allEvents.forEach((event) => {
-        const ancestor = tree.ancestry.get(event.process.entity_id);
-        if (ancestor) {
-          expect(eventInNode(event, ancestor)).toBeTruthy();
-          return;
-        }
+        const entityID = entityIDSafeVersion(event);
+        if (entityID) {
+          const ancestor = tree.ancestry.get(entityID);
+          if (ancestor) {
+            expect(eventInNode(event, ancestor)).toBeTruthy();
+            return;
+          }
 
-        const children = tree.children.get(event.process.entity_id);
-        if (children) {
-          expect(eventInNode(event, children)).toBeTruthy();
+          const children = tree.children.get(entityID);
+          if (children) {
+            expect(eventInNode(event, children)).toBeTruthy();
+          }
         }
       });
     });
@@ -351,9 +359,8 @@ describe('data generator', () => {
     let events: Event[];
 
     const isCategoryProcess = (event: Event) => {
-      return (
-        _.isEqual(event.event.category, ['process']) || _.isEqual(event.event.category, 'process')
-      );
+      const category = values(event.event?.category);
+      return _.isEqual(category, ['process']);
     };
 
     beforeEach(() => {
@@ -366,12 +373,16 @@ describe('data generator', () => {
 
     it('with n-1 process events', () => {
       for (let i = events.length - 2; i > 0; ) {
-        const parentEntityIdOfChild = events[i].process.parent?.entity_id;
-        for (; --i >= -1 && (events[i].event.kind !== 'event' || !isCategoryProcess(events[i])); ) {
+        const parentEntityIdOfChild = parentEntityIDSafeVersion(events[i]);
+        for (
+          ;
+          --i >= -1 && (events[i].event?.kind !== 'event' || !isCategoryProcess(events[i]));
+
+        ) {
           // related event - skip it
         }
         expect(i).toBeGreaterThanOrEqual(0);
-        expect(parentEntityIdOfChild).toEqual(events[i].process.entity_id);
+        expect(parentEntityIdOfChild).toEqual(entityIDSafeVersion(events[i]));
       }
     });
 
@@ -380,7 +391,7 @@ describe('data generator', () => {
       for (
         ;
         previousProcessEventIndex >= -1 &&
-        (events[previousProcessEventIndex].event.kind !== 'event' ||
+        (events[previousProcessEventIndex].event?.kind !== 'event' ||
           !isCategoryProcess(events[previousProcessEventIndex]));
         previousProcessEventIndex--
       ) {
@@ -388,14 +399,14 @@ describe('data generator', () => {
       }
       expect(previousProcessEventIndex).toBeGreaterThanOrEqual(0);
       // The alert should be last and have the same entity_id as the previous process event
-      expect(events[events.length - 1].process.entity_id).toEqual(
-        events[previousProcessEventIndex].process.entity_id
+      expect(events[events.length - 1].process?.entity_id).toEqual(
+        events[previousProcessEventIndex].process?.entity_id
       );
-      expect(events[events.length - 1].process.parent?.entity_id).toEqual(
-        events[previousProcessEventIndex].process.parent?.entity_id
+      expect(events[events.length - 1].process?.parent?.entity_id).toEqual(
+        events[previousProcessEventIndex].process?.parent?.entity_id
       );
-      expect(events[events.length - 1].event.kind).toEqual('alert');
-      expect(events[events.length - 1].event.category).toEqual('malware');
+      expect(events[events.length - 1].event?.kind).toEqual('alert');
+      expect(events[events.length - 1].event?.category).toEqual('malware');
     });
   });
 
@@ -403,14 +414,17 @@ describe('data generator', () => {
     // First pass we gather up all the events by entity_id
     const tree: Record<string, Node> = {};
     events.forEach((event) => {
-      if (event.process.entity_id in tree) {
-        tree[event.process.entity_id].events.push(event);
-      } else {
-        tree[event.process.entity_id] = {
-          events: [event],
-          children: [],
-          parent_entity_id: event.process.parent?.entity_id,
-        };
+      const entityID = entityIDSafeVersion(event);
+      if (entityID) {
+        if (entityID in tree) {
+          tree[entityID].events.push(event);
+        } else {
+          tree[entityID] = {
+            events: [event],
+            children: [],
+            parent_entity_id: parentEntityIDSafeVersion(event),
+          };
+        }
       }
     });
     // Second pass add child references to each node
@@ -419,8 +433,14 @@ describe('data generator', () => {
         tree[value.parent_entity_id].children.push(value);
       }
     }
+
+    const entityID = entityIDSafeVersion(events[0]);
+    if (!entityID) {
+      throw new Error('entity id was invalid');
+    }
+
     // The root node must be first in the array or this fails
-    return tree[events[0].process.entity_id];
+    return tree[entityID];
   }
 
   function countResolverEvents(rootNode: Node, generations: number): number {
diff --git a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
index e1ff34463d215..7f31c71fe712b 100644
--- a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
@@ -7,7 +7,6 @@ import uuid from 'uuid';
 import seedrandom from 'seedrandom';
 import {
   AlertEvent,
-  EndpointEvent,
   EndpointStatus,
   Host,
   HostMetadata,
@@ -15,9 +14,15 @@ import {
   HostPolicyResponseActionStatus,
   OSFields,
   PolicyData,
+  SafeEndpointEvent,
 } from './types';
 import { factory as policyFactory } from './models/policy_config';
-import { parentEntityId } from './models/event';
+import {
+  ancestryArray,
+  entityIDSafeVersion,
+  parentEntityIDSafeVersion,
+  timestampSafeVersion,
+} from './models/event';
 import {
   GetAgentPoliciesResponseItem,
   GetPackagesResponse,
@@ -28,8 +33,9 @@ import {
   InstallationStatus,
   KibanaAssetReference,
 } from '../../../ingest_manager/common/types/models';
+import { firstNonNullValue } from './models/ecs_safety_helpers';
 
-export type Event = AlertEvent | EndpointEvent;
+export type Event = AlertEvent | SafeEndpointEvent;
 /**
  * This value indicates the limit for the size of the ancestry array. The endpoint currently saves up to 20 values
  * in its messages. To simulate a limit on the array size I'm using 2 here so that we can't rely on there being a large
@@ -426,13 +432,13 @@ export class EndpointDocGenerator {
    * @param ts - Timestamp to put in the event
    * @param entityID - entityID of the originating process
    * @param parentEntityID - optional entityID of the parent process, if it exists
-   * @param ancestryArray - an array of ancestors for the generated alert
+   * @param ancestry - an array of ancestors for the generated alert
    */
   public generateAlert(
     ts = new Date().getTime(),
     entityID = this.randomString(10),
     parentEntityID?: string,
-    ancestryArray: string[] = []
+    ancestry: string[] = []
   ): AlertEvent {
     return {
       ...this.commonInfo,
@@ -493,7 +499,7 @@ export class EndpointDocGenerator {
           sha256: 'fake sha256',
         },
         Ext: {
-          ancestry: ancestryArray,
+          ancestry,
           code_signature: [
             {
               trusted: false,
@@ -555,7 +561,7 @@ export class EndpointDocGenerator {
    * Creates an event, customized by the options parameter
    * @param options - Allows event field values to be specified
    */
-  public generateEvent(options: EventOptions = {}): EndpointEvent {
+  public generateEvent(options: EventOptions = {}): Event {
     // this will default to an empty array for the ancestry field if options.ancestry isn't included
     const ancestry: string[] =
       options.ancestry?.slice(0, options?.ancestryArrayLimit ?? ANCESTRY_LIMIT) ?? [];
@@ -643,7 +649,11 @@ export class EndpointDocGenerator {
   public generateTree(options: TreeOptions = {}): Tree {
     const optionsWithDef = getTreeOptionsWithDef(options);
     const addEventToMap = (nodeMap: Map<string, TreeNode>, event: Event) => {
-      const nodeId = event.process.entity_id;
+      const nodeId = entityIDSafeVersion(event);
+      if (!nodeId) {
+        return nodeMap;
+      }
+
       // if a node already exists for the entity_id we'll use that one, otherwise let's create a new empty node
       // and add the event to the right array.
       let node = nodeMap.get(nodeId);
@@ -652,18 +662,13 @@ export class EndpointDocGenerator {
       }
 
       // place the event in the right array depending on its category
-      if (event.event.kind === 'event') {
-        if (
-          (Array.isArray(event.event.category) &&
-            event.event.category.length === 1 &&
-            event.event.category[0] === 'process') ||
-          event.event.category === 'process'
-        ) {
+      if (firstNonNullValue(event.event?.kind) === 'event') {
+        if (firstNonNullValue(event.event?.category) === 'process') {
           node.lifecycle.push(event);
         } else {
           node.relatedEvents.push(event);
         }
-      } else if (event.event.kind === 'alert') {
+      } else if (firstNonNullValue(event.event?.kind) === 'alert') {
         node.relatedAlerts.push(event);
       }
 
@@ -673,7 +678,7 @@ export class EndpointDocGenerator {
     const groupNodesByParent = (children: Map<string, TreeNode>) => {
       const nodesByParent: Map<string, Map<string, TreeNode>> = new Map();
       for (const node of children.values()) {
-        const parentID = parentEntityId(node.lifecycle[0]);
+        const parentID = parentEntityIDSafeVersion(node.lifecycle[0]);
         if (parentID) {
           let groupedNodes = nodesByParent.get(parentID);
 
@@ -715,9 +720,13 @@ export class EndpointDocGenerator {
     const ancestryNodes: Map<string, TreeNode> = ancestry.reduce(addEventToMap, new Map());
 
     const alert = ancestry[ancestry.length - 1];
-    const origin = ancestryNodes.get(alert.process.entity_id);
+    const alertEntityID = entityIDSafeVersion(alert);
+    if (!alertEntityID) {
+      throw Error("could not find the originating alert's entity id");
+    }
+    const origin = ancestryNodes.get(alertEntityID);
     if (!origin) {
-      throw Error(`could not find origin while building tree: ${alert.process.entity_id}`);
+      throw Error(`could not find origin while building tree: ${alertEntityID}`);
     }
 
     const children = Array.from(this.descendantsTreeGenerator(alert, optionsWithDef));
@@ -799,7 +808,7 @@ export class EndpointDocGenerator {
     });
     events.push(root);
     let ancestor = root;
-    let timestamp = root['@timestamp'] + 1000;
+    let timestamp = (timestampSafeVersion(root) ?? 0) + 1000;
 
     const addRelatedAlerts = (
       node: Event,
@@ -836,8 +845,8 @@ export class EndpointDocGenerator {
       events.push(
         this.generateEvent({
           timestamp: timestamp + termProcessDuration * 1000,
-          entityID: root.process.entity_id,
-          parentEntityID: root.process.parent?.entity_id,
+          entityID: entityIDSafeVersion(root),
+          parentEntityID: parentEntityIDSafeVersion(root),
           eventCategory: ['process'],
           eventType: ['end'],
         })
@@ -845,13 +854,20 @@ export class EndpointDocGenerator {
     }
 
     for (let i = 0; i < opts.ancestors; i++) {
+      const ancestorEntityID = entityIDSafeVersion(ancestor);
+      const ancestry: string[] = [];
+      if (ancestorEntityID) {
+        ancestry.push(ancestorEntityID);
+      }
+
+      ancestry.push(...(ancestryArray(ancestor) ?? []));
       ancestor = this.generateEvent({
         timestamp,
-        parentEntityID: ancestor.process.entity_id,
+        parentEntityID: entityIDSafeVersion(ancestor),
         // add the parent to the ancestry array
-        ancestry: [ancestor.process.entity_id, ...(ancestor.process.Ext?.ancestry ?? [])],
+        ancestry,
         ancestryArrayLimit: opts.ancestryArraySize,
-        parentPid: ancestor.process.pid,
+        parentPid: firstNonNullValue(ancestor.process?.pid),
         pid: this.randomN(5000),
       });
       events.push(ancestor);
@@ -862,11 +878,11 @@ export class EndpointDocGenerator {
         events.push(
           this.generateEvent({
             timestamp: timestamp + termProcessDuration * 1000,
-            entityID: ancestor.process.entity_id,
-            parentEntityID: ancestor.process.parent?.entity_id,
+            entityID: entityIDSafeVersion(ancestor),
+            parentEntityID: parentEntityIDSafeVersion(ancestor),
             eventCategory: ['process'],
             eventType: ['end'],
-            ancestry: ancestor.process.Ext?.ancestry,
+            ancestry: ancestryArray(ancestor),
             ancestryArrayLimit: opts.ancestryArraySize,
           })
         );
@@ -890,9 +906,9 @@ export class EndpointDocGenerator {
     events.push(
       this.generateAlert(
         timestamp,
-        ancestor.process.entity_id,
-        ancestor.process.parent?.entity_id,
-        ancestor.process.Ext?.ancestry
+        entityIDSafeVersion(ancestor),
+        parentEntityIDSafeVersion(ancestor),
+        ancestryArray(ancestor)
       )
     );
     return events;
@@ -922,7 +938,7 @@ export class EndpointDocGenerator {
       maxChildren,
     };
     const lineage: NodeState[] = [rootState];
-    let timestamp = root['@timestamp'];
+    let timestamp = timestampSafeVersion(root) ?? 0;
     while (lineage.length > 0) {
       const currentState = lineage[lineage.length - 1];
       // If we get to a state node and it has made all the children, move back up a level
@@ -937,13 +953,17 @@ export class EndpointDocGenerator {
       // Otherwise, add a child and any nodes associated with it
       currentState.childrenCreated++;
       timestamp = timestamp + 1000;
+      const currentStateEntityID = entityIDSafeVersion(currentState.event);
+      const ancestry: string[] = [];
+      if (currentStateEntityID) {
+        ancestry.push(currentStateEntityID);
+      }
+      ancestry.push(...(ancestryArray(currentState.event) ?? []));
+
       const child = this.generateEvent({
         timestamp,
-        parentEntityID: currentState.event.process.entity_id,
-        ancestry: [
-          currentState.event.process.entity_id,
-          ...(currentState.event.process.Ext?.ancestry ?? []),
-        ],
+        parentEntityID: currentStateEntityID,
+        ancestry,
         ancestryArrayLimit: opts.ancestryArraySize,
       });
 
@@ -962,11 +982,11 @@ export class EndpointDocGenerator {
         processDuration = this.randomN(1000000); // This lets termination events be up to 1 million seconds after the creation event (~11 days)
         yield this.generateEvent({
           timestamp: timestamp + processDuration * 1000,
-          entityID: child.process.entity_id,
-          parentEntityID: child.process.parent?.entity_id,
+          entityID: entityIDSafeVersion(child),
+          parentEntityID: parentEntityIDSafeVersion(child),
           eventCategory: ['process'],
           eventType: ['end'],
-          ancestry: child.process.Ext?.ancestry,
+          ancestry,
           ancestryArrayLimit: opts.ancestryArraySize,
         });
       }
@@ -998,7 +1018,8 @@ export class EndpointDocGenerator {
     ordered: boolean = false
   ) {
     let relatedEventsInfo: RelatedEventInfo[];
-    let ts = node['@timestamp'] + 1;
+    const nodeTimestamp = timestampSafeVersion(node) ?? 0;
+    let ts = nodeTimestamp + 1;
     if (typeof relatedEvents === 'number') {
       relatedEventsInfo = [{ category: RelatedEventCategory.Random, count: relatedEvents }];
     } else {
@@ -1017,16 +1038,16 @@ export class EndpointDocGenerator {
         if (ordered) {
           ts += this.randomN(processDuration) * 1000;
         } else {
-          ts = node['@timestamp'] + this.randomN(processDuration) * 1000;
+          ts = nodeTimestamp + this.randomN(processDuration) * 1000;
         }
 
         yield this.generateEvent({
           timestamp: ts,
-          entityID: node.process.entity_id,
-          parentEntityID: node.process.parent?.entity_id,
+          entityID: entityIDSafeVersion(node),
+          parentEntityID: parentEntityIDSafeVersion(node),
           eventCategory: eventInfo.category,
           eventType: eventInfo.creationType,
-          ancestry: node.process.Ext?.ancestry,
+          ancestry: ancestryArray(node),
         });
       }
     }
@@ -1044,12 +1065,12 @@ export class EndpointDocGenerator {
     alertCreationTime: number = 6 * 3600
   ) {
     for (let i = 0; i < relatedAlerts; i++) {
-      const ts = node['@timestamp'] + this.randomN(alertCreationTime) * 1000;
+      const ts = (timestampSafeVersion(node) ?? 0) + this.randomN(alertCreationTime) * 1000;
       yield this.generateAlert(
         ts,
-        node.process.entity_id,
-        node.process.parent?.entity_id,
-        node.process.Ext?.ancestry
+        entityIDSafeVersion(node),
+        parentEntityIDSafeVersion(node),
+        ancestryArray(node)
       );
     }
   }
diff --git a/x-pack/plugins/security_solution/common/endpoint/index_data.ts b/x-pack/plugins/security_solution/common/endpoint/index_data.ts
index 9a61738cd84b4..b8c2fdbe65f1e 100644
--- a/x-pack/plugins/security_solution/common/endpoint/index_data.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/index_data.ts
@@ -7,6 +7,7 @@
 import { Client } from '@elastic/elasticsearch';
 import seedrandom from 'seedrandom';
 import { EndpointDocGenerator, TreeOptions, Event } from './generate_data';
+import { firstNonNullValue } from './models/ecs_safety_helpers';
 
 export async function indexHostsAndAlerts(
   client: Client,
@@ -86,7 +87,7 @@ async function indexAlerts(
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       (array: Array<Record<string, any>>, doc) => {
         let index = eventIndex;
-        if (doc.event.kind === 'alert') {
+        if (firstNonNullValue(doc.event?.kind) === 'alert') {
           index = alertIndex;
         }
         array.push({ create: { _index: index } }, doc);
diff --git a/x-pack/plugins/security_solution/common/endpoint/models/ecs_safety_helpers.ts b/x-pack/plugins/security_solution/common/endpoint/models/ecs_safety_helpers.ts
index 8b419e90a6ee9..5dc75bb707d0e 100644
--- a/x-pack/plugins/security_solution/common/endpoint/models/ecs_safety_helpers.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/models/ecs_safety_helpers.ts
@@ -46,12 +46,12 @@ export function values<T>(valueOrCollection: ECSField<T>): T[] {
   if (Array.isArray(valueOrCollection)) {
     const nonNullValues: T[] = [];
     for (const value of valueOrCollection) {
-      if (value !== null) {
+      if (value !== null && value !== undefined) {
         nonNullValues.push(value);
       }
     }
     return nonNullValues;
-  } else if (valueOrCollection !== null) {
+  } else if (valueOrCollection !== null && valueOrCollection !== undefined) {
     // if there is a single non-null value, wrap it in an array and return it.
     return [valueOrCollection];
   } else {
diff --git a/x-pack/plugins/security_solution/common/endpoint/models/event.test.ts b/x-pack/plugins/security_solution/common/endpoint/models/event.test.ts
index 6e6e0f443015b..2b0aa1601ab37 100644
--- a/x-pack/plugins/security_solution/common/endpoint/models/event.test.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/models/event.test.ts
@@ -5,7 +5,7 @@
  */
 import { EndpointDocGenerator } from '../generate_data';
 import { descriptiveName, isProcessRunning } from './event';
-import { ResolverEvent } from '../types';
+import { ResolverEvent, SafeResolverEvent } from '../types';
 
 describe('Generated documents', () => {
   let generator: EndpointDocGenerator;
@@ -17,20 +17,31 @@ describe('Generated documents', () => {
     it('returns the right name for a registry event', () => {
       const extensions = { registry: { key: `HKLM/Windows/Software/abc` } };
       const event = generator.generateEvent({ eventCategory: 'registry', extensions });
-      expect(descriptiveName(event)).toEqual({ subject: `HKLM/Windows/Software/abc` });
+      // casting to ResolverEvent here because the `descriptiveName` function is used by the frontend is still relies
+      // on the unsafe ResolverEvent type. Once it's switched over to the safe version we can remove this cast.
+      expect(descriptiveName(event as ResolverEvent)).toEqual({
+        subject: `HKLM/Windows/Software/abc`,
+      });
     });
 
     it('returns the right name for a network event', () => {
       const randomIP = `${generator.randomIP()}`;
       const extensions = { network: { direction: 'outbound', forwarded_ip: randomIP } };
       const event = generator.generateEvent({ eventCategory: 'network', extensions });
-      expect(descriptiveName(event)).toEqual({ subject: `${randomIP}`, descriptor: 'outbound' });
+      // casting to ResolverEvent here because the `descriptiveName` function is used by the frontend is still relies
+      // on the unsafe ResolverEvent type. Once it's switched over to the safe version we can remove this cast.
+      expect(descriptiveName(event as ResolverEvent)).toEqual({
+        subject: `${randomIP}`,
+        descriptor: 'outbound',
+      });
     });
 
     it('returns the right name for a file event', () => {
       const extensions = { file: { path: 'C:\\My Documents\\business\\January\\processName' } };
       const event = generator.generateEvent({ eventCategory: 'file', extensions });
-      expect(descriptiveName(event)).toEqual({
+      // casting to ResolverEvent here because the `descriptiveName` function is used by the frontend is still relies
+      // on the unsafe ResolverEvent type. Once it's switched over to the safe version we can remove this cast.
+      expect(descriptiveName(event as ResolverEvent)).toEqual({
         subject: 'C:\\My Documents\\business\\January\\processName',
       });
     });
@@ -38,27 +49,31 @@ describe('Generated documents', () => {
     it('returns the right name for a dns event', () => {
       const extensions = { dns: { question: { name: `${generator.randomIP()}` } } };
       const event = generator.generateEvent({ eventCategory: 'dns', extensions });
-      expect(descriptiveName(event)).toEqual({ subject: extensions.dns.question.name });
+      // casting to ResolverEvent here because the `descriptiveName` function is used by the frontend is still relies
+      // on the unsafe ResolverEvent type. Once it's switched over to the safe version we can remove this cast.
+      expect(descriptiveName(event as ResolverEvent)).toEqual({
+        subject: extensions.dns.question.name,
+      });
     });
   });
 
   describe('Process running events', () => {
     it('is a running event when event.type is a string', () => {
-      const event: ResolverEvent = generator.generateEvent({
+      const event: SafeResolverEvent = generator.generateEvent({
         eventType: 'start',
       });
       expect(isProcessRunning(event)).toBeTruthy();
     });
 
     it('is a running event when event.type is an array of strings', () => {
-      const event: ResolverEvent = generator.generateEvent({
+      const event: SafeResolverEvent = generator.generateEvent({
         eventType: ['start'],
       });
       expect(isProcessRunning(event)).toBeTruthy();
     });
 
     it('is a running event when event.type is an array of strings and contains start', () => {
-      let event: ResolverEvent = generator.generateEvent({
+      let event: SafeResolverEvent = generator.generateEvent({
         eventType: ['bogus', 'start', 'creation'],
       });
       expect(isProcessRunning(event)).toBeTruthy();
@@ -70,35 +85,35 @@ describe('Generated documents', () => {
     });
 
     it('is not a running event when event.type is only and end type', () => {
-      const event: ResolverEvent = generator.generateEvent({
+      const event: SafeResolverEvent = generator.generateEvent({
         eventType: ['end'],
       });
       expect(isProcessRunning(event)).toBeFalsy();
     });
 
     it('is not a running event when event.type is empty', () => {
-      const event: ResolverEvent = generator.generateEvent({
+      const event: SafeResolverEvent = generator.generateEvent({
         eventType: [],
       });
       expect(isProcessRunning(event)).toBeFalsy();
     });
 
     it('is not a running event when event.type is bogus', () => {
-      const event: ResolverEvent = generator.generateEvent({
+      const event: SafeResolverEvent = generator.generateEvent({
         eventType: ['bogus'],
       });
       expect(isProcessRunning(event)).toBeFalsy();
     });
 
     it('is a running event when event.type contains info', () => {
-      const event: ResolverEvent = generator.generateEvent({
+      const event: SafeResolverEvent = generator.generateEvent({
         eventType: ['info'],
       });
       expect(isProcessRunning(event)).toBeTruthy();
     });
 
     it('is a running event when event.type contains change', () => {
-      const event: ResolverEvent = generator.generateEvent({
+      const event: SafeResolverEvent = generator.generateEvent({
         eventType: ['bogus', 'change'],
       });
       expect(isProcessRunning(event)).toBeTruthy();
diff --git a/x-pack/plugins/security_solution/common/endpoint/models/event.ts b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
index a0e9be58911c6..07208214a641a 100644
--- a/x-pack/plugins/security_solution/common/endpoint/models/event.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
@@ -9,7 +9,7 @@ import {
   SafeResolverEvent,
   SafeLegacyEndpointEvent,
 } from '../types';
-import { firstNonNullValue } from './ecs_safety_helpers';
+import { firstNonNullValue, hasValue, values } from './ecs_safety_helpers';
 
 /*
  * Determine if a `ResolverEvent` is the legacy variety. Can be used to narrow `ResolverEvent` to `LegacyEndpointEvent`.
@@ -27,32 +27,24 @@ export function isLegacyEvent(event: ResolverEvent): event is LegacyEndpointEven
   return (event as LegacyEndpointEvent).endgame !== undefined;
 }
 
-export function isProcessRunning(event: ResolverEvent): boolean {
-  if (isLegacyEvent(event)) {
-    return (
-      event.event?.type === 'process_start' ||
-      event.event?.action === 'fork_event' ||
-      event.event?.type === 'already_running'
-    );
-  }
-
-  if (Array.isArray(event.event.type)) {
+export function isProcessRunning(event: SafeResolverEvent): boolean {
+  if (isLegacyEventSafeVersion(event)) {
     return (
-      event.event.type.includes('start') ||
-      event.event.type.includes('change') ||
-      event.event.type.includes('info')
+      hasValue(event.event?.type, 'process_start') ||
+      hasValue(event.event?.action, 'fork_event') ||
+      hasValue(event.event?.type, 'already_running')
     );
   }
 
   return (
-    event.event.type === 'start' || event.event.type === 'change' || event.event.type === 'info'
+    hasValue(event.event?.type, 'start') ||
+    hasValue(event.event?.type, 'change') ||
+    hasValue(event.event?.type, 'info')
   );
 }
 
-export function timestampSafeVersion(event: SafeResolverEvent): string | undefined | number {
-  return isLegacyEventSafeVersion(event)
-    ? firstNonNullValue(event.endgame?.timestamp_utc)
-    : firstNonNullValue(event?.['@timestamp']);
+export function timestampSafeVersion(event: SafeResolverEvent): undefined | number {
+  return firstNonNullValue(event?.['@timestamp']);
 }
 
 /**
@@ -75,11 +67,7 @@ export function timestampAsDateSafeVersion(event: SafeResolverEvent): Date | und
 }
 
 export function eventTimestamp(event: ResolverEvent): string | undefined | number {
-  if (isLegacyEvent(event)) {
-    return event.endgame.timestamp_utc;
-  } else {
-    return event['@timestamp'];
-  }
+  return event['@timestamp'];
 }
 
 export function eventName(event: ResolverEvent): string {
@@ -105,14 +93,7 @@ export function eventId(event: ResolverEvent): number | undefined | string {
   return event.event.id;
 }
 
-export function eventSequence(event: ResolverEvent): number | undefined {
-  if (isLegacyEvent(event)) {
-    return firstNonNullValue(event.endgame.serial_event_id);
-  }
-  return firstNonNullValue(event.event?.sequence);
-}
-
-export function eventSequenceSafeVersion(event: SafeResolverEvent): number | undefined {
+export function eventSequence(event: SafeResolverEvent): number | undefined {
   if (isLegacyEventSafeVersion(event)) {
     return firstNonNullValue(event.endgame.serial_event_id);
   }
@@ -156,16 +137,16 @@ export function parentEntityIDSafeVersion(event: SafeResolverEvent): string | un
   return firstNonNullValue(event.process?.parent?.entity_id);
 }
 
-export function ancestryArray(event: ResolverEvent): string[] | undefined {
-  if (isLegacyEvent(event)) {
+export function ancestryArray(event: SafeResolverEvent): string[] | undefined {
+  if (isLegacyEventSafeVersion(event)) {
     return undefined;
   }
   // this is to guard against the endpoint accidentally not sending the ancestry array
   // otherwise the request will fail when really we should just try using the parent entity id
-  return event.process.Ext?.ancestry;
+  return values(event.process?.Ext?.ancestry);
 }
 
-export function getAncestryAsArray(event: ResolverEvent | undefined): string[] {
+export function getAncestryAsArray(event: SafeResolverEvent | undefined): string[] {
   if (!event) {
     return [];
   }
@@ -175,7 +156,7 @@ export function getAncestryAsArray(event: ResolverEvent | undefined): string[] {
     return ancestors;
   }
 
-  const parentID = parentEntityId(event);
+  const parentID = parentEntityIDSafeVersion(event);
   if (parentID) {
     return [parentID];
   }
diff --git a/x-pack/plugins/security_solution/common/endpoint/types/index.ts b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
index e0bd916103a28..cc40225ec1a10 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types/index.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
@@ -112,6 +112,27 @@ export interface ResolverChildNode extends ResolverLifecycleNode {
   nextChild?: string | null;
 }
 
+/**
+ * Safe version of `ResolverChildNode`.
+ */
+export interface SafeResolverChildNode extends SafeResolverLifecycleNode {
+  /**
+   * nextChild can have 3 different states:
+   *
+   * undefined: This indicates that you should not use this node for additional queries. It does not mean that node does
+   * not have any more direct children. The node could have more direct children but to determine that, use the
+   * ResolverChildren node's nextChild.
+   *
+   * null: Indicates that we have received all the children of the node. There may be more descendants though.
+   *
+   * string: Indicates this is a leaf node and it can be used to continue querying for additional descendants
+   * using this node's entity_id
+   *
+   * For more information see the resolver docs on pagination [here](../../server/endpoint/routes/resolver/docs/README.md#L129)
+   */
+  nextChild?: string | null;
+}
+
 /**
  * The response structure for the children route. The structure is an array of nodes where each node
  * has an array of lifecycle events.
@@ -131,6 +152,24 @@ export interface ResolverChildren {
   nextChild: string | null;
 }
 
+/**
+ * Safe version of `ResolverChildren`.
+ */
+export interface SafeResolverChildren {
+  childNodes: SafeResolverChildNode[];
+  /**
+   * nextChild can have 2 different states:
+   *
+   * null: Indicates that we have received all the descendants that can be retrieved using this node. To retrieve more
+   * nodes in the tree use a cursor provided in one of the returned children. If no other cursor exists then the tree
+   * is complete.
+   *
+   * string: Indicates this node has more descendants that can be retrieved, pass this cursor in while using this node's
+   * entity_id for the request.
+   */
+  nextChild: string | null;
+}
+
 /**
  * A flattened tree representing the nodes in a resolver graph.
  */
@@ -148,6 +187,23 @@ export interface ResolverTree {
   stats: ResolverNodeStats;
 }
 
+/**
+ * Safe version of `ResolverTree`.
+ */
+export interface SafeResolverTree {
+  /**
+   * Origin of the tree. This is in the middle of the tree. Typically this would be the same
+   * process node that generated an alert.
+   */
+  entityID: string;
+  children: SafeResolverChildren;
+  relatedEvents: Omit<SafeResolverRelatedEvents, 'entityID'>;
+  relatedAlerts: Omit<ResolverRelatedAlerts, 'entityID'>;
+  ancestry: SafeResolverAncestry;
+  lifecycle: SafeResolverEvent[];
+  stats: ResolverNodeStats;
+}
+
 /**
  * The lifecycle events (start, end etc) for a node.
  */
@@ -160,6 +216,18 @@ export interface ResolverLifecycleNode {
   stats?: ResolverNodeStats;
 }
 
+/**
+ * Safe version of `ResolverLifecycleNode`.
+ */
+export interface SafeResolverLifecycleNode {
+  entityID: string;
+  lifecycle: SafeResolverEvent[];
+  /**
+   * stats are only set when the entire tree is being fetched
+   */
+  stats?: ResolverNodeStats;
+}
+
 /**
  * The response structure when searching for ancestors of a node.
  */
@@ -175,6 +243,21 @@ export interface ResolverAncestry {
   nextAncestor: string | null;
 }
 
+/**
+ * Safe version of `ResolverAncestry`.
+ */
+export interface SafeResolverAncestry {
+  /**
+   * An array of ancestors with the lifecycle events grouped together
+   */
+  ancestors: SafeResolverLifecycleNode[];
+  /**
+   * A cursor for retrieving additional ancestors for a particular node. `null` indicates that there were no additional
+   * ancestors when the request returned. More could have been ingested by ES after the fact though.
+   */
+  nextAncestor: string | null;
+}
+
 /**
  * Response structure for the related events route.
  */
@@ -198,7 +281,7 @@ export interface SafeResolverRelatedEvents {
  */
 export interface ResolverRelatedAlerts {
   entityID: string;
-  alerts: ResolverEvent[];
+  alerts: SafeResolverEvent[];
   nextAlert: string | null;
 }
 
@@ -251,152 +334,133 @@ export interface Host {
 /**
  * A record of hashes for something. Provides hashes in multiple formats. A favorite structure of the Elastic Endpoint.
  */
-interface Hashes {
+type Hashes = Partial<{
   /**
    * A hash in MD5 format.
    */
-  md5: string;
+  md5: ECSField<string>;
   /**
    * A hash in SHA-1 format.
    */
-  sha1: string;
+  sha1: ECSField<string>;
   /**
    * A hash in SHA-256 format.
    */
-  sha256: string;
-}
+  sha256: ECSField<string>;
+}>;
 
-interface MalwareClassification {
-  identifier: string;
-  score: number;
-  threshold: number;
-  version: string;
-}
+type MalwareClassification = Partial<{
+  identifier: ECSField<string>;
+  score: ECSField<number>;
+  threshold: ECSField<number>;
+  version: ECSField<string>;
+}>;
 
-interface ThreadFields {
-  id: number;
-  Ext: {
-    service_name: string;
-    start: number;
-    start_address: number;
-    start_address_module: string;
-  };
-}
+type ThreadFields = Partial<{
+  id: ECSField<number>;
+  Ext: Partial<{
+    service_name: ECSField<string>;
+    start: ECSField<number>;
+    start_address: ECSField<number>;
+    start_address_module: ECSField<string>;
+  }>;
+}>;
 
-interface DllFields {
+type DllFields = Partial<{
   hash: Hashes;
-  path: string;
-  pe: {
-    architecture: string;
-  };
-  code_signature: {
-    subject_name: string;
-    trusted: boolean;
-  };
-  Ext: {
-    compile_time: number;
+  path: ECSField<string>;
+  pe: Partial<{
+    architecture: ECSField<string>;
+  }>;
+  code_signature: Partial<{
+    subject_name: ECSField<string>;
+    trusted: ECSField<boolean>;
+  }>;
+  Ext: Partial<{
+    compile_time: ECSField<number>;
     malware_classification: MalwareClassification;
-    mapped_address: number;
-    mapped_size: number;
-  };
-}
+    mapped_address: ECSField<number>;
+    mapped_size: ECSField<number>;
+  }>;
+}>;
 
 /**
  * Describes an Alert Event.
  */
-export interface AlertEvent {
-  '@timestamp': number;
-  agent: {
-    id: string;
-    version: string;
-    type: string;
-  };
-  ecs: {
-    version: string;
-  };
-  event: {
-    id: string;
-    action: string;
-    category: string;
-    kind: string;
-    dataset: string;
-    module: string;
-    type: string;
-    sequence: number;
-  };
-  Endpoint: {
-    policy: {
-      applied: {
-        id: string;
-        status: HostPolicyResponseActionStatus;
-        name: string;
-      };
-    };
-  };
-  process: {
-    command_line?: string;
-    pid: number;
-    ppid?: number;
-    entity_id: string;
-    parent?: {
-      pid: number;
-      entity_id: string;
-    };
-    name: string;
-    hash: Hashes;
-    executable: string;
-    start: number;
-    thread?: ThreadFields[];
-    uptime: number;
-    Ext?: {
-      /*
-       * The array has a special format. The entity_ids towards the beginning of the array are closer ancestors and the
-       * values towards the end of the array are more distant ancestors (grandparents). Therefore
-       * ancestry_array[0] == process.parent.entity_id and ancestry_array[1] == process.parent.parent.entity_id
-       */
-      ancestry?: string[];
-      code_signature: Array<{
-        subject_name: string;
-        trusted: boolean;
+export type AlertEvent = Partial<{
+  event: Partial<{
+    action: ECSField<string>;
+    dataset: ECSField<string>;
+    module: ECSField<string>;
+  }>;
+  Endpoint: Partial<{
+    policy: Partial<{
+      applied: Partial<{
+        id: ECSField<string>;
+        status: ECSField<HostPolicyResponseActionStatus>;
+        name: ECSField<string>;
       }>;
-      malware_classification?: MalwareClassification;
-      token: {
-        domain: string;
-        type: string;
-        user: string;
-        sid: string;
-        integrity_level: number;
-        integrity_level_name: string;
-        privileges?: Array<{
-          description: string;
-          name: string;
-          enabled: boolean;
-        }>;
-      };
-      user: string;
-    };
-  };
-  file: {
-    owner: string;
-    name: string;
-    path: string;
-    accessed: number;
-    mtime: number;
-    created: number;
-    size: number;
-    hash: Hashes;
-    Ext: {
+    }>;
+  }>;
+  process: Partial<{
+    command_line: ECSField<string>;
+    ppid: ECSField<number>;
+    start: ECSField<number>;
+    // Using ECSField as the outer because the object is expected to be an array
+    thread: ECSField<ThreadFields>;
+    uptime: ECSField<number>;
+    Ext: Partial<{
+      // Using ECSField as the outer because the object is expected to be an array
+      code_signature: ECSField<
+        Partial<{
+          subject_name: ECSField<string>;
+          trusted: ECSField<boolean>;
+        }>
+      >;
       malware_classification: MalwareClassification;
-      temp_file_path: string;
-      code_signature: Array<{
-        trusted: boolean;
-        subject_name: string;
+      token: Partial<{
+        domain: ECSField<string>;
+        type: ECSField<string>;
+        user: ECSField<string>;
+        sid: ECSField<string>;
+        integrity_level: ECSField<number>;
+        integrity_level_name: ECSField<string>;
+        // Using ECSField as the outer because the object is expected to be an array
+        privileges: ECSField<
+          Partial<{
+            description: ECSField<string>;
+            name: ECSField<string>;
+            enabled: ECSField<boolean>;
+          }>
+        >;
       }>;
-    };
-  };
-  host: Host;
-  dll?: DllFields[];
-}
+      user: ECSField<string>;
+    }>;
+  }>;
+  file: Partial<{
+    owner: ECSField<string>;
+    name: ECSField<string>;
+    accessed: ECSField<number>;
+    mtime: ECSField<number>;
+    created: ECSField<number>;
+    size: ECSField<number>;
+    hash: Hashes;
+    Ext: Partial<{
+      malware_classification: MalwareClassification;
+      temp_file_path: ECSField<string>;
+      // Using ECSField as the outer because the object is expected to be an array
+      code_signature: ECSField<
+        Partial<{
+          trusted: ECSField<boolean>;
+          subject_name: ECSField<string>;
+        }>
+      >;
+    }>;
+  }>;
+  // Using ECSField as the outer because the object is expected to be an array
+  dll: ECSField<DllFields>;
+}> &
+  SafeEndpointEvent;
 
 /**
  * The status of the Endpoint Agent as reported by the Agent or the
@@ -585,7 +649,7 @@ export type ResolverEvent = EndpointEvent | LegacyEndpointEvent;
  * All mappings in Elasticsearch support arrays. They can also return null values or be missing. For example, a `keyword` mapping could return `null` or `[null]` or `[]` or `'hi'`, or `['hi', 'there']`. We need to handle these cases in order to avoid throwing an error.
  * When dealing with an value that comes from ES, wrap the underlying type in `ECSField`. For example, if you have a `keyword` or `text` value coming from ES, cast it to `ECSField<string>`.
  */
-export type ECSField<T> = T | null | Array<T | null>;
+export type ECSField<T> = T | null | undefined | Array<T | null>;
 
 /**
  * A more conservative version of `ResolverEvent` that treats fields as optional and use `ECSField` to type all ECS fields.
@@ -648,9 +712,7 @@ export type SafeEndpointEvent = Partial<{
       subject_name: ECSField<string>;
     }>;
     pid: ECSField<number>;
-    hash: Partial<{
-      md5: ECSField<string>;
-    }>;
+    hash: Hashes;
     parent: Partial<{
       entity_id: ECSField<string>;
       name: ECSField<string>;
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
index 79756621ef502..5ec5bb97250db 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
@@ -80,9 +80,9 @@ export const selectNumberOfRules = (numberOfRules: number) => {
 };
 
 export const sortByActivatedRules = () => {
-  cy.get(SORT_RULES_BTN).click({ force: true });
+  cy.get(SORT_RULES_BTN).contains('Activated').click({ force: true });
   waitForRulesToBeLoaded();
-  cy.get(SORT_RULES_BTN).click({ force: true });
+  cy.get(SORT_RULES_BTN).contains('Activated').click({ force: true });
   waitForRulesToBeLoaded();
 };
 
diff --git a/x-pack/plugins/security_solution/public/cases/containers/configure/mock.ts b/x-pack/plugins/security_solution/public/cases/containers/configure/mock.ts
index 9b9e978ffca4b..2fc761f4dc429 100644
--- a/x-pack/plugins/security_solution/public/cases/containers/configure/mock.ts
+++ b/x-pack/plugins/security_solution/public/cases/containers/configure/mock.ts
@@ -77,7 +77,7 @@ export const connectorsMock: Connector[] = [
     name: 'Jira',
     config: {
       apiUrl: 'https://instance.atlassian.ne',
-      casesConfiguration: {
+      incidentConfiguration: {
         mapping: [
           {
             source: 'title',
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/components/connector_flyout/index.tsx b/x-pack/plugins/security_solution/public/common/lib/connectors/components/connector_flyout/index.tsx
deleted file mode 100644
index 30e2c650a70cc..0000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/components/connector_flyout/index.tsx
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { useCallback, useEffect } from 'react';
-import { EuiFieldText, EuiFlexGroup, EuiFlexItem, EuiFormRow, EuiSpacer } from '@elastic/eui';
-
-import { isEmpty, get } from 'lodash/fp';
-
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { ActionConnectorFieldsProps } from '../../../../../../../triggers_actions_ui/public/types';
-import { FieldMapping } from '../../../../../cases/components/configure_cases/field_mapping';
-
-import { CasesConfigurationMapping } from '../../../../../cases/containers/configure/types';
-
-import * as i18n from '../../translations';
-import { ActionConnector, ConnectorFlyoutHOCProps } from '../../types';
-import { createDefaultMapping } from '../../utils';
-import { connectorsConfiguration } from '../../config';
-
-export const withConnectorFlyout = <T extends ActionConnector>({
-  ConnectorFormComponent,
-  connectorActionTypeId,
-  secretKeys = [],
-  configKeys = [],
-}: ConnectorFlyoutHOCProps<T>) => {
-  const ConnectorFlyout: React.FC<ActionConnectorFieldsProps<T>> = ({
-    action,
-    editActionConfig,
-    editActionSecrets,
-    errors,
-  }) => {
-    /* We do not provide defaults values to the fields (like empty string for apiUrl) intentionally.
-   * If we do, errors will be shown the first time the flyout is open even though the user did not
-   * interact with the form. Also, we would like to show errors for empty fields provided by the user.
-  /*/
-    const { apiUrl, casesConfiguration: { mapping = [] } = {} } = action.config;
-    const configKeysWithDefault = [...configKeys, 'apiUrl'];
-
-    const isApiUrlInvalid: boolean = errors.apiUrl.length > 0 && apiUrl != null;
-
-    /**
-     * We need to distinguish between the add flyout and the edit flyout.
-     * useEffect will run only once on component mount.
-     * This guarantees that the function below will run only once.
-     * On the first render of the component the apiUrl can be either undefined or filled.
-     * If it is filled then we are on the edit flyout. Otherwise we are on the add flyout.
-     */
-
-    useEffect(() => {
-      if (!isEmpty(apiUrl)) {
-        secretKeys.forEach((key: string) => editActionSecrets(key, ''));
-      }
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, []);
-
-    if (isEmpty(mapping)) {
-      editActionConfig('casesConfiguration', {
-        ...action.config.casesConfiguration,
-        mapping: createDefaultMapping(connectorsConfiguration[connectorActionTypeId].fields),
-      });
-    }
-
-    const handleOnChangeActionConfig = useCallback(
-      (key: string, value: string) => editActionConfig(key, value),
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      []
-    );
-
-    const handleOnBlurActionConfig = useCallback(
-      (key: string) => {
-        if (configKeysWithDefault.includes(key) && get(key, action.config) == null) {
-          editActionConfig(key, '');
-        }
-      },
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      [action.config]
-    );
-
-    const handleOnChangeSecretConfig = useCallback(
-      (key: string, value: string) => editActionSecrets(key, value),
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      []
-    );
-
-    const handleOnBlurSecretConfig = useCallback(
-      (key: string) => {
-        if (secretKeys.includes(key) && get(key, action.secrets) == null) {
-          editActionSecrets(key, '');
-        }
-      },
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      [action.secrets]
-    );
-
-    const handleOnChangeMappingConfig = useCallback(
-      (newMapping: CasesConfigurationMapping[]) =>
-        editActionConfig('casesConfiguration', {
-          ...action.config.casesConfiguration,
-          mapping: newMapping,
-        }),
-      // eslint-disable-next-line react-hooks/exhaustive-deps
-      [action.config]
-    );
-
-    return (
-      <>
-        <EuiFlexGroup>
-          <EuiFlexItem>
-            <EuiFormRow
-              id="apiUrl"
-              fullWidth
-              error={errors.apiUrl}
-              isInvalid={isApiUrlInvalid}
-              label={i18n.API_URL_LABEL}
-            >
-              <EuiFieldText
-                fullWidth
-                isInvalid={isApiUrlInvalid}
-                name="apiUrl"
-                value={apiUrl || ''} // Needed to prevent uncontrolled input error when value is undefined
-                data-test-subj="apiUrlFromInput"
-                placeholder="https://<site-url>"
-                onChange={(evt) => handleOnChangeActionConfig('apiUrl', evt.target.value)}
-                onBlur={handleOnBlurActionConfig.bind(null, 'apiUrl')}
-              />
-            </EuiFormRow>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-        <EuiSpacer size="m" />
-        <ConnectorFormComponent
-          errors={errors}
-          action={action}
-          onChangeSecret={handleOnChangeSecretConfig}
-          onBlurSecret={handleOnBlurSecretConfig}
-          onChangeConfig={handleOnChangeActionConfig}
-          onBlurConfig={handleOnBlurActionConfig}
-        />
-        <EuiSpacer size="l" />
-        <EuiFlexGroup>
-          <EuiFlexItem>
-            <FieldMapping
-              disabled={true}
-              connectorActionTypeId={connectorActionTypeId}
-              mapping={mapping as CasesConfigurationMapping[]}
-              onChangeMapping={handleOnChangeMappingConfig}
-            />
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </>
-    );
-  };
-
-  return ConnectorFlyout;
-};
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/config.ts b/x-pack/plugins/security_solution/public/common/lib/connectors/config.ts
index 9e6982ea20301..3aca186378820 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/config.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/connectors/config.ts
@@ -9,12 +9,12 @@
 import {
   ServiceNowConnectorConfiguration,
   JiraConnectorConfiguration,
+  ResilientConnectorConfiguration,
 } from '../../../../../triggers_actions_ui/public/common';
-import { connector as resilientConnectorConfig } from './resilient/config';
 import { ConnectorConfiguration } from './types';
 
 export const connectorsConfiguration: Record<string, ConnectorConfiguration> = {
   '.servicenow': ServiceNowConnectorConfiguration as ConnectorConfiguration,
   '.jira': JiraConnectorConfiguration as ConnectorConfiguration,
-  '.resilient': resilientConnectorConfig,
+  '.resilient': ResilientConnectorConfiguration as ConnectorConfiguration,
 };
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/flyout.tsx b/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/flyout.tsx
deleted file mode 100644
index 31bf0a4dfc34b..0000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/flyout.tsx
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React from 'react';
-import {
-  EuiFieldText,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiFormRow,
-  EuiFieldPassword,
-  EuiSpacer,
-} from '@elastic/eui';
-
-import * as i18n from './translations';
-import { ConnectorFlyoutFormProps } from '../types';
-import { ResilientActionConnector } from './types';
-import { withConnectorFlyout } from '../components/connector_flyout';
-
-const resilientConnectorForm: React.FC<ConnectorFlyoutFormProps<ResilientActionConnector>> = ({
-  errors,
-  action,
-  onChangeSecret,
-  onBlurSecret,
-  onChangeConfig,
-  onBlurConfig,
-}) => {
-  const { orgId } = action.config;
-  const { apiKeyId, apiKeySecret } = action.secrets;
-  const isOrgIdInvalid: boolean = errors.orgId.length > 0 && orgId != null;
-  const isApiKeyIdInvalid: boolean = errors.apiKeyId.length > 0 && apiKeyId != null;
-  const isApiKeySecretInvalid: boolean = errors.apiKeySecret.length > 0 && apiKeySecret != null;
-
-  return (
-    <>
-      <EuiFlexGroup>
-        <EuiFlexItem>
-          <EuiFormRow
-            id="connector-resilient-org-id"
-            fullWidth
-            error={errors.orgId}
-            isInvalid={isOrgIdInvalid}
-            label={i18n.RESILIENT_PROJECT_KEY_LABEL}
-          >
-            <EuiFieldText
-              fullWidth
-              isInvalid={isOrgIdInvalid}
-              name="connector-resilient-project-key"
-              value={orgId || ''} // Needed to prevent uncontrolled input error when value is undefined
-              data-test-subj="connector-resilient-project-key-form-input"
-              onChange={(evt) => onChangeConfig('orgId', evt.target.value)}
-              onBlur={() => onBlurConfig('orgId')}
-            />
-          </EuiFormRow>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      <EuiSpacer size="m" />
-      <EuiFlexGroup>
-        <EuiFlexItem>
-          <EuiFormRow
-            id="connector-resilient-apiKeyId"
-            fullWidth
-            error={errors.apiKeyId}
-            isInvalid={isApiKeyIdInvalid}
-            label={i18n.RESILIENT_API_KEY_ID_LABEL}
-          >
-            <EuiFieldText
-              fullWidth
-              isInvalid={isApiKeyIdInvalid}
-              name="connector-resilient-apiKeyId"
-              value={apiKeyId || ''} // Needed to prevent uncontrolled input error when value is undefined
-              data-test-subj="connector-resilient-apiKeyId-form-input"
-              onChange={(evt) => onChangeSecret('apiKeyId', evt.target.value)}
-              onBlur={() => onBlurSecret('apiKeyId')}
-            />
-          </EuiFormRow>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      <EuiSpacer size="m" />
-      <EuiFlexGroup>
-        <EuiFlexItem>
-          <EuiFormRow
-            id="connector-resilient-apiKeySecret"
-            fullWidth
-            error={errors.apiKeySecret}
-            isInvalid={isApiKeySecretInvalid}
-            label={i18n.RESILIENT_API_KEY_SECRET_LABEL}
-          >
-            <EuiFieldPassword
-              fullWidth
-              isInvalid={isApiKeySecretInvalid}
-              name="connector-resilient-apiKeySecret"
-              value={apiKeySecret || ''} // Needed to prevent uncontrolled input error when value is undefined
-              data-test-subj="connector-resilient-apiKeySecret-form-input"
-              onChange={(evt) => onChangeSecret('apiKeySecret', evt.target.value)}
-              onBlur={() => onBlurSecret('apiKeySecret')}
-            />
-          </EuiFormRow>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </>
-  );
-};
-
-export const resilientConnectorFlyout = withConnectorFlyout<ResilientActionConnector>({
-  ConnectorFormComponent: resilientConnectorForm,
-  secretKeys: ['apiKeyId', 'apiKeySecret'],
-  configKeys: ['orgId'],
-  connectorActionTypeId: '.resilient',
-});
-
-// eslint-disable-next-line import/no-default-export
-export { resilientConnectorFlyout as default };
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/index.tsx b/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/index.tsx
deleted file mode 100644
index ba4879e87a1f6..0000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/index.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { lazy } from 'react';
-import {
-  ValidationResult,
-  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-} from '../../../../../../triggers_actions_ui/public/types';
-
-import { connector } from './config';
-import { createActionType } from '../utils';
-import logo from './logo.svg';
-import { ResilientActionConnector } from './types';
-import * as i18n from './translations';
-
-interface Errors {
-  orgId: string[];
-  apiKeyId: string[];
-  apiKeySecret: string[];
-}
-
-const validateConnector = (action: ResilientActionConnector): ValidationResult => {
-  const errors: Errors = {
-    orgId: [],
-    apiKeyId: [],
-    apiKeySecret: [],
-  };
-
-  if (!action.config.orgId) {
-    errors.orgId = [...errors.orgId, i18n.RESILIENT_PROJECT_KEY_REQUIRED];
-  }
-
-  if (!action.secrets.apiKeyId) {
-    errors.apiKeyId = [...errors.apiKeyId, i18n.RESILIENT_API_KEY_ID_REQUIRED];
-  }
-
-  if (!action.secrets.apiKeySecret) {
-    errors.apiKeySecret = [...errors.apiKeySecret, i18n.RESILIENT_API_KEY_SECRET_REQUIRED];
-  }
-
-  return { errors };
-};
-
-export const getActionType = createActionType({
-  id: connector.id,
-  iconClass: logo,
-  selectMessage: i18n.RESILIENT_DESC,
-  actionTypeTitle: connector.name,
-  validateConnector,
-  actionConnectorFields: lazy(() => import('./flyout')),
-});
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/translations.ts b/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/translations.ts
deleted file mode 100644
index 2ff97ad354095..0000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/translations.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export * from '../translations';
-
-export const RESILIENT_DESC = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.selectMessageText',
-  {
-    defaultMessage: 'Push or update Security case data to a new issue in Resilient',
-  }
-);
-
-export const RESILIENT_TITLE = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.actionTypeTitle',
-  {
-    defaultMessage: 'IBM Resilient',
-  }
-);
-
-export const RESILIENT_PROJECT_KEY_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.orgId',
-  {
-    defaultMessage: 'Organization ID',
-  }
-);
-
-export const RESILIENT_PROJECT_KEY_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.requiredOrgIdTextField',
-  {
-    defaultMessage: 'Organization ID is required',
-  }
-);
-
-export const RESILIENT_API_KEY_ID_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.apiKeyId',
-  {
-    defaultMessage: 'API key ID',
-  }
-);
-
-export const RESILIENT_API_KEY_ID_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.requiredApiKeyIdTextField',
-  {
-    defaultMessage: 'API key ID is required',
-  }
-);
-
-export const RESILIENT_API_KEY_SECRET_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.apiKeySecret',
-  {
-    defaultMessage: 'API key secret',
-  }
-);
-
-export const RESILIENT_API_KEY_SECRET_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.resilient.requiredApiKeySecretTextField',
-  {
-    defaultMessage: 'API key secret is required',
-  }
-);
-
-export const MAPPING_FIELD_NAME = i18n.translate(
-  'xpack.securitySolution.case.configureCases.mappingFieldName',
-  {
-    defaultMessage: 'Name',
-  }
-);
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/types.ts b/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/types.ts
deleted file mode 100644
index fe6dbb2b3674a..0000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/types.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-/* eslint-disable no-restricted-imports */
-/* eslint-disable @kbn/eslint/no-restricted-paths */
-
-import {
-  ResilientPublicConfigurationType,
-  ResilientSecretConfigurationType,
-} from '../../../../../../actions/server/builtin_action_types/resilient/types';
-
-export { ResilientFieldsType } from '../../../../../../case/common/api/connectors';
-
-export * from '../types';
-
-export interface ResilientActionConnector {
-  config: ResilientPublicConfigurationType;
-  secrets: ResilientSecretConfigurationType;
-}
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/translations.ts b/x-pack/plugins/security_solution/public/common/lib/connectors/translations.ts
deleted file mode 100644
index 6dd1247d40fcb..0000000000000
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/translations.ts
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const API_URL_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.apiUrlTextFieldLabel',
-  {
-    defaultMessage: 'URL',
-  }
-);
-
-export const API_URL_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.requiredApiUrlTextField',
-  {
-    defaultMessage: 'URL is required',
-  }
-);
-
-export const API_URL_INVALID = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.invalidApiUrlTextField',
-  {
-    defaultMessage: 'URL is invalid',
-  }
-);
-
-export const USERNAME_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.usernameTextFieldLabel',
-  {
-    defaultMessage: 'Username',
-  }
-);
-
-export const USERNAME_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.requiredUsernameTextField',
-  {
-    defaultMessage: 'Username is required',
-  }
-);
-
-export const PASSWORD_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.passwordTextFieldLabel',
-  {
-    defaultMessage: 'Password',
-  }
-);
-
-export const PASSWORD_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.requiredPasswordTextField',
-  {
-    defaultMessage: 'Password is required',
-  }
-);
-
-export const API_TOKEN_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.apiTokenTextFieldLabel',
-  {
-    defaultMessage: 'API token',
-  }
-);
-
-export const API_TOKEN_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.requiredApiTokenTextField',
-  {
-    defaultMessage: 'API token is required',
-  }
-);
-
-export const EMAIL_LABEL = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.emailTextFieldLabel',
-  {
-    defaultMessage: 'Email',
-  }
-);
-
-export const EMAIL_REQUIRED = i18n.translate(
-  'xpack.securitySolution.case.connectors.common.requiredEmailTextField',
-  {
-    defaultMessage: 'Email is required',
-  }
-);
-
-export const MAPPING_FIELD_DESC = i18n.translate(
-  'xpack.securitySolution.case.configureCases.mappingFieldDescription',
-  {
-    defaultMessage: 'Description',
-  }
-);
-
-export const MAPPING_FIELD_COMMENTS = i18n.translate(
-  'xpack.securitySolution.case.configureCases.mappingFieldComments',
-  {
-    defaultMessage: 'Comments',
-  }
-);
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/types.ts b/x-pack/plugins/security_solution/public/common/lib/connectors/types.ts
index 1d688ad9b1d6a..5d83c226bfeca 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/types.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/connectors/types.ts
@@ -4,12 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-/* eslint-disable no-restricted-imports */
-/* eslint-disable @kbn/eslint/no-restricted-paths */
-
 import { ActionType } from '../../../../../triggers_actions_ui/public';
-import { IErrorObject } from '../../../../../triggers_actions_ui/public/types';
-import { ExternalIncidentServiceConfiguration } from '../../../../../actions/server/builtin_action_types/case/types';
 
 import {
   ActionType as ThirdPartySupportedActions,
@@ -29,34 +24,3 @@ export interface ConnectorConfiguration extends ActionType {
   logo: string;
   fields: Record<string, ThirdPartyField>;
 }
-
-export interface ActionConnector {
-  config: ExternalIncidentServiceConfiguration;
-  secrets: {};
-}
-
-export interface ActionConnectorParams {
-  message: string;
-}
-
-export interface ActionConnectorValidationErrors {
-  apiUrl: string[];
-}
-
-export type Optional<T, K extends keyof T> = Omit<T, K> & Partial<T>;
-
-export interface ConnectorFlyoutFormProps<T> {
-  errors: IErrorObject;
-  action: T;
-  onChangeSecret: (key: string, value: string) => void;
-  onBlurSecret: (key: string) => void;
-  onChangeConfig: (key: string, value: string) => void;
-  onBlurConfig: (key: string) => void;
-}
-
-export interface ConnectorFlyoutHOCProps<T> {
-  ConnectorFormComponent: React.FC<ConnectorFlyoutFormProps<T>>;
-  connectorActionTypeId: string;
-  configKeys?: string[];
-  secretKeys?: string[];
-}
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/utils.ts b/x-pack/plugins/security_solution/public/common/lib/connectors/utils.ts
index 6e72205c145a2..0a6dd37d9f9e2 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/utils.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/connectors/utils.ts
@@ -4,63 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  ActionTypeModel,
-  ValidationResult,
-  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-} from '../../../../../triggers_actions_ui/public/types';
-
-import {
-  ActionConnector,
-  ActionConnectorParams,
-  ActionConnectorValidationErrors,
-  Optional,
-  ThirdPartyField,
-} from './types';
-import { isUrlInvalid } from './validators';
-
-import * as i18n from './translations';
 import { CasesConfigurationMapping } from '../../../cases/containers/configure/types';
 
-export const createActionType = ({
-  id,
-  actionTypeTitle,
-  selectMessage,
-  iconClass,
-  validateConnector,
-  validateParams = connectorParamsValidator,
-  actionConnectorFields,
-  actionParamsFields = null,
-}: Optional<ActionTypeModel, 'validateParams' | 'actionParamsFields'>) => (): ActionTypeModel => {
-  return {
-    id,
-    iconClass,
-    selectMessage,
-    actionTypeTitle,
-    validateConnector: (action: ActionConnector): ValidationResult => {
-      const errors: ActionConnectorValidationErrors = {
-        apiUrl: [],
-      };
-
-      if (!action.config.apiUrl) {
-        errors.apiUrl = [...errors.apiUrl, i18n.API_URL_REQUIRED];
-      }
-
-      if (isUrlInvalid(action.config.apiUrl)) {
-        errors.apiUrl = [...errors.apiUrl, i18n.API_URL_INVALID];
-      }
-
-      return { errors: { ...errors, ...validateConnector(action).errors } };
-    },
-    validateParams,
-    actionConnectorFields,
-    actionParamsFields,
-  };
-};
-
-const connectorParamsValidator = (actionParams: ActionConnectorParams): ValidationResult => {
-  return { errors: {} };
-};
+import { ThirdPartyField } from './types';
 
 export const createDefaultMapping = (
   fields: Record<string, ThirdPartyField>
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx
index 8fd3f648bc812..bfb23ff6af6a0 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/all_rules_tables/index.tsx
@@ -20,7 +20,7 @@ import {
   RulesColumns,
   RuleStatusRowItemType,
 } from '../../../pages/detection_engine/rules/all/columns';
-import { Rule, Rules } from '../../../containers/detection_engine/rules/types';
+import { Rule, Rules, RulesSortingFields } from '../../../containers/detection_engine/rules/types';
 import { AllRulesTabs } from '../../../pages/detection_engine/rules/all';
 
 // EuiBasicTable give me a hardtime with adding the ref attributes so I went the easy way
@@ -30,7 +30,7 @@ const MyEuiBasicTable = styled(EuiBasicTable as any)`` as any;
 
 export interface SortingType {
   sort: {
-    field: 'enabled';
+    field: RulesSortingFields;
     direction: Direction;
   };
 }
@@ -48,12 +48,7 @@ interface AllRulesTablesProps {
   rules: Rules;
   rulesColumns: RulesColumns[];
   rulesStatuses: RuleStatusRowItemType[];
-  sorting: {
-    sort: {
-      field: 'enabled';
-      direction: Direction;
-    };
-  };
+  sorting: SortingType;
   tableOnChangeCallback: ({ page, sort }: EuiBasicTableOnChange) => void;
   tableRef?: React.MutableRefObject<EuiBasicTable | undefined>;
   selectedTab: AllRulesTabs;
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/__snapshots__/index.test.tsx.snap
index 1ed55774f935f..4d21a983c9707 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/__snapshots__/index.test.tsx.snap
@@ -40,7 +40,7 @@ exports[`RuleActionsOverflow snapshots renders correctly against snapshot 1`] =
             icon="copy"
             onClick={[Function]}
           >
-            Duplicate rule…
+            Duplicate rule
           </EuiContextMenuItem>,
           <EuiContextMenuItem
             data-test-subj="rules-details-export-rule"
@@ -56,7 +56,7 @@ exports[`RuleActionsOverflow snapshots renders correctly against snapshot 1`] =
             icon="trash"
             onClick={[Function]}
           >
-            Delete rule…
+            Delete rule
           </EuiContextMenuItem>,
         ]
       }
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
index cd1ded544cfe5..2a15cf7b95ceb 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts
@@ -202,7 +202,7 @@ describe('Detections Rules API', () => {
       expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/rules/_find', {
         method: 'GET',
         query: {
-          filter: 'alert.attributes.tags: "hello" AND alert.attributes.tags: "world"',
+          filter: 'alert.attributes.tags: "hello" OR alert.attributes.tags: "world"',
           page: 1,
           per_page: 20,
           sort_field: 'enabled',
@@ -297,7 +297,7 @@ describe('Detections Rules API', () => {
         method: 'GET',
         query: {
           filter:
-            'alert.attributes.name: ruleName AND alert.attributes.tags: "__internal_immutable:false" AND alert.attributes.tags: "__internal_immutable:true" AND alert.attributes.tags: "hello" AND alert.attributes.tags: "world"',
+            'alert.attributes.name: ruleName AND alert.attributes.tags: "__internal_immutable:false" AND alert.attributes.tags: "__internal_immutable:true" AND (alert.attributes.tags: "hello" OR alert.attributes.tags: "world")',
           page: 1,
           per_page: 20,
           sort_field: 'enabled',
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
index e254516d11076..b66154fbb57d2 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts
@@ -107,7 +107,7 @@ export const fetchRules = async ({
   },
   signal,
 }: FetchRulesProps): Promise<FetchRulesResponse> => {
-  const filters = [
+  const filtersWithoutTags = [
     ...(filterOptions.filter.length ? [`alert.attributes.name: ${filterOptions.filter}`] : []),
     ...(filterOptions.showCustomRules
       ? [`alert.attributes.tags: "__internal_immutable:false"`]
@@ -115,15 +115,27 @@ export const fetchRules = async ({
     ...(filterOptions.showElasticRules
       ? [`alert.attributes.tags: "__internal_immutable:true"`]
       : []),
+  ].join(' AND ');
+
+  const tags = [
     ...(filterOptions.tags?.map((t) => `alert.attributes.tags: "${t.replace(/"/g, '\\"')}"`) ?? []),
-  ];
+  ].join(' OR ');
+
+  const filterString =
+    filtersWithoutTags !== '' && tags !== ''
+      ? `${filtersWithoutTags} AND (${tags})`
+      : filtersWithoutTags + tags;
+
+  const getFieldNameForSortField = (field: string) => {
+    return field === 'name' ? `${field}.keyword` : field;
+  };
 
   const query = {
     page: pagination.page,
     per_page: pagination.perPage,
-    sort_field: filterOptions.sortField,
+    sort_field: getFieldNameForSortField(filterOptions.sortField),
     sort_order: filterOptions.sortOrder,
-    ...(filters.length ? { filter: filters.join(' AND ') } : {}),
+    ...(filterString !== '' ? { filter: filterString } : {}),
   };
 
   return KibanaServices.get().http.fetch<FetchRulesResponse>(
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
index e94e57ad82bcf..49579e893029b 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/types.ts
@@ -149,9 +149,10 @@ export interface FetchRulesProps {
   signal: AbortSignal;
 }
 
+export type RulesSortingFields = 'enabled' | 'updated_at' | 'name' | 'created_at';
 export interface FilterOptions {
   filter: string;
-  sortField: string;
+  sortField: RulesSortingFields;
   sortOrder: SortOrder;
   showCustomRules?: boolean;
   showElasticRules?: boolean;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
index ea36a0cb0b48d..866d3e896a71d 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
@@ -99,7 +99,6 @@ interface GetColumns {
   reFetchRules: (refreshPrePackagedRule?: boolean) => void;
 }
 
-// Michael: Are we able to do custom, in-table-header filters, as shown in my wireframes?
 export const getColumns = ({
   dispatch,
   dispatchToaster,
@@ -127,7 +126,8 @@ export const getColumns = ({
         </LinkAnchor>
       ),
       truncateText: true,
-      width: '24%',
+      width: '20%',
+      sortable: true,
     },
     {
       field: 'risk_score',
@@ -138,14 +138,14 @@ export const getColumns = ({
         </EuiText>
       ),
       truncateText: true,
-      width: '14%',
+      width: '10%',
     },
     {
       field: 'severity',
       name: i18n.COLUMN_SEVERITY,
       render: (value: Rule['severity']) => <SeverityBadge value={value} />,
       truncateText: true,
-      width: '16%',
+      width: '12%',
     },
     {
       field: 'status_date',
@@ -160,7 +160,7 @@ export const getColumns = ({
         );
       },
       truncateText: true,
-      width: '20%',
+      width: '14%',
     },
     {
       field: 'status',
@@ -174,9 +174,40 @@ export const getColumns = ({
           </>
         );
       },
-      width: '16%',
+      width: '12%',
       truncateText: true,
     },
+    {
+      field: 'updated_at',
+      name: i18n.COLUMN_LAST_UPDATE,
+      render: (value: Rule['updated_at']) => {
+        return value == null ? (
+          getEmptyTagValue()
+        ) : (
+          <LocalizedDateTooltip fieldName={i18n.COLUMN_LAST_UPDATE} date={new Date(value)}>
+            <FormattedRelative value={value} />
+          </LocalizedDateTooltip>
+        );
+      },
+      sortable: true,
+      truncateText: true,
+      width: '14%',
+    },
+    {
+      field: 'version',
+      name: i18n.COLUMN_VERSION,
+      render: (value: Rule['version']) => {
+        return value == null ? (
+          getEmptyTagValue()
+        ) : (
+          <EuiText data-test-subj="version" size="s">
+            {value}
+          </EuiText>
+        );
+      },
+      truncateText: true,
+      width: '10%',
+    },
     {
       field: 'tags',
       name: i18n.COLUMN_TAGS,
@@ -190,7 +221,7 @@ export const getColumns = ({
         </TruncatableText>
       ),
       truncateText: true,
-      width: '20%',
+      width: '14%',
     },
     {
       align: 'center',
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/index.tsx
index 110691328b13b..306adbd63ee72 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/index.tsx
@@ -24,6 +24,7 @@ import {
   Rule,
   PaginationOptions,
   exportRules,
+  RulesSortingFields,
 } from '../../../../containers/detection_engine/rules';
 import { HeaderSection } from '../../../../../common/components/header_section';
 import {
@@ -53,12 +54,12 @@ import { hasMlLicense } from '../../../../../../common/machine_learning/has_ml_l
 import { SecurityPageName } from '../../../../../app/types';
 import { useFormatUrl } from '../../../../../common/components/link_to';
 
-const SORT_FIELD = 'enabled';
+const INITIAL_SORT_FIELD = 'enabled';
 const initialState: State = {
   exportRuleIds: [],
   filterOptions: {
     filter: '',
-    sortField: SORT_FIELD,
+    sortField: INITIAL_SORT_FIELD,
     sortOrder: 'desc',
   },
   loadingRuleIds: [],
@@ -164,8 +165,13 @@ export const AllRules = React.memo<AllRulesProps>(
     });
 
     const sorting = useMemo(
-      (): SortingType => ({ sort: { field: 'enabled', direction: filterOptions.sortOrder } }),
-      [filterOptions.sortOrder]
+      (): SortingType => ({
+        sort: {
+          field: filterOptions.sortField,
+          direction: filterOptions.sortOrder,
+        },
+      }),
+      [filterOptions]
     );
 
     const prePackagedRuleStatus = getPrePackagedRuleStatus(
@@ -215,7 +221,7 @@ export const AllRules = React.memo<AllRulesProps>(
         dispatch({
           type: 'updateFilterOptions',
           filterOptions: {
-            sortField: SORT_FIELD, // Only enabled is supported for sorting currently
+            sortField: (sort?.field as RulesSortingFields) ?? INITIAL_SORT_FIELD, // Narrowing EuiBasicTable sorting types
             sortOrder: sort?.direction ?? 'desc',
           },
           pagination: { page: page.index + 1, perPage: page.size },
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_table_filters/tags_filter_popover.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_table_filters/tags_filter_popover.tsx
index 49fe3438664c6..4fe0bc8f835df 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_table_filters/tags_filter_popover.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/rules_table_filters/tags_filter_popover.tsx
@@ -4,7 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Dispatch, SetStateAction, useState } from 'react';
+import React, {
+  ChangeEvent,
+  Dispatch,
+  SetStateAction,
+  useCallback,
+  useEffect,
+  useMemo,
+  useState,
+} from 'react';
 import {
   EuiFilterButton,
   EuiFilterSelectItem,
@@ -13,6 +21,8 @@ import {
   EuiPanel,
   EuiPopover,
   EuiText,
+  EuiFieldSearch,
+  EuiPopoverTitle,
 } from '@elastic/eui';
 import styled from 'styled-components';
 import * as i18n from '../../translations';
@@ -37,12 +47,39 @@ const ScrollableDiv = styled.div`
  * @param tags to display for filtering
  * @param onSelectedTagsChanged change listener to be notified when tag selection changes
  */
-export const TagsFilterPopoverComponent = ({
+const TagsFilterPopoverComponent = ({
   tags,
   selectedTags,
   onSelectedTagsChanged,
 }: TagsFilterPopoverProps) => {
+  const sortedTags = useMemo(() => {
+    return tags.sort((a: string, b: string) => a.toLowerCase().localeCompare(b.toLowerCase())); // Case insensitive
+  }, [tags]);
   const [isTagPopoverOpen, setIsTagPopoverOpen] = useState(false);
+  const [searchInput, setSearchInput] = useState('');
+  const [filterTags, setFilterTags] = useState(sortedTags);
+
+  const tagsComponent = useMemo(() => {
+    return filterTags.map((tag, index) => (
+      <EuiFilterSelectItem
+        checked={selectedTags.includes(tag) ? 'on' : undefined}
+        key={`${index}-${tag}`}
+        onClick={() => toggleSelectedGroup(tag, selectedTags, onSelectedTagsChanged)}
+      >
+        {`${tag}`}
+      </EuiFilterSelectItem>
+    ));
+  }, [onSelectedTagsChanged, selectedTags, filterTags]);
+
+  const onSearchInputChange = useCallback((event: ChangeEvent<HTMLInputElement>) => {
+    setSearchInput(event.target.value);
+  }, []);
+
+  useEffect(() => {
+    setFilterTags(
+      sortedTags.filter((tag) => tag.toLowerCase().includes(searchInput.toLowerCase()))
+    );
+  }, [sortedTags, searchInput]);
 
   return (
     <EuiPopover
@@ -64,18 +101,17 @@ export const TagsFilterPopoverComponent = ({
       panelPaddingSize="none"
       repositionOnScroll
     >
-      <ScrollableDiv>
-        {tags.map((tag, index) => (
-          <EuiFilterSelectItem
-            checked={selectedTags.includes(tag) ? 'on' : undefined}
-            key={`${index}-${tag}`}
-            onClick={() => toggleSelectedGroup(tag, selectedTags, onSelectedTagsChanged)}
-          >
-            {`${tag}`}
-          </EuiFilterSelectItem>
-        ))}
-      </ScrollableDiv>
-      {tags.length === 0 && (
+      <EuiPopoverTitle>
+        <EuiFieldSearch
+          placeholder="Search tags"
+          value={searchInput}
+          onChange={onSearchInputChange}
+          isClearable
+          aria-label="Rules tag search"
+        />
+      </EuiPopoverTitle>
+      <ScrollableDiv>{tagsComponent}</ScrollableDiv>
+      {filterTags.length === 0 && (
         <EuiFlexGroup gutterSize="m" justifyContent="spaceAround">
           <EuiFlexItem grow={true}>
             <EuiPanel>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
index b20c8de8ed58b..09503fcf1ef0f 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/translations.ts
@@ -16,7 +16,7 @@ export const BACK_TO_DETECTIONS = i18n.translate(
 export const IMPORT_RULE = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.importRuleTitle',
   {
-    defaultMessage: 'Import rule…',
+    defaultMessage: 'Import rule',
   }
 );
 
@@ -100,7 +100,7 @@ export const BATCH_ACTION_ACTIVATE_SELECTED_ERROR = (totalRules: number) =>
     'xpack.securitySolution.detectionEngine.rules.allRules.batchActions.activateSelectedErrorTitle',
     {
       values: { totalRules },
-      defaultMessage: 'Error activating {totalRules, plural, =1 {rule} other {rules}}…',
+      defaultMessage: 'Error activating {totalRules, plural, =1 {rule} other {rules}}',
     }
   );
 
@@ -116,7 +116,7 @@ export const BATCH_ACTION_DEACTIVATE_SELECTED_ERROR = (totalRules: number) =>
     'xpack.securitySolution.detectionEngine.rules.allRules.batchActions.deactivateSelectedErrorTitle',
     {
       values: { totalRules },
-      defaultMessage: 'Error deactivating {totalRules, plural, =1 {rule} other {rules}}…',
+      defaultMessage: 'Error deactivating {totalRules, plural, =1 {rule} other {rules}}',
     }
   );
 
@@ -130,14 +130,14 @@ export const BATCH_ACTION_EXPORT_SELECTED = i18n.translate(
 export const BATCH_ACTION_DUPLICATE_SELECTED = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.batchActions.duplicateSelectedTitle',
   {
-    defaultMessage: 'Duplicate selected…',
+    defaultMessage: 'Duplicate selected',
   }
 );
 
 export const BATCH_ACTION_DELETE_SELECTED = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.batchActions.deleteSelectedTitle',
   {
-    defaultMessage: 'Delete selected…',
+    defaultMessage: 'Delete selected',
   }
 );
 
@@ -153,7 +153,7 @@ export const BATCH_ACTION_DELETE_SELECTED_ERROR = (totalRules: number) =>
     'xpack.securitySolution.detectionEngine.rules.allRules.batchActions.deleteSelectedErrorTitle',
     {
       values: { totalRules },
-      defaultMessage: 'Error deleting {totalRules, plural, =1 {rule} other {rules}}…',
+      defaultMessage: 'Error deleting {totalRules, plural, =1 {rule} other {rules}}',
     }
   );
 
@@ -224,7 +224,7 @@ export const DUPLICATE = i18n.translate(
 export const DUPLICATE_RULE = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.actions.duplicateRuleDescription',
   {
-    defaultMessage: 'Duplicate rule…',
+    defaultMessage: 'Duplicate rule',
   }
 );
 
@@ -241,7 +241,7 @@ export const SUCCESSFULLY_DUPLICATED_RULES = (totalRules: number) =>
 export const DUPLICATE_RULE_ERROR = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.actions.duplicateRuleErrorDescription',
   {
-    defaultMessage: 'Error duplicating rule…',
+    defaultMessage: 'Error duplicating rule',
   }
 );
 
@@ -255,7 +255,7 @@ export const EXPORT_RULE = i18n.translate(
 export const DELETE_RULE = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.actions.deleteeRuleDescription',
   {
-    defaultMessage: 'Delete rule…',
+    defaultMessage: 'Delete rule',
   }
 );
 
@@ -287,6 +287,13 @@ export const COLUMN_LAST_COMPLETE_RUN = i18n.translate(
   }
 );
 
+export const COLUMN_LAST_UPDATE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.rules.allRules.columns.lastUpdateTitle',
+  {
+    defaultMessage: 'Last updated',
+  }
+);
+
 export const COLUMN_LAST_RESPONSE = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.columns.lastResponseTitle',
   {
@@ -294,6 +301,13 @@ export const COLUMN_LAST_RESPONSE = i18n.translate(
   }
 );
 
+export const COLUMN_VERSION = i18n.translate(
+  'xpack.securitySolution.detectionEngine.rules.allRules.columns.versionTitle',
+  {
+    defaultMessage: 'Version',
+  }
+);
+
 export const COLUMN_TAGS = i18n.translate(
   'xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle',
   {
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/models/index_pattern.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/models/index_pattern.ts
new file mode 100644
index 0000000000000..064a591d0f3fa
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/models/index_pattern.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { all } from 'deepmerge';
+import { IIndexPattern } from '../../../../../../../../src/plugins/data/common';
+import { Immutable } from '../../../../../common/endpoint/types';
+
+export function clone(value: IIndexPattern | Immutable<IIndexPattern>): IIndexPattern {
+  return all([value]) as IIndexPattern;
+}
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
index 5f36af2a2d8ea..84d09adfc295e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
@@ -13,6 +13,7 @@ import { ServerApiError } from '../../../../common/types';
 import { GetPolicyListResponse } from '../../policy/types';
 import { GetPackagesResponse } from '../../../../../../ingest_manager/common';
 import { EndpointState } from '../types';
+import { IIndexPattern } from '../../../../../../../../src/plugins/data/public';
 
 interface ServerReturnedEndpointList {
   type: 'serverReturnedEndpointList';
@@ -86,6 +87,15 @@ interface ServerReturnedEndpointExistValue {
   payload: boolean;
 }
 
+interface ServerReturnedMetadataPatterns {
+  type: 'serverReturnedMetadataPatterns';
+  payload: IIndexPattern[];
+}
+
+interface ServerFailedToReturnMetadataPatterns {
+  type: 'serverFailedToReturnMetadataPatterns';
+  payload: ServerApiError;
+}
 interface UserUpdatedEndpointListRefreshOptions {
   type: 'userUpdatedEndpointListRefreshOptions';
   payload: {
@@ -112,6 +122,8 @@ export type EndpointAction =
   | ServerReturnedEndpointExistValue
   | ServerCancelledPolicyItemsLoading
   | ServerReturnedEndpointPackageInfo
+  | ServerReturnedMetadataPatterns
+  | ServerFailedToReturnMetadataPatterns
   | AppRequestedEndpointList
   | ServerReturnedEndpointNonExistingPolicies
   | UserUpdatedEndpointListRefreshOptions;
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts
index 0fd970f4bed12..b4e00319485e9 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/endpoint_pagination.test.ts
@@ -77,6 +77,7 @@ describe('endpoint list pagination: ', () => {
       expect(fakeHttpServices.post).toHaveBeenCalledWith('/api/endpoint/metadata', {
         body: JSON.stringify({
           paging_properties: [{ page_index: '0' }, { page_size: '10' }],
+          filters: { kql: '' },
         }),
       });
     });
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
index 3a095644b3b41..f28ae9bf55ab2 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/index.test.ts
@@ -53,6 +53,8 @@ describe('EndpointList store concerns', () => {
         endpointPackageInfo: undefined,
         nonExistingPolicies: {},
         endpointsExist: true,
+        patterns: [],
+        patternsError: undefined,
         isAutoRefreshEnabled: true,
         autoRefreshInterval: DEFAULT_POLL_INTERVAL,
       });
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
index 15e89f9771382..c4d2886f3e8e5 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.test.ts
@@ -72,6 +72,7 @@ describe('endpoint list middleware', () => {
     expect(fakeHttpServices.post).toHaveBeenCalledWith('/api/endpoint/metadata', {
       body: JSON.stringify({
         paging_properties: [{ page_index: '0' }, { page_size: '10' }],
+        filters: { kql: '' },
       }),
     });
     expect(listData(getState())).toEqual(apiResponse.hosts);
@@ -100,6 +101,7 @@ describe('endpoint list middleware', () => {
     expect(fakeHttpServices.post).toHaveBeenCalledWith('/api/endpoint/metadata', {
       body: JSON.stringify({
         paging_properties: [{ page_index: '0' }, { page_size: '10' }],
+        filters: { kql: '' },
       }),
     });
     expect(listData(getState())).toEqual(apiResponse.hosts);
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
index 2650aa4865228..5bf085023c65d 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
@@ -15,6 +15,8 @@ import {
   listData,
   endpointPackageInfo,
   nonExistingPolicies,
+  patterns,
+  searchBarQuery,
 } from './selectors';
 import { EndpointState } from '../types';
 import {
@@ -23,8 +25,24 @@ import {
   sendGetAgentPolicyList,
 } from '../../policy/store/policy_list/services/ingest';
 import { AGENT_POLICY_SAVED_OBJECT_TYPE } from '../../../../../../ingest_manager/common';
+import { metadataCurrentIndexPattern } from '../../../../../common/endpoint/constants';
+import { IIndexPattern, Query } from '../../../../../../../../src/plugins/data/public';
 
-export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState> = (coreStart) => {
+export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState> = (
+  coreStart,
+  depsStart
+) => {
+  async function fetchIndexPatterns(): Promise<IIndexPattern[]> {
+    const { indexPatterns } = depsStart.data;
+    const fields = await indexPatterns.getFieldsForWildcard({
+      pattern: metadataCurrentIndexPattern,
+    });
+    const indexPattern: IIndexPattern = {
+      title: metadataCurrentIndexPattern,
+      fields,
+    };
+    return [indexPattern];
+  }
   // eslint-disable-next-line complexity
   return ({ getState, dispatch }) => (next) => async (action) => {
     next(action);
@@ -52,10 +70,31 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
       const { page_index: pageIndex, page_size: pageSize } = uiQueryParams(getState());
       let endpointResponse;
 
+      // get index pattern and fields for search bar
+      if (patterns(getState()).length === 0) {
+        try {
+          const indexPatterns = await fetchIndexPatterns();
+          if (indexPatterns !== undefined) {
+            dispatch({
+              type: 'serverReturnedMetadataPatterns',
+              payload: indexPatterns,
+            });
+          }
+        } catch (error) {
+          dispatch({
+            type: 'serverFailedToReturnMetadataPatterns',
+            payload: error,
+          });
+        }
+      }
+
       try {
+        const decodedQuery: Query = searchBarQuery(getState());
+
         endpointResponse = await coreStart.http.post<HostResultList>('/api/endpoint/metadata', {
           body: JSON.stringify({
             paging_properties: [{ page_index: pageIndex }, { page_size: pageSize }],
+            filters: { kql: decodedQuery.query },
           }),
         });
         endpointResponse.request_page_index = Number(pageIndex);
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
index 060321fa40401..d688fa3b76b5a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/reducer.ts
@@ -31,6 +31,8 @@ export const initialEndpointListState: Immutable<EndpointState> = {
   endpointPackageInfo: undefined,
   nonExistingPolicies: {},
   endpointsExist: true,
+  patterns: [],
+  patternsError: undefined,
   isAutoRefreshEnabled: true,
   autoRefreshInterval: DEFAULT_POLL_INTERVAL,
 };
@@ -70,6 +72,18 @@ export const endpointListReducer: ImmutableReducer<EndpointState, AppAction> = (
         ...action.payload,
       },
     };
+  } else if (action.type === 'serverReturnedMetadataPatterns') {
+    // handle error case
+    return {
+      ...state,
+      patterns: action.payload,
+      patternsError: undefined,
+    };
+  } else if (action.type === 'serverFailedToReturnMetadataPatterns') {
+    return {
+      ...state,
+      patternsError: action.payload,
+    };
   } else if (action.type === 'serverReturnedEndpointDetails') {
     return {
       ...state,
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
index e8abe37cf0a88..8eefcc271794a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/selectors.ts
@@ -8,6 +8,7 @@
 import querystring from 'querystring';
 import { createSelector } from 'reselect';
 import { matchPath } from 'react-router-dom';
+import { decode } from 'rison-node';
 import {
   Immutable,
   HostPolicyResponseAppliedAction,
@@ -21,6 +22,7 @@ import {
   MANAGEMENT_DEFAULT_PAGE_SIZE,
   MANAGEMENT_ROUTING_ENDPOINTS_PATH,
 } from '../../../common/constants';
+import { Query } from '../../../../../../../../src/plugins/data/common/query/types';
 
 export const listData = (state: Immutable<EndpointState>) => state.hosts;
 
@@ -57,6 +59,13 @@ export const endpointPackageVersion = createSelector(
   (info) => info?.version ?? undefined
 );
 
+/**
+ * Returns the index patterns for the SearchBar to use for autosuggest
+ */
+export const patterns = (state: Immutable<EndpointState>) => state.patterns;
+
+export const patternsError = (state: Immutable<EndpointState>) => state.patternsError;
+
 /**
  * Returns the full policy response from the endpoint after a user modifies a policy.
  */
@@ -142,7 +151,11 @@ export const uiQueryParams: (
       const query = querystring.parse(location.search.slice(1));
       const paginationParams = extractListPaginationParams(query);
 
-      const keys: Array<keyof EndpointIndexUIQueryParams> = ['selected_endpoint', 'show'];
+      const keys: Array<keyof EndpointIndexUIQueryParams> = [
+        'selected_endpoint',
+        'show',
+        'admin_query',
+      ];
 
       for (const key of keys) {
         const value: string | undefined =
@@ -210,3 +223,27 @@ export const nonExistingPolicies: (
  */
 export const endpointsExist: (state: Immutable<EndpointState>) => boolean = (state) =>
   state.endpointsExist;
+
+/**
+ * Returns query text from query bar
+ */
+export const searchBarQuery: (state: Immutable<EndpointState>) => Query = createSelector(
+  uiQueryParams,
+  ({ admin_query: adminQuery }) => {
+    const decodedQuery: Query = { query: '', language: 'kuery' };
+    if (adminQuery) {
+      const urlDecodedQuery = (decode(adminQuery) as unknown) as Query;
+      if (urlDecodedQuery && typeof urlDecodedQuery.query === 'string') {
+        decodedQuery.query = urlDecodedQuery.query;
+      }
+      if (
+        urlDecodedQuery &&
+        typeof urlDecodedQuery.language === 'string' &&
+        (urlDecodedQuery.language === 'kuery' || urlDecodedQuery.language === 'lucene')
+      ) {
+        decodedQuery.language = urlDecodedQuery.language;
+      }
+    }
+    return decodedQuery;
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
index 5a6a1af7bd7e8..b73e60718d12e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
@@ -14,6 +14,7 @@ import {
 } from '../../../../common/endpoint/types';
 import { ServerApiError } from '../../../common/types';
 import { GetPackagesResponse } from '../../../../../ingest_manager/common';
+import { IIndexPattern } from '../../../../../../../src/plugins/data/public';
 
 export interface EndpointState {
   /** list of host **/
@@ -54,6 +55,10 @@ export interface EndpointState {
   nonExistingPolicies: Record<string, boolean>;
   /** Tracks whether hosts exist and helps control if onboarding should be visible */
   endpointsExist: boolean;
+  /** index patterns for query bar */
+  patterns: IIndexPattern[];
+  /** api error from retrieving index patters for query bar */
+  patternsError?: ServerApiError;
   /** Is auto-refresh enabled */
   isAutoRefreshEnabled: boolean;
   /** The current auto refresh interval for data in ms */
@@ -72,4 +77,6 @@ export interface EndpointIndexUIQueryParams {
   page_index?: string;
   /** show the policy response or host details */
   show?: 'policy_response' | 'details';
+  /** Query text from search bar*/
+  admin_query?: string;
 }
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/components/search_bar.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/components/search_bar.tsx
new file mode 100644
index 0000000000000..b6349a45f383d
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/components/search_bar.tsx
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useCallback, useMemo } from 'react';
+import { useHistory } from 'react-router-dom';
+import { encode, RisonValue } from 'rison-node';
+import styled from 'styled-components';
+import { Query, SearchBar, TimeHistory } from '../../../../../../../../../src/plugins/data/public';
+import { Storage } from '../../../../../../../../../src/plugins/kibana_utils/public';
+import { urlFromQueryParams } from '../url_from_query_params';
+import { useEndpointSelector } from '../hooks';
+import * as selectors from '../../store/selectors';
+import { clone } from '../../models/index_pattern';
+
+const AdminQueryBar = styled.div`
+  .globalQueryBar {
+    padding: 0;
+  }
+`;
+
+export const AdminSearchBar = memo(() => {
+  const history = useHistory();
+  const queryParams = useEndpointSelector(selectors.uiQueryParams);
+  const searchBarIndexPatterns = useEndpointSelector(selectors.patterns);
+  const searchBarQuery = useEndpointSelector(selectors.searchBarQuery);
+  const clonedIndexPatterns = useMemo(
+    () => searchBarIndexPatterns.map((pattern) => clone(pattern)),
+    [searchBarIndexPatterns]
+  );
+
+  const onQuerySubmit = useCallback(
+    (params: { query?: Query }) => {
+      history.push(
+        urlFromQueryParams({
+          ...queryParams,
+          admin_query: encode((params.query as unknown) as RisonValue),
+        })
+      );
+    },
+    [history, queryParams]
+  );
+
+  const timeHistory = useMemo(() => new TimeHistory(new Storage(localStorage)), []);
+
+  return (
+    <div>
+      {searchBarIndexPatterns && searchBarIndexPatterns.length > 0 && (
+        <AdminQueryBar>
+          <SearchBar
+            dataTestSubj="adminSearchBar"
+            query={searchBarQuery}
+            indexPatterns={clonedIndexPatterns}
+            timeHistory={timeHistory}
+            onQuerySubmit={onQuerySubmit}
+            isLoading={false}
+            showFilterBar={false}
+            showDatePicker={false}
+            showQueryBar={true}
+            showQueryInput={true}
+          />
+        </AdminQueryBar>
+      )}
+    </div>
+  );
+});
+
+AdminSearchBar.displayName = 'AdminSearchBar';
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
index a569c4f02604b..378f3cc4cb316 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
@@ -16,6 +16,8 @@ import {
   EuiSelectableProps,
   EuiSuperDatePicker,
   EuiSpacer,
+  EuiFlexGroup,
+  EuiFlexItem,
 } from '@elastic/eui';
 import { useHistory } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
@@ -46,6 +48,7 @@ import { getEndpointListPath, getEndpointDetailsPath } from '../../../common/rou
 import { useFormatUrl } from '../../../../common/components/link_to';
 import { EndpointAction } from '../store/action';
 import { EndpointPolicyLink } from './components/endpoint_policy_link';
+import { AdminSearchBar } from './components/search_bar';
 import { AdministrationListPage } from '../../../components/administration_list_page';
 
 const EndpointListNavLink = memo<{
@@ -89,6 +92,7 @@ export const EndpointList = () => {
     endpointsExist,
     autoRefreshInterval,
     isAutoRefreshEnabled,
+    patternsError,
   } = useEndpointSelector(selector);
   const { formatUrl, search } = useFormatUrl(SecurityPageName.administration);
 
@@ -397,16 +401,16 @@ export const EndpointList = () => {
   const hasListData = listData && listData.length > 0;
 
   const refreshStyle = useMemo(() => {
-    return { display: hasListData ? 'flex' : 'none', maxWidth: 200 };
-  }, [hasListData]);
+    return { display: endpointsExist ? 'flex' : 'none', maxWidth: 200 };
+  }, [endpointsExist]);
 
   const refreshIsPaused = useMemo(() => {
-    return !hasListData ? false : hasSelectedEndpoint ? true : !isAutoRefreshEnabled;
-  }, [hasListData, hasSelectedEndpoint, isAutoRefreshEnabled]);
+    return !endpointsExist ? false : hasSelectedEndpoint ? true : !isAutoRefreshEnabled;
+  }, [endpointsExist, hasSelectedEndpoint, isAutoRefreshEnabled]);
 
   const refreshInterval = useMemo(() => {
-    return !hasListData ? DEFAULT_POLL_INTERVAL : autoRefreshInterval;
-  }, [hasListData, autoRefreshInterval]);
+    return !endpointsExist ? DEFAULT_POLL_INTERVAL : autoRefreshInterval;
+  }, [endpointsExist, autoRefreshInterval]);
 
   return (
     <AdministrationListPage
@@ -426,9 +430,14 @@ export const EndpointList = () => {
       }
     >
       {hasSelectedEndpoint && <EndpointDetailsFlyout />}
-      {
-        <>
-          <div style={refreshStyle}>
+      <>
+        <EuiFlexGroup>
+          {endpointsExist && !patternsError && (
+            <EuiFlexItem>
+              <AdminSearchBar />
+            </EuiFlexItem>
+          )}
+          <EuiFlexItem grow={false} style={refreshStyle}>
             <EuiSuperDatePicker
               onTimeChange={NOOP}
               isDisabled={hasSelectedEndpoint}
@@ -438,10 +447,10 @@ export const EndpointList = () => {
               onRefreshChange={onRefreshChange}
               isAutoRefreshOnly={true}
             />
-          </div>
-          <EuiSpacer size="m" />
-        </>
-      }
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        <EuiSpacer size="m" />
+      </>
       {hasListData && (
         <>
           <EuiText color="subdued" size="xs" data-test-subj="endpointListTableTotal">
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index 10bbbbfa72719..9b4eb6a25d1e5 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -21,7 +21,6 @@ import {
 import { Storage } from '../../../../src/plugins/kibana_utils/public';
 import { initTelemetry } from './common/lib/telemetry';
 import { KibanaServices } from './common/lib/kibana/services';
-import { resilientActionType } from './common/lib/connectors';
 import {
   PluginSetup,
   PluginStart,
@@ -96,8 +95,6 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       });
     }
 
-    plugins.triggers_actions_ui.actionTypeRegistry.register(resilientActionType());
-
     const mountSecurityFactory = async () => {
       const storage = new Storage(localStorage);
       const [coreStart, startPlugins] = await core.getStartServices();
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
index db8d047c2ce86..fc0d646fd62ca 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
@@ -212,6 +212,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:0:1",
       },
       "points": Array [
@@ -227,6 +231,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:0:2",
       },
       "points": Array [
@@ -242,6 +250,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:0:8",
       },
       "points": Array [
@@ -287,6 +299,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:1:3",
       },
       "points": Array [
@@ -302,6 +318,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:1:4",
       },
       "points": Array [
@@ -347,6 +367,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:2:5",
       },
       "points": Array [
@@ -362,6 +386,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:2:6",
       },
       "points": Array [
@@ -377,6 +405,10 @@ Object {
     },
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:6:7",
       },
       "points": Array [
@@ -584,6 +616,10 @@ Object {
   "edgeLineSegments": Array [
     Object {
       "metadata": Object {
+        "elapsedTime": Object {
+          "duration": "<1",
+          "durationType": "millisecond",
+        },
         "uniqueId": "edge:0:1",
       },
       "points": Array [
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts b/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts
index e6e525334e818..1e2de06ea4af5 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/reducer.test.ts
@@ -10,8 +10,9 @@ import { dataReducer } from './reducer';
 import * as selectors from './selectors';
 import { DataState } from '../../types';
 import { DataAction } from './action';
-import { ResolverChildNode, ResolverTree } from '../../../../common/endpoint/types';
+import { ResolverChildNode, ResolverEvent, ResolverTree } from '../../../../common/endpoint/types';
 import * as eventModel from '../../../../common/endpoint/models/event';
+import { values } from '../../../../common/endpoint/models/ecs_safety_helpers';
 import { mockTreeFetcherParameters } from '../../mocks/tree_fetcher_parameters';
 
 /**
@@ -40,7 +41,9 @@ describe('Resolver Data Middleware', () => {
       // Generate a 'tree' using the Resolver generator code. This structure isn't the same as what the API returns.
       const baseTree = generateBaseTree();
       const tree = mockResolverTree({
-        events: baseTree.allEvents,
+        // Casting here because the generator returns the SafeResolverEvent type which isn't yet compatible with
+        // a lot of the frontend functions. So casting it back to the unsafe type for now.
+        events: baseTree.allEvents as ResolverEvent[],
         cursors: {
           childrenNextChild: 'aValidChildCursor',
           ancestryNextAncestor: 'aValidAncestorCursor',
@@ -89,7 +92,9 @@ describe('Resolver Data Middleware', () => {
           type: 'serverReturnedRelatedEventData',
           payload: {
             entityID: firstChildNodeInTree.id,
-            events: firstChildNodeInTree.relatedEvents,
+            // Casting here because the generator returns the SafeResolverEvent type which isn't yet compatible with
+            // a lot of the frontend functions. So casting it back to the unsafe type for now.
+            events: firstChildNodeInTree.relatedEvents as ResolverEvent[],
             nextEvent: null,
           },
         };
@@ -162,7 +167,9 @@ describe('Resolver Data Middleware', () => {
             type: 'serverReturnedRelatedEventData',
             payload: {
               entityID: firstChildNodeInTree.id,
-              events: firstChildNodeInTree.relatedEvents,
+              // Casting here because the generator returns the SafeResolverEvent type which isn't yet compatible with
+              // a lot of the frontend functions. So casting it back to the unsafe type for now.
+              events: firstChildNodeInTree.relatedEvents as ResolverEvent[],
               nextEvent: 'aValidNextEventCursor',
             },
           };
@@ -232,7 +239,9 @@ function mockedTree() {
   const statsResults = compileStatsForChild(firstChildNodeInTree);
 
   const tree = mockResolverTree({
-    events: baseTree.allEvents,
+    // Casting here because the generator returns the SafeResolverEvent type which isn't yet compatible with
+    // a lot of the frontend functions. So casting it back to the unsafe type for now.
+    events: baseTree.allEvents as ResolverEvent[],
     /**
      * Calculate children from the ResolverTree response using the children of the `Tree` we generated using the Resolver data generator code.
      * Compile (and attach) stats to the first child node.
@@ -243,14 +252,15 @@ function mockedTree() {
      * related event limits should be shown.
      */
     children: [...baseTree.children.values()].map((node: TreeNode) => {
-      // Treat each `TreeNode` as a `ResolverChildNode`.
-      // These types are almost close enough to be used interchangably (for the purposes of this test.)
-      const childNode: Partial<ResolverChildNode> = node;
+      const childNode: Partial<ResolverChildNode> = {};
+      // Casting here because the generator returns the SafeResolverEvent type which isn't yet compatible with
+      // a lot of the frontend functions. So casting it back to the unsafe type for now.
+      childNode.lifecycle = node.lifecycle as ResolverEvent[];
 
       // `TreeNode` has `id` which is the same as `entityID`.
       // The `ResolverChildNode` calls the entityID as `entityID`.
       // Set `entityID` on `childNode` since the code in test relies on it.
-      childNode.entityID = (childNode as TreeNode).id;
+      childNode.entityID = node.id;
 
       // This should only be true for the first child.
       if (node.id === firstChildNodeInTree.id) {
@@ -315,10 +325,8 @@ function compileStatsForChild(
 
   const compiledStats = node.relatedEvents.reduce(
     (counts: Record<string, number>, relatedEvent) => {
-      // `relatedEvent.event.category` is `string | string[]`.
-      // Wrap it in an array and flatten that array to get a `string[] | [string]`
-      // which we can loop over.
-      const categories: string[] = [relatedEvent.event.category].flat();
+      // get an array of categories regardless of whether category is a string or string[]
+      const categories: string[] = values(relatedEvent.event?.category);
 
       for (const category of categories) {
         // Set the first category as 'categoryToOverCount'
diff --git a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
index 6962d300f7072..1317c0ee94b60 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
@@ -24,7 +24,8 @@ type ResolverColorNames =
   | 'resolverBackground'
   | 'resolverEdge'
   | 'resolverEdgeText'
-  | 'resolverBreadcrumbBackground';
+  | 'resolverBreadcrumbBackground'
+  | 'pillStroke';
 
 type ColorMap = Record<ResolverColorNames, string>;
 interface NodeStyleConfig {
@@ -438,6 +439,7 @@ export const useResolverTheme = (): {
     resolverBreadcrumbBackground: theme.euiColorLightestShade,
     resolverEdgeText: getThemedOption(theme.euiColorDarkShade, theme.euiColorFullShade),
     triggerBackingFill: `${theme.euiColorDanger}${getThemedOption('0F', '1F')}`,
+    pillStroke: theme.euiColorLightShade,
   };
 
   const nodeAssets: NodeStyleMap = {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index 2aacc5f9176c4..5d7112dd1547a 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -38,6 +38,7 @@ const StyledActionsContainer = styled.div<StyledActionsContainer>`
   position: absolute;
   top: ${(props) => `${props.topPct}%`};
   width: auto;
+  pointer-events: all;
 `;
 
 interface StyledDescriptionText {
@@ -61,6 +62,11 @@ const StyledDescriptionText = styled.div<StyledDescriptionText>`
   width: fit-content;
 `;
 
+const StyledOuterGroup = styled.g`
+  fill: none;
+  pointer-events: visiblePainted;
+`;
+
 /**
  * An artifact that represents a process node and the things associated with it in the Resolver
  */
@@ -329,6 +335,7 @@ const UnstyledProcessEventDot = React.memo(
           }
           role="img"
           aria-labelledby={labelHTMLID}
+          fill="none"
           style={{
             display: 'block',
             width: '100%',
@@ -338,9 +345,10 @@ const UnstyledProcessEventDot = React.memo(
             left: '0',
             outline: 'transparent',
             border: 'none',
+            pointerEvents: 'none',
           }}
         >
-          <g>
+          <StyledOuterGroup>
             <use
               xlinkHref={`#${SymbolIds.processCubeActiveBacking}`}
               fill={backingFill} // Only visible on hover
@@ -372,7 +380,7 @@ const UnstyledProcessEventDot = React.memo(
                 ref={animationTarget}
               />
             </use>
-          </g>
+          </StyledOuterGroup>
         </svg>
         <StyledActionsContainer
           color={colorMap.full}
@@ -464,6 +472,7 @@ export const ProcessEventDot = styled(UnstyledProcessEventDot)`
   min-width: 280px;
   min-height: 90px;
   overflow-y: visible;
+  pointer-events: none;
 
   //dasharray & dashoffset should be equal to "pull" the stroke back
   //when it is transitioned.
diff --git a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
index 14d6470c95207..adff11ee94cf9 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
@@ -4,23 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-/* eslint-disable no-duplicate-imports */
-
 /* eslint-disable react/display-name */
 
 import { i18n } from '@kbn/i18n';
-import React, { useState, useMemo, useCallback, useRef, useLayoutEffect } from 'react';
-import {
-  EuiI18nNumber,
-  EuiSelectable,
-  EuiButton,
-  EuiPopover,
-  ButtonColor,
-  htmlIdGenerator,
-} from '@elastic/eui';
+import React, { useState, useCallback, useRef, useLayoutEffect, useMemo } from 'react';
+import { EuiI18nNumber, EuiButton, EuiPopover, ButtonColor } from '@elastic/eui';
 import styled from 'styled-components';
-import { EuiSelectableOption } from '@elastic/eui';
 import { Matrix3 } from '../types';
+import { useResolverTheme } from './assets';
 
 /**
  * i18n-translated titles for submenus and identifiers for display of states:
@@ -43,7 +34,7 @@ export const subMenuAssets = {
     }),
   },
 };
-const idGenerator = htmlIdGenerator();
+
 interface ResolverSubmenuOption {
   optionTitle: string;
   action: () => unknown;
@@ -52,73 +43,51 @@ interface ResolverSubmenuOption {
 
 export type ResolverSubmenuOptionList = ResolverSubmenuOption[] | string;
 
-const OptionListItem = styled.div`
-  width: 175px;
+const StyledActionButton = styled(EuiButton)`
+  &.euiButton--small {
+    height: fit-content;
+    line-height: 1;
+    padding: 0.25em;
+    font-size: 0.85rem;
+  }
 `;
 
-const OptionList = React.memo(
+/**
+ * This will be the "host button" that displays the "total number of related events" and opens
+ * the sumbmenu (with counts by category) when clicked.
+ */
+const SubButton = React.memo(
   ({
-    subMenuOptions,
-    isLoading,
+    hasMenu,
+    menuIsOpen,
+    action,
+    count,
+    title,
+    nodeID,
   }: {
-    subMenuOptions: ResolverSubmenuOptionList;
-    isLoading: boolean;
+    hasMenu: boolean;
+    menuIsOpen?: boolean;
+    action: (evt: React.MouseEvent<HTMLButtonElement, MouseEvent>) => void;
+    count?: number;
+    title: string;
+    nodeID: string;
   }) => {
-    const [options, setOptions] = useState<EuiSelectableOption[]>(() =>
-      typeof subMenuOptions !== 'object'
-        ? []
-        : subMenuOptions.map((option: ResolverSubmenuOption) => {
-            const dataTestSubj = 'resolver:map:node-submenu-item';
-            return option.prefix
-              ? {
-                  label: option.optionTitle,
-                  prepend: <span>{option.prefix} </span>,
-                  'data-test-subj': dataTestSubj,
-                }
-              : {
-                  label: option.optionTitle,
-                  prepend: <span />,
-                  'data-test-subj': dataTestSubj,
-                };
-          })
-    );
-
-    const actionsByLabel: Record<string, () => unknown> = useMemo(() => {
-      if (typeof subMenuOptions !== 'object') {
-        return {};
-      }
-      return subMenuOptions.reduce((titleActionRecord, opt) => {
-        const { optionTitle, action } = opt;
-        return { ...titleActionRecord, [optionTitle]: action };
-      }, {});
-    }, [subMenuOptions]);
-
-    const selectableProps = useMemo(() => {
-      return {
-        listProps: { showIcons: true, bordered: true },
-        onChange: (newOptions: EuiSelectableOption[]) => {
-          const selectedOption = newOptions.find((opt) => opt.checked === 'on');
-          if (selectedOption) {
-            const { label } = selectedOption;
-            const actionToTake = actionsByLabel[label];
-            if (typeof actionToTake === 'function') {
-              actionToTake();
-            }
-          }
-          setOptions(newOptions);
-        },
-      };
-    }, [actionsByLabel]);
-
+    const iconType = menuIsOpen === true ? 'arrowUp' : 'arrowDown';
     return (
-      <EuiSelectable
-        singleSelection={true}
-        options={options}
-        {...selectableProps}
-        isLoading={isLoading}
+      <StyledActionButton
+        onClick={action}
+        iconType={hasMenu ? iconType : 'none'}
+        fill={false}
+        color={'primary'}
+        size="s"
+        iconSide="right"
+        tabIndex={-1}
+        data-test-subj="resolver:submenu:button"
+        data-test-resolver-node-id={nodeID}
+        id={nodeID}
       >
-        {(list) => <OptionListItem>{list}</OptionListItem>}
-      </EuiSelectable>
+        {count ? <EuiI18nNumber value={count} /> : ''} {title}
+      </StyledActionButton>
     );
   }
 );
@@ -177,11 +146,6 @@ const NodeSubMenuComponents = React.memo(
       [menuAction]
     );
 
-    const closePopover = useCallback(() => setMenuOpen(false), []);
-    const popoverId = idGenerator('submenu-popover');
-
-    const isMenuLoading = optionsWithActions === 'waitingForRelatedEventData';
-
     // The last projection matrix that was used to position the popover
     const projectionMatrixAtLastRender = useRef<Matrix3>();
 
@@ -204,6 +168,16 @@ const NodeSubMenuComponents = React.memo(
       projectionMatrixAtLastRender.current = projectionMatrix;
     }, [projectionMatrixAtLastRender, projectionMatrix]);
 
+    const {
+      colorMap: { pillStroke: pillBorderStroke, resolverBackground: pillFill },
+    } = useResolverTheme();
+    const listStylesFromTheme = useMemo(() => {
+      return {
+        border: `1.5px solid ${pillBorderStroke}`,
+        backgroundColor: pillFill,
+      };
+    }, [pillBorderStroke, pillFill]);
+
     if (!optionsWithActions) {
       /**
        * When called with a `menuAction`
@@ -222,44 +196,47 @@ const NodeSubMenuComponents = React.memo(
         </div>
       );
     }
-    /**
-     * When called with a set of `optionsWithActions`:
-     * Render with a panel of options that appear when the menu host button is clicked
-     */
 
-    const submenuPopoverButton = (
-      <EuiButton
-        onClick={
-          typeof optionsWithActions === 'object' ? handleMenuOpenClick : handleMenuActionClick
-        }
-        color={buttonBorderColor}
-        size="s"
-        iconType={menuIsOpen ? 'arrowUp' : 'arrowDown'}
-        iconSide="right"
-        tabIndex={-1}
-        data-test-subj="resolver:submenu:button"
-        data-test-resolver-node-id={nodeID}
-      >
-        {count ? <EuiI18nNumber value={count} /> : ''} {menuTitle}
-      </EuiButton>
-    );
+    if (typeof optionsWithActions === 'string') {
+      return <></>;
+    }
 
     return (
-      <div className={className + (menuIsOpen ? ' is-open' : '')}>
-        <EuiPopover
-          id={popoverId}
-          panelPaddingSize="none"
-          button={submenuPopoverButton}
-          isOpen={menuIsOpen}
-          closePopover={closePopover}
-          repositionOnScroll
-          ref={popoverRef}
-        >
-          {menuIsOpen && typeof optionsWithActions === 'object' && (
-            <OptionList isLoading={isMenuLoading} subMenuOptions={optionsWithActions} />
-          )}
-        </EuiPopover>
-      </div>
+      <>
+        <SubButton
+          hasMenu={true}
+          menuIsOpen={menuIsOpen}
+          action={handleMenuOpenClick}
+          count={count}
+          title={menuTitle}
+          nodeID={nodeID}
+        />
+        {menuIsOpen ? (
+          <ul
+            className={`${className} options`}
+            aria-hidden={!menuIsOpen}
+            aria-describedby={nodeID}
+          >
+            {optionsWithActions
+              .sort((opta, optb) => {
+                return opta.optionTitle.localeCompare(optb.optionTitle);
+              })
+              .map((opt) => {
+                return (
+                  <li
+                    className="item"
+                    data-test-subj="resolver:map:node-submenu-item"
+                    style={listStylesFromTheme}
+                  >
+                    <button type="button" className="kbn-resetFocusState" onClick={opt.action}>
+                      {opt.prefix} {opt.optionTitle}
+                    </button>
+                  </li>
+                );
+              })}
+          </ul>
+        ) : null}
+      </>
     );
   }
 );
@@ -271,6 +248,48 @@ export const NodeSubMenu = styled(NodeSubMenuComponents)`
   display: flex;
   flex-flow: column;
 
+  &.options {
+    font-size: 0.8rem;
+    display: flex;
+    flex-flow: row wrap;
+    background: transparent;
+    position: absolute;
+    top: 6.5em;
+    contain: content;
+    width: 12em;
+    z-index: 2;
+  }
+
+  &.options .item {
+    margin: 0.25ch 0.35ch 0.35ch 0;
+    padding: 0.35em 0.5em;
+    height: fit-content;
+    width: fit-content;
+    border-radius: 2px;
+    line-height: 0.8;
+  }
+
+  &.options .item button {
+    appearance: none;
+    height: fit-content;
+    width: fit-content;
+    line-height: 0.8;
+    outline-style: none;
+    border-color: transparent;
+    box-shadow: none;
+  }
+
+  &.options .item button:focus {
+    outline-style: none;
+    border-color: transparent;
+    box-shadow: none;
+    text-decoration: underline;
+  }
+
+  &.options .item button:active {
+    transform: scale(0.95);
+  }
+
   & .euiButton {
     background-color: ${(props) => props.buttonFill};
     border-color: ${(props) => props.buttonBorderColor};
@@ -283,16 +302,4 @@ export const NodeSubMenu = styled(NodeSubMenuComponents)`
       background-color: ${(props) => props.buttonFill};
     }
   }
-
-  & .euiPopover__anchor {
-    display: flex;
-  }
-
-  &.is-open .euiButton {
-    border-bottom-left-radius: 0;
-    border-bottom-right-radius: 0;
-  }
-  &.is-open .euiSelectableListItem__prepend {
-    color: white;
-  }
 `;
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/alerts.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/alerts.ts
index 54c6cf432aa89..8f68cba893108 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/alerts.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/alerts.ts
@@ -5,7 +5,7 @@
  */
 import { SearchResponse } from 'elasticsearch';
 import { esKuery } from '../../../../../../../../src/plugins/data/server';
-import { ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { ResolverQuery } from './base';
 import { PaginationBuilder } from '../utils/pagination';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
@@ -13,7 +13,7 @@ import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/com
 /**
  * Builds a query for retrieving alerts for a node.
  */
-export class AlertsQuery extends ResolverQuery<ResolverEvent[]> {
+export class AlertsQuery extends ResolverQuery<SafeResolverEvent[]> {
   private readonly kqlQuery: JsonObject[] = [];
   constructor(
     private readonly pagination: PaginationBuilder,
@@ -68,7 +68,7 @@ export class AlertsQuery extends ResolverQuery<ResolverEvent[]> {
     };
   }
 
-  formatResponse(response: SearchResponse<ResolverEvent>): ResolverEvent[] {
+  formatResponse(response: SearchResponse<SafeResolverEvent>): SafeResolverEvent[] {
     return this.getResults(response);
   }
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/base.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/base.ts
index 0d8a42d7a26f3..a2bdf358745c2 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/base.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/base.ts
@@ -6,7 +6,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
-import { ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
 import { legacyEventIndexPattern } from './legacy_event_index_pattern';
 import { MSearchQuery } from './multi_searcher';
@@ -19,7 +19,7 @@ import { MSearchQuery } from './multi_searcher';
  * @param R the is the type after transforming ES's response. Making this definable let's us set whether it is a resolver event
  * or something else.
  */
-export abstract class ResolverQuery<T, R = ResolverEvent> implements MSearchQuery {
+export abstract class ResolverQuery<T, R = SafeResolverEvent> implements MSearchQuery {
   /**
    *
    * @param indexPattern the index pattern to use in the query for finding indices with documents in ES.
@@ -77,7 +77,7 @@ export abstract class ResolverQuery<T, R = ResolverEvent> implements MSearchQuer
    * @param ids a single more multiple unique node ids (e.g. entity_id or unique_pid)
    */
   async searchAndFormat(client: ILegacyScopedClusterClient, ids: string | string[]): Promise<T> {
-    const res: SearchResponse<ResolverEvent> = await this.search(client, ids);
+    const res: SearchResponse<R> = await this.search(client, ids);
     return this.formatResponse(res);
   }
 
@@ -113,5 +113,5 @@ export abstract class ResolverQuery<T, R = ResolverEvent> implements MSearchQuer
    * @param response a SearchResponse from ES resulting from executing this query
    * @returns the translated ES response into a structured object
    */
-  public abstract formatResponse(response: SearchResponse<ResolverEvent>): T;
+  public abstract formatResponse(response: SearchResponse<R>): T;
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts
index 6fb38a32f9581..8c7daf9451217 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { SearchResponse } from 'elasticsearch';
-import { ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { ResolverQuery } from './base';
 import { ChildrenPaginationBuilder } from '../utils/children_pagination';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
@@ -12,7 +12,7 @@ import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/com
 /**
  * Builds a query for retrieving descendants of a node.
  */
-export class ChildrenQuery extends ResolverQuery<ResolverEvent[]> {
+export class ChildrenQuery extends ResolverQuery<SafeResolverEvent[]> {
   constructor(
     private readonly pagination: ChildrenPaginationBuilder,
     indexPattern: string | string[],
@@ -126,7 +126,7 @@ export class ChildrenQuery extends ResolverQuery<ResolverEvent[]> {
     };
   }
 
-  formatResponse(response: SearchResponse<ResolverEvent>): ResolverEvent[] {
+  formatResponse(response: SearchResponse<SafeResolverEvent>): SafeResolverEvent[] {
     return this.getResults(response);
   }
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/events.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/events.ts
index 0969a3c360e4a..bd054d548a93a 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/events.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/events.ts
@@ -5,7 +5,7 @@
  */
 import { SearchResponse } from 'elasticsearch';
 import { esKuery } from '../../../../../../../../src/plugins/data/server';
-import { ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { ResolverQuery } from './base';
 import { PaginationBuilder } from '../utils/pagination';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
@@ -13,7 +13,7 @@ import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/com
 /**
  * Builds a query for retrieving related events for a node.
  */
-export class EventsQuery extends ResolverQuery<ResolverEvent[]> {
+export class EventsQuery extends ResolverQuery<SafeResolverEvent[]> {
   private readonly kqlQuery: JsonObject[] = [];
 
   constructor(
@@ -83,7 +83,7 @@ export class EventsQuery extends ResolverQuery<ResolverEvent[]> {
     };
   }
 
-  formatResponse(response: SearchResponse<ResolverEvent>): ResolverEvent[] {
+  formatResponse(response: SearchResponse<SafeResolverEvent>): SafeResolverEvent[] {
     return this.getResults(response);
   }
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/lifecycle.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/lifecycle.ts
index 0b5728958e91f..ecbc5d8344928 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/lifecycle.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/lifecycle.ts
@@ -6,12 +6,12 @@
 import { SearchResponse } from 'elasticsearch';
 import { ResolverQuery } from './base';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
-import { ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 
 /**
  * Builds a query for retrieving life cycle information about a node (start, stop, etc).
  */
-export class LifecycleQuery extends ResolverQuery<ResolverEvent[]> {
+export class LifecycleQuery extends ResolverQuery<SafeResolverEvent[]> {
   protected legacyQuery(endpointID: string, uniquePIDs: string[]): JsonObject {
     return {
       query: {
@@ -59,7 +59,7 @@ export class LifecycleQuery extends ResolverQuery<ResolverEvent[]> {
     };
   }
 
-  formatResponse(response: SearchResponse<ResolverEvent>): ResolverEvent[] {
+  formatResponse(response: SearchResponse<SafeResolverEvent>): SafeResolverEvent[] {
     return this.getResults(response);
   }
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/multi_searcher.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/multi_searcher.ts
index 02dbd92d9252b..76203973a6211 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/multi_searcher.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/multi_searcher.ts
@@ -6,7 +6,7 @@
 
 import { ILegacyScopedClusterClient } from 'kibana/server';
 import { MSearchResponse, SearchResponse } from 'elasticsearch';
-import { ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
 
 /**
@@ -37,7 +37,7 @@ export interface QueryInfo {
   /**
    * a function to handle the response
    */
-  handler: (response: SearchResponse<ResolverEvent>) => void;
+  handler: (response: SearchResponse<SafeResolverEvent>) => void;
 }
 
 /**
@@ -65,7 +65,7 @@ export class MultiSearcher {
     for (const info of queries) {
       searchQuery.push(...info.query.buildMSearch(info.ids));
     }
-    const res: MSearchResponse<ResolverEvent> = await this.client.callAsCurrentUser('msearch', {
+    const res: MSearchResponse<SafeResolverEvent> = await this.client.callAsCurrentUser('msearch', {
       body: searchQuery,
     });
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/stats.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/stats.ts
index b8fa409e2ca21..50e56258b7448 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/stats.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/stats.ts
@@ -5,7 +5,7 @@
  */
 import { SearchResponse } from 'elasticsearch';
 import { ResolverQuery } from './base';
-import { ResolverEvent, EventStats } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent, EventStats } from '../../../../../common/endpoint/types';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
 
 export interface StatsResult {
@@ -185,7 +185,7 @@ export class StatsQuery extends ResolverQuery<StatsResult> {
     };
   }
 
-  public formatResponse(response: SearchResponse<ResolverEvent>): StatsResult {
+  public formatResponse(response: SearchResponse<SafeResolverEvent>): StatsResult {
     let alerts: Record<string, number> = {};
 
     if (response.aggregations?.alerts?.ids?.buckets) {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/alerts_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/alerts_query_handler.ts
index efffbc10473d4..f34218ddbde9b 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/alerts_query_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/alerts_query_handler.ts
@@ -6,7 +6,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
-import { ResolverRelatedAlerts, ResolverEvent } from '../../../../../common/endpoint/types';
+import { ResolverRelatedAlerts, SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { createRelatedAlerts } from './node';
 import { AlertsQuery } from '../queries/alerts';
 import { PaginationBuilder } from './pagination';
@@ -45,7 +45,7 @@ export class RelatedAlertsQueryHandler implements SingleQueryHandler<ResolverRel
     );
   }
 
-  private handleResponse = (response: SearchResponse<ResolverEvent>) => {
+  private handleResponse = (response: SearchResponse<SafeResolverEvent>) => {
     const results = this.query.formatResponse(response);
     this.relatedAlerts = createRelatedAlerts(
       this.entityID,
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/ancestry_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/ancestry_query_handler.ts
index 7dd47658bc4c1..b796913118c99 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/ancestry_query_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/ancestry_query_handler.ts
@@ -7,14 +7,14 @@
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
 import {
-  parentEntityId,
-  entityId,
+  parentEntityIDSafeVersion,
+  entityIDSafeVersion,
   getAncestryAsArray,
 } from '../../../../../common/endpoint/models/event';
 import {
-  ResolverAncestry,
-  ResolverEvent,
-  ResolverLifecycleNode,
+  SafeResolverAncestry,
+  SafeResolverEvent,
+  SafeResolverLifecycleNode,
 } from '../../../../../common/endpoint/types';
 import { createAncestry, createLifecycle } from './node';
 import { LifecycleQuery } from '../queries/lifecycle';
@@ -24,8 +24,8 @@ import { QueryHandler } from './fetch';
 /**
  * Retrieve the ancestry portion of a resolver tree.
  */
-export class AncestryQueryHandler implements QueryHandler<ResolverAncestry> {
-  private readonly ancestry: ResolverAncestry = createAncestry();
+export class AncestryQueryHandler implements QueryHandler<SafeResolverAncestry> {
+  private readonly ancestry: SafeResolverAncestry = createAncestry();
   private ancestorsToFind: string[];
   private readonly query: LifecycleQuery;
 
@@ -33,7 +33,7 @@ export class AncestryQueryHandler implements QueryHandler<ResolverAncestry> {
     private levels: number,
     indexPattern: string,
     legacyEndpointID: string | undefined,
-    originNode: ResolverLifecycleNode | undefined
+    originNode: SafeResolverLifecycleNode | undefined
   ) {
     this.ancestorsToFind = getAncestryAsArray(originNode?.lifecycle[0]).slice(0, levels);
     this.query = new LifecycleQuery(indexPattern, legacyEndpointID);
@@ -41,21 +41,28 @@ export class AncestryQueryHandler implements QueryHandler<ResolverAncestry> {
     // add the origin node to the response if it exists
     if (originNode) {
       this.ancestry.ancestors.push(originNode);
-      this.ancestry.nextAncestor = parentEntityId(originNode.lifecycle[0]) || null;
+      this.ancestry.nextAncestor = parentEntityIDSafeVersion(originNode.lifecycle[0]) || null;
     }
   }
 
-  private toMapOfNodes(results: ResolverEvent[]) {
-    return results.reduce((nodes: Map<string, ResolverLifecycleNode>, event: ResolverEvent) => {
-      const nodeId = entityId(event);
-      let node = nodes.get(nodeId);
-      if (!node) {
-        node = createLifecycle(nodeId, []);
-      }
+  private toMapOfNodes(results: SafeResolverEvent[]) {
+    return results.reduce(
+      (nodes: Map<string, SafeResolverLifecycleNode>, event: SafeResolverEvent) => {
+        const nodeId = entityIDSafeVersion(event);
+        if (!nodeId) {
+          return nodes;
+        }
+
+        let node = nodes.get(nodeId);
+        if (!node) {
+          node = createLifecycle(nodeId, []);
+        }
 
-      node.lifecycle.push(event);
-      return nodes.set(nodeId, node);
-    }, new Map());
+        node.lifecycle.push(event);
+        return nodes.set(nodeId, node);
+      },
+      new Map()
+    );
   }
 
   private setNoMore() {
@@ -64,7 +71,7 @@ export class AncestryQueryHandler implements QueryHandler<ResolverAncestry> {
     this.levels = 0;
   }
 
-  private handleResponse = (searchResp: SearchResponse<ResolverEvent>) => {
+  private handleResponse = (searchResp: SearchResponse<SafeResolverEvent>) => {
     const results = this.query.formatResponse(searchResp);
     if (results.length === 0) {
       this.setNoMore();
@@ -97,7 +104,7 @@ export class AncestryQueryHandler implements QueryHandler<ResolverAncestry> {
      * Hence: [D, E, B, C, A]
      */
     this.ancestry.ancestors.push(...ancestryNodes.values());
-    this.ancestry.nextAncestor = parentEntityId(results[0]) || null;
+    this.ancestry.nextAncestor = parentEntityIDSafeVersion(results[0]) || null;
     this.levels = this.levels - ancestryNodes.size;
     // the results come back in ascending order on timestamp so the first entry in the
     // results should be the further ancestor (most distant grandparent)
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.test.ts
index 78e4219aad75c..d33e9a2d70af6 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.test.ts
@@ -10,7 +10,7 @@ import {
   TreeNode,
 } from '../../../../../common/endpoint/generate_data';
 import { ChildrenNodesHelper } from './children_helper';
-import { eventId, isProcessRunning } from '../../../../../common/endpoint/models/event';
+import { eventIDSafeVersion, isProcessRunning } from '../../../../../common/endpoint/models/event';
 
 function getStartEvents(events: Event[]): Event[] {
   const startEvents: Event[] = [];
@@ -179,7 +179,9 @@ describe('Children helper', () => {
 
     childrenNodes.childNodes.forEach((node) => {
       node.lifecycle.forEach((event) => {
-        expect(childrenEvents.find((child) => child.event.id === eventId(event))).toEqual(event);
+        expect(
+          childrenEvents.find((child) => eventIDSafeVersion(child) === eventIDSafeVersion(event))
+        ).toEqual(event);
       });
     });
   });
@@ -191,7 +193,9 @@ describe('Children helper', () => {
     const childrenNodes = helper.getNodes();
     childrenNodes.childNodes.forEach((node) => {
       node.lifecycle.forEach((event) => {
-        expect(childrenEvents.find((child) => child.event.id === eventId(event))).toEqual(event);
+        expect(
+          childrenEvents.find((child) => eventIDSafeVersion(child) === eventIDSafeVersion(event))
+        ).toEqual(event);
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
index b82b972b887b5..e9174548898dd 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts
@@ -5,15 +5,15 @@
  */
 
 import {
-  entityId,
-  parentEntityId,
+  parentEntityIDSafeVersion,
   isProcessRunning,
   getAncestryAsArray,
+  entityIDSafeVersion,
 } from '../../../../../common/endpoint/models/event';
 import {
-  ResolverChildNode,
-  ResolverEvent,
-  ResolverChildren,
+  SafeResolverChildren,
+  SafeResolverChildNode,
+  SafeResolverEvent,
 } from '../../../../../common/endpoint/types';
 import { createChild } from './node';
 import { ChildrenPaginationBuilder } from './children_pagination';
@@ -22,7 +22,7 @@ import { ChildrenPaginationBuilder } from './children_pagination';
  * This class helps construct the children structure when building a resolver tree.
  */
 export class ChildrenNodesHelper {
-  private readonly entityToNodeCache: Map<string, ResolverChildNode> = new Map();
+  private readonly entityToNodeCache: Map<string, SafeResolverChildNode> = new Map();
 
   constructor(private readonly rootID: string, private readonly limit: number) {
     this.entityToNodeCache.set(rootID, createChild(rootID));
@@ -31,8 +31,8 @@ export class ChildrenNodesHelper {
   /**
    * Constructs a ResolverChildren response based on the children that were previously add.
    */
-  getNodes(): ResolverChildren {
-    const cacheCopy: Map<string, ResolverChildNode> = new Map(this.entityToNodeCache);
+  getNodes(): SafeResolverChildren {
+    const cacheCopy: Map<string, SafeResolverChildNode> = new Map(this.entityToNodeCache);
     const rootNode = cacheCopy.get(this.rootID);
     let rootNextChild = null;
 
@@ -51,7 +51,7 @@ export class ChildrenNodesHelper {
    * Get the entity_ids of the nodes that are cached.
    */
   getEntityIDs(): string[] {
-    const cacheCopy: Map<string, ResolverChildNode> = new Map(this.entityToNodeCache);
+    const cacheCopy: Map<string, SafeResolverChildNode> = new Map(this.entityToNodeCache);
     cacheCopy.delete(this.rootID);
     return Array.from(cacheCopy.keys());
   }
@@ -69,9 +69,9 @@ export class ChildrenNodesHelper {
    *
    * @param lifecycle an array of resolver lifecycle events for different process nodes returned from ES.
    */
-  addLifecycleEvents(lifecycle: ResolverEvent[]) {
+  addLifecycleEvents(lifecycle: SafeResolverEvent[]) {
     for (const event of lifecycle) {
-      const entityID = entityId(event);
+      const entityID = entityIDSafeVersion(event);
       if (entityID) {
         const cachedChild = this.getOrCreateChildNode(entityID);
         cachedChild.lifecycle.push(event);
@@ -86,19 +86,22 @@ export class ChildrenNodesHelper {
    * @param queriedNodes the entity_ids of the nodes that returned these start events
    * @param startEvents an array of start events returned by ES
    */
-  addStartEvents(queriedNodes: Set<string>, startEvents: ResolverEvent[]): Set<string> | undefined {
+  addStartEvents(
+    queriedNodes: Set<string>,
+    startEvents: SafeResolverEvent[]
+  ): Set<string> | undefined {
     let largestAncestryArray = 0;
     const nodesToQueryNext: Map<number, Set<string>> = new Map();
-    const nonLeafNodes: Set<ResolverChildNode> = new Set();
+    const nonLeafNodes: Set<SafeResolverChildNode> = new Set();
 
-    const isDistantGrandchild = (event: ResolverEvent) => {
+    const isDistantGrandchild = (event: SafeResolverEvent) => {
       const ancestry = getAncestryAsArray(event);
       return ancestry.length > 0 && queriedNodes.has(ancestry[ancestry.length - 1]);
     };
 
     for (const event of startEvents) {
-      const parentID = parentEntityId(event);
-      const entityID = entityId(event);
+      const parentID = parentEntityIDSafeVersion(event);
+      const entityID = entityIDSafeVersion(event);
       if (parentID && entityID && isProcessRunning(event)) {
         // don't actually add the start event to the node, because that'll be done in
         // a different call
@@ -158,7 +161,7 @@ export class ChildrenNodesHelper {
     return nodesToQueryNext.get(largestAncestryArray);
   }
 
-  private setPaginationForNodes(nodes: Set<string>, startEvents: ResolverEvent[]) {
+  private setPaginationForNodes(nodes: Set<string>, startEvents: SafeResolverEvent[]) {
     for (const nodeEntityID of nodes.values()) {
       const cachedNode = this.entityToNodeCache.get(nodeEntityID);
       if (cachedNode) {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_lifecycle_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_lifecycle_query_handler.ts
index ab610dc9776ca..f9f73c2ad75ff 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_lifecycle_query_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_lifecycle_query_handler.ts
@@ -6,7 +6,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
-import { ResolverEvent, ResolverChildren } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent, SafeResolverChildren } from '../../../../../common/endpoint/types';
 import { LifecycleQuery } from '../queries/lifecycle';
 import { QueryInfo } from '../queries/multi_searcher';
 import { SingleQueryHandler } from './fetch';
@@ -16,8 +16,8 @@ import { createChildren } from './node';
 /**
  * Returns the children of a resolver tree.
  */
-export class ChildrenLifecycleQueryHandler implements SingleQueryHandler<ResolverChildren> {
-  private lifecycle: ResolverChildren | undefined;
+export class ChildrenLifecycleQueryHandler implements SingleQueryHandler<SafeResolverChildren> {
+  private lifecycle: SafeResolverChildren | undefined;
   private readonly query: LifecycleQuery;
   constructor(
     private readonly childrenHelper: ChildrenNodesHelper,
@@ -27,7 +27,7 @@ export class ChildrenLifecycleQueryHandler implements SingleQueryHandler<Resolve
     this.query = new LifecycleQuery(indexPattern, legacyEndpointID);
   }
 
-  private handleResponse = (response: SearchResponse<ResolverEvent>) => {
+  private handleResponse = (response: SearchResponse<SafeResolverEvent>) => {
     this.childrenHelper.addLifecycleEvents(this.query.formatResponse(response));
     this.lifecycle = this.childrenHelper.getNodes();
   };
@@ -50,7 +50,7 @@ export class ChildrenLifecycleQueryHandler implements SingleQueryHandler<Resolve
   /**
    * Return the results from the search.
    */
-  getResults(): ResolverChildren | undefined {
+  getResults(): SafeResolverChildren | undefined {
     return this.lifecycle;
   }
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts
index 1e154caf70c48..4cc8aaf42d12b 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ResolverEvent } from '../../../../../common/endpoint/types';
-import { eventSequence } from '../../../../../common/endpoint/models/event';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
+import { eventSequence, timestampSafeVersion } from '../../../../../common/endpoint/models/event';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
 import { urlEncodeCursor, SortFields, urlDecodeCursor } from './pagination';
 
@@ -65,11 +65,11 @@ export class ChildrenPaginationBuilder {
    *
    * @param results the events that were returned by the ES query
    */
-  static buildCursor(results: ResolverEvent[]): string | null {
+  static buildCursor(results: SafeResolverEvent[]): string | null {
     const lastResult = results[results.length - 1];
     const sequence = eventSequence(lastResult);
     const cursor = {
-      timestamp: lastResult['@timestamp'],
+      timestamp: timestampSafeVersion(lastResult) ?? 0,
       sequence: sequence === undefined ? 0 : sequence,
     };
     return urlEncodeCursor(cursor);
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts
index 30d46d12afbe5..327be8d3696fd 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts
@@ -6,7 +6,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
-import { ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { ChildrenQuery } from '../queries/children';
 import { QueryInfo } from '../queries/multi_searcher';
 import { QueryHandler } from './fetch';
@@ -46,7 +46,7 @@ export class ChildrenStartQueryHandler implements QueryHandler<ChildrenNodesHelp
     this.limitLeft = 0;
   }
 
-  private handleResponse = (response: SearchResponse<ResolverEvent>) => {
+  private handleResponse = (response: SearchResponse<SafeResolverEvent>) => {
     const results = this.query.formatResponse(response);
     this.nodesToQuery = this.childrenHelper.addStartEvents(this.nodesToQuery, results) ?? new Set();
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/events_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/events_query_handler.ts
index 8792f917fb4d6..5c4d9a4741ad7 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/events_query_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/events_query_handler.ts
@@ -6,7 +6,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
-import { ResolverRelatedEvents, ResolverEvent } from '../../../../../common/endpoint/types';
+import { SafeResolverRelatedEvents, SafeResolverEvent } from '../../../../../common/endpoint/types';
 import { createRelatedEvents } from './node';
 import { EventsQuery } from '../queries/events';
 import { PaginationBuilder } from './pagination';
@@ -28,8 +28,8 @@ export interface RelatedEventsParams {
 /**
  * This retrieves the related events for the origin node of a resolver tree.
  */
-export class RelatedEventsQueryHandler implements SingleQueryHandler<ResolverRelatedEvents> {
-  private relatedEvents: ResolverRelatedEvents | undefined;
+export class RelatedEventsQueryHandler implements SingleQueryHandler<SafeResolverRelatedEvents> {
+  private relatedEvents: SafeResolverRelatedEvents | undefined;
   private readonly query: EventsQuery;
   private readonly limit: number;
   private readonly entityID: string;
@@ -46,7 +46,7 @@ export class RelatedEventsQueryHandler implements SingleQueryHandler<ResolverRel
     );
   }
 
-  private handleResponse = (response: SearchResponse<ResolverEvent>) => {
+  private handleResponse = (response: SearchResponse<SafeResolverEvent>) => {
     const results = this.query.formatResponse(response);
     this.relatedEvents = createRelatedEvents(
       this.entityID,
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts
index 1b88f965909eb..15a9639872f2a 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/fetch.ts
@@ -6,11 +6,11 @@
 
 import { ILegacyScopedClusterClient } from 'kibana/server';
 import {
-  ResolverChildren,
-  ResolverRelatedEvents,
-  ResolverAncestry,
+  SafeResolverChildren,
+  SafeResolverRelatedEvents,
+  SafeResolverAncestry,
   ResolverRelatedAlerts,
-  ResolverLifecycleNode,
+  SafeResolverLifecycleNode,
 } from '../../../../../common/endpoint/types';
 import { Tree } from './tree';
 import { LifecycleQuery } from '../queries/lifecycle';
@@ -190,7 +190,7 @@ export class Fetcher {
    *
    * @param limit upper limit of ancestors to retrieve
    */
-  public async ancestors(limit: number): Promise<ResolverAncestry> {
+  public async ancestors(limit: number): Promise<SafeResolverAncestry> {
     const originNode = await this.getNode(this.id);
     const ancestryHandler = new AncestryQueryHandler(
       limit,
@@ -207,7 +207,7 @@ export class Fetcher {
    * @param limit the number of children to retrieve for a single level
    * @param after a cursor to use as the starting point for retrieving children
    */
-  public async children(limit: number, after?: string): Promise<ResolverChildren> {
+  public async children(limit: number, after?: string): Promise<SafeResolverChildren> {
     const childrenHandler = new ChildrenStartQueryHandler(
       limit,
       this.id,
@@ -237,7 +237,7 @@ export class Fetcher {
     limit: number,
     after?: string,
     filter?: string
-  ): Promise<ResolverRelatedEvents> {
+  ): Promise<SafeResolverRelatedEvents> {
     const eventsHandler = new RelatedEventsQueryHandler({
       limit,
       entityID: this.id,
@@ -285,7 +285,7 @@ export class Fetcher {
     return tree;
   }
 
-  private async getNode(entityID: string): Promise<ResolverLifecycleNode | undefined> {
+  private async getNode(entityID: string): Promise<SafeResolverLifecycleNode | undefined> {
     const query = new LifecycleQuery(this.eventsIndexPattern, this.endpointID);
     const results = await query.searchAndFormat(this.client, entityID);
     if (results.length === 0) {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/lifecycle_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/lifecycle_query_handler.ts
index ab0501e099490..d4dc12d5e8b66 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/lifecycle_query_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/lifecycle_query_handler.ts
@@ -6,7 +6,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ILegacyScopedClusterClient } from 'kibana/server';
-import { ResolverEvent, ResolverLifecycleNode } from '../../../../../common/endpoint/types';
+import { SafeResolverEvent, SafeResolverLifecycleNode } from '../../../../../common/endpoint/types';
 import { LifecycleQuery } from '../queries/lifecycle';
 import { QueryInfo } from '../queries/multi_searcher';
 import { SingleQueryHandler } from './fetch';
@@ -15,8 +15,8 @@ import { createLifecycle } from './node';
 /**
  * Retrieve the lifecycle events for a node.
  */
-export class LifecycleQueryHandler implements SingleQueryHandler<ResolverLifecycleNode> {
-  private lifecycle: ResolverLifecycleNode | undefined;
+export class LifecycleQueryHandler implements SingleQueryHandler<SafeResolverLifecycleNode> {
+  private lifecycle: SafeResolverLifecycleNode | undefined;
   private readonly query: LifecycleQuery;
   constructor(
     private readonly entityID: string,
@@ -26,7 +26,7 @@ export class LifecycleQueryHandler implements SingleQueryHandler<ResolverLifecyc
     this.query = new LifecycleQuery(indexPattern, legacyEndpointID);
   }
 
-  private handleResponse = (response: SearchResponse<ResolverEvent>) => {
+  private handleResponse = (response: SearchResponse<SafeResolverEvent>) => {
     const results = this.query.formatResponse(response);
     if (results.length !== 0) {
       this.lifecycle = createLifecycle(this.entityID, results);
@@ -51,7 +51,7 @@ export class LifecycleQueryHandler implements SingleQueryHandler<ResolverLifecyc
   /**
    * Get the results from the msearch.
    */
-  getResults(): ResolverLifecycleNode | undefined {
+  getResults(): SafeResolverLifecycleNode | undefined {
     return this.lifecycle;
   }
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts
index 98180885faf05..535ee37f3db32 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/node.ts
@@ -5,14 +5,14 @@
  */
 
 import {
-  ResolverEvent,
-  ResolverAncestry,
-  ResolverLifecycleNode,
-  ResolverRelatedEvents,
-  ResolverTree,
-  ResolverChildNode,
+  SafeResolverAncestry,
+  SafeResolverTree,
   ResolverRelatedAlerts,
-  ResolverChildren,
+  SafeResolverChildren,
+  SafeResolverLifecycleNode,
+  SafeResolverEvent,
+  SafeResolverChildNode,
+  SafeResolverRelatedEvents,
 } from '../../../../../common/endpoint/types';
 
 /**
@@ -24,9 +24,9 @@ import {
  */
 export function createRelatedEvents(
   entityID: string,
-  events: ResolverEvent[] = [],
+  events: SafeResolverEvent[] = [],
   nextEvent: string | null = null
-): ResolverRelatedEvents {
+): SafeResolverRelatedEvents {
   return { entityID, events, nextEvent };
 }
 
@@ -39,7 +39,7 @@ export function createRelatedEvents(
  */
 export function createRelatedAlerts(
   entityID: string,
-  alerts: ResolverEvent[] = [],
+  alerts: SafeResolverEvent[] = [],
   nextAlert: string | null = null
 ): ResolverRelatedAlerts {
   return { entityID, alerts, nextAlert };
@@ -50,7 +50,7 @@ export function createRelatedAlerts(
  *
  * @param entityID the entity_id of the child
  */
-export function createChild(entityID: string): ResolverChildNode {
+export function createChild(entityID: string): SafeResolverChildNode {
   const lifecycle = createLifecycle(entityID, []);
   return {
     ...lifecycle,
@@ -60,7 +60,7 @@ export function createChild(entityID: string): ResolverChildNode {
 /**
  * Creates an empty ancestry response structure.
  */
-export function createAncestry(): ResolverAncestry {
+export function createAncestry(): SafeResolverAncestry {
   return { ancestors: [], nextAncestor: null };
 }
 
@@ -72,8 +72,8 @@ export function createAncestry(): ResolverAncestry {
  */
 export function createLifecycle(
   entityID: string,
-  lifecycle: ResolverEvent[]
-): ResolverLifecycleNode {
+  lifecycle: SafeResolverEvent[]
+): SafeResolverLifecycleNode {
   return { entityID, lifecycle };
 }
 
@@ -84,9 +84,9 @@ export function createLifecycle(
  * @param nextChild the cursor for the response
  */
 export function createChildren(
-  nodes: ResolverChildNode[] = [],
+  nodes: SafeResolverChildNode[] = [],
   nextChild: string | null = null
-): ResolverChildren {
+): SafeResolverChildren {
   return { childNodes: nodes, nextChild };
 }
 
@@ -95,7 +95,7 @@ export function createChildren(
  *
  * @param entityID the entity_id of the tree's origin node
  */
-export function createTree(entityID: string): ResolverTree {
+export function createTree(entityID: string): SafeResolverTree {
   return {
     entityID,
     children: {
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.test.ts
index 8e567bfb59c65..55965e5a9c70e 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.test.ts
@@ -5,14 +5,18 @@
  */
 import { PaginationBuilder } from './pagination';
 import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data';
-import { EndpointEvent } from '../../../../../common/endpoint/types';
+import { SafeEndpointEvent } from '../../../../../common/endpoint/types';
+import {
+  eventIDSafeVersion,
+  timestampSafeVersion,
+} from '../../../../../common/endpoint/models/event';
 
 describe('Pagination', () => {
   const generator = new EndpointDocGenerator();
 
-  const getSearchAfterInfo = (events: EndpointEvent[]) => {
+  const getSearchAfterInfo = (events: SafeEndpointEvent[]) => {
     const lastEvent = events[events.length - 1];
-    return [lastEvent['@timestamp'], lastEvent.event.id];
+    return [timestampSafeVersion(lastEvent), eventIDSafeVersion(lastEvent)];
   };
   describe('cursor', () => {
     const root = generator.generateEvent();
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
index 4a6c65e55a6b6..af0311a262f30 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
@@ -4,8 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ResolverEvent } from '../../../../../common/endpoint/types';
-import { eventId } from '../../../../../common/endpoint/models/event';
+import { SafeResolverEvent } from '../../../../../common/endpoint/types';
+import {
+  eventIDSafeVersion,
+  timestampSafeVersion,
+} from '../../../../../common/endpoint/models/event';
 import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common';
 import { ChildrenPaginationCursor } from './children_pagination';
 
@@ -116,11 +119,12 @@ export class PaginationBuilder {
    *
    * @param results the events that were returned by the ES query
    */
-  static buildCursor(results: ResolverEvent[]): string | null {
+  static buildCursor(results: SafeResolverEvent[]): string | null {
     const lastResult = results[results.length - 1];
     const cursor = {
-      timestamp: lastResult['@timestamp'],
-      eventID: eventId(lastResult) === undefined ? '' : String(eventId(lastResult)),
+      timestamp: timestampSafeVersion(lastResult) ?? 0,
+      eventID:
+        eventIDSafeVersion(lastResult) === undefined ? '' : String(eventIDSafeVersion(lastResult)),
     };
     return urlEncodeCursor(cursor);
   }
@@ -131,7 +135,10 @@ export class PaginationBuilder {
    * @param requestLimit the request limit for a query.
    * @param results the events that were returned by the ES query
    */
-  static buildCursorRequestLimit(requestLimit: number, results: ResolverEvent[]): string | null {
+  static buildCursorRequestLimit(
+    requestLimit: number,
+    results: SafeResolverEvent[]
+  ): string | null {
     if (requestLimit <= results.length && results.length > 0) {
       return PaginationBuilder.buildCursor(results);
     }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.test.ts
index 21db11f3affd3..290af87a61b1d 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.test.ts
@@ -7,28 +7,28 @@
 import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data';
 import { Tree } from './tree';
 import {
-  ResolverAncestry,
-  ResolverEvent,
-  ResolverRelatedEvents,
+  SafeResolverAncestry,
+  SafeResolverEvent,
+  SafeResolverRelatedEvents,
 } from '../../../../../common/endpoint/types';
-import { entityId } from '../../../../../common/endpoint/models/event';
+import { entityIDSafeVersion } from '../../../../../common/endpoint/models/event';
 
 describe('Tree', () => {
   const generator = new EndpointDocGenerator();
 
   describe('ancestry', () => {
     // transform the generator's array of events into the format expected by the tree class
-    const ancestorInfo: ResolverAncestry = {
+    const ancestorInfo: SafeResolverAncestry = {
       ancestors: generator
         .createAlertEventAncestry({ ancestors: 5, percentTerminated: 0, percentWithRelated: 0 })
         .filter((event) => {
-          return event.event.kind === 'event';
+          return event.event?.kind === 'event';
         })
         .map((event) => {
           return {
-            entityID: event.process.entity_id,
+            entityID: entityIDSafeVersion(event) ?? '',
             // The generator returns Events, but the tree needs a ResolverEvent
-            lifecycle: [event as ResolverEvent],
+            lifecycle: [event as SafeResolverEvent],
           };
         }),
       nextAncestor: 'hello',
@@ -39,7 +39,7 @@ describe('Tree', () => {
       const ids = tree.ids();
       ids.forEach((id) => {
         const foundAncestor = ancestorInfo.ancestors.find(
-          (ancestor) => entityId(ancestor.lifecycle[0]) === id
+          (ancestor) => entityIDSafeVersion(ancestor.lifecycle[0]) === id
         );
         expect(foundAncestor).not.toBeUndefined();
       });
@@ -50,12 +50,12 @@ describe('Tree', () => {
   describe('related events', () => {
     it('adds related events to the tree', () => {
       const root = generator.generateEvent();
-      const events: ResolverRelatedEvents = {
-        entityID: root.process.entity_id,
+      const events: SafeResolverRelatedEvents = {
+        entityID: entityIDSafeVersion(root) ?? '',
         events: Array.from(generator.relatedEventsGenerator(root)),
         nextEvent: null,
       };
-      const tree = new Tree(root.process.entity_id, { relatedEvents: events });
+      const tree = new Tree(entityIDSafeVersion(root) ?? '', { relatedEvents: events });
       const rendered = tree.render();
       expect(rendered.relatedEvents.nextEvent).toBeNull();
       expect(rendered.relatedEvents.events).toStrictEqual(events.events);
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.ts
index 3f941851a4143..dd493d70ffcd3 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/tree.ts
@@ -6,26 +6,26 @@
 
 import _ from 'lodash';
 import {
-  ResolverEvent,
+  SafeResolverEvent,
   ResolverNodeStats,
-  ResolverRelatedEvents,
-  ResolverAncestry,
-  ResolverTree,
-  ResolverChildren,
+  SafeResolverRelatedEvents,
+  SafeResolverAncestry,
+  SafeResolverTree,
+  SafeResolverChildren,
   ResolverRelatedAlerts,
 } from '../../../../../common/endpoint/types';
 import { createTree } from './node';
 
 interface Node {
   entityID: string;
-  lifecycle: ResolverEvent[];
+  lifecycle: SafeResolverEvent[];
   stats?: ResolverNodeStats;
 }
 
 export interface Options {
-  relatedEvents?: ResolverRelatedEvents;
-  ancestry?: ResolverAncestry;
-  children?: ResolverChildren;
+  relatedEvents?: SafeResolverRelatedEvents;
+  ancestry?: SafeResolverAncestry;
+  children?: SafeResolverChildren;
   relatedAlerts?: ResolverRelatedAlerts;
 }
 
@@ -37,7 +37,7 @@ export interface Options {
  */
 export class Tree {
   protected cache: Map<string, Node> = new Map();
-  protected tree: ResolverTree;
+  protected tree: SafeResolverTree;
 
   constructor(protected readonly id: string, options: Options = {}) {
     const tree = createTree(this.id);
@@ -55,7 +55,7 @@ export class Tree {
    *
    * @returns the origin ResolverNode
    */
-  public render(): ResolverTree {
+  public render(): SafeResolverTree {
     return this.tree;
   }
 
@@ -73,7 +73,7 @@ export class Tree {
    *
    * @param relatedEventsInfo is the related events and pagination information to add to the tree.
    */
-  private addRelatedEvents(relatedEventsInfo: ResolverRelatedEvents | undefined) {
+  private addRelatedEvents(relatedEventsInfo: SafeResolverRelatedEvents | undefined) {
     if (!relatedEventsInfo) {
       return;
     }
@@ -101,7 +101,7 @@ export class Tree {
    *
    * @param ancestorInfo is the ancestors and pagination information to add to the tree.
    */
-  private addAncestors(ancestorInfo: ResolverAncestry | undefined) {
+  private addAncestors(ancestorInfo: SafeResolverAncestry | undefined) {
     if (!ancestorInfo) {
       return;
     }
@@ -132,7 +132,7 @@ export class Tree {
     }
   }
 
-  private addChildren(children: ResolverChildren | undefined) {
+  private addChildren(children: SafeResolverChildren | undefined) {
     if (!children) {
       return;
     }
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
new file mode 100644
index 0000000000000..7403adfd9a659
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/__mocks__/index.ts
@@ -0,0 +1,2232 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+import {
+  HostsQueries,
+  HostDetailsRequestOptions,
+} from '../../../../../../../common/search_strategy';
+
+export const mockOptions: HostDetailsRequestOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  docValueFields: [
+    {
+      field: '@timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'event.created',
+      format: 'date_time',
+    },
+    {
+      field: 'event.end',
+      format: 'date_time',
+    },
+    {
+      field: 'event.ingested',
+      format: 'date_time',
+    },
+    {
+      field: 'event.start',
+      format: 'date_time',
+    },
+    {
+      field: 'file.accessed',
+      format: 'date_time',
+    },
+    {
+      field: 'file.created',
+      format: 'date_time',
+    },
+    {
+      field: 'file.ctime',
+      format: 'date_time',
+    },
+    {
+      field: 'file.mtime',
+      format: 'date_time',
+    },
+    {
+      field: 'package.installed',
+      format: 'date_time',
+    },
+    {
+      field: 'process.parent.start',
+      format: 'date_time',
+    },
+    {
+      field: 'process.start',
+      format: 'date_time',
+    },
+    {
+      field: 'system.audit.host.boottime',
+      format: 'date_time',
+    },
+    {
+      field: 'system.audit.package.installtime',
+      format: 'date_time',
+    },
+    {
+      field: 'system.audit.user.password.last_changed',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.client.not_after',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.client.not_before',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.server.not_after',
+      format: 'date_time',
+    },
+    {
+      field: 'tls.server.not_before',
+      format: 'date_time',
+    },
+    {
+      field: 'aws.cloudtrail.user_identity.session_context.creation_date',
+      format: 'date_time',
+    },
+    {
+      field: 'azure.auditlogs.properties.activity_datetime',
+      format: 'date_time',
+    },
+    {
+      field: 'azure.enqueued_time',
+      format: 'date_time',
+    },
+    {
+      field: 'azure.signinlogs.properties.created_at',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.agentReceiptTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.deviceCustomDate1',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.deviceCustomDate2',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.deviceReceiptTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.endTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.fileCreateTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.fileModificationTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.flexDate1',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.managerReceiptTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.oldFileCreateTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.oldFileModificationTime',
+      format: 'date_time',
+    },
+    {
+      field: 'cef.extensions.startTime',
+      format: 'date_time',
+    },
+    {
+      field: 'checkpoint.subs_exp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.EndTimestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.IncidentEndTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.IncidentStartTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.ProcessEndTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.ProcessStartTime',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.StartTimestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.Timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.event.UTCTimestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'crowdstrike.metadata.eventCreationTime',
+      format: 'date_time',
+    },
+    {
+      field: 'gsuite.admin.email.log_search_filter.end_date',
+      format: 'date_time',
+    },
+    {
+      field: 'gsuite.admin.email.log_search_filter.start_date',
+      format: 'date_time',
+    },
+    {
+      field: 'gsuite.admin.user.birthdate',
+      format: 'date_time',
+    },
+    {
+      field: 'kafka.block_timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'microsoft.defender_atp.lastUpdateTime',
+      format: 'date_time',
+    },
+    {
+      field: 'microsoft.defender_atp.resolvedTime',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.campaign.first_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.campaign.last_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.intrusion_set.first_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.intrusion_set.last_seen',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.observed_data.first_observed',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.observed_data.last_observed',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.report.published',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.threat_indicator.valid_from',
+      format: 'date_time',
+    },
+    {
+      field: 'misp.threat_indicator.valid_until',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.collection_time_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.exporter.timestamp',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_end_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.flow_start_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_export_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.max_flow_end_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_export_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.min_flow_start_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.monitoring_interval_end_milli_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.monitoring_interval_start_milli_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_microseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_nanoseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.observation_time_seconds',
+      format: 'date_time',
+    },
+    {
+      field: 'netflow.system_init_time_milliseconds',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.internal.lc_ctime',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.internal.time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.effective_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.endtime',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.event_queue_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.event_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.expire_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.recorded_time',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.stamp',
+      format: 'date_time',
+    },
+    {
+      field: 'rsa.time.starttime',
+      format: 'date_time',
+    },
+    {
+      field: 'sophos.xg.date',
+      format: 'date_time',
+    },
+    {
+      field: 'sophos.xg.eventtime',
+      format: 'date_time',
+    },
+    {
+      field: 'sophos.xg.start_time',
+      format: 'date_time',
+    },
+  ],
+  factoryQueryType: HostsQueries.authentications,
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  pagination: {
+    activePage: 0,
+    cursorStart: 0,
+    fakePossibleCount: 50,
+    querySize: 10,
+  },
+  timerange: {
+    interval: '12h',
+    from: '2020-09-02T15:17:13.678Z',
+    to: '2020-09-03T15:17:13.678Z',
+  },
+  hostName: 'bastion00',
+};
+
+export const mockSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 14,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: -1, max_score: 0, hits: [] },
+    aggregations: {
+      group_by_users: {
+        doc_count_error_upper_bound: -1,
+        sum_other_doc_count: 408,
+        buckets: [
+          {
+            key: 'SYSTEM',
+            doc_count: 281,
+            failures: {
+              meta: {},
+              doc_count: 0,
+              lastFailure: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+            successes: {
+              meta: {},
+              doc_count: 4,
+              lastSuccess: {
+                hits: {
+                  total: 4,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'winlogbeat-8.0.0-2020.09.02-000001',
+                      _id: 'zqY7WXQBA6bGZw2uLeKI',
+                      _score: null,
+                      _source: {
+                        process: {
+                          name: 'services.exe',
+                          pid: 564,
+                          executable: 'C:\\Windows\\System32\\services.exe',
+                        },
+                        agent: {
+                          build_date: '2020-07-16 09:16:27 +0000 UTC ',
+                          name: 'siem-windows',
+                          commit: '4dcbde39492bdc3843034bba8db811c68cb44b97 ',
+                          id: '05e1bff7-d7a8-416a-8554-aa10288fa07d',
+                          type: 'winlogbeat',
+                          ephemeral_id: '655abd6c-6c33-435d-a2eb-79b2a01e6d61',
+                          version: '8.0.0',
+                          user: { name: 'inside_winlogbeat_user' },
+                        },
+                        winlog: {
+                          computer_name: 'siem-windows',
+                          process: { pid: 576, thread: { id: 880 } },
+                          keywords: ['Audit Success'],
+                          logon: { id: '0x3e7', type: 'Service' },
+                          channel: 'Security',
+                          event_data: {
+                            LogonGuid: '{00000000-0000-0000-0000-000000000000}',
+                            TargetOutboundDomainName: '-',
+                            VirtualAccount: '%%1843',
+                            LogonType: '5',
+                            IpPort: '-',
+                            TransmittedServices: '-',
+                            SubjectLogonId: '0x3e7',
+                            LmPackageName: '-',
+                            TargetOutboundUserName: '-',
+                            KeyLength: '0',
+                            TargetLogonId: '0x3e7',
+                            RestrictedAdminMode: '-',
+                            SubjectUserName: 'SIEM-WINDOWS$',
+                            TargetLinkedLogonId: '0x0',
+                            ElevatedToken: '%%1842',
+                            SubjectDomainName: 'WORKGROUP',
+                            IpAddress: '-',
+                            ImpersonationLevel: '%%1833',
+                            TargetUserName: 'SYSTEM',
+                            LogonProcessName: 'Advapi  ',
+                            TargetDomainName: 'NT AUTHORITY',
+                            SubjectUserSid: 'S-1-5-18',
+                            TargetUserSid: 'S-1-5-18',
+                            AuthenticationPackageName: 'Negotiate',
+                          },
+                          opcode: 'Info',
+                          version: 2,
+                          record_id: 57818,
+                          task: 'Logon',
+                          event_id: 4624,
+                          provider_guid: '{54849625-5478-4994-a5ba-3e3b0328c30d}',
+                          activity_id: '{d2485217-6bac-0000-8fbb-3f7e2571d601}',
+                          api: 'wineventlog',
+                          provider_name: 'Microsoft-Windows-Security-Auditing',
+                        },
+                        log: { level: 'information' },
+                        source: { domain: '-' },
+                        message:
+                          'An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSIEM-WINDOWS$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSYSTEM\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x234\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.',
+                        cloud: {
+                          availability_zone: 'us-central1-c',
+                          instance: { name: 'siem-windows', id: '9156726559029788564' },
+                          provider: 'gcp',
+                          machine: { type: 'g1-small' },
+                          project: { id: 'elastic-siem' },
+                        },
+                        '@timestamp': '2020-09-04T13:08:02.532Z',
+                        related: { user: ['SYSTEM', 'SIEM-WINDOWS$'] },
+                        ecs: { version: '1.5.0' },
+                        host: {
+                          hostname: 'siem-windows',
+                          os: {
+                            build: '17763.1397',
+                            kernel: '10.0.17763.1397 (WinBuild.160101.0800)',
+                            name: 'Windows Server 2019 Datacenter',
+                            family: 'windows',
+                            version: '10.0',
+                            platform: 'windows',
+                          },
+                          ip: ['fe80::ecf5:decc:3ec3:767e', '10.200.0.15'],
+                          name: 'siem-windows',
+                          id: 'ce1d3c9b-a815-4643-9641-ada0f2c00609',
+                          mac: ['42:01:0a:c8:00:0f'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          code: 4624,
+                          provider: 'Microsoft-Windows-Security-Auditing',
+                          created: '2020-09-04T13:08:03.638Z',
+                          kind: 'event',
+                          module: 'security',
+                          action: 'logged-in',
+                          category: 'authentication',
+                          type: 'start',
+                          outcome: 'success',
+                        },
+                        user: { domain: 'NT AUTHORITY', name: 'SYSTEM', id: 'S-1-5-18' },
+                      },
+                      sort: [1599224882532],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'tsg',
+            doc_count: 1,
+            failures: {
+              doc_count: 0,
+              lastFailure: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+            successes: {
+              doc_count: 1,
+              lastSuccess: {
+                hits: {
+                  total: 1,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: '9_sfWXQBc39KFIJbIsDh',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20764 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 552463 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'DE-BE',
+                            city_name: 'Berlin',
+                            country_iso_code: 'DE',
+                            region_name: 'Land Berlin',
+                            location: { lon: 13.3512, lat: 52.5727 },
+                          },
+                          as: { number: 6805, organization: { name: 'Telefonica Germany' } },
+                          port: 57457,
+                          ip: '77.183.42.188',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:49:21.000Z',
+                        system: {
+                          auth: {
+                            ssh: {
+                              method: 'publickey',
+                              signature: 'RSA SHA256:vv64JNLzKZWYA9vonnGWuW7zxWhyZrL/BFxyIGbISx8',
+                              event: 'Accepted',
+                            },
+                          },
+                        },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_success',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'success',
+                        },
+                        user: { name: 'tsg' },
+                      },
+                      sort: [1599220161000],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'admin',
+            doc_count: 23,
+            failures: {
+              doc_count: 23,
+              lastFailure: {
+                hits: {
+                  total: 23,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'ZfxZWXQBc39KFIJbLN5U',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 22913 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 562910 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'KR-28',
+                            city_name: 'Incheon',
+                            country_iso_code: 'KR',
+                            region_name: 'Incheon',
+                            location: { lon: 126.7288, lat: 37.4562 },
+                          },
+                          as: { number: 4766, organization: { name: 'Korea Telecom' } },
+                          ip: '59.15.3.197',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:40:46.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'admin' },
+                      },
+                      sort: [1599226846000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'user',
+            doc_count: 21,
+            failures: {
+              doc_count: 21,
+              lastFailure: {
+                hits: {
+                  total: 21,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'M_xLWXQBc39KFIJbY7Cb',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20671 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1028103 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:43.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['user'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:47.034172Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'user' },
+                      },
+                      sort: [1599225943000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'ubuntu',
+            doc_count: 18,
+            failures: {
+              doc_count: 18,
+              lastFailure: {
+                hits: {
+                  total: 18,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'nPxKWXQBc39KFIJb7q4w',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          type: 'filebeat',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20665 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1027372 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:07.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['ubuntu'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:16.974606Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'ubuntu' },
+                      },
+                      sort: [1599225907000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'odoo',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'mPsfWXQBc39KFIJbI8HI',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          type: 'filebeat',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 21506 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 556761 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'IN-DL',
+                            city_name: 'New Delhi',
+                            country_iso_code: 'IN',
+                            region_name: 'National Capital Territory of Delhi',
+                            location: { lon: 77.2245, lat: 28.6358 },
+                          },
+                          as: { number: 10029, organization: { name: 'SHYAM SPECTRA PVT LTD' } },
+                          ip: '180.151.228.166',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T12:26:36.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'odoo' },
+                      },
+                      sort: [1599222396000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'pi',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'aaToWHQBA6bGZw2uR-St',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20475 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1019218 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'SE-AB',
+                            city_name: 'Stockholm',
+                            country_iso_code: 'SE',
+                            region_name: 'Stockholm',
+                            location: { lon: 17.7833, lat: 59.25 },
+                          },
+                          as: { number: 8473, organization: { name: 'Bahnhof AB' } },
+                          ip: '178.174.148.58',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:37:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['178.174.148.58'], user: ['pi'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T11:37:31.797423Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'pi' },
+                      },
+                      sort: [1599219442000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'demo',
+            doc_count: 14,
+            failures: {
+              doc_count: 14,
+              lastFailure: {
+                hits: {
+                  total: 14,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'VaP_V3QBA6bGZw2upUbg',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19849 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 981036 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:23:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['demo'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:23:26.046346Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'demo' },
+                      },
+                      sort: [1599204202000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'git',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'PqYfWXQBA6bGZw2uIhVU',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20396 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 550795 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'CN-BJ',
+                            city_name: 'Beijing',
+                            country_iso_code: 'CN',
+                            region_name: 'Beijing',
+                            location: { lon: 116.3889, lat: 39.9288 },
+                          },
+                          as: {
+                            number: 45090,
+                            organization: {
+                              name: 'Shenzhen Tencent Computer Systems Company Limited',
+                            },
+                          },
+                          ip: '123.206.30.76',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:20:26.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'git' },
+                      },
+                      sort: [1599218426000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'webadmin',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'iMABWHQBB-gskclyitP-',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19870 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 984133 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:25:28.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['webadmin'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:25:30.236651Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'webadmin' },
+                      },
+                      sort: [1599204328000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+        ],
+      },
+      user_count: { value: 188 },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedSearchStrategyResponse = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 14,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: -1, max_score: 0, hits: [] },
+    aggregations: {
+      group_by_users: {
+        doc_count_error_upper_bound: -1,
+        sum_other_doc_count: 408,
+        buckets: [
+          {
+            key: 'SYSTEM',
+            doc_count: 281,
+            failures: {
+              meta: {},
+              doc_count: 0,
+              lastFailure: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+            successes: {
+              meta: {},
+              doc_count: 4,
+              lastSuccess: {
+                hits: {
+                  total: 4,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'winlogbeat-8.0.0-2020.09.02-000001',
+                      _id: 'zqY7WXQBA6bGZw2uLeKI',
+                      _score: null,
+                      _source: {
+                        process: {
+                          name: 'services.exe',
+                          pid: 564,
+                          executable: 'C:\\Windows\\System32\\services.exe',
+                        },
+                        agent: {
+                          build_date: '2020-07-16 09:16:27 +0000 UTC ',
+                          name: 'siem-windows',
+                          commit: '4dcbde39492bdc3843034bba8db811c68cb44b97 ',
+                          id: '05e1bff7-d7a8-416a-8554-aa10288fa07d',
+                          type: 'winlogbeat',
+                          ephemeral_id: '655abd6c-6c33-435d-a2eb-79b2a01e6d61',
+                          version: '8.0.0',
+                          user: { name: 'inside_winlogbeat_user' },
+                        },
+                        winlog: {
+                          computer_name: 'siem-windows',
+                          process: { pid: 576, thread: { id: 880 } },
+                          keywords: ['Audit Success'],
+                          logon: { id: '0x3e7', type: 'Service' },
+                          channel: 'Security',
+                          event_data: {
+                            LogonGuid: '{00000000-0000-0000-0000-000000000000}',
+                            TargetOutboundDomainName: '-',
+                            VirtualAccount: '%%1843',
+                            LogonType: '5',
+                            IpPort: '-',
+                            TransmittedServices: '-',
+                            SubjectLogonId: '0x3e7',
+                            LmPackageName: '-',
+                            TargetOutboundUserName: '-',
+                            KeyLength: '0',
+                            TargetLogonId: '0x3e7',
+                            RestrictedAdminMode: '-',
+                            SubjectUserName: 'SIEM-WINDOWS$',
+                            TargetLinkedLogonId: '0x0',
+                            ElevatedToken: '%%1842',
+                            SubjectDomainName: 'WORKGROUP',
+                            IpAddress: '-',
+                            ImpersonationLevel: '%%1833',
+                            TargetUserName: 'SYSTEM',
+                            LogonProcessName: 'Advapi  ',
+                            TargetDomainName: 'NT AUTHORITY',
+                            SubjectUserSid: 'S-1-5-18',
+                            TargetUserSid: 'S-1-5-18',
+                            AuthenticationPackageName: 'Negotiate',
+                          },
+                          opcode: 'Info',
+                          version: 2,
+                          record_id: 57818,
+                          task: 'Logon',
+                          event_id: 4624,
+                          provider_guid: '{54849625-5478-4994-a5ba-3e3b0328c30d}',
+                          activity_id: '{d2485217-6bac-0000-8fbb-3f7e2571d601}',
+                          api: 'wineventlog',
+                          provider_name: 'Microsoft-Windows-Security-Auditing',
+                        },
+                        log: { level: 'information' },
+                        source: { domain: '-' },
+                        message:
+                          'An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSIEM-WINDOWS$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tSYSTEM\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x234\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.',
+                        cloud: {
+                          availability_zone: 'us-central1-c',
+                          instance: { name: 'siem-windows', id: '9156726559029788564' },
+                          provider: 'gcp',
+                          machine: { type: 'g1-small' },
+                          project: { id: 'elastic-siem' },
+                        },
+                        '@timestamp': '2020-09-04T13:08:02.532Z',
+                        related: { user: ['SYSTEM', 'SIEM-WINDOWS$'] },
+                        ecs: { version: '1.5.0' },
+                        host: {
+                          hostname: 'siem-windows',
+                          os: {
+                            build: '17763.1397',
+                            kernel: '10.0.17763.1397 (WinBuild.160101.0800)',
+                            name: 'Windows Server 2019 Datacenter',
+                            family: 'windows',
+                            version: '10.0',
+                            platform: 'windows',
+                          },
+                          ip: ['fe80::ecf5:decc:3ec3:767e', '10.200.0.15'],
+                          name: 'siem-windows',
+                          id: 'ce1d3c9b-a815-4643-9641-ada0f2c00609',
+                          mac: ['42:01:0a:c8:00:0f'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          code: 4624,
+                          provider: 'Microsoft-Windows-Security-Auditing',
+                          created: '2020-09-04T13:08:03.638Z',
+                          kind: 'event',
+                          module: 'security',
+                          action: 'logged-in',
+                          category: 'authentication',
+                          type: 'start',
+                          outcome: 'success',
+                        },
+                        user: { domain: 'NT AUTHORITY', name: 'SYSTEM', id: 'S-1-5-18' },
+                      },
+                      sort: [1599224882532],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'tsg',
+            doc_count: 1,
+            failures: { doc_count: 0, lastFailure: { hits: { total: 0, max_score: 0, hits: [] } } },
+            successes: {
+              doc_count: 1,
+              lastSuccess: {
+                hits: {
+                  total: 1,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: '9_sfWXQBc39KFIJbIsDh',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20764 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 552463 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'DE-BE',
+                            city_name: 'Berlin',
+                            country_iso_code: 'DE',
+                            region_name: 'Land Berlin',
+                            location: { lon: 13.3512, lat: 52.5727 },
+                          },
+                          as: { number: 6805, organization: { name: 'Telefonica Germany' } },
+                          port: 57457,
+                          ip: '77.183.42.188',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:49:21.000Z',
+                        system: {
+                          auth: {
+                            ssh: {
+                              method: 'publickey',
+                              signature: 'RSA SHA256:vv64JNLzKZWYA9vonnGWuW7zxWhyZrL/BFxyIGbISx8',
+                              event: 'Accepted',
+                            },
+                          },
+                        },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_success',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'success',
+                        },
+                        user: { name: 'tsg' },
+                      },
+                      sort: [1599220161000],
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          {
+            key: 'admin',
+            doc_count: 23,
+            failures: {
+              doc_count: 23,
+              lastFailure: {
+                hits: {
+                  total: 23,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'ZfxZWXQBc39KFIJbLN5U',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 22913 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 562910 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'KR-28',
+                            city_name: 'Incheon',
+                            country_iso_code: 'KR',
+                            region_name: 'Incheon',
+                            location: { lon: 126.7288, lat: 37.4562 },
+                          },
+                          as: { number: 4766, organization: { name: 'Korea Telecom' } },
+                          ip: '59.15.3.197',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:40:46.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'admin' },
+                      },
+                      sort: [1599226846000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'user',
+            doc_count: 21,
+            failures: {
+              doc_count: 21,
+              lastFailure: {
+                hits: {
+                  total: 21,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'M_xLWXQBc39KFIJbY7Cb',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20671 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1028103 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:43.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['user'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:47.034172Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'user' },
+                      },
+                      sort: [1599225943000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'ubuntu',
+            doc_count: 18,
+            failures: {
+              doc_count: 18,
+              lastFailure: {
+                hits: {
+                  total: 18,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'nPxKWXQBc39KFIJb7q4w',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          type: 'filebeat',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20665 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1027372 },
+                        source: {
+                          geo: {
+                            continent_name: 'North America',
+                            region_iso_code: 'US-NY',
+                            city_name: 'New York',
+                            country_iso_code: 'US',
+                            region_name: 'New York',
+                            location: { lon: -74, lat: 40.7157 },
+                          },
+                          ip: '64.227.88.245',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T13:25:07.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['64.227.88.245'], user: ['ubuntu'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T13:25:16.974606Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'ubuntu' },
+                      },
+                      sort: [1599225907000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'odoo',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'mPsfWXQBc39KFIJbI8HI',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          type: 'filebeat',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 21506 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 556761 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'IN-DL',
+                            city_name: 'New Delhi',
+                            country_iso_code: 'IN',
+                            region_name: 'National Capital Territory of Delhi',
+                            location: { lon: 77.2245, lat: 28.6358 },
+                          },
+                          as: { number: 10029, organization: { name: 'SHYAM SPECTRA PVT LTD' } },
+                          ip: '180.151.228.166',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T12:26:36.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'odoo' },
+                      },
+                      sort: [1599222396000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'pi',
+            doc_count: 17,
+            failures: {
+              doc_count: 17,
+              lastFailure: {
+                hits: {
+                  total: 17,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'aaToWHQBA6bGZw2uR-St',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 20475 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 1019218 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            region_iso_code: 'SE-AB',
+                            city_name: 'Stockholm',
+                            country_iso_code: 'SE',
+                            region_name: 'Stockholm',
+                            location: { lon: 17.7833, lat: 59.25 },
+                          },
+                          as: { number: 8473, organization: { name: 'Bahnhof AB' } },
+                          ip: '178.174.148.58',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:37:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['178.174.148.58'], user: ['pi'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T11:37:31.797423Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'pi' },
+                      },
+                      sort: [1599219442000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'demo',
+            doc_count: 14,
+            failures: {
+              doc_count: 14,
+              lastFailure: {
+                hits: {
+                  total: 14,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'VaP_V3QBA6bGZw2upUbg',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19849 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 981036 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:23:22.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['demo'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:23:26.046346Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'demo' },
+                      },
+                      sort: [1599204202000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'git',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: '.ds-logs-system.auth-default-000001',
+                      _id: 'PqYfWXQBA6bGZw2uIhVU',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          hostname: 'siem-kibana',
+                          name: 'siem-kibana',
+                          id: 'aa3d9dc7-fef1-4c2f-a68d-25785d624e35',
+                          ephemeral_id: 'e503bd85-11c7-4bc9-ae7d-70be1d919fb7',
+                          type: 'filebeat',
+                          version: '7.9.1',
+                        },
+                        process: { name: 'sshd', pid: 20396 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 550795 },
+                        source: {
+                          geo: {
+                            continent_name: 'Asia',
+                            region_iso_code: 'CN-BJ',
+                            city_name: 'Beijing',
+                            country_iso_code: 'CN',
+                            region_name: 'Beijing',
+                            location: { lon: 116.3889, lat: 39.9288 },
+                          },
+                          as: {
+                            number: 45090,
+                            organization: {
+                              name: 'Shenzhen Tencent Computer Systems Company Limited',
+                            },
+                          },
+                          ip: '123.206.30.76',
+                        },
+                        cloud: {
+                          availability_zone: 'us-east1-b',
+                          instance: { name: 'siem-kibana', id: '5412578377715150143' },
+                          provider: 'gcp',
+                          machine: { type: 'n1-standard-2' },
+                          project: { id: 'elastic-beats' },
+                        },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T11:20:26.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        data_stream: { namespace: 'default', type: 'logs', dataset: 'system.auth' },
+                        host: {
+                          hostname: 'siem-kibana',
+                          os: {
+                            kernel: '4.9.0-8-amd64',
+                            codename: 'stretch',
+                            name: 'Debian GNU/Linux',
+                            family: 'debian',
+                            version: '9 (stretch)',
+                            platform: 'debian',
+                          },
+                          containerized: false,
+                          ip: ['10.142.0.7', 'fe80::4001:aff:fe8e:7'],
+                          name: 'siem-kibana',
+                          id: 'aa7ca589f1b8220002f2fc61c64cfbf1',
+                          mac: ['42:01:0a:8e:00:07'],
+                          architecture: 'x86_64',
+                        },
+                        event: {
+                          timezone: '+00:00',
+                          action: 'ssh_login',
+                          type: 'authentication_failure',
+                          category: 'authentication',
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'git' },
+                      },
+                      sort: [1599218426000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+          {
+            key: 'webadmin',
+            doc_count: 13,
+            failures: {
+              doc_count: 13,
+              lastFailure: {
+                hits: {
+                  total: 13,
+                  max_score: 0,
+                  hits: [
+                    {
+                      _index: 'filebeat-8.0.0-2020.09.02-000001',
+                      _id: 'iMABWHQBB-gskclyitP-',
+                      _score: null,
+                      _source: {
+                        agent: {
+                          name: 'bastion00.siem.estc.dev',
+                          id: 'f9a321c1-ec27-49fa-aacf-6a50ef6d836f',
+                          type: 'filebeat',
+                          ephemeral_id: '734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc',
+                          version: '8.0.0',
+                        },
+                        process: { name: 'sshd', pid: 19870 },
+                        log: { file: { path: '/var/log/auth.log' }, offset: 984133 },
+                        source: {
+                          geo: {
+                            continent_name: 'Europe',
+                            country_iso_code: 'HR',
+                            location: { lon: 15.5, lat: 45.1667 },
+                          },
+                          as: {
+                            number: 42864,
+                            organization: { name: 'Giganet Internet Szolgaltato Kft' },
+                          },
+                          ip: '45.95.168.157',
+                        },
+                        fileset: { name: 'auth' },
+                        input: { type: 'log' },
+                        '@timestamp': '2020-09-04T07:25:28.000Z',
+                        system: { auth: { ssh: { event: 'Invalid' } } },
+                        ecs: { version: '1.5.0' },
+                        related: { ip: ['45.95.168.157'], user: ['webadmin'] },
+                        service: { type: 'system' },
+                        host: { hostname: 'bastion00', name: 'bastion00.siem.estc.dev' },
+                        event: {
+                          ingested: '2020-09-04T07:25:30.236651Z',
+                          timezone: '+00:00',
+                          kind: 'event',
+                          module: 'system',
+                          action: 'ssh_login',
+                          type: ['authentication_failure', 'info'],
+                          category: ['authentication'],
+                          dataset: 'system.auth',
+                          outcome: 'failure',
+                        },
+                        user: { name: 'webadmin' },
+                      },
+                      sort: [1599204328000],
+                    },
+                  ],
+                },
+              },
+            },
+            successes: {
+              doc_count: 0,
+              lastSuccess: { hits: { total: 0, max_score: 0, hits: [] } },
+            },
+          },
+        ],
+      },
+      user_count: { value: 188 },
+    },
+  },
+  total: 21,
+  loaded: 21,
+  inspect: {
+    dsl: [
+      '{\n  "allowNoIndices": true,\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "host_architecture": {\n        "terms": {\n          "field": "host.architecture",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_id": {\n        "terms": {\n          "field": "host.id",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_ip": {\n        "terms": {\n          "field": "host.ip",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_mac": {\n        "terms": {\n          "field": "host.mac",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_name": {\n        "terms": {\n          "field": "host.name",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_family": {\n        "terms": {\n          "field": "host.os.family",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_name": {\n        "terms": {\n          "field": "host.os.name",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_platform": {\n        "terms": {\n          "field": "host.os.platform",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "host_os_version": {\n        "terms": {\n          "field": "host.os.version",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_instance_id": {\n        "terms": {\n          "field": "cloud.instance.id",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_machine_type": {\n        "terms": {\n          "field": "cloud.machine.type",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_provider": {\n        "terms": {\n          "field": "cloud.provider",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      },\n      "cloud_region": {\n        "terms": {\n          "field": "cloud.region",\n          "size": 10,\n          "order": {\n            "timestamp": "desc"\n          }\n        },\n        "aggs": {\n          "timestamp": {\n            "max": {\n              "field": "@timestamp"\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          {\n            "term": {\n              "host.name": "bastion00"\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "format": "strict_date_optional_time",\n                "gte": "2020-09-02T15:17:13.678Z",\n                "lte": "2020-09-03T15:17:13.678Z"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": false\n  }\n}',
+    ],
+    response: [
+      '{\n  "isPartial": false,\n  "isRunning": false,\n  "rawResponse": {\n    "took": 14,\n    "timed_out": false,\n    "_shards": {\n      "total": 21,\n      "successful": 21,\n      "skipped": 0,\n      "failed": 0\n    },\n    "hits": {\n      "total": -1,\n      "max_score": 0,\n      "hits": []\n    },\n    "aggregations": {\n      "group_by_users": {\n        "doc_count_error_upper_bound": -1,\n        "sum_other_doc_count": 408,\n        "buckets": [\n          {\n            "key": "SYSTEM",\n            "doc_count": 281,\n            "failures": {\n              "meta": {},\n              "doc_count": 0,\n              "lastFailure": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            },\n            "successes": {\n              "meta": {},\n              "doc_count": 4,\n              "lastSuccess": {\n                "hits": {\n                  "total": 4,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": "winlogbeat-8.0.0-2020.09.02-000001",\n                      "_id": "zqY7WXQBA6bGZw2uLeKI",\n                      "_score": null,\n                      "_source": {\n                        "process": {\n                          "name": "services.exe",\n                          "pid": 564,\n                          "executable": "C:\\\\Windows\\\\System32\\\\services.exe"\n                        },\n                        "agent": {\n                          "build_date": "2020-07-16 09:16:27 +0000 UTC ",\n                          "name": "siem-windows",\n                          "commit": "4dcbde39492bdc3843034bba8db811c68cb44b97 ",\n                          "id": "05e1bff7-d7a8-416a-8554-aa10288fa07d",\n                          "type": "winlogbeat",\n                          "ephemeral_id": "655abd6c-6c33-435d-a2eb-79b2a01e6d61",\n                          "version": "8.0.0",\n                          "user": {\n                            "name": "inside_winlogbeat_user"\n                          }\n                        },\n                        "winlog": {\n                          "computer_name": "siem-windows",\n                          "process": {\n                            "pid": 576,\n                            "thread": {\n                              "id": 880\n                            }\n                          },\n                          "keywords": [\n                            "Audit Success"\n                          ],\n                          "logon": {\n                            "id": "0x3e7",\n                            "type": "Service"\n                          },\n                          "channel": "Security",\n                          "event_data": {\n                            "LogonGuid": "{00000000-0000-0000-0000-000000000000}",\n                            "TargetOutboundDomainName": "-",\n                            "VirtualAccount": "%%1843",\n                            "LogonType": "5",\n                            "IpPort": "-",\n                            "TransmittedServices": "-",\n                            "SubjectLogonId": "0x3e7",\n                            "LmPackageName": "-",\n                            "TargetOutboundUserName": "-",\n                            "KeyLength": "0",\n                            "TargetLogonId": "0x3e7",\n                            "RestrictedAdminMode": "-",\n                            "SubjectUserName": "SIEM-WINDOWS$",\n                            "TargetLinkedLogonId": "0x0",\n                            "ElevatedToken": "%%1842",\n                            "SubjectDomainName": "WORKGROUP",\n                            "IpAddress": "-",\n                            "ImpersonationLevel": "%%1833",\n                            "TargetUserName": "SYSTEM",\n                            "LogonProcessName": "Advapi  ",\n                            "TargetDomainName": "NT AUTHORITY",\n                            "SubjectUserSid": "S-1-5-18",\n                            "TargetUserSid": "S-1-5-18",\n                            "AuthenticationPackageName": "Negotiate"\n                          },\n                          "opcode": "Info",\n                          "version": 2,\n                          "record_id": 57818,\n                          "task": "Logon",\n                          "event_id": 4624,\n                          "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",\n                          "activity_id": "{d2485217-6bac-0000-8fbb-3f7e2571d601}",\n                          "api": "wineventlog",\n                          "provider_name": "Microsoft-Windows-Security-Auditing"\n                        },\n                        "log": {\n                          "level": "information"\n                        },\n                        "source": {\n                          "domain": "-"\n                        },\n                        "message": "An account was successfully logged on.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tS-1-5-18\\n\\tAccount Name:\\t\\tSIEM-WINDOWS$\\n\\tAccount Domain:\\t\\tWORKGROUP\\n\\tLogon ID:\\t\\t0x3E7\\n\\nLogon Information:\\n\\tLogon Type:\\t\\t5\\n\\tRestricted Admin Mode:\\t-\\n\\tVirtual Account:\\t\\tNo\\n\\tElevated Token:\\t\\tYes\\n\\nImpersonation Level:\\t\\tImpersonation\\n\\nNew Logon:\\n\\tSecurity ID:\\t\\tS-1-5-18\\n\\tAccount Name:\\t\\tSYSTEM\\n\\tAccount Domain:\\t\\tNT AUTHORITY\\n\\tLogon ID:\\t\\t0x3E7\\n\\tLinked Logon ID:\\t\\t0x0\\n\\tNetwork Account Name:\\t-\\n\\tNetwork Account Domain:\\t-\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\n\\nProcess Information:\\n\\tProcess ID:\\t\\t0x234\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\services.exe\\n\\nNetwork Information:\\n\\tWorkstation Name:\\t-\\n\\tSource Network Address:\\t-\\n\\tSource Port:\\t\\t-\\n\\nDetailed Authentication Information:\\n\\tLogon Process:\\t\\tAdvapi  \\n\\tAuthentication Package:\\tNegotiate\\n\\tTransited Services:\\t-\\n\\tPackage Name (NTLM only):\\t-\\n\\tKey Length:\\t\\t0\\n\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\n\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\n\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\n\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\n\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\n\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\n\\nThe authentication information fields provide detailed information about this specific logon request.\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.",\n                        "cloud": {\n                          "availability_zone": "us-central1-c",\n                          "instance": {\n                            "name": "siem-windows",\n                            "id": "9156726559029788564"\n                          },\n                          "provider": "gcp",\n                          "machine": {\n                            "type": "g1-small"\n                          },\n                          "project": {\n                            "id": "elastic-siem"\n                          }\n                        },\n                        "@timestamp": "2020-09-04T13:08:02.532Z",\n                        "related": {\n                          "user": [\n                            "SYSTEM",\n                            "SIEM-WINDOWS$"\n                          ]\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "host": {\n                          "hostname": "siem-windows",\n                          "os": {\n                            "build": "17763.1397",\n                            "kernel": "10.0.17763.1397 (WinBuild.160101.0800)",\n                            "name": "Windows Server 2019 Datacenter",\n                            "family": "windows",\n                            "version": "10.0",\n                            "platform": "windows"\n                          },\n                          "ip": [\n                            "fe80::ecf5:decc:3ec3:767e",\n                            "10.200.0.15"\n                          ],\n                          "name": "siem-windows",\n                          "id": "ce1d3c9b-a815-4643-9641-ada0f2c00609",\n                          "mac": [\n                            "42:01:0a:c8:00:0f"\n                          ],\n                          "architecture": "x86_64"\n                        },\n                        "event": {\n                          "code": 4624,\n                          "provider": "Microsoft-Windows-Security-Auditing",\n                          "created": "2020-09-04T13:08:03.638Z",\n                          "kind": "event",\n                          "module": "security",\n                          "action": "logged-in",\n                          "category": "authentication",\n                          "type": "start",\n                          "outcome": "success"\n                        },\n                        "user": {\n                          "domain": "NT AUTHORITY",\n                          "name": "SYSTEM",\n                          "id": "S-1-5-18"\n                        }\n                      },\n                      "sort": [\n                        1599224882532\n                      ]\n                    }\n                  ]\n                }\n              }\n            }\n          },\n          {\n            "key": "tsg",\n            "doc_count": 1,\n            "failures": {\n              "doc_count": 0,\n              "lastFailure": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 1,\n              "lastSuccess": {\n                "hits": {\n                  "total": 1,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": ".ds-logs-system.auth-default-000001",\n                      "_id": "9_sfWXQBc39KFIJbIsDh",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "hostname": "siem-kibana",\n                          "name": "siem-kibana",\n                          "id": "aa3d9dc7-fef1-4c2f-a68d-25785d624e35",\n                          "ephemeral_id": "e503bd85-11c7-4bc9-ae7d-70be1d919fb7",\n                          "type": "filebeat",\n                          "version": "7.9.1"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 20764\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 552463\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "Europe",\n                            "region_iso_code": "DE-BE",\n                            "city_name": "Berlin",\n                            "country_iso_code": "DE",\n                            "region_name": "Land Berlin",\n                            "location": {\n                              "lon": 13.3512,\n                              "lat": 52.5727\n                            }\n                          },\n                          "as": {\n                            "number": 6805,\n                            "organization": {\n                              "name": "Telefonica Germany"\n                            }\n                          },\n                          "port": 57457,\n                          "ip": "77.183.42.188"\n                        },\n                        "cloud": {\n                          "availability_zone": "us-east1-b",\n                          "instance": {\n                            "name": "siem-kibana",\n                            "id": "5412578377715150143"\n                          },\n                          "provider": "gcp",\n                          "machine": {\n                            "type": "n1-standard-2"\n                          },\n                          "project": {\n                            "id": "elastic-beats"\n                          }\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T11:49:21.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "method": "publickey",\n                              "signature": "RSA SHA256:vv64JNLzKZWYA9vonnGWuW7zxWhyZrL/BFxyIGbISx8",\n                              "event": "Accepted"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "data_stream": {\n                          "namespace": "default",\n                          "type": "logs",\n                          "dataset": "system.auth"\n                        },\n                        "host": {\n                          "hostname": "siem-kibana",\n                          "os": {\n                            "kernel": "4.9.0-8-amd64",\n                            "codename": "stretch",\n                            "name": "Debian GNU/Linux",\n                            "family": "debian",\n                            "version": "9 (stretch)",\n                            "platform": "debian"\n                          },\n                          "containerized": false,\n                          "ip": [\n                            "10.142.0.7",\n                            "fe80::4001:aff:fe8e:7"\n                          ],\n                          "name": "siem-kibana",\n                          "id": "aa7ca589f1b8220002f2fc61c64cfbf1",\n                          "mac": [\n                            "42:01:0a:8e:00:07"\n                          ],\n                          "architecture": "x86_64"\n                        },\n                        "event": {\n                          "timezone": "+00:00",\n                          "action": "ssh_login",\n                          "type": "authentication_success",\n                          "category": "authentication",\n                          "dataset": "system.auth",\n                          "outcome": "success"\n                        },\n                        "user": {\n                          "name": "tsg"\n                        }\n                      },\n                      "sort": [\n                        1599220161000\n                      ]\n                    }\n                  ]\n                }\n              }\n            }\n          },\n          {\n            "key": "admin",\n            "doc_count": 23,\n            "failures": {\n              "doc_count": 23,\n              "lastFailure": {\n                "hits": {\n                  "total": 23,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": ".ds-logs-system.auth-default-000001",\n                      "_id": "ZfxZWXQBc39KFIJbLN5U",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "hostname": "siem-kibana",\n                          "name": "siem-kibana",\n                          "id": "aa3d9dc7-fef1-4c2f-a68d-25785d624e35",\n                          "ephemeral_id": "e503bd85-11c7-4bc9-ae7d-70be1d919fb7",\n                          "type": "filebeat",\n                          "version": "7.9.1"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 22913\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 562910\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "Asia",\n                            "region_iso_code": "KR-28",\n                            "city_name": "Incheon",\n                            "country_iso_code": "KR",\n                            "region_name": "Incheon",\n                            "location": {\n                              "lon": 126.7288,\n                              "lat": 37.4562\n                            }\n                          },\n                          "as": {\n                            "number": 4766,\n                            "organization": {\n                              "name": "Korea Telecom"\n                            }\n                          },\n                          "ip": "59.15.3.197"\n                        },\n                        "cloud": {\n                          "availability_zone": "us-east1-b",\n                          "instance": {\n                            "name": "siem-kibana",\n                            "id": "5412578377715150143"\n                          },\n                          "provider": "gcp",\n                          "machine": {\n                            "type": "n1-standard-2"\n                          },\n                          "project": {\n                            "id": "elastic-beats"\n                          }\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T13:40:46.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "data_stream": {\n                          "namespace": "default",\n                          "type": "logs",\n                          "dataset": "system.auth"\n                        },\n                        "host": {\n                          "hostname": "siem-kibana",\n                          "os": {\n                            "kernel": "4.9.0-8-amd64",\n                            "codename": "stretch",\n                            "name": "Debian GNU/Linux",\n                            "family": "debian",\n                            "version": "9 (stretch)",\n                            "platform": "debian"\n                          },\n                          "containerized": false,\n                          "ip": [\n                            "10.142.0.7",\n                            "fe80::4001:aff:fe8e:7"\n                          ],\n                          "name": "siem-kibana",\n                          "id": "aa7ca589f1b8220002f2fc61c64cfbf1",\n                          "mac": [\n                            "42:01:0a:8e:00:07"\n                          ],\n                          "architecture": "x86_64"\n                        },\n                        "event": {\n                          "timezone": "+00:00",\n                          "action": "ssh_login",\n                          "type": "authentication_failure",\n                          "category": "authentication",\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "admin"\n                        }\n                      },\n                      "sort": [\n                        1599226846000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          },\n          {\n            "key": "user",\n            "doc_count": 21,\n            "failures": {\n              "doc_count": 21,\n              "lastFailure": {\n                "hits": {\n                  "total": 21,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": "filebeat-8.0.0-2020.09.02-000001",\n                      "_id": "M_xLWXQBc39KFIJbY7Cb",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "name": "bastion00.siem.estc.dev",\n                          "id": "f9a321c1-ec27-49fa-aacf-6a50ef6d836f",\n                          "type": "filebeat",\n                          "ephemeral_id": "734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc",\n                          "version": "8.0.0"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 20671\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 1028103\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "North America",\n                            "region_iso_code": "US-NY",\n                            "city_name": "New York",\n                            "country_iso_code": "US",\n                            "region_name": "New York",\n                            "location": {\n                              "lon": -74,\n                              "lat": 40.7157\n                            }\n                          },\n                          "ip": "64.227.88.245"\n                        },\n                        "fileset": {\n                          "name": "auth"\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T13:25:43.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "related": {\n                          "ip": [\n                            "64.227.88.245"\n                          ],\n                          "user": [\n                            "user"\n                          ]\n                        },\n                        "service": {\n                          "type": "system"\n                        },\n                        "host": {\n                          "hostname": "bastion00",\n                          "name": "bastion00.siem.estc.dev"\n                        },\n                        "event": {\n                          "ingested": "2020-09-04T13:25:47.034172Z",\n                          "timezone": "+00:00",\n                          "kind": "event",\n                          "module": "system",\n                          "action": "ssh_login",\n                          "type": [\n                            "authentication_failure",\n                            "info"\n                          ],\n                          "category": [\n                            "authentication"\n                          ],\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "user"\n                        }\n                      },\n                      "sort": [\n                        1599225943000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          },\n          {\n            "key": "ubuntu",\n            "doc_count": 18,\n            "failures": {\n              "doc_count": 18,\n              "lastFailure": {\n                "hits": {\n                  "total": 18,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": "filebeat-8.0.0-2020.09.02-000001",\n                      "_id": "nPxKWXQBc39KFIJb7q4w",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "name": "bastion00.siem.estc.dev",\n                          "id": "f9a321c1-ec27-49fa-aacf-6a50ef6d836f",\n                          "ephemeral_id": "734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc",\n                          "type": "filebeat",\n                          "version": "8.0.0"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 20665\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 1027372\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "North America",\n                            "region_iso_code": "US-NY",\n                            "city_name": "New York",\n                            "country_iso_code": "US",\n                            "region_name": "New York",\n                            "location": {\n                              "lon": -74,\n                              "lat": 40.7157\n                            }\n                          },\n                          "ip": "64.227.88.245"\n                        },\n                        "fileset": {\n                          "name": "auth"\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T13:25:07.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "related": {\n                          "ip": [\n                            "64.227.88.245"\n                          ],\n                          "user": [\n                            "ubuntu"\n                          ]\n                        },\n                        "service": {\n                          "type": "system"\n                        },\n                        "host": {\n                          "hostname": "bastion00",\n                          "name": "bastion00.siem.estc.dev"\n                        },\n                        "event": {\n                          "ingested": "2020-09-04T13:25:16.974606Z",\n                          "timezone": "+00:00",\n                          "kind": "event",\n                          "module": "system",\n                          "action": "ssh_login",\n                          "type": [\n                            "authentication_failure",\n                            "info"\n                          ],\n                          "category": [\n                            "authentication"\n                          ],\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "ubuntu"\n                        }\n                      },\n                      "sort": [\n                        1599225907000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          },\n          {\n            "key": "odoo",\n            "doc_count": 17,\n            "failures": {\n              "doc_count": 17,\n              "lastFailure": {\n                "hits": {\n                  "total": 17,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": ".ds-logs-system.auth-default-000001",\n                      "_id": "mPsfWXQBc39KFIJbI8HI",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "hostname": "siem-kibana",\n                          "name": "siem-kibana",\n                          "id": "aa3d9dc7-fef1-4c2f-a68d-25785d624e35",\n                          "type": "filebeat",\n                          "ephemeral_id": "e503bd85-11c7-4bc9-ae7d-70be1d919fb7",\n                          "version": "7.9.1"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 21506\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 556761\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "Asia",\n                            "region_iso_code": "IN-DL",\n                            "city_name": "New Delhi",\n                            "country_iso_code": "IN",\n                            "region_name": "National Capital Territory of Delhi",\n                            "location": {\n                              "lon": 77.2245,\n                              "lat": 28.6358\n                            }\n                          },\n                          "as": {\n                            "number": 10029,\n                            "organization": {\n                              "name": "SHYAM SPECTRA PVT LTD"\n                            }\n                          },\n                          "ip": "180.151.228.166"\n                        },\n                        "cloud": {\n                          "availability_zone": "us-east1-b",\n                          "instance": {\n                            "name": "siem-kibana",\n                            "id": "5412578377715150143"\n                          },\n                          "provider": "gcp",\n                          "machine": {\n                            "type": "n1-standard-2"\n                          },\n                          "project": {\n                            "id": "elastic-beats"\n                          }\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T12:26:36.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "data_stream": {\n                          "namespace": "default",\n                          "type": "logs",\n                          "dataset": "system.auth"\n                        },\n                        "host": {\n                          "hostname": "siem-kibana",\n                          "os": {\n                            "kernel": "4.9.0-8-amd64",\n                            "codename": "stretch",\n                            "name": "Debian GNU/Linux",\n                            "family": "debian",\n                            "version": "9 (stretch)",\n                            "platform": "debian"\n                          },\n                          "containerized": false,\n                          "ip": [\n                            "10.142.0.7",\n                            "fe80::4001:aff:fe8e:7"\n                          ],\n                          "name": "siem-kibana",\n                          "id": "aa7ca589f1b8220002f2fc61c64cfbf1",\n                          "mac": [\n                            "42:01:0a:8e:00:07"\n                          ],\n                          "architecture": "x86_64"\n                        },\n                        "event": {\n                          "timezone": "+00:00",\n                          "action": "ssh_login",\n                          "type": "authentication_failure",\n                          "category": "authentication",\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "odoo"\n                        }\n                      },\n                      "sort": [\n                        1599222396000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          },\n          {\n            "key": "pi",\n            "doc_count": 17,\n            "failures": {\n              "doc_count": 17,\n              "lastFailure": {\n                "hits": {\n                  "total": 17,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": "filebeat-8.0.0-2020.09.02-000001",\n                      "_id": "aaToWHQBA6bGZw2uR-St",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "name": "bastion00.siem.estc.dev",\n                          "id": "f9a321c1-ec27-49fa-aacf-6a50ef6d836f",\n                          "type": "filebeat",\n                          "ephemeral_id": "734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc",\n                          "version": "8.0.0"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 20475\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 1019218\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "Europe",\n                            "region_iso_code": "SE-AB",\n                            "city_name": "Stockholm",\n                            "country_iso_code": "SE",\n                            "region_name": "Stockholm",\n                            "location": {\n                              "lon": 17.7833,\n                              "lat": 59.25\n                            }\n                          },\n                          "as": {\n                            "number": 8473,\n                            "organization": {\n                              "name": "Bahnhof AB"\n                            }\n                          },\n                          "ip": "178.174.148.58"\n                        },\n                        "fileset": {\n                          "name": "auth"\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T11:37:22.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "related": {\n                          "ip": [\n                            "178.174.148.58"\n                          ],\n                          "user": [\n                            "pi"\n                          ]\n                        },\n                        "service": {\n                          "type": "system"\n                        },\n                        "host": {\n                          "hostname": "bastion00",\n                          "name": "bastion00.siem.estc.dev"\n                        },\n                        "event": {\n                          "ingested": "2020-09-04T11:37:31.797423Z",\n                          "timezone": "+00:00",\n                          "kind": "event",\n                          "module": "system",\n                          "action": "ssh_login",\n                          "type": [\n                            "authentication_failure",\n                            "info"\n                          ],\n                          "category": [\n                            "authentication"\n                          ],\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "pi"\n                        }\n                      },\n                      "sort": [\n                        1599219442000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          },\n          {\n            "key": "demo",\n            "doc_count": 14,\n            "failures": {\n              "doc_count": 14,\n              "lastFailure": {\n                "hits": {\n                  "total": 14,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": "filebeat-8.0.0-2020.09.02-000001",\n                      "_id": "VaP_V3QBA6bGZw2upUbg",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "name": "bastion00.siem.estc.dev",\n                          "id": "f9a321c1-ec27-49fa-aacf-6a50ef6d836f",\n                          "type": "filebeat",\n                          "ephemeral_id": "734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc",\n                          "version": "8.0.0"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 19849\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 981036\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "Europe",\n                            "country_iso_code": "HR",\n                            "location": {\n                              "lon": 15.5,\n                              "lat": 45.1667\n                            }\n                          },\n                          "as": {\n                            "number": 42864,\n                            "organization": {\n                              "name": "Giganet Internet Szolgaltato Kft"\n                            }\n                          },\n                          "ip": "45.95.168.157"\n                        },\n                        "fileset": {\n                          "name": "auth"\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T07:23:22.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "related": {\n                          "ip": [\n                            "45.95.168.157"\n                          ],\n                          "user": [\n                            "demo"\n                          ]\n                        },\n                        "service": {\n                          "type": "system"\n                        },\n                        "host": {\n                          "hostname": "bastion00",\n                          "name": "bastion00.siem.estc.dev"\n                        },\n                        "event": {\n                          "ingested": "2020-09-04T07:23:26.046346Z",\n                          "timezone": "+00:00",\n                          "kind": "event",\n                          "module": "system",\n                          "action": "ssh_login",\n                          "type": [\n                            "authentication_failure",\n                            "info"\n                          ],\n                          "category": [\n                            "authentication"\n                          ],\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "demo"\n                        }\n                      },\n                      "sort": [\n                        1599204202000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          },\n          {\n            "key": "git",\n            "doc_count": 13,\n            "failures": {\n              "doc_count": 13,\n              "lastFailure": {\n                "hits": {\n                  "total": 13,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": ".ds-logs-system.auth-default-000001",\n                      "_id": "PqYfWXQBA6bGZw2uIhVU",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "hostname": "siem-kibana",\n                          "name": "siem-kibana",\n                          "id": "aa3d9dc7-fef1-4c2f-a68d-25785d624e35",\n                          "ephemeral_id": "e503bd85-11c7-4bc9-ae7d-70be1d919fb7",\n                          "type": "filebeat",\n                          "version": "7.9.1"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 20396\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 550795\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "Asia",\n                            "region_iso_code": "CN-BJ",\n                            "city_name": "Beijing",\n                            "country_iso_code": "CN",\n                            "region_name": "Beijing",\n                            "location": {\n                              "lon": 116.3889,\n                              "lat": 39.9288\n                            }\n                          },\n                          "as": {\n                            "number": 45090,\n                            "organization": {\n                              "name": "Shenzhen Tencent Computer Systems Company Limited"\n                            }\n                          },\n                          "ip": "123.206.30.76"\n                        },\n                        "cloud": {\n                          "availability_zone": "us-east1-b",\n                          "instance": {\n                            "name": "siem-kibana",\n                            "id": "5412578377715150143"\n                          },\n                          "provider": "gcp",\n                          "machine": {\n                            "type": "n1-standard-2"\n                          },\n                          "project": {\n                            "id": "elastic-beats"\n                          }\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T11:20:26.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "data_stream": {\n                          "namespace": "default",\n                          "type": "logs",\n                          "dataset": "system.auth"\n                        },\n                        "host": {\n                          "hostname": "siem-kibana",\n                          "os": {\n                            "kernel": "4.9.0-8-amd64",\n                            "codename": "stretch",\n                            "name": "Debian GNU/Linux",\n                            "family": "debian",\n                            "version": "9 (stretch)",\n                            "platform": "debian"\n                          },\n                          "containerized": false,\n                          "ip": [\n                            "10.142.0.7",\n                            "fe80::4001:aff:fe8e:7"\n                          ],\n                          "name": "siem-kibana",\n                          "id": "aa7ca589f1b8220002f2fc61c64cfbf1",\n                          "mac": [\n                            "42:01:0a:8e:00:07"\n                          ],\n                          "architecture": "x86_64"\n                        },\n                        "event": {\n                          "timezone": "+00:00",\n                          "action": "ssh_login",\n                          "type": "authentication_failure",\n                          "category": "authentication",\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "git"\n                        }\n                      },\n                      "sort": [\n                        1599218426000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          },\n          {\n            "key": "webadmin",\n            "doc_count": 13,\n            "failures": {\n              "doc_count": 13,\n              "lastFailure": {\n                "hits": {\n                  "total": 13,\n                  "max_score": 0,\n                  "hits": [\n                    {\n                      "_index": "filebeat-8.0.0-2020.09.02-000001",\n                      "_id": "iMABWHQBB-gskclyitP-",\n                      "_score": null,\n                      "_source": {\n                        "agent": {\n                          "name": "bastion00.siem.estc.dev",\n                          "id": "f9a321c1-ec27-49fa-aacf-6a50ef6d836f",\n                          "type": "filebeat",\n                          "ephemeral_id": "734ee3da-1a4f-4bc9-b400-e0cf0e5eeebc",\n                          "version": "8.0.0"\n                        },\n                        "process": {\n                          "name": "sshd",\n                          "pid": 19870\n                        },\n                        "log": {\n                          "file": {\n                            "path": "/var/log/auth.log"\n                          },\n                          "offset": 984133\n                        },\n                        "source": {\n                          "geo": {\n                            "continent_name": "Europe",\n                            "country_iso_code": "HR",\n                            "location": {\n                              "lon": 15.5,\n                              "lat": 45.1667\n                            }\n                          },\n                          "as": {\n                            "number": 42864,\n                            "organization": {\n                              "name": "Giganet Internet Szolgaltato Kft"\n                            }\n                          },\n                          "ip": "45.95.168.157"\n                        },\n                        "fileset": {\n                          "name": "auth"\n                        },\n                        "input": {\n                          "type": "log"\n                        },\n                        "@timestamp": "2020-09-04T07:25:28.000Z",\n                        "system": {\n                          "auth": {\n                            "ssh": {\n                              "event": "Invalid"\n                            }\n                          }\n                        },\n                        "ecs": {\n                          "version": "1.5.0"\n                        },\n                        "related": {\n                          "ip": [\n                            "45.95.168.157"\n                          ],\n                          "user": [\n                            "webadmin"\n                          ]\n                        },\n                        "service": {\n                          "type": "system"\n                        },\n                        "host": {\n                          "hostname": "bastion00",\n                          "name": "bastion00.siem.estc.dev"\n                        },\n                        "event": {\n                          "ingested": "2020-09-04T07:25:30.236651Z",\n                          "timezone": "+00:00",\n                          "kind": "event",\n                          "module": "system",\n                          "action": "ssh_login",\n                          "type": [\n                            "authentication_failure",\n                            "info"\n                          ],\n                          "category": [\n                            "authentication"\n                          ],\n                          "dataset": "system.auth",\n                          "outcome": "failure"\n                        },\n                        "user": {\n                          "name": "webadmin"\n                        }\n                      },\n                      "sort": [\n                        1599204328000\n                      ]\n                    }\n                  ]\n                }\n              }\n            },\n            "successes": {\n              "doc_count": 0,\n              "lastSuccess": {\n                "hits": {\n                  "total": 0,\n                  "max_score": 0,\n                  "hits": []\n                }\n              }\n            }\n          }\n        ]\n      },\n      "user_count": {\n        "value": 188\n      }\n    }\n  },\n  "total": 21,\n  "loaded": 21\n}',
+    ],
+  },
+  hostDetails: {},
+};
+
+export const expectedDsl = {
+  allowNoIndices: true,
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      host_architecture: {
+        terms: { field: 'host.architecture', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_id: {
+        terms: { field: 'host.id', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_ip: {
+        terms: { field: 'host.ip', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_mac: {
+        terms: { field: 'host.mac', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_name: {
+        terms: { field: 'host.name', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_os_family: {
+        terms: { field: 'host.os.family', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_os_name: {
+        terms: { field: 'host.os.name', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_os_platform: {
+        terms: { field: 'host.os.platform', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      host_os_version: {
+        terms: { field: 'host.os.version', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      cloud_instance_id: {
+        terms: { field: 'cloud.instance.id', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      cloud_machine_type: {
+        terms: { field: 'cloud.machine.type', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      cloud_provider: {
+        terms: { field: 'cloud.provider', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+      cloud_region: {
+        terms: { field: 'cloud.region', size: 10, order: { timestamp: 'desc' } },
+        aggs: { timestamp: { max: { field: '@timestamp' } } },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          { term: { 'host.name': 'bastion00' } },
+          {
+            range: {
+              '@timestamp': {
+                format: 'strict_date_optional_time',
+                gte: '2020-09-02T15:17:13.678Z',
+                lte: '2020-09-03T15:17:13.678Z',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
new file mode 100644
index 0000000000000..816b9b2081c63
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as buildQuery from './query.host_details.dsl';
+import { hostDetails } from '.';
+import {
+  mockOptions,
+  mockSearchStrategyResponse,
+  formattedSearchStrategyResponse,
+} from './__mocks__';
+
+describe('hostDetails search strategy', () => {
+  const buildHostDetailsQuery = jest.spyOn(buildQuery, 'buildHostDetailsQuery');
+
+  afterEach(() => {
+    buildHostDetailsQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      hostDetails.buildDsl(mockOptions);
+      expect(buildHostDetailsQuery).toHaveBeenCalledWith(mockOptions);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await hostDetails.parse(mockOptions, mockSearchStrategyResponse);
+      expect(result).toMatchObject(formattedSearchStrategyResponse);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.test.ts
new file mode 100644
index 0000000000000..eab1966434859
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildHostDetailsQuery as buildQuery } from './query.host_details.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
new file mode 100644
index 0000000000000..73cf74087aad6
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/__mocks__/index.ts
@@ -0,0 +1,1305 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { MatrixHistogramStrategyResponse } from '../../../../../../common/search_strategy';
+
+export const mockAlertsSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 11,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: 0, max_score: 0, hits: [] },
+    aggregations: {
+      alertsGroup: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedAlertsSearchStrategyResponse: MatrixHistogramStrategyResponse = {
+  ...mockAlertsSearchStrategyResponse,
+  inspect: {
+    dsl: [
+      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "alertsGroup": {\n        "terms": {\n          "field": "event.module",\n          "missing": "All others",\n          "order": {\n            "_count": "desc"\n          },\n          "size": 10\n        },\n        "aggs": {\n          "alerts": {\n            "date_histogram": {\n              "field": "@timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599574984482,\n                "max": 1599661384482\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}},{\\"bool\\":{\\"filter\\":[{\\"bool\\":{\\"should\\":[{\\"exists\\":{\\"field\\":\\"host.name\\"}}],\\"minimum_should_match\\":1}}]}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "bool": {\n              "filter": [\n                {\n                  "bool": {\n                    "should": [\n                      {\n                        "match": {\n                          "event.kind": "alert"\n                        }\n                      }\n                    ],\n                    "minimum_should_match": 1\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T14:23:04.482Z",\n                "lte": "2020-09-09T14:23:04.482Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+    ],
+  },
+  matrixHistogramData: [],
+  totalCount: 0,
+};
+
+export const expectedDsl = {
+  allowNoIndices: true,
+  body: {
+    aggregations: {
+      host_count: { cardinality: { field: 'host.name' } },
+      host_data: {
+        aggs: {
+          lastSeen: { max: { field: '@timestamp' } },
+          os: {
+            top_hits: {
+              _source: { includes: ['host.os.*'] },
+              size: 1,
+              sort: [{ '@timestamp': { order: 'desc' } }],
+            },
+          },
+        },
+        terms: { field: 'host.name', order: { lastSeen: 'desc' }, size: 10 },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          { bool: { filter: [{ match_all: {} }], must: [], must_not: [], should: [] } },
+          {
+            range: {
+              '@timestamp': {
+                format: 'strict_date_optional_time',
+                gte: '2020-09-03T09:15:21.415Z',
+                lte: '2020-09-04T09:15:21.415Z',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  },
+  ignoreUnavailable: true,
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+};
+
+export const mockAnomaliesSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 9,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: 0, max_score: 0, hits: [] },
+    aggregations: {
+      anomalyActionGroup: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedAnomaliesSearchStrategyResponse: MatrixHistogramStrategyResponse = {
+  ...mockAnomaliesSearchStrategyResponse,
+  inspect: {
+    dsl: [
+      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggs": {\n      "anomalyActionGroup": {\n        "terms": {\n          "field": "job_id",\n          "order": {\n            "_count": "desc"\n          },\n          "size": 10\n        },\n        "aggs": {\n          "anomalies": {\n            "date_histogram": {\n              "field": "timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599578075566,\n                "max": 1599664475566\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}},{\\"bool\\":{\\"should\\":[],\\"minimum_should_match\\":1}},{\\"match_phrase\\":{\\"result_type\\":\\"record\\"}},null,{\\"range\\":{\\"record_score\\":{\\"gte\\":50}}}],\\"should\\":[{\\"exists\\":{\\"field\\":\\"source.ip\\"}},{\\"exists\\":{\\"field\\":\\"destination.ip\\"}}],\\"must_not\\":[],\\"minimum_should_match\\":1}}",\n          {\n            "range": {\n              "timestamp": {\n                "gte": "2020-09-08T15:14:35.566Z",\n                "lte": "2020-09-09T15:14:35.566Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+    ],
+  },
+  matrixHistogramData: [],
+  totalCount: 0,
+};
+
+export const mockAuthenticationsSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 6,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: 0, max_score: 0, hits: [] },
+    aggregations: {
+      eventActionGroup: {
+        doc_count_error_upper_bound: 0,
+        sum_other_doc_count: 0,
+        buckets: [
+          {
+            key: 'failure',
+            doc_count: 379,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:00:00.000Z', key: 1599577200000, doc_count: 1 },
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 4 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 34 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 1 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 3 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 20 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 24 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 37 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 4 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 22 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 3 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 0 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 2 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 21 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 28 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 30 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 19 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 4 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 1 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 6 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 18 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 5 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 23 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 15 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 2 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 0 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 5 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 2 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 4 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 6 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 11 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 0 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 24 },
+              ],
+            },
+          },
+          {
+            key: 'success',
+            doc_count: 191,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:00:00.000Z', key: 1599577200000, doc_count: 2 },
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 5 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 5 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 2 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 4 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 6 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 4 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 13 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 6 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 3 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 1 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 9 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 5 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 6 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 8 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 2 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 9 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 2 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 5 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 2 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 14 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 7 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 13 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 10 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 5 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 2 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 6 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 7 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 5 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 6 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 5 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 10 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 2 },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedAuthenticationsSearchStrategyResponse: MatrixHistogramStrategyResponse = {
+  ...mockAuthenticationsSearchStrategyResponse,
+  inspect: {
+    dsl: [
+      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "eventActionGroup": {\n        "terms": {\n          "field": "event.outcome",\n          "include": [\n            "success",\n            "failure"\n          ],\n          "order": {\n            "_count": "desc"\n          },\n          "size": 2\n        },\n        "aggs": {\n          "events": {\n            "date_histogram": {\n              "field": "@timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599578520325,\n                "max": 1599664920325\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "bool": {\n              "must": [\n                {\n                  "term": {\n                    "event.category": "authentication"\n                  }\n                }\n              ]\n            }\n          },\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T15:22:00.325Z",\n                "lte": "2020-09-09T15:22:00.325Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+    ],
+  },
+  matrixHistogramData: [
+    { x: 1599577200000, y: 1, g: 'failure' },
+    { x: 1599579900000, y: 4, g: 'failure' },
+    { x: 1599582600000, y: 34, g: 'failure' },
+    { x: 1599585300000, y: 1, g: 'failure' },
+    { x: 1599588000000, y: 3, g: 'failure' },
+    { x: 1599590700000, y: 20, g: 'failure' },
+    { x: 1599593400000, y: 24, g: 'failure' },
+    { x: 1599596100000, y: 37, g: 'failure' },
+    { x: 1599598800000, y: 4, g: 'failure' },
+    { x: 1599601500000, y: 22, g: 'failure' },
+    { x: 1599604200000, y: 3, g: 'failure' },
+    { x: 1599606900000, y: 0, g: 'failure' },
+    { x: 1599609600000, y: 2, g: 'failure' },
+    { x: 1599612300000, y: 21, g: 'failure' },
+    { x: 1599615000000, y: 28, g: 'failure' },
+    { x: 1599617700000, y: 30, g: 'failure' },
+    { x: 1599620400000, y: 19, g: 'failure' },
+    { x: 1599623100000, y: 4, g: 'failure' },
+    { x: 1599625800000, y: 1, g: 'failure' },
+    { x: 1599628500000, y: 6, g: 'failure' },
+    { x: 1599631200000, y: 18, g: 'failure' },
+    { x: 1599633900000, y: 5, g: 'failure' },
+    { x: 1599636600000, y: 23, g: 'failure' },
+    { x: 1599639300000, y: 15, g: 'failure' },
+    { x: 1599642000000, y: 2, g: 'failure' },
+    { x: 1599644700000, y: 0, g: 'failure' },
+    { x: 1599647400000, y: 5, g: 'failure' },
+    { x: 1599650100000, y: 2, g: 'failure' },
+    { x: 1599652800000, y: 4, g: 'failure' },
+    { x: 1599655500000, y: 6, g: 'failure' },
+    { x: 1599658200000, y: 11, g: 'failure' },
+    { x: 1599660900000, y: 0, g: 'failure' },
+    { x: 1599663600000, y: 24, g: 'failure' },
+    { x: 1599577200000, y: 2, g: 'success' },
+    { x: 1599579900000, y: 5, g: 'success' },
+    { x: 1599582600000, y: 5, g: 'success' },
+    { x: 1599585300000, y: 2, g: 'success' },
+    { x: 1599588000000, y: 4, g: 'success' },
+    { x: 1599590700000, y: 6, g: 'success' },
+    { x: 1599593400000, y: 4, g: 'success' },
+    { x: 1599596100000, y: 13, g: 'success' },
+    { x: 1599598800000, y: 6, g: 'success' },
+    { x: 1599601500000, y: 3, g: 'success' },
+    { x: 1599604200000, y: 1, g: 'success' },
+    { x: 1599606900000, y: 9, g: 'success' },
+    { x: 1599609600000, y: 5, g: 'success' },
+    { x: 1599612300000, y: 6, g: 'success' },
+    { x: 1599615000000, y: 8, g: 'success' },
+    { x: 1599617700000, y: 2, g: 'success' },
+    { x: 1599620400000, y: 9, g: 'success' },
+    { x: 1599623100000, y: 2, g: 'success' },
+    { x: 1599625800000, y: 5, g: 'success' },
+    { x: 1599628500000, y: 2, g: 'success' },
+    { x: 1599631200000, y: 14, g: 'success' },
+    { x: 1599633900000, y: 7, g: 'success' },
+    { x: 1599636600000, y: 13, g: 'success' },
+    { x: 1599639300000, y: 10, g: 'success' },
+    { x: 1599642000000, y: 5, g: 'success' },
+    { x: 1599644700000, y: 2, g: 'success' },
+    { x: 1599647400000, y: 6, g: 'success' },
+    { x: 1599650100000, y: 7, g: 'success' },
+    { x: 1599652800000, y: 5, g: 'success' },
+    { x: 1599655500000, y: 6, g: 'success' },
+    { x: 1599658200000, y: 5, g: 'success' },
+    { x: 1599660900000, y: 10, g: 'success' },
+    { x: 1599663600000, y: 2, g: 'success' },
+  ],
+  totalCount: 0,
+};
+
+export const mockEventsSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 198,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: 0, max_score: 0, hits: [] },
+    aggregations: {
+      eventActionGroup: {
+        doc_count_error_upper_bound: 3,
+        sum_other_doc_count: 4090,
+        buckets: [
+          {
+            key: 'All others',
+            doc_count: 1556741,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 26124 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 62910 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 60326 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 56144 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 53614 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 53228 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 61195 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 52082 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 52697 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 41094 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 50164 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 41500 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 42373 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 49785 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 42237 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 43114 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 40716 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 39248 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 37674 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 41072 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 37049 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 38561 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 40895 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 45490 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 46559 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 40020 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 44335 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 47252 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 48744 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 55756 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 56887 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 66920 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 40976 },
+              ],
+            },
+          },
+          {
+            key: 'end',
+            doc_count: 18413,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 226 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 547 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 532 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 551 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 543 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 547 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 656 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 543 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 616 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 539 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 539 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 547 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 616 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 640 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 614 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 545 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 537 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 544 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 571 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 743 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 560 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 598 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 613 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 563 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 540 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 538 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 549 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 561 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 554 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 561 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 542 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 712 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 326 },
+              ],
+            },
+          },
+          {
+            key: 'fork',
+            doc_count: 18412,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 226 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 546 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 532 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 551 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 543 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 547 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 656 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 543 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 616 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 539 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 539 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 547 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 616 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 640 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 614 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 545 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 537 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 544 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 571 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 743 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 560 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 598 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 613 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 563 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 540 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 538 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 549 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 561 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 554 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 561 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 542 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 712 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 326 },
+              ],
+            },
+          },
+          {
+            key: 'exec',
+            doc_count: 15183,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 189 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 456 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 445 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 458 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 455 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 457 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 511 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 455 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 493 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 451 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 453 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 460 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 521 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 504 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 490 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 457 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 447 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 454 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 469 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 642 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 465 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 481 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 489 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 466 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 452 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 448 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 457 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 471 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 460 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 463 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 455 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 547 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 262 },
+              ],
+            },
+          },
+          {
+            key: 'disconnect_received',
+            doc_count: 4998,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 59 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 151 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 139 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 144 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 143 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 144 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 202 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 142 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 180 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 144 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 143 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 137 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 150 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 195 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 178 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 144 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 143 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 142 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 157 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 166 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 153 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 168 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 175 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 158 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 142 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 144 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 147 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 139 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 145 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 158 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 137 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 234 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 95 },
+              ],
+            },
+          },
+          {
+            key: 'connection_attempted',
+            doc_count: 4534,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 60 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 145 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 138 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 144 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 140 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 144 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 145 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 137 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 142 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 142 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 143 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 132 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 153 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 143 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 142 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 143 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 142 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 140 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 140 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 148 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 142 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 139 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 139 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 142 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 142 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 143 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 141 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 137 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 141 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 144 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 138 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 145 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 78 },
+              ],
+            },
+          },
+          {
+            key: 'creation',
+            doc_count: 1880,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 24 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 53 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 50 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 54 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 55 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 53 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 54 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 54 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 55 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 52 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 51 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 58 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 122 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 54 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 54 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 56 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 53 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 55 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 51 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 144 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 54 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 53 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 51 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 57 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 55 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 52 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 52 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 57 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 56 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 53 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 51 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 56 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 31 },
+              ],
+            },
+          },
+          {
+            key: 'deletion',
+            doc_count: 1869,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 23 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 53 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 50 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 54 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 54 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 53 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 53 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 54 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 55 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 52 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 51 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 55 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 121 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 54 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 53 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 55 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 53 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 54 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 51 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 146 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 54 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 53 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 51 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 55 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 55 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 52 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 55 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 55 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 55 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 53 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 51 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 55 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 31 },
+              ],
+            },
+          },
+          {
+            key: 'File Delete (rule: FileDelete)',
+            doc_count: 1831,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 19 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 46 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 47 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 47 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 47 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 45 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 48 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 46 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 45 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 47 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 47 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 60 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 45 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 46 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 46 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 47 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 88 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 53 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 46 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 49 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 45 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 48 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 46 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 46 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 45 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 47 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 47 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 45 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 331 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 45 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 47 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 47 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 28 },
+              ],
+            },
+          },
+          {
+            key: 'session_id_change',
+            doc_count: 647,
+            events: {
+              buckets: [
+                { key_as_string: '2020-09-08T15:45:00.000Z', key: 1599579900000, doc_count: 3 },
+                { key_as_string: '2020-09-08T16:30:00.000Z', key: 1599582600000, doc_count: 9 },
+                { key_as_string: '2020-09-08T17:15:00.000Z', key: 1599585300000, doc_count: 7 },
+                { key_as_string: '2020-09-08T18:00:00.000Z', key: 1599588000000, doc_count: 10 },
+                { key_as_string: '2020-09-08T18:45:00.000Z', key: 1599590700000, doc_count: 7 },
+                { key_as_string: '2020-09-08T19:30:00.000Z', key: 1599593400000, doc_count: 10 },
+                { key_as_string: '2020-09-08T20:15:00.000Z', key: 1599596100000, doc_count: 63 },
+                { key_as_string: '2020-09-08T21:00:00.000Z', key: 1599598800000, doc_count: 7 },
+                { key_as_string: '2020-09-08T21:45:00.000Z', key: 1599601500000, doc_count: 45 },
+                { key_as_string: '2020-09-08T22:30:00.000Z', key: 1599604200000, doc_count: 4 },
+                { key_as_string: '2020-09-08T23:15:00.000Z', key: 1599606900000, doc_count: 5 },
+                { key_as_string: '2020-09-09T00:00:00.000Z', key: 1599609600000, doc_count: 6 },
+                { key_as_string: '2020-09-09T00:45:00.000Z', key: 1599612300000, doc_count: 6 },
+                { key_as_string: '2020-09-09T01:30:00.000Z', key: 1599615000000, doc_count: 55 },
+                { key_as_string: '2020-09-09T02:15:00.000Z', key: 1599617700000, doc_count: 43 },
+                { key_as_string: '2020-09-09T03:00:00.000Z', key: 1599620400000, doc_count: 8 },
+                { key_as_string: '2020-09-09T03:45:00.000Z', key: 1599623100000, doc_count: 9 },
+                { key_as_string: '2020-09-09T04:30:00.000Z', key: 1599625800000, doc_count: 7 },
+                { key_as_string: '2020-09-09T05:15:00.000Z', key: 1599628500000, doc_count: 21 },
+                { key_as_string: '2020-09-09T06:00:00.000Z', key: 1599631200000, doc_count: 26 },
+                { key_as_string: '2020-09-09T06:45:00.000Z', key: 1599633900000, doc_count: 17 },
+                { key_as_string: '2020-09-09T07:30:00.000Z', key: 1599636600000, doc_count: 34 },
+                { key_as_string: '2020-09-09T08:15:00.000Z', key: 1599639300000, doc_count: 41 },
+                { key_as_string: '2020-09-09T09:00:00.000Z', key: 1599642000000, doc_count: 18 },
+                { key_as_string: '2020-09-09T09:45:00.000Z', key: 1599644700000, doc_count: 4 },
+                { key_as_string: '2020-09-09T10:30:00.000Z', key: 1599647400000, doc_count: 11 },
+                { key_as_string: '2020-09-09T11:15:00.000Z', key: 1599650100000, doc_count: 9 },
+                { key_as_string: '2020-09-09T12:00:00.000Z', key: 1599652800000, doc_count: 7 },
+                { key_as_string: '2020-09-09T12:45:00.000Z', key: 1599655500000, doc_count: 12 },
+                { key_as_string: '2020-09-09T13:30:00.000Z', key: 1599658200000, doc_count: 16 },
+                { key_as_string: '2020-09-09T14:15:00.000Z', key: 1599660900000, doc_count: 7 },
+                { key_as_string: '2020-09-09T15:00:00.000Z', key: 1599663600000, doc_count: 99 },
+                { key_as_string: '2020-09-09T15:45:00.000Z', key: 1599666300000, doc_count: 21 },
+              ],
+            },
+          },
+        ],
+      },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedEventsSearchStrategyResponse: MatrixHistogramStrategyResponse = {
+  ...mockEventsSearchStrategyResponse,
+  inspect: {
+    dsl: [
+      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "eventActionGroup": {\n        "terms": {\n          "field": "event.action",\n          "missing": "All others",\n          "order": {\n            "_count": "desc"\n          },\n          "size": 10\n        },\n        "aggs": {\n          "events": {\n            "date_histogram": {\n              "field": "@timestamp",\n              "fixed_interval": "2700000ms",\n              "min_doc_count": 0,\n              "extended_bounds": {\n                "min": 1599581486215,\n                "max": 1599667886215\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T16:11:26.215Z",\n                "lte": "2020-09-09T16:11:26.215Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+    ],
+  },
+  totalCount: 0,
+  matrixHistogramData: [
+    { x: 1599579900000, y: 26124, g: 'All others' },
+    { x: 1599582600000, y: 62910, g: 'All others' },
+    { x: 1599585300000, y: 60326, g: 'All others' },
+    { x: 1599588000000, y: 56144, g: 'All others' },
+    { x: 1599590700000, y: 53614, g: 'All others' },
+    { x: 1599593400000, y: 53228, g: 'All others' },
+    { x: 1599596100000, y: 61195, g: 'All others' },
+    { x: 1599598800000, y: 52082, g: 'All others' },
+    { x: 1599601500000, y: 52697, g: 'All others' },
+    { x: 1599604200000, y: 41094, g: 'All others' },
+    { x: 1599606900000, y: 50164, g: 'All others' },
+    { x: 1599609600000, y: 41500, g: 'All others' },
+    { x: 1599612300000, y: 42373, g: 'All others' },
+    { x: 1599615000000, y: 49785, g: 'All others' },
+    { x: 1599617700000, y: 42237, g: 'All others' },
+    { x: 1599620400000, y: 43114, g: 'All others' },
+    { x: 1599623100000, y: 40716, g: 'All others' },
+    { x: 1599625800000, y: 39248, g: 'All others' },
+    { x: 1599628500000, y: 37674, g: 'All others' },
+    { x: 1599631200000, y: 41072, g: 'All others' },
+    { x: 1599633900000, y: 37049, g: 'All others' },
+    { x: 1599636600000, y: 38561, g: 'All others' },
+    { x: 1599639300000, y: 40895, g: 'All others' },
+    { x: 1599642000000, y: 45490, g: 'All others' },
+    { x: 1599644700000, y: 46559, g: 'All others' },
+    { x: 1599647400000, y: 40020, g: 'All others' },
+    { x: 1599650100000, y: 44335, g: 'All others' },
+    { x: 1599652800000, y: 47252, g: 'All others' },
+    { x: 1599655500000, y: 48744, g: 'All others' },
+    { x: 1599658200000, y: 55756, g: 'All others' },
+    { x: 1599660900000, y: 56887, g: 'All others' },
+    { x: 1599663600000, y: 66920, g: 'All others' },
+    { x: 1599666300000, y: 40976, g: 'All others' },
+    { x: 1599579900000, y: 226, g: 'end' },
+    { x: 1599582600000, y: 547, g: 'end' },
+    { x: 1599585300000, y: 532, g: 'end' },
+    { x: 1599588000000, y: 551, g: 'end' },
+    { x: 1599590700000, y: 543, g: 'end' },
+    { x: 1599593400000, y: 547, g: 'end' },
+    { x: 1599596100000, y: 656, g: 'end' },
+    { x: 1599598800000, y: 543, g: 'end' },
+    { x: 1599601500000, y: 616, g: 'end' },
+    { x: 1599604200000, y: 539, g: 'end' },
+    { x: 1599606900000, y: 539, g: 'end' },
+    { x: 1599609600000, y: 547, g: 'end' },
+    { x: 1599612300000, y: 616, g: 'end' },
+    { x: 1599615000000, y: 640, g: 'end' },
+    { x: 1599617700000, y: 614, g: 'end' },
+    { x: 1599620400000, y: 545, g: 'end' },
+    { x: 1599623100000, y: 537, g: 'end' },
+    { x: 1599625800000, y: 544, g: 'end' },
+    { x: 1599628500000, y: 571, g: 'end' },
+    { x: 1599631200000, y: 743, g: 'end' },
+    { x: 1599633900000, y: 560, g: 'end' },
+    { x: 1599636600000, y: 598, g: 'end' },
+    { x: 1599639300000, y: 613, g: 'end' },
+    { x: 1599642000000, y: 563, g: 'end' },
+    { x: 1599644700000, y: 540, g: 'end' },
+    { x: 1599647400000, y: 538, g: 'end' },
+    { x: 1599650100000, y: 549, g: 'end' },
+    { x: 1599652800000, y: 561, g: 'end' },
+    { x: 1599655500000, y: 554, g: 'end' },
+    { x: 1599658200000, y: 561, g: 'end' },
+    { x: 1599660900000, y: 542, g: 'end' },
+    { x: 1599663600000, y: 712, g: 'end' },
+    { x: 1599666300000, y: 326, g: 'end' },
+    { x: 1599579900000, y: 226, g: 'fork' },
+    { x: 1599582600000, y: 546, g: 'fork' },
+    { x: 1599585300000, y: 532, g: 'fork' },
+    { x: 1599588000000, y: 551, g: 'fork' },
+    { x: 1599590700000, y: 543, g: 'fork' },
+    { x: 1599593400000, y: 547, g: 'fork' },
+    { x: 1599596100000, y: 656, g: 'fork' },
+    { x: 1599598800000, y: 543, g: 'fork' },
+    { x: 1599601500000, y: 616, g: 'fork' },
+    { x: 1599604200000, y: 539, g: 'fork' },
+    { x: 1599606900000, y: 539, g: 'fork' },
+    { x: 1599609600000, y: 547, g: 'fork' },
+    { x: 1599612300000, y: 616, g: 'fork' },
+    { x: 1599615000000, y: 640, g: 'fork' },
+    { x: 1599617700000, y: 614, g: 'fork' },
+    { x: 1599620400000, y: 545, g: 'fork' },
+    { x: 1599623100000, y: 537, g: 'fork' },
+    { x: 1599625800000, y: 544, g: 'fork' },
+    { x: 1599628500000, y: 571, g: 'fork' },
+    { x: 1599631200000, y: 743, g: 'fork' },
+    { x: 1599633900000, y: 560, g: 'fork' },
+    { x: 1599636600000, y: 598, g: 'fork' },
+    { x: 1599639300000, y: 613, g: 'fork' },
+    { x: 1599642000000, y: 563, g: 'fork' },
+    { x: 1599644700000, y: 540, g: 'fork' },
+    { x: 1599647400000, y: 538, g: 'fork' },
+    { x: 1599650100000, y: 549, g: 'fork' },
+    { x: 1599652800000, y: 561, g: 'fork' },
+    { x: 1599655500000, y: 554, g: 'fork' },
+    { x: 1599658200000, y: 561, g: 'fork' },
+    { x: 1599660900000, y: 542, g: 'fork' },
+    { x: 1599663600000, y: 712, g: 'fork' },
+    { x: 1599666300000, y: 326, g: 'fork' },
+    { x: 1599579900000, y: 189, g: 'exec' },
+    { x: 1599582600000, y: 456, g: 'exec' },
+    { x: 1599585300000, y: 445, g: 'exec' },
+    { x: 1599588000000, y: 458, g: 'exec' },
+    { x: 1599590700000, y: 455, g: 'exec' },
+    { x: 1599593400000, y: 457, g: 'exec' },
+    { x: 1599596100000, y: 511, g: 'exec' },
+    { x: 1599598800000, y: 455, g: 'exec' },
+    { x: 1599601500000, y: 493, g: 'exec' },
+    { x: 1599604200000, y: 451, g: 'exec' },
+    { x: 1599606900000, y: 453, g: 'exec' },
+    { x: 1599609600000, y: 460, g: 'exec' },
+    { x: 1599612300000, y: 521, g: 'exec' },
+    { x: 1599615000000, y: 504, g: 'exec' },
+    { x: 1599617700000, y: 490, g: 'exec' },
+    { x: 1599620400000, y: 457, g: 'exec' },
+    { x: 1599623100000, y: 447, g: 'exec' },
+    { x: 1599625800000, y: 454, g: 'exec' },
+    { x: 1599628500000, y: 469, g: 'exec' },
+    { x: 1599631200000, y: 642, g: 'exec' },
+    { x: 1599633900000, y: 465, g: 'exec' },
+    { x: 1599636600000, y: 481, g: 'exec' },
+    { x: 1599639300000, y: 489, g: 'exec' },
+    { x: 1599642000000, y: 466, g: 'exec' },
+    { x: 1599644700000, y: 452, g: 'exec' },
+    { x: 1599647400000, y: 448, g: 'exec' },
+    { x: 1599650100000, y: 457, g: 'exec' },
+    { x: 1599652800000, y: 471, g: 'exec' },
+    { x: 1599655500000, y: 460, g: 'exec' },
+    { x: 1599658200000, y: 463, g: 'exec' },
+    { x: 1599660900000, y: 455, g: 'exec' },
+    { x: 1599663600000, y: 547, g: 'exec' },
+    { x: 1599666300000, y: 262, g: 'exec' },
+    { x: 1599579900000, y: 59, g: 'disconnect_received' },
+    { x: 1599582600000, y: 151, g: 'disconnect_received' },
+    { x: 1599585300000, y: 139, g: 'disconnect_received' },
+    { x: 1599588000000, y: 144, g: 'disconnect_received' },
+    { x: 1599590700000, y: 143, g: 'disconnect_received' },
+    { x: 1599593400000, y: 144, g: 'disconnect_received' },
+    { x: 1599596100000, y: 202, g: 'disconnect_received' },
+    { x: 1599598800000, y: 142, g: 'disconnect_received' },
+    { x: 1599601500000, y: 180, g: 'disconnect_received' },
+    { x: 1599604200000, y: 144, g: 'disconnect_received' },
+    { x: 1599606900000, y: 143, g: 'disconnect_received' },
+    { x: 1599609600000, y: 137, g: 'disconnect_received' },
+    { x: 1599612300000, y: 150, g: 'disconnect_received' },
+    { x: 1599615000000, y: 195, g: 'disconnect_received' },
+    { x: 1599617700000, y: 178, g: 'disconnect_received' },
+    { x: 1599620400000, y: 144, g: 'disconnect_received' },
+    { x: 1599623100000, y: 143, g: 'disconnect_received' },
+    { x: 1599625800000, y: 142, g: 'disconnect_received' },
+    { x: 1599628500000, y: 157, g: 'disconnect_received' },
+    { x: 1599631200000, y: 166, g: 'disconnect_received' },
+    { x: 1599633900000, y: 153, g: 'disconnect_received' },
+    { x: 1599636600000, y: 168, g: 'disconnect_received' },
+    { x: 1599639300000, y: 175, g: 'disconnect_received' },
+    { x: 1599642000000, y: 158, g: 'disconnect_received' },
+    { x: 1599644700000, y: 142, g: 'disconnect_received' },
+    { x: 1599647400000, y: 144, g: 'disconnect_received' },
+    { x: 1599650100000, y: 147, g: 'disconnect_received' },
+    { x: 1599652800000, y: 139, g: 'disconnect_received' },
+    { x: 1599655500000, y: 145, g: 'disconnect_received' },
+    { x: 1599658200000, y: 158, g: 'disconnect_received' },
+    { x: 1599660900000, y: 137, g: 'disconnect_received' },
+    { x: 1599663600000, y: 234, g: 'disconnect_received' },
+    { x: 1599666300000, y: 95, g: 'disconnect_received' },
+    { x: 1599579900000, y: 60, g: 'connection_attempted' },
+    { x: 1599582600000, y: 145, g: 'connection_attempted' },
+    { x: 1599585300000, y: 138, g: 'connection_attempted' },
+    { x: 1599588000000, y: 144, g: 'connection_attempted' },
+    { x: 1599590700000, y: 140, g: 'connection_attempted' },
+    { x: 1599593400000, y: 144, g: 'connection_attempted' },
+    { x: 1599596100000, y: 145, g: 'connection_attempted' },
+    { x: 1599598800000, y: 137, g: 'connection_attempted' },
+    { x: 1599601500000, y: 142, g: 'connection_attempted' },
+    { x: 1599604200000, y: 142, g: 'connection_attempted' },
+    { x: 1599606900000, y: 143, g: 'connection_attempted' },
+    { x: 1599609600000, y: 132, g: 'connection_attempted' },
+    { x: 1599612300000, y: 153, g: 'connection_attempted' },
+    { x: 1599615000000, y: 143, g: 'connection_attempted' },
+    { x: 1599617700000, y: 142, g: 'connection_attempted' },
+    { x: 1599620400000, y: 143, g: 'connection_attempted' },
+    { x: 1599623100000, y: 142, g: 'connection_attempted' },
+    { x: 1599625800000, y: 140, g: 'connection_attempted' },
+    { x: 1599628500000, y: 140, g: 'connection_attempted' },
+    { x: 1599631200000, y: 148, g: 'connection_attempted' },
+    { x: 1599633900000, y: 142, g: 'connection_attempted' },
+    { x: 1599636600000, y: 139, g: 'connection_attempted' },
+    { x: 1599639300000, y: 139, g: 'connection_attempted' },
+    { x: 1599642000000, y: 142, g: 'connection_attempted' },
+    { x: 1599644700000, y: 142, g: 'connection_attempted' },
+    { x: 1599647400000, y: 143, g: 'connection_attempted' },
+    { x: 1599650100000, y: 141, g: 'connection_attempted' },
+    { x: 1599652800000, y: 137, g: 'connection_attempted' },
+    { x: 1599655500000, y: 141, g: 'connection_attempted' },
+    { x: 1599658200000, y: 144, g: 'connection_attempted' },
+    { x: 1599660900000, y: 138, g: 'connection_attempted' },
+    { x: 1599663600000, y: 145, g: 'connection_attempted' },
+    { x: 1599666300000, y: 78, g: 'connection_attempted' },
+    { x: 1599579900000, y: 24, g: 'creation' },
+    { x: 1599582600000, y: 53, g: 'creation' },
+    { x: 1599585300000, y: 50, g: 'creation' },
+    { x: 1599588000000, y: 54, g: 'creation' },
+    { x: 1599590700000, y: 55, g: 'creation' },
+    { x: 1599593400000, y: 53, g: 'creation' },
+    { x: 1599596100000, y: 54, g: 'creation' },
+    { x: 1599598800000, y: 54, g: 'creation' },
+    { x: 1599601500000, y: 55, g: 'creation' },
+    { x: 1599604200000, y: 52, g: 'creation' },
+    { x: 1599606900000, y: 51, g: 'creation' },
+    { x: 1599609600000, y: 58, g: 'creation' },
+    { x: 1599612300000, y: 122, g: 'creation' },
+    { x: 1599615000000, y: 54, g: 'creation' },
+    { x: 1599617700000, y: 54, g: 'creation' },
+    { x: 1599620400000, y: 56, g: 'creation' },
+    { x: 1599623100000, y: 53, g: 'creation' },
+    { x: 1599625800000, y: 55, g: 'creation' },
+    { x: 1599628500000, y: 51, g: 'creation' },
+    { x: 1599631200000, y: 144, g: 'creation' },
+    { x: 1599633900000, y: 54, g: 'creation' },
+    { x: 1599636600000, y: 53, g: 'creation' },
+    { x: 1599639300000, y: 51, g: 'creation' },
+    { x: 1599642000000, y: 57, g: 'creation' },
+    { x: 1599644700000, y: 55, g: 'creation' },
+    { x: 1599647400000, y: 52, g: 'creation' },
+    { x: 1599650100000, y: 52, g: 'creation' },
+    { x: 1599652800000, y: 57, g: 'creation' },
+    { x: 1599655500000, y: 56, g: 'creation' },
+    { x: 1599658200000, y: 53, g: 'creation' },
+    { x: 1599660900000, y: 51, g: 'creation' },
+    { x: 1599663600000, y: 56, g: 'creation' },
+    { x: 1599666300000, y: 31, g: 'creation' },
+    { x: 1599579900000, y: 23, g: 'deletion' },
+    { x: 1599582600000, y: 53, g: 'deletion' },
+    { x: 1599585300000, y: 50, g: 'deletion' },
+    { x: 1599588000000, y: 54, g: 'deletion' },
+    { x: 1599590700000, y: 54, g: 'deletion' },
+    { x: 1599593400000, y: 53, g: 'deletion' },
+    { x: 1599596100000, y: 53, g: 'deletion' },
+    { x: 1599598800000, y: 54, g: 'deletion' },
+    { x: 1599601500000, y: 55, g: 'deletion' },
+    { x: 1599604200000, y: 52, g: 'deletion' },
+    { x: 1599606900000, y: 51, g: 'deletion' },
+    { x: 1599609600000, y: 55, g: 'deletion' },
+    { x: 1599612300000, y: 121, g: 'deletion' },
+    { x: 1599615000000, y: 54, g: 'deletion' },
+    { x: 1599617700000, y: 53, g: 'deletion' },
+    { x: 1599620400000, y: 55, g: 'deletion' },
+    { x: 1599623100000, y: 53, g: 'deletion' },
+    { x: 1599625800000, y: 54, g: 'deletion' },
+    { x: 1599628500000, y: 51, g: 'deletion' },
+    { x: 1599631200000, y: 146, g: 'deletion' },
+    { x: 1599633900000, y: 54, g: 'deletion' },
+    { x: 1599636600000, y: 53, g: 'deletion' },
+    { x: 1599639300000, y: 51, g: 'deletion' },
+    { x: 1599642000000, y: 55, g: 'deletion' },
+    { x: 1599644700000, y: 55, g: 'deletion' },
+    { x: 1599647400000, y: 52, g: 'deletion' },
+    { x: 1599650100000, y: 55, g: 'deletion' },
+    { x: 1599652800000, y: 55, g: 'deletion' },
+    { x: 1599655500000, y: 55, g: 'deletion' },
+    { x: 1599658200000, y: 53, g: 'deletion' },
+    { x: 1599660900000, y: 51, g: 'deletion' },
+    { x: 1599663600000, y: 55, g: 'deletion' },
+    { x: 1599666300000, y: 31, g: 'deletion' },
+    { x: 1599579900000, y: 19, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599582600000, y: 46, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599585300000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599588000000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599590700000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599593400000, y: 45, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599596100000, y: 48, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599598800000, y: 46, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599601500000, y: 45, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599604200000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599606900000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599609600000, y: 60, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599612300000, y: 45, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599615000000, y: 46, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599617700000, y: 46, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599620400000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599623100000, y: 88, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599625800000, y: 53, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599628500000, y: 46, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599631200000, y: 49, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599633900000, y: 45, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599636600000, y: 48, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599639300000, y: 46, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599642000000, y: 46, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599644700000, y: 45, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599647400000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599650100000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599652800000, y: 45, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599655500000, y: 331, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599658200000, y: 45, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599660900000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599663600000, y: 47, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599666300000, y: 28, g: 'File Delete (rule: FileDelete)' },
+    { x: 1599579900000, y: 3, g: 'session_id_change' },
+    { x: 1599582600000, y: 9, g: 'session_id_change' },
+    { x: 1599585300000, y: 7, g: 'session_id_change' },
+    { x: 1599588000000, y: 10, g: 'session_id_change' },
+    { x: 1599590700000, y: 7, g: 'session_id_change' },
+    { x: 1599593400000, y: 10, g: 'session_id_change' },
+    { x: 1599596100000, y: 63, g: 'session_id_change' },
+    { x: 1599598800000, y: 7, g: 'session_id_change' },
+    { x: 1599601500000, y: 45, g: 'session_id_change' },
+    { x: 1599604200000, y: 4, g: 'session_id_change' },
+    { x: 1599606900000, y: 5, g: 'session_id_change' },
+    { x: 1599609600000, y: 6, g: 'session_id_change' },
+    { x: 1599612300000, y: 6, g: 'session_id_change' },
+    { x: 1599615000000, y: 55, g: 'session_id_change' },
+    { x: 1599617700000, y: 43, g: 'session_id_change' },
+    { x: 1599620400000, y: 8, g: 'session_id_change' },
+    { x: 1599623100000, y: 9, g: 'session_id_change' },
+    { x: 1599625800000, y: 7, g: 'session_id_change' },
+    { x: 1599628500000, y: 21, g: 'session_id_change' },
+    { x: 1599631200000, y: 26, g: 'session_id_change' },
+    { x: 1599633900000, y: 17, g: 'session_id_change' },
+    { x: 1599636600000, y: 34, g: 'session_id_change' },
+    { x: 1599639300000, y: 41, g: 'session_id_change' },
+    { x: 1599642000000, y: 18, g: 'session_id_change' },
+    { x: 1599644700000, y: 4, g: 'session_id_change' },
+    { x: 1599647400000, y: 11, g: 'session_id_change' },
+    { x: 1599650100000, y: 9, g: 'session_id_change' },
+    { x: 1599652800000, y: 7, g: 'session_id_change' },
+    { x: 1599655500000, y: 12, g: 'session_id_change' },
+    { x: 1599658200000, y: 16, g: 'session_id_change' },
+    { x: 1599660900000, y: 7, g: 'session_id_change' },
+    { x: 1599663600000, y: 99, g: 'session_id_change' },
+    { x: 1599666300000, y: 21, g: 'session_id_change' },
+  ],
+};
+
+export const mockDnsSearchStrategyResponse: IEsSearchResponse<unknown> = {
+  isPartial: false,
+  isRunning: false,
+  rawResponse: {
+    took: 150,
+    timed_out: false,
+    _shards: { total: 21, successful: 21, skipped: 0, failed: 0 },
+    hits: { total: 0, max_score: 0, hits: [] },
+    aggregations: {
+      NetworkDns: {
+        buckets: [
+          {
+            key_as_string: '2020-09-08T15:00:00.000Z',
+            key: 1599577200000,
+            doc_count: 7083,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T15:45:00.000Z',
+            key: 1599579900000,
+            doc_count: 146148,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T16:30:00.000Z',
+            key: 1599582600000,
+            doc_count: 65025,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T17:15:00.000Z',
+            key: 1599585300000,
+            doc_count: 62317,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T18:00:00.000Z',
+            key: 1599588000000,
+            doc_count: 58223,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T18:45:00.000Z',
+            key: 1599590700000,
+            doc_count: 55712,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T19:30:00.000Z',
+            key: 1599593400000,
+            doc_count: 55328,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T20:15:00.000Z',
+            key: 1599596100000,
+            doc_count: 63878,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T21:00:00.000Z',
+            key: 1599598800000,
+            doc_count: 54151,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T21:45:00.000Z',
+            key: 1599601500000,
+            doc_count: 55170,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T22:30:00.000Z',
+            key: 1599604200000,
+            doc_count: 43115,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-08T23:15:00.000Z',
+            key: 1599606900000,
+            doc_count: 52204,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T00:00:00.000Z',
+            key: 1599609600000,
+            doc_count: 43609,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T00:45:00.000Z',
+            key: 1599612300000,
+            doc_count: 44825,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T01:30:00.000Z',
+            key: 1599615000000,
+            doc_count: 52374,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T02:15:00.000Z',
+            key: 1599617700000,
+            doc_count: 44667,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T03:00:00.000Z',
+            key: 1599620400000,
+            doc_count: 45231,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T03:45:00.000Z',
+            key: 1599623100000,
+            doc_count: 42871,
+            dns: {
+              doc_count_error_upper_bound: 0,
+              sum_other_doc_count: 0,
+              buckets: [
+                { key: 'google.com', doc_count: 1, orderAgg: { value: 1 } },
+                { key: 'google.internal', doc_count: 1, orderAgg: { value: 1 } },
+              ],
+            },
+          },
+          {
+            key_as_string: '2020-09-09T04:30:00.000Z',
+            key: 1599625800000,
+            doc_count: 41327,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T05:15:00.000Z',
+            key: 1599628500000,
+            doc_count: 39860,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T06:00:00.000Z',
+            key: 1599631200000,
+            doc_count: 44061,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T06:45:00.000Z',
+            key: 1599633900000,
+            doc_count: 39193,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T07:30:00.000Z',
+            key: 1599636600000,
+            doc_count: 40909,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T08:15:00.000Z',
+            key: 1599639300000,
+            doc_count: 43293,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T09:00:00.000Z',
+            key: 1599642000000,
+            doc_count: 47640,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T09:45:00.000Z',
+            key: 1599644700000,
+            doc_count: 48605,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T10:30:00.000Z',
+            key: 1599647400000,
+            doc_count: 42072,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T11:15:00.000Z',
+            key: 1599650100000,
+            doc_count: 46398,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T12:00:00.000Z',
+            key: 1599652800000,
+            doc_count: 49378,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T12:45:00.000Z',
+            key: 1599655500000,
+            doc_count: 51171,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T13:30:00.000Z',
+            key: 1599658200000,
+            doc_count: 57911,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T14:15:00.000Z',
+            key: 1599660900000,
+            doc_count: 58909,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+          {
+            key_as_string: '2020-09-09T15:00:00.000Z',
+            key: 1599663600000,
+            doc_count: 62358,
+            dns: { doc_count_error_upper_bound: 0, sum_other_doc_count: 0, buckets: [] },
+          },
+        ],
+      },
+    },
+  },
+  total: 21,
+  loaded: 21,
+};
+
+export const formattedDnsSearchStrategyResponse: MatrixHistogramStrategyResponse = {
+  ...mockDnsSearchStrategyResponse,
+  inspect: {
+    dsl: [
+      '{\n  "index": [\n    "apm-*-transaction*",\n    "auditbeat-*",\n    "endgame-*",\n    "filebeat-*",\n    "logs-*",\n    "packetbeat-*",\n    "winlogbeat-*"\n  ],\n  "allowNoIndices": true,\n  "ignoreUnavailable": true,\n  "body": {\n    "aggregations": {\n      "NetworkDns": {\n        "date_histogram": {\n          "field": "@timestamp",\n          "fixed_interval": "2700000ms"\n        },\n        "aggs": {\n          "dns": {\n            "terms": {\n              "field": "dns.question.registered_domain",\n              "order": {\n                "orderAgg": "desc"\n              },\n              "size": 10\n            },\n            "aggs": {\n              "orderAgg": {\n                "cardinality": {\n                  "field": "dns.question.name"\n                }\n              }\n            }\n          }\n        }\n      }\n    },\n    "query": {\n      "bool": {\n        "filter": [\n          "{\\"bool\\":{\\"must\\":[],\\"filter\\":[{\\"match_all\\":{}}],\\"should\\":[],\\"must_not\\":[]}}",\n          {\n            "range": {\n              "@timestamp": {\n                "gte": "2020-09-08T15:41:15.528Z",\n                "lte": "2020-09-09T15:41:15.529Z",\n                "format": "strict_date_optional_time"\n              }\n            }\n          }\n        ]\n      }\n    },\n    "size": 0,\n    "track_total_hits": true\n  }\n}',
+    ],
+  },
+  matrixHistogramData: [
+    { x: 1599623100000, y: 1, g: 'google.com' },
+    { x: 1599623100000, y: 1, g: 'google.internal' },
+  ],
+  totalCount: 0,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
new file mode 100644
index 0000000000000..8b2e666ad0103
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
+
+export const mockOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  filterQuery:
+    '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"filter":[{"bool":{"should":[{"exists":{"field":"host.name"}}],"minimum_should_match":1}}]}}],"should":[],"must_not":[]}}',
+  histogramType: MatrixHistogramType.alerts,
+  timerange: { interval: '12h', from: '2020-09-08T14:23:04.482Z', to: '2020-09-09T14:23:04.482Z' },
+  stackByField: 'event.module',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      alertsGroup: {
+        terms: {
+          field: 'event.module',
+          missing: 'All others',
+          order: { _count: 'desc' },
+          size: 10,
+        },
+        aggs: {
+          alerts: {
+            date_histogram: {
+              field: '@timestamp',
+              fixed_interval: '2700000ms',
+              min_doc_count: 0,
+              extended_bounds: { min: 1599574984482, max: 1599661384482 },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"filter":[{"bool":{"should":[{"exists":{"field":"host.name"}}],"minimum_should_match":1}}]}}],"should":[],"must_not":[]}}',
+          {
+            bool: {
+              filter: [
+                {
+                  bool: { should: [{ match: { 'event.kind': 'alert' } }], minimum_should_match: 1 },
+                },
+              ],
+            },
+          },
+          {
+            range: {
+              '@timestamp': {
+                gte: '2020-09-08T14:23:04.482Z',
+                lte: '2020-09-09T14:23:04.482Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/index.test.ts
new file mode 100644
index 0000000000000..3b1e57ea50a87
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/index.test.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { alertsMatrixHistogramConfig } from '.';
+import { buildAlertsHistogramQuery } from './query.alerts_histogram.dsl';
+
+jest.mock('./query.alerts_histogram.dsl', () => ({
+  buildAlertsHistogramQuery: jest.fn(),
+}));
+
+describe('alertsMatrixHistogramConfig', () => {
+  test('should export alertsMatrixHistogramConfig corrrectly', () => {
+    expect(alertsMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.alertsGroup.buckets',
+      parseKey: 'alerts.buckets',
+      buildDsl: buildAlertsHistogramQuery,
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.test.ts
new file mode 100644
index 0000000000000..89a28b10dd684
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildAlertsHistogramQuery } from './query.alerts_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildAlertsHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildAlertsHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
new file mode 100644
index 0000000000000..6ca3c785e2e75
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
+
+export const mockOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  filterQuery:
+    '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"should":[],"minimum_should_match":1}},{"match_phrase":{"result_type":"record"}},null,{"range":{"record_score":{"gte":50}}}],"should":[{"exists":{"field":"source.ip"}},{"exists":{"field":"destination.ip"}}],"must_not":[],"minimum_should_match":1}}',
+  histogramType: MatrixHistogramType.anomalies,
+  timerange: { interval: '12h', from: '2020-09-08T15:14:35.566Z', to: '2020-09-09T15:14:35.566Z' },
+  stackByField: 'job_id',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggs: {
+      anomalyActionGroup: {
+        terms: { field: 'job_id', order: { _count: 'desc' }, size: 10 },
+        aggs: {
+          anomalies: {
+            date_histogram: {
+              field: 'timestamp',
+              fixed_interval: '2700000ms',
+              min_doc_count: 0,
+              extended_bounds: { min: 1599578075566, max: 1599664475566 },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"should":[],"minimum_should_match":1}},{"match_phrase":{"result_type":"record"}},null,{"range":{"record_score":{"gte":50}}}],"should":[{"exists":{"field":"source.ip"}},{"exists":{"field":"destination.ip"}}],"must_not":[],"minimum_should_match":1}}',
+          {
+            range: {
+              timestamp: {
+                gte: '2020-09-08T15:14:35.566Z',
+                lte: '2020-09-09T15:14:35.566Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/index.test.ts
new file mode 100644
index 0000000000000..d1466a057553d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/index.test.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { anomaliesMatrixHistogramConfig } from '.';
+import { buildAnomaliesHistogramQuery } from './query.anomalies_histogram.dsl';
+
+jest.mock('./query.anomalies_histogram.dsl', () => ({
+  buildAnomaliesHistogramQuery: jest.fn(),
+}));
+
+describe('anomaliesMatrixHistogramConfig', () => {
+  test('should export anomaliesMatrixHistogramConfig corrrectly', () => {
+    expect(anomaliesMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.anomalyActionGroup.buckets',
+      parseKey: 'anomalies.buckets',
+      buildDsl: buildAnomaliesHistogramQuery,
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.test.ts
new file mode 100644
index 0000000000000..7c10005853b26
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildAnomaliesHistogramQuery } from './query.anomalies_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__';
+
+describe('buildAnomaliesHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildAnomaliesHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
new file mode 100644
index 0000000000000..1fd420dbb94cb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
+
+export const mockOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  histogramType: MatrixHistogramType.authentications,
+  timerange: { interval: '12h', from: '2020-09-08T15:22:00.325Z', to: '2020-09-09T15:22:00.325Z' },
+  stackByField: 'event.outcome',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      eventActionGroup: {
+        terms: {
+          field: 'event.outcome',
+          include: ['success', 'failure'],
+          order: { _count: 'desc' },
+          size: 2,
+        },
+        aggs: {
+          events: {
+            date_histogram: {
+              field: '@timestamp',
+              fixed_interval: '2700000ms',
+              min_doc_count: 0,
+              extended_bounds: { min: 1599578520325, max: 1599664920325 },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [{ term: { 'event.category': 'authentication' } }] } },
+          {
+            range: {
+              '@timestamp': {
+                gte: '2020-09-08T15:22:00.325Z',
+                lte: '2020-09-09T15:22:00.325Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/index.test.ts
new file mode 100644
index 0000000000000..54f1459b24933
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/index.test.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { authenticationsMatrixHistogramConfig } from '.';
+import { buildAuthenticationsHistogramQuery } from './query.authentications_histogram.dsl';
+
+jest.mock('./query.authentications_histogram.dsl', () => ({
+  buildAuthenticationsHistogramQuery: jest.fn(),
+}));
+
+describe('authenticationsMatrixHistogramConfig', () => {
+  test('should export authenticationsMatrixHistogramConfig corrrectly', () => {
+    expect(authenticationsMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.eventActionGroup.buckets',
+      parseKey: 'events.buckets',
+      buildDsl: buildAuthenticationsHistogramQuery,
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.test.ts
new file mode 100644
index 0000000000000..67d681d8ba870
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildAuthenticationsHistogramQuery } from './query.authentications_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildAuthenticationsHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildAuthenticationsHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
new file mode 100644
index 0000000000000..94ba20327a404
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/__mocks__/index.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
+
+export const mockOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  histogramType: MatrixHistogramType.dns,
+  timerange: { interval: '12h', from: '2020-09-08T15:41:15.528Z', to: '2020-09-09T15:41:15.529Z' },
+  stackByField: 'dns.question.registered_domain',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      NetworkDns: {
+        date_histogram: { field: '@timestamp', fixed_interval: '2700000ms' },
+        aggs: {
+          dns: {
+            terms: {
+              field: 'dns.question.registered_domain',
+              order: { orderAgg: 'desc' },
+              size: 10,
+            },
+            aggs: { orderAgg: { cardinality: { field: 'dns.question.name' } } },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          {
+            range: {
+              '@timestamp': {
+                gte: '2020-09-08T15:41:15.528Z',
+                lte: '2020-09-09T15:41:15.529Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/index.test.ts
new file mode 100644
index 0000000000000..8afc764d97f87
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/index.test.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { dnsMatrixHistogramConfig } from '.';
+import { buildDnsHistogramQuery } from './query.dns_histogram.dsl';
+import { getDnsParsedData } from './helpers';
+
+jest.mock('./query.dns_histogram.dsl', () => ({
+  buildDnsHistogramQuery: jest.fn(),
+}));
+
+jest.mock('./helpers', () => ({
+  getDnsParsedData: jest.fn(),
+}));
+
+describe('dnsMatrixHistogramConfig', () => {
+  test('should export dnsMatrixHistogramConfig corrrectly', () => {
+    expect(dnsMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.NetworkDns.buckets',
+      parseKey: 'dns.buckets',
+      buildDsl: buildDnsHistogramQuery,
+      parser: getDnsParsedData,
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.test.ts
new file mode 100644
index 0000000000000..a3d562a28d07f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/dns/query.dns_histogram.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildDnsHistogramQuery } from './query.dns_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildDnsHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildDnsHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
new file mode 100644
index 0000000000000..09b710ab33c76
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/__mocks__/index.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  MatrixHistogramQuery,
+  MatrixHistogramRequestOptions,
+  MatrixHistogramType,
+} from '../../../../../../../common/search_strategy';
+
+export const mockOptions: MatrixHistogramRequestOptions = {
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  factoryQueryType: MatrixHistogramQuery,
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  histogramType: MatrixHistogramType.events,
+  timerange: { interval: '12h', from: '2020-09-08T16:11:26.215Z', to: '2020-09-09T16:11:26.215Z' },
+  stackByField: 'event.action',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      eventActionGroup: {
+        terms: {
+          field: 'event.action',
+          missing: 'All others',
+          order: { _count: 'desc' },
+          size: 10,
+        },
+        aggs: {
+          events: {
+            date_histogram: {
+              field: '@timestamp',
+              fixed_interval: '2700000ms',
+              min_doc_count: 0,
+              extended_bounds: { min: 1599581486215, max: 1599667886215 },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          {
+            range: {
+              '@timestamp': {
+                gte: '2020-09-08T16:11:26.215Z',
+                lte: '2020-09-09T16:11:26.215Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/index.test.ts
new file mode 100644
index 0000000000000..f67307eac67ed
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/index.test.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { eventsMatrixHistogramConfig } from '.';
+import { buildEventsHistogramQuery } from './query.events_histogram.dsl';
+
+jest.mock('./query.events_histogram.dsl.ts', () => ({
+  buildEventsHistogramQuery: jest.fn(),
+}));
+
+describe('eventsMatrixHistogramConfig', () => {
+  test('should export eventsMatrixHistogramConfig corrrectly', () => {
+    expect(eventsMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.eventActionGroup.buckets',
+      parseKey: 'events.buckets',
+      buildDsl: buildEventsHistogramQuery,
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.test.ts
new file mode 100644
index 0000000000000..72cb9de9f0e7a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/events/query.events_histogram.dsl.test.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildEventsHistogramQuery } from './query.events_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildEventsHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildEventsHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/index.test.ts
new file mode 100644
index 0000000000000..3fd7240eba93b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/index.test.ts
@@ -0,0 +1,211 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  MatrixHistogramRequestOptions,
+  MatrixHistogramType,
+} from '../../../../../common/search_strategy/security_solution';
+import { matrixHistogram } from '.';
+import {
+  formattedAlertsSearchStrategyResponse,
+  formattedAnomaliesSearchStrategyResponse,
+  formattedAuthenticationsSearchStrategyResponse,
+  formattedEventsSearchStrategyResponse,
+  formattedDnsSearchStrategyResponse,
+  mockAlertsSearchStrategyResponse,
+  mockAnomaliesSearchStrategyResponse,
+  mockAuthenticationsSearchStrategyResponse,
+  mockEventsSearchStrategyResponse,
+  mockDnsSearchStrategyResponse,
+} from './__mocks__';
+import { alertsMatrixHistogramConfig } from './alerts';
+import { anomaliesMatrixHistogramConfig } from './anomalies';
+import { authenticationsMatrixHistogramConfig } from './authentications';
+import { eventsMatrixHistogramConfig } from './events';
+import { dnsMatrixHistogramConfig } from './dns';
+
+import { mockOptions as mockAlertsOptions } from './alerts/__mocks__';
+import { mockOptions as mockAnomaliesOptions } from './anomalies/__mocks__';
+import { mockOptions as mockAuthenticationsOptions } from './authentications/__mocks__';
+import { mockOptions as mockEventsOptions } from './events/__mocks__';
+import { mockOptions as mockDnsOptions } from './dns/__mocks__';
+
+describe('Alerts matrixHistogram search strategy', () => {
+  const buildMatrixHistogramQuery = jest.spyOn(alertsMatrixHistogramConfig, 'buildDsl');
+
+  afterEach(() => {
+    buildMatrixHistogramQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      matrixHistogram.buildDsl(mockAlertsOptions);
+      expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockAlertsOptions);
+    });
+
+    test('should throw error if histogramType is invalid', () => {
+      const invalidOptions: MatrixHistogramRequestOptions = {
+        ...mockAlertsOptions,
+        histogramType: 'xxx' as MatrixHistogramType,
+      } as MatrixHistogramRequestOptions;
+
+      expect(() => {
+        matrixHistogram.buildDsl(invalidOptions);
+      }).toThrowError(`This histogram type xxx is unknown to the server side`);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await matrixHistogram.parse(
+        mockAlertsOptions,
+        mockAlertsSearchStrategyResponse
+      );
+      expect(result).toMatchObject(formattedAlertsSearchStrategyResponse);
+    });
+  });
+});
+
+describe('Anomalies matrixHistogram search strategy', () => {
+  const buildMatrixHistogramQuery = jest.spyOn(anomaliesMatrixHistogramConfig, 'buildDsl');
+
+  afterEach(() => {
+    buildMatrixHistogramQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      matrixHistogram.buildDsl(mockAnomaliesOptions);
+      expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockAnomaliesOptions);
+    });
+
+    test('should throw error if histogramType is invalid', () => {
+      const invalidOptions: MatrixHistogramRequestOptions = {
+        ...mockAnomaliesOptions,
+        histogramType: 'xxx' as MatrixHistogramType,
+      } as MatrixHistogramRequestOptions;
+
+      expect(() => {
+        matrixHistogram.buildDsl(invalidOptions);
+      }).toThrowError(`This histogram type xxx is unknown to the server side`);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await matrixHistogram.parse(
+        mockAnomaliesOptions,
+        mockAnomaliesSearchStrategyResponse
+      );
+      expect(result).toMatchObject(formattedAnomaliesSearchStrategyResponse);
+    });
+  });
+});
+
+describe('Authentications matrixHistogram search strategy', () => {
+  const buildMatrixHistogramQuery = jest.spyOn(authenticationsMatrixHistogramConfig, 'buildDsl');
+
+  afterEach(() => {
+    buildMatrixHistogramQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      matrixHistogram.buildDsl(mockAuthenticationsOptions);
+      expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockAuthenticationsOptions);
+    });
+
+    test('should throw error if histogramType is invalid', () => {
+      const invalidOptions = {
+        ...mockAuthenticationsOptions,
+        histogramType: 'xxx' as MatrixHistogramType,
+      } as MatrixHistogramRequestOptions;
+
+      expect(() => {
+        matrixHistogram.buildDsl(invalidOptions);
+      }).toThrowError(`This histogram type xxx is unknown to the server side`);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await matrixHistogram.parse(
+        mockAuthenticationsOptions,
+        mockAuthenticationsSearchStrategyResponse
+      );
+      expect(result).toMatchObject(formattedAuthenticationsSearchStrategyResponse);
+    });
+  });
+});
+
+describe('Events matrixHistogram search strategy', () => {
+  const buildMatrixHistogramQuery = jest.spyOn(eventsMatrixHistogramConfig, 'buildDsl');
+
+  afterEach(() => {
+    buildMatrixHistogramQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      matrixHistogram.buildDsl(mockEventsOptions);
+      expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockEventsOptions);
+    });
+
+    test('should throw error if histogramType is invalid', () => {
+      const invalidOptions = {
+        ...mockEventsOptions,
+        histogramType: 'xxx' as MatrixHistogramType,
+      } as MatrixHistogramRequestOptions;
+
+      expect(() => {
+        matrixHistogram.buildDsl(invalidOptions);
+      }).toThrowError(`This histogram type xxx is unknown to the server side`);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await matrixHistogram.parse(
+        mockEventsOptions,
+        mockEventsSearchStrategyResponse
+      );
+      expect(result).toMatchObject(formattedEventsSearchStrategyResponse);
+    });
+  });
+});
+
+describe('Dns matrixHistogram search strategy', () => {
+  const buildMatrixHistogramQuery = jest.spyOn(dnsMatrixHistogramConfig, 'buildDsl');
+
+  afterEach(() => {
+    buildMatrixHistogramQuery.mockClear();
+  });
+
+  describe('buildDsl', () => {
+    test('should build dsl query', () => {
+      matrixHistogram.buildDsl(mockDnsOptions);
+      expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockDnsOptions);
+    });
+
+    test('should throw error if histogramType is invalid', () => {
+      const invalidOptions = {
+        ...mockDnsOptions,
+        histogramType: 'xxx' as MatrixHistogramType,
+      } as MatrixHistogramRequestOptions;
+
+      expect(() => {
+        matrixHistogram.buildDsl(invalidOptions);
+      }).toThrowError(`This histogram type xxx is unknown to the server side`);
+    });
+  });
+
+  describe('parse', () => {
+    test('should parse data correctly', async () => {
+      const result = await matrixHistogram.parse(mockDnsOptions, mockDnsSearchStrategyResponse);
+      expect(result).toMatchObject(formattedDnsSearchStrategyResponse);
+    });
+  });
+});
diff --git a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_logistics.tsx b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_logistics.tsx
index f825c7b1f3d98..7d3ba92cf2ad7 100644
--- a/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_logistics.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/components/policy_form/steps/step_logistics.tsx
@@ -51,7 +51,7 @@ export const PolicyStepLogistics: React.FunctionComponent<StepProps> = ({
         name: undefined,
       },
     },
-    sendRequest: reloadRepositories,
+    resendRequest: reloadRepositories,
   } = useLoadRepositories();
 
   const { i18n, history } = useServices();
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx
index f67e8eb586238..b4612c9df42ff 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_details/policy_details.tsx
@@ -65,7 +65,7 @@ export const PolicyDetails: React.FunctionComponent<Props> = ({
   onPolicyExecuted,
 }) => {
   const { i18n, uiMetricService, history } = useServices();
-  const { error, data: policyDetails, sendRequest: reload } = useLoadPolicy(policyName);
+  const { error, data: policyDetails, resendRequest: reload } = useLoadPolicy(policyName);
   const [activeTab, setActiveTab] = useState<string>(TAB_SUMMARY);
   const [isPopoverOpen, setIsPopoverOpen] = useState<boolean>(false);
 
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx
index 655bd0e9d8bb9..57f18ccbf8150 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_list.tsx
@@ -45,7 +45,7 @@ export const PolicyList: React.FunctionComponent<RouteComponentProps<MatchParams
     data: { policies } = {
       policies: undefined,
     },
-    sendRequest: reload,
+    resendRequest: reload,
   } = useLoadPolicies();
 
   const { uiMetricService } = useServices();
@@ -55,7 +55,7 @@ export const PolicyList: React.FunctionComponent<RouteComponentProps<MatchParams
     isLoading: isLoadingRetentionSettings,
     error: retentionSettingsError,
     data: retentionSettings,
-    sendRequest: reloadRetentionSettings,
+    resendRequest: reloadRetentionSettings,
   } = useLoadRetentionSettings();
 
   const openPolicyDetailsUrl = (newPolicyName: SlmPolicy['name']): string => {
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx
index d55bbf0b324cf..e7e4a9b54ada7 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/policy_list/policy_table/policy_table.tsx
@@ -21,7 +21,7 @@ import {
 } from '@elastic/eui';
 
 import { SlmPolicy } from '../../../../../../common/types';
-import { Error } from '../../../../../shared_imports';
+import { UseRequestResponse } from '../../../../../shared_imports';
 import { UIM_POLICY_SHOW_DETAILS_CLICK } from '../../../../constants';
 import { useServices } from '../../../../app_context';
 import {
@@ -30,13 +30,12 @@ import {
   PolicyDeleteProvider,
 } from '../../../../components';
 import { linkToAddPolicy, linkToEditPolicy } from '../../../../services/navigation';
-import { SendRequestResponse } from '../../../../../shared_imports';
 
 import { reactRouterNavigate } from '../../../../../../../../../src/plugins/kibana_react/public';
 
 interface Props {
   policies: SlmPolicy[];
-  reload: () => Promise<SendRequestResponse<any, Error>>;
+  reload: UseRequestResponse['resendRequest'];
   openPolicyDetailsUrl: (name: SlmPolicy['name']) => string;
   onPolicyDeleted: (policiesDeleted: Array<SlmPolicy['name']>) => void;
   onPolicyExecuted: () => void;
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx
index 9afdad3806def..a3f57ce4fbf5e 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_list.tsx
@@ -40,7 +40,7 @@ export const RepositoryList: React.FunctionComponent<RouteComponentProps<MatchPa
         name: undefined,
       },
     },
-    sendRequest: reload,
+    resendRequest: reload,
   } = useLoadRepositories();
 
   const { uiMetricService } = useServices();
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_table/repository_table.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_table/repository_table.tsx
index d435ff4524ea2..4ccec36fba040 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_table/repository_table.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/repository_list/repository_table/repository_table.tsx
@@ -17,7 +17,7 @@ import {
 
 import { REPOSITORY_TYPES } from '../../../../../../common';
 import { Repository, RepositoryType } from '../../../../../../common/types';
-import { Error, SendRequestResponse } from '../../../../../shared_imports';
+import { UseRequestResponse } from '../../../../../shared_imports';
 import { RepositoryDeleteProvider } from '../../../../components';
 import { UIM_REPOSITORY_SHOW_DETAILS_CLICK } from '../../../../constants';
 import { useServices } from '../../../../app_context';
@@ -29,7 +29,7 @@ import { reactRouterNavigate } from '../../../../../../../../../src/plugins/kiba
 interface Props {
   repositories: Repository[];
   managedRepository?: string;
-  reload: () => Promise<SendRequestResponse<any, Error>>;
+  reload: UseRequestResponse['resendRequest'];
   openRepositoryDetailsUrl: (name: Repository['name']) => string;
   onRepositoryDeleted: (repositoriesDeleted: Array<Repository['name']>) => void;
 }
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/restore_list/restore_list.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/restore_list/restore_list.tsx
index d7a82386926c1..d9507a101bbac 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/restore_list/restore_list.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/restore_list/restore_list.tsx
@@ -52,9 +52,13 @@ export const RestoreList: React.FunctionComponent = () => {
   const [currentInterval, setCurrentInterval] = useState<number>(INTERVAL_OPTIONS[1]);
 
   // Load restores
-  const { error, isLoading, data: restores = [], isInitialRequest, sendRequest } = useLoadRestores(
-    currentInterval
-  );
+  const {
+    error,
+    isLoading,
+    data: restores = [],
+    isInitialRequest,
+    resendRequest,
+  } = useLoadRestores(currentInterval);
 
   const { uiMetricService, history } = useServices();
 
@@ -174,7 +178,7 @@ export const RestoreList: React.FunctionComponent = () => {
                       key={interval}
                       icon="empty"
                       onClick={() => {
-                        sendRequest();
+                        resendRequest();
                         setCurrentInterval(interval);
                         setIsIntervalMenuOpen(false);
                       }}
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx
index d13188fc44730..97def33ffe8f6 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_list.tsx
@@ -44,7 +44,7 @@ export const SnapshotList: React.FunctionComponent<RouteComponentProps<MatchPara
     error,
     isLoading,
     data: { snapshots = [], repositories = [], policies = [], errors = {} },
-    sendRequest: reload,
+    resendRequest: reload,
   } = useLoadSnapshots();
 
   const { uiMetricService } = useServices();
diff --git a/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_table/snapshot_table.tsx b/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_table/snapshot_table.tsx
index 46bd5bab53d2b..ab2591b594dcb 100644
--- a/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_table/snapshot_table.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/sections/home/snapshot_list/snapshot_table/snapshot_table.tsx
@@ -17,19 +17,18 @@ import {
 } from '@elastic/eui';
 
 import { SnapshotDetails } from '../../../../../../common/types';
-import { Error } from '../../../../../shared_imports';
+import { UseRequestResponse } from '../../../../../shared_imports';
 import { SNAPSHOT_STATE, UIM_SNAPSHOT_SHOW_DETAILS_CLICK } from '../../../../constants';
 import { useServices } from '../../../../app_context';
 import { linkToRepository, linkToRestoreSnapshot } from '../../../../services/navigation';
 import { DataPlaceholder, FormattedDateTime, SnapshotDeleteProvider } from '../../../../components';
-import { SendRequestResponse } from '../../../../../shared_imports';
 
 import { reactRouterNavigate } from '../../../../../../../../../src/plugins/kibana_react/public';
 
 interface Props {
   snapshots: SnapshotDetails[];
   repositories: string[];
-  reload: () => Promise<SendRequestResponse<any, Error>>;
+  reload: UseRequestResponse['resendRequest'];
   openSnapshotDetailsUrl: (repositoryName: string, snapshotId: string) => string;
   repositoryFilter?: string;
   policyFilter?: string;
diff --git a/x-pack/plugins/snapshot_restore/public/shared_imports.ts b/x-pack/plugins/snapshot_restore/public/shared_imports.ts
index cad8ce147bd25..bd1c0e0cd395b 100644
--- a/x-pack/plugins/snapshot_restore/public/shared_imports.ts
+++ b/x-pack/plugins/snapshot_restore/public/shared_imports.ts
@@ -14,6 +14,7 @@ export {
   sendRequest,
   SendRequestConfig,
   SendRequestResponse,
+  UseRequestResponse,
   useAuthorizationContext,
   useRequest,
   UseRequestConfig,
diff --git a/x-pack/plugins/spaces/server/lib/copy_to_spaces/copy_to_spaces.test.ts b/x-pack/plugins/spaces/server/lib/copy_to_spaces/copy_to_spaces.test.ts
index d49dfa2015dc6..1cec7b769fa26 100644
--- a/x-pack/plugins/spaces/server/lib/copy_to_spaces/copy_to_spaces.test.ts
+++ b/x-pack/plugins/spaces/server/lib/copy_to_spaces/copy_to_spaces.test.ts
@@ -20,6 +20,7 @@ import { copySavedObjectsToSpacesFactory } from './copy_to_spaces';
 
 jest.mock('../../../../../../src/core/server', () => {
   return {
+    ...(jest.requireActual('../../../../../../src/core/server') as Record<string, unknown>),
     exportSavedObjectsToStream: jest.fn(),
     importSavedObjectsFromStream: jest.fn(),
   };
diff --git a/x-pack/plugins/spaces/server/lib/copy_to_spaces/resolve_copy_conflicts.test.ts b/x-pack/plugins/spaces/server/lib/copy_to_spaces/resolve_copy_conflicts.test.ts
index 6a77bf7397cb5..37181c9d81649 100644
--- a/x-pack/plugins/spaces/server/lib/copy_to_spaces/resolve_copy_conflicts.test.ts
+++ b/x-pack/plugins/spaces/server/lib/copy_to_spaces/resolve_copy_conflicts.test.ts
@@ -20,6 +20,7 @@ import { resolveCopySavedObjectsToSpacesConflictsFactory } from './resolve_copy_
 
 jest.mock('../../../../../../src/core/server', () => {
   return {
+    ...(jest.requireActual('../../../../../../src/core/server') as Record<string, unknown>),
     exportSavedObjectsToStream: jest.fn(),
     resolveSavedObjectsImportErrors: jest.fn(),
   };
diff --git a/x-pack/plugins/spaces/server/lib/utils/__mocks__/index.ts b/x-pack/plugins/spaces/server/lib/utils/__mocks__/index.ts
new file mode 100644
index 0000000000000..2b93e6d87a7af
--- /dev/null
+++ b/x-pack/plugins/spaces/server/lib/utils/__mocks__/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+const mockNamespaceIdToString = jest.fn();
+const mockNamespaceStringToId = jest.fn();
+jest.mock('../../../../../../../src/core/server', () => ({
+  SavedObjectsUtils: {
+    namespaceIdToString: mockNamespaceIdToString,
+    namespaceStringToId: mockNamespaceStringToId,
+  },
+}));
+
+export { mockNamespaceIdToString, mockNamespaceStringToId };
diff --git a/x-pack/plugins/spaces/server/lib/utils/namespace.test.ts b/x-pack/plugins/spaces/server/lib/utils/namespace.test.ts
index a81a5f3cee187..79d3dda301045 100644
--- a/x-pack/plugins/spaces/server/lib/utils/namespace.test.ts
+++ b/x-pack/plugins/spaces/server/lib/utils/namespace.test.ts
@@ -4,45 +4,29 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DEFAULT_SPACE_ID } from '../../../common/constants';
+import { mockNamespaceIdToString, mockNamespaceStringToId } from './__mocks__';
 import { spaceIdToNamespace, namespaceToSpaceId } from './namespace';
 
-describe('#spaceIdToNamespace', () => {
-  it('converts the default space to undefined', () => {
-    expect(spaceIdToNamespace(DEFAULT_SPACE_ID)).toBeUndefined();
-  });
-
-  it('returns non-default spaces as-is', () => {
-    expect(spaceIdToNamespace('foo')).toEqual('foo');
-  });
-
-  it('throws an error when a spaceId is not provided', () => {
-    // @ts-ignore ts knows this isn't right
-    expect(() => spaceIdToNamespace()).toThrowErrorMatchingInlineSnapshot(`"spaceId is required"`);
+beforeEach(() => {
+  jest.clearAllMocks();
+});
 
-    // @ts-ignore ts knows this isn't right
-    expect(() => spaceIdToNamespace(null)).toThrowErrorMatchingInlineSnapshot(
-      `"spaceId is required"`
-    );
+describe('#spaceIdToNamespace', () => {
+  it('returns result of namespaceStringToId', () => {
+    mockNamespaceStringToId.mockReturnValue('bar');
 
-    expect(() => spaceIdToNamespace('')).toThrowErrorMatchingInlineSnapshot(
-      `"spaceId is required"`
-    );
+    const result = spaceIdToNamespace('foo');
+    expect(mockNamespaceStringToId).toHaveBeenCalledWith('foo');
+    expect(result).toEqual('bar');
   });
 });
 
 describe('#namespaceToSpaceId', () => {
-  it('returns the default space id for undefined namespaces', () => {
-    expect(namespaceToSpaceId(undefined)).toEqual(DEFAULT_SPACE_ID);
-  });
-
-  it('returns all other namespaces as-is', () => {
-    expect(namespaceToSpaceId('foo')).toEqual('foo');
-  });
+  it('returns result of namespaceIdToString', () => {
+    mockNamespaceIdToString.mockReturnValue('bar');
 
-  it('throws an error when an empty string is provided', () => {
-    expect(() => namespaceToSpaceId('')).toThrowErrorMatchingInlineSnapshot(
-      `"namespace cannot be an empty string"`
-    );
+    const result = namespaceToSpaceId('foo');
+    expect(mockNamespaceIdToString).toHaveBeenCalledWith('foo');
+    expect(result).toEqual('bar');
   });
 });
diff --git a/x-pack/plugins/spaces/server/lib/utils/namespace.ts b/x-pack/plugins/spaces/server/lib/utils/namespace.ts
index 8c7ed2ea1797d..344da18846f3b 100644
--- a/x-pack/plugins/spaces/server/lib/utils/namespace.ts
+++ b/x-pack/plugins/spaces/server/lib/utils/namespace.ts
@@ -4,28 +4,22 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DEFAULT_SPACE_ID } from '../../../common/constants';
+import { SavedObjectsUtils } from '../../../../../../src/core/server';
 
-export function spaceIdToNamespace(spaceId: string): string | undefined {
-  if (!spaceId) {
-    throw new TypeError('spaceId is required');
-  }
-
-  if (spaceId === DEFAULT_SPACE_ID) {
-    return undefined;
-  }
-
-  return spaceId;
+/**
+ * Converts a Space ID string to its namespace ID representation. Note that a Space ID string is equivalent to a namespace string.
+ *
+ * See also: {@link namespaceStringToId}.
+ */
+export function spaceIdToNamespace(spaceId: string) {
+  return SavedObjectsUtils.namespaceStringToId(spaceId);
 }
 
-export function namespaceToSpaceId(namespace: string | undefined): string {
-  if (namespace === '') {
-    throw new TypeError('namespace cannot be an empty string');
-  }
-
-  if (!namespace) {
-    return DEFAULT_SPACE_ID;
-  }
-
-  return namespace;
+/**
+ * Converts a namespace ID to its Space ID string representation. Note that a Space ID string is equivalent to a namespace string.
+ *
+ * See also: {@link namespaceIdToString}.
+ */
+export function namespaceToSpaceId(namespace?: string) {
+  return SavedObjectsUtils.namespaceIdToString(namespace);
 }
diff --git a/x-pack/plugins/spaces/server/routes/api/external/copy_to_space.test.ts b/x-pack/plugins/spaces/server/routes/api/external/copy_to_space.test.ts
index bec3a5dcb0b71..dce6de908cfcb 100644
--- a/x-pack/plugins/spaces/server/routes/api/external/copy_to_space.test.ts
+++ b/x-pack/plugins/spaces/server/routes/api/external/copy_to_space.test.ts
@@ -30,10 +30,10 @@ import { securityMock } from '../../../../../security/server/mocks';
 import { ObjectType } from '@kbn/config-schema';
 jest.mock('../../../../../../../src/core/server', () => {
   return {
+    ...(jest.requireActual('../../../../../../../src/core/server') as Record<string, unknown>),
     exportSavedObjectsToStream: jest.fn(),
     importSavedObjectsFromStream: jest.fn(),
     resolveSavedObjectsImportErrors: jest.fn(),
-    kibanaResponseFactory: jest.requireActual('src/core/server').kibanaResponseFactory,
   };
 });
 import {
diff --git a/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
index a7330d3ebd552..904b14a7459ad 100644
--- a/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
+++ b/x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json
@@ -297,6 +297,28 @@
         }
       }
     },
+    "security": {
+      "properties": {
+        "auditLoggingEnabled": {
+          "type": "boolean"
+        },
+        "loginSelectorEnabled": {
+          "type": "boolean"
+        },
+        "accessAgreementEnabled": {
+          "type": "boolean"
+        },
+        "authProviderCount": {
+          "type": "number"
+        },
+        "enabledAuthProviders": {
+          "type": "keyword"
+        },
+        "httpAuthSchemes": {
+          "type": "keyword"
+        }
+      }
+    },
     "spaces": {
       "properties": {
         "usesFeatureControls": {
diff --git a/x-pack/plugins/transform/common/utils/errors.ts b/x-pack/plugins/transform/common/utils/errors.ts
new file mode 100644
index 0000000000000..0c31d7e1584f0
--- /dev/null
+++ b/x-pack/plugins/transform/common/utils/errors.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface ErrorResponse {
+  body: {
+    statusCode: number;
+    error: string;
+    message: string;
+    attributes?: any;
+  };
+  name: string;
+}
+
+export function isErrorResponse(arg: any): arg is ErrorResponse {
+  return arg?.body?.error !== undefined && arg?.body?.message !== undefined;
+}
+
+export function getErrorMessage(error: any) {
+  if (isErrorResponse(error)) {
+    return `${error.body.error}: ${error.body.message}`;
+  }
+
+  if (typeof error === 'object' && typeof error.message === 'string') {
+    return error.message;
+  }
+
+  return JSON.stringify(error);
+}
diff --git a/x-pack/plugins/transform/public/__mocks__/shared_imports.ts b/x-pack/plugins/transform/public/__mocks__/shared_imports.ts
index e115e086f45b5..f7441fd93f38a 100644
--- a/x-pack/plugins/transform/public/__mocks__/shared_imports.ts
+++ b/x-pack/plugins/transform/public/__mocks__/shared_imports.ts
@@ -15,7 +15,6 @@ export const useRequest = jest.fn(() => ({
 
 // just passing through the reimports
 export {
-  getErrorMessage,
   getDataGridSchemaFromKibanaFieldType,
   getFieldsFromKibanaIndexPattern,
   multiColumnSortFactory,
diff --git a/x-pack/plugins/transform/public/app/hooks/use_delete_transform.tsx b/x-pack/plugins/transform/public/app/hooks/use_delete_transform.tsx
index 43c5ae6fad1b1..fdf77c8ebee51 100644
--- a/x-pack/plugins/transform/public/app/hooks/use_delete_transform.tsx
+++ b/x-pack/plugins/transform/public/app/hooks/use_delete_transform.tsx
@@ -12,7 +12,8 @@ import {
   DeleteTransformStatus,
   TransformEndpointRequest,
 } from '../../../common';
-import { extractErrorMessage, getErrorMessage } from '../../shared_imports';
+import { extractErrorMessage } from '../../shared_imports';
+import { getErrorMessage } from '../../../common/utils/errors';
 import { useAppDependencies, useToastNotifications } from '../app_dependencies';
 import { REFRESH_TRANSFORM_LIST_STATE, refreshTransformList$, TransformListRow } from '../common';
 import { ToastNotificationText } from '../components';
diff --git a/x-pack/plugins/transform/public/app/hooks/use_index_data.ts b/x-pack/plugins/transform/public/app/hooks/use_index_data.ts
index ad5850f26be2e..946f7991d049d 100644
--- a/x-pack/plugins/transform/public/app/hooks/use_index_data.ts
+++ b/x-pack/plugins/transform/public/app/hooks/use_index_data.ts
@@ -12,7 +12,6 @@ import {
   getFieldType,
   getDataGridSchemaFromKibanaFieldType,
   getFieldsFromKibanaIndexPattern,
-  getErrorMessage,
   showDataGridColumnChartErrorMessageToast,
   useDataGrid,
   useRenderCellValue,
@@ -21,6 +20,7 @@ import {
   UseIndexDataReturnType,
   INDEX_STATUS,
 } from '../../shared_imports';
+import { getErrorMessage } from '../../../common/utils/errors';
 
 import { isDefaultQuery, matchAllQuery, PivotQuery } from '../common';
 
diff --git a/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts b/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts
index a9f34996b9b51..a0e7c5dde494a 100644
--- a/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts
+++ b/x-pack/plugins/transform/public/app/hooks/use_pivot_data.ts
@@ -18,13 +18,13 @@ import { formatHumanReadableDateTimeSeconds } from '../../shared_imports';
 import { getNestedProperty } from '../../../common/utils/object_utils';
 
 import {
-  getErrorMessage,
   multiColumnSortFactory,
   useDataGrid,
   RenderCellValue,
   UseIndexDataReturnType,
   INDEX_STATUS,
 } from '../../shared_imports';
+import { getErrorMessage } from '../../../common/utils/errors';
 
 import {
   getPreviewRequestBody,
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx
index 255a245081d5a..2fa1b7c713370 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_create/step_create_form.tsx
@@ -32,7 +32,7 @@ import { toMountPoint } from '../../../../../../../../../src/plugins/kibana_reac
 
 import { PROGRESS_REFRESH_INTERVAL_MS } from '../../../../../../common/constants';
 
-import { getErrorMessage } from '../../../../../shared_imports';
+import { getErrorMessage } from '../../../../../../common/utils/errors';
 
 import { getTransformProgress, getDiscoverUrl } from '../../../../common';
 import { useApi } from '../../../../hooks/use_api';
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx
index 271fde27f519a..85f4065e8c069 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/step_details_form.tsx
@@ -16,7 +16,7 @@ import { toMountPoint } from '../../../../../../../../../src/plugins/kibana_reac
 import { TransformId } from '../../../../../../common';
 import { isValidIndexName } from '../../../../../../common/utils/es_utils';
 
-import { getErrorMessage } from '../../../../../shared_imports';
+import { getErrorMessage } from '../../../../../../common/utils/errors';
 
 import { useAppDependencies, useToastNotifications } from '../../../../app_dependencies';
 import { ToastNotificationText } from '../../../../components';
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx
index 77a7ae25ce887..735a059e57e14 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/edit_transform_flyout/edit_transform_flyout.tsx
@@ -23,7 +23,7 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 
-import { getErrorMessage } from '../../../../../shared_imports';
+import { getErrorMessage } from '../../../../../../common/utils/errors';
 
 import {
   refreshTransformList$,
diff --git a/x-pack/plugins/transform/public/shared_imports.ts b/x-pack/plugins/transform/public/shared_imports.ts
index abbc39dd6c728..196df250b7a3d 100644
--- a/x-pack/plugins/transform/public/shared_imports.ts
+++ b/x-pack/plugins/transform/public/shared_imports.ts
@@ -15,7 +15,6 @@ export {
 
 export {
   getFieldType,
-  getErrorMessage,
   extractErrorMessage,
   formatHumanReadableDateTimeSeconds,
   getDataGridSchemaFromKibanaFieldType,
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index ec87fde944a88..cb4a0f226f24c 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -816,8 +816,6 @@
     "data.query.queryBar.KQLNestedQuerySyntaxInfoTitle": "KQL ネストされたクエリ構文",
     "data.query.queryBar.kqlOffLabel": "オフ",
     "data.query.queryBar.kqlOnLabel": "オン",
-    "data.query.queryBar.licenseOptions": "ライセンスオプションに進む",
-    "data.query.queryBar.longQueryMessage": "ライセンスをアップグレードすれば、リクエストの完了までに十分な時間を確保できます。",
     "data.query.queryBar.luceneLanguageName": "Lucene",
     "data.query.queryBar.luceneSyntaxWarningMessage": "Lucene クエリ構文を使用しているようですが、Kibana クエリ言語 (KQL) が選択されています。KQL ドキュメント {link} を確認してください。",
     "data.query.queryBar.luceneSyntaxWarningOptOutText": "今後表示しない",
@@ -6676,8 +6674,6 @@
     "xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "より小さいまたは等しい",
     "xpack.data.kueryAutocomplete.orOperatorDescription": "{oneOrMoreArguments} が true であることを条件とする",
     "xpack.data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "1つ以上の引数",
-    "xpack.data.query.queryBar.cancelLongQuery": "キャンセル",
-    "xpack.data.query.queryBar.runBeyond": "タイムアウトを越えて実行",
     "xpack.discover.FlyoutCreateDrilldownAction.displayName": "基本データを調査",
     "xpack.embeddableEnhanced.actions.panelNotifications.manyDrilldowns": "パネルには{count}個のドリルダウンがあります",
     "xpack.embeddableEnhanced.actions.panelNotifications.oneDrilldown": "パネルには1個のドリルダウンがあります",
@@ -10890,7 +10886,6 @@
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsErrorMessage": "データフレーム分析ジョブ{analyticsId}の削除中にエラーが発生しました。",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsPrivilegeErrorMessage": "ユーザーはインデックス{indexName}を削除する権限がありません。{error}",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsSuccessMessage": "データフレーム分析ジョブ{analyticsId}の削除リクエストが受け付けられました。",
-    "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexErrorMessage": "ディスティネーションインデックス{destinationIndex}の削除中にエラーが発生しました。{error}",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexPatternErrorMessage": "インデックスパターン{destinationIndex}の削除中にエラーが発生しました。{error}",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexPatternSuccessMessage": "インデックスパターン{destinationIndex}を削除する要求が確認されました。",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexSuccessMessage": "ディスティネーションインデックス{destinationIndex}を削除する要求が確認されました。",
@@ -11358,16 +11353,9 @@
     "xpack.ml.jobService.activeDatafeedsLabel": "アクティブなデータフィード",
     "xpack.ml.jobService.activeMLNodesLabel": "アクティブな ML ノード",
     "xpack.ml.jobService.closedJobsLabel": "ジョブを作成",
-    "xpack.ml.jobService.couldNotStartDatafeedErrorMessage": "{jobId} のデータフィードを開始できませんでした",
-    "xpack.ml.jobService.couldNotStopDatafeedErrorMessage": "{jobId} のデータフィードを停止できませんでした",
-    "xpack.ml.jobService.couldNotUpdateDatafeedErrorMessage": "データフィードを更新できませんでした: {datafeedId}",
-    "xpack.ml.jobService.datafeedsListCouldNotBeRetrievedErrorMessage": "データフィードリストを取得できませんでした",
     "xpack.ml.jobService.failedJobsLabel": "失敗したジョブ",
-    "xpack.ml.jobService.jobsListCouldNotBeRetrievedErrorMessage": "ジョブリストを取得できませんでした",
     "xpack.ml.jobService.openJobsLabel": "ジョブを開く",
-    "xpack.ml.jobService.requestMayHaveTimedOutErrorMessage": "リクエストがタイムアウトし、まだバックグラウンドで実行中の可能性があります。",
     "xpack.ml.jobService.totalJobsLabel": "合計ジョブ数",
-    "xpack.ml.jobService.updateJobErrorTitle": "ジョブを更新できませんでした: {jobId}",
     "xpack.ml.jobService.validateJobErrorTitle": "ジョブ検証エラー",
     "xpack.ml.jobsList.actionExecuteSuccessfullyNotificationMessage": "{successesJobsCount, plural, one{{successJob}} other{# 件のジョブ}} {actionTextPT}成功",
     "xpack.ml.jobsList.actionFailedNotificationMessage": "{failureId} が {actionText} に失敗しました",
@@ -11572,7 +11560,6 @@
     "xpack.ml.maxFileSizeSettingsDescription": "ファイルデータビジュアライザーでデータをインポートするときのファイルサイズ上限を設定します。この設定でサポートされている最大値は1 GBです。",
     "xpack.ml.maxFileSizeSettingsError": "200 MB、1 GBなどの有効なデータサイズにしてください。",
     "xpack.ml.maxFileSizeSettingsName": "ファイルデータビジュアライザーの最大ファイルアップロードサイズ",
-    "xpack.ml.messagebarService.errorTitle": "エラーが発生しました",
     "xpack.ml.models.jobService.allOtherRequestsCancelledDescription": " 他のすべてのリクエストはキャンセルされました。",
     "xpack.ml.models.jobService.categorization.messages.failureToGetTokens": "フィールド値の例のサンプルをトークン化することができませんでした。{message}",
     "xpack.ml.models.jobService.categorization.messages.insufficientPrivileges": "権限が不十分なため、フィールド値の例のトークン化を実行できませんでした。そのため、フィールド値を確認し、カテゴリー分けジョブでの使用が適当かを確認することができません。",
@@ -15106,9 +15093,6 @@
     "xpack.securitySolution.case.configureCases.incidentManagementSystemDesc": "オプションとして、セキュリティケースを選択した外部のインシデント管理システムに接続できます。そうすると、選択したサードパーティシステム内でケースデータをインシデントとしてプッシュできます。",
     "xpack.securitySolution.case.configureCases.incidentManagementSystemLabel": "インシデント管理システム",
     "xpack.securitySolution.case.configureCases.incidentManagementSystemTitle": "外部のインシデント管理システムに接続",
-    "xpack.securitySolution.case.configureCases.mappingFieldComments": "コメント",
-    "xpack.securitySolution.case.configureCases.mappingFieldDescription": "説明",
-    "xpack.securitySolution.case.configureCases.mappingFieldName": "名前",
     "xpack.securitySolution.case.configureCases.mappingFieldNotMapped": "マップされません",
     "xpack.securitySolution.case.configureCases.noConnector": "コネクターを選択していません",
     "xpack.securitySolution.case.configureCases.updateConnector": "コネクターを更新",
@@ -15122,25 +15106,6 @@
     "xpack.securitySolution.case.confirmDeleteCase.deleteCases": "ケースを削除",
     "xpack.securitySolution.case.confirmDeleteCase.deleteTitle": "「{caseTitle}」を削除",
     "xpack.securitySolution.case.confirmDeleteCase.selectedCases": "選択したケースを削除",
-    "xpack.securitySolution.case.connectors.common.apiTokenTextFieldLabel": "APIトークン",
-    "xpack.securitySolution.case.connectors.common.apiUrlTextFieldLabel": "URL",
-    "xpack.securitySolution.case.connectors.common.emailTextFieldLabel": "メール",
-    "xpack.securitySolution.case.connectors.common.invalidApiUrlTextField": "URLが無効です",
-    "xpack.securitySolution.case.connectors.common.passwordTextFieldLabel": "パスワード",
-    "xpack.securitySolution.case.connectors.common.requiredApiTokenTextField": "APIトークンが必要です",
-    "xpack.securitySolution.case.connectors.common.requiredApiUrlTextField": "URLが必要です",
-    "xpack.securitySolution.case.connectors.common.requiredEmailTextField": "電子メールが必要です",
-    "xpack.securitySolution.case.connectors.common.requiredPasswordTextField": "パスワードが必要です",
-    "xpack.securitySolution.case.connectors.common.requiredUsernameTextField": "ユーザー名が必要です",
-    "xpack.securitySolution.case.connectors.common.usernameTextFieldLabel": "ユーザー名",
-    "xpack.securitySolution.case.connectors.resilient.actionTypeTitle": "IBM Resilient",
-    "xpack.securitySolution.case.connectors.resilient.apiKeyId": "APIキーID",
-    "xpack.securitySolution.case.connectors.resilient.apiKeySecret": "APIキーシークレット",
-    "xpack.securitySolution.case.connectors.resilient.orgId": "組織ID",
-    "xpack.securitySolution.case.connectors.resilient.requiredApiKeyIdTextField": "APIキーIDが必要です",
-    "xpack.securitySolution.case.connectors.resilient.requiredApiKeySecretTextField": "APIキーシークレットが必要です",
-    "xpack.securitySolution.case.connectors.resilient.requiredOrgIdTextField": "組織IDが必要です",
-    "xpack.securitySolution.case.connectors.resilient.selectMessageText": "Resilientでセキュリティケースデータを更新するか、新しいインシデントにプッシュ",
     "xpack.securitySolution.case.createCase.descriptionFieldRequiredError": "説明が必要です。",
     "xpack.securitySolution.case.createCase.fieldTagsHelpText": "このケースの1つ以上のカスタム識別タグを入力します。新しいタグを開始するには、各タグの後でEnterを押します。",
     "xpack.securitySolution.case.createCase.titleFieldRequiredError": "タイトルが必要です。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index d9c4c7b6badb7..a8381a8f142c8 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -817,8 +817,6 @@
     "data.query.queryBar.KQLNestedQuerySyntaxInfoTitle": "KQL 嵌套查询语法",
     "data.query.queryBar.kqlOffLabel": "关闭",
     "data.query.queryBar.kqlOnLabel": "开启",
-    "data.query.queryBar.licenseOptions": "前往许可证选项",
-    "data.query.queryBar.longQueryMessage": "使用升级的许可证，您可以确保有足够的时间来完成请求。",
     "data.query.queryBar.luceneLanguageName": "Lucene",
     "data.query.queryBar.luceneSyntaxWarningMessage": "尽管您选择了 Kibana 查询语言 (KQL)，但似乎您正在尝试使用 Lucene 查询语法。请查看 KQL 文档 {link}。",
     "data.query.queryBar.luceneSyntaxWarningOptOutText": "不再显示",
@@ -6679,8 +6677,6 @@
     "xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "小于或等于",
     "xpack.data.kueryAutocomplete.orOperatorDescription": "需要{oneOrMoreArguments}为 true",
     "xpack.data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "一个或多个参数",
-    "xpack.data.query.queryBar.cancelLongQuery": "取消",
-    "xpack.data.query.queryBar.runBeyond": "运行超时",
     "xpack.discover.FlyoutCreateDrilldownAction.displayName": "浏览底层数据",
     "xpack.embeddableEnhanced.actions.panelNotifications.manyDrilldowns": "面板有 {count} 个向下钻取",
     "xpack.embeddableEnhanced.actions.panelNotifications.oneDrilldown": "面板有 1 个向下钻取",
@@ -10896,7 +10892,6 @@
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsErrorMessage": "删除数据帧分析作业 {analyticsId} 时发生错误",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsPrivilegeErrorMessage": "用户无权删除索引 {indexName}：{error}",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsSuccessMessage": "删除的数据帧分析作业 {analyticsId} 的请求已确认。",
-    "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexErrorMessage": "删除目标索引 {destinationIndex} 时发生错误：{error}",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexPatternErrorMessage": "删除索引模式 {destinationIndex} 时发生错误：{error}",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexPatternSuccessMessage": "删除索引模式 {destinationIndex} 的请求已确认。",
     "xpack.ml.dataframe.analyticsList.deleteAnalyticsWithIndexSuccessMessage": "删除目标索引 {destinationIndex} 的请求已确认。",
@@ -11365,16 +11360,9 @@
     "xpack.ml.jobService.activeDatafeedsLabel": "活动数据馈送",
     "xpack.ml.jobService.activeMLNodesLabel": "活动 ML 节点",
     "xpack.ml.jobService.closedJobsLabel": "已关闭的作业",
-    "xpack.ml.jobService.couldNotStartDatafeedErrorMessage": "无法开始 {jobId} 的数据馈送",
-    "xpack.ml.jobService.couldNotStopDatafeedErrorMessage": "无法停止 {jobId} 的数据馈送",
-    "xpack.ml.jobService.couldNotUpdateDatafeedErrorMessage": "无法更新数据馈送：{datafeedId}",
-    "xpack.ml.jobService.datafeedsListCouldNotBeRetrievedErrorMessage": "无法检索数据馈送列表",
     "xpack.ml.jobService.failedJobsLabel": "失败的作业",
-    "xpack.ml.jobService.jobsListCouldNotBeRetrievedErrorMessage": "无法检索作业列表",
     "xpack.ml.jobService.openJobsLabel": "打开的作业",
-    "xpack.ml.jobService.requestMayHaveTimedOutErrorMessage": "请求可能已超时，并可能仍在后台运行。",
     "xpack.ml.jobService.totalJobsLabel": "总计作业数",
-    "xpack.ml.jobService.updateJobErrorTitle": "无法更新作业：{jobId}",
     "xpack.ml.jobService.validateJobErrorTitle": "作业验证错误",
     "xpack.ml.jobsList.actionExecuteSuccessfullyNotificationMessage": "{successesJobsCount, plural, one{{successJob}} other{# 个作业}}{actionTextPT}已成功",
     "xpack.ml.jobsList.actionFailedNotificationMessage": "{failureId} 未能{actionText}",
@@ -11579,7 +11567,6 @@
     "xpack.ml.maxFileSizeSettingsDescription": "设置在文件数据可视化工具中导入数据时的文件大小限制。此设置支持的最高值为 1GB。",
     "xpack.ml.maxFileSizeSettingsError": "应为有效的数据大小。如 200MB、1GB",
     "xpack.ml.maxFileSizeSettingsName": "文件数据可视化工具最大文件上传大小",
-    "xpack.ml.messagebarService.errorTitle": "发生了错误",
     "xpack.ml.models.jobService.allOtherRequestsCancelledDescription": " 所有其他请求已取消。",
     "xpack.ml.models.jobService.categorization.messages.failureToGetTokens": "无法对示例字段值样本进行分词。{message}",
     "xpack.ml.models.jobService.categorization.messages.insufficientPrivileges": "由于权限不足，无法对字段值示例执行分词。因此，无法检查字段值是否适合用于归类作业。",
@@ -15115,9 +15102,6 @@
     "xpack.securitySolution.case.configureCases.incidentManagementSystemDesc": "您可能会根据需要将 Security 案例连接到选择的外部事件管理系统。这将允许您将案例数据作为事件推送到所选第三方系统。",
     "xpack.securitySolution.case.configureCases.incidentManagementSystemLabel": "事件管理系统",
     "xpack.securitySolution.case.configureCases.incidentManagementSystemTitle": "连接到外部事件管理系统",
-    "xpack.securitySolution.case.configureCases.mappingFieldComments": "注释",
-    "xpack.securitySolution.case.configureCases.mappingFieldDescription": "描述",
-    "xpack.securitySolution.case.configureCases.mappingFieldName": "名称",
     "xpack.securitySolution.case.configureCases.mappingFieldNotMapped": "未映射",
     "xpack.securitySolution.case.configureCases.noConnector": "未选择连接器",
     "xpack.securitySolution.case.configureCases.updateConnector": "更新连接器",
@@ -15131,25 +15115,6 @@
     "xpack.securitySolution.case.confirmDeleteCase.deleteCases": "删除案例",
     "xpack.securitySolution.case.confirmDeleteCase.deleteTitle": "删除“{caseTitle}”",
     "xpack.securitySolution.case.confirmDeleteCase.selectedCases": "删除选定案例",
-    "xpack.securitySolution.case.connectors.common.apiTokenTextFieldLabel": "API 令牌",
-    "xpack.securitySolution.case.connectors.common.apiUrlTextFieldLabel": "URL",
-    "xpack.securitySolution.case.connectors.common.emailTextFieldLabel": "电子邮件",
-    "xpack.securitySolution.case.connectors.common.invalidApiUrlTextField": "URL 无效",
-    "xpack.securitySolution.case.connectors.common.passwordTextFieldLabel": "密码",
-    "xpack.securitySolution.case.connectors.common.requiredApiTokenTextField": "“API 令牌”必填",
-    "xpack.securitySolution.case.connectors.common.requiredApiUrlTextField": "“URL”必填",
-    "xpack.securitySolution.case.connectors.common.requiredEmailTextField": "“电子邮件”必填",
-    "xpack.securitySolution.case.connectors.common.requiredPasswordTextField": "“密码”必填",
-    "xpack.securitySolution.case.connectors.common.requiredUsernameTextField": "“用户名”必填",
-    "xpack.securitySolution.case.connectors.common.usernameTextFieldLabel": "用户名",
-    "xpack.securitySolution.case.connectors.resilient.actionTypeTitle": "IBM Resilient",
-    "xpack.securitySolution.case.connectors.resilient.apiKeyId": "API 密钥 ID",
-    "xpack.securitySolution.case.connectors.resilient.apiKeySecret": "API 密钥密码",
-    "xpack.securitySolution.case.connectors.resilient.orgId": "组织 ID",
-    "xpack.securitySolution.case.connectors.resilient.requiredApiKeyIdTextField": "“API 密钥 ID”必填",
-    "xpack.securitySolution.case.connectors.resilient.requiredApiKeySecretTextField": "“API 密钥密码”必填",
-    "xpack.securitySolution.case.connectors.resilient.requiredOrgIdTextField": "“组织 ID”必填",
-    "xpack.securitySolution.case.connectors.resilient.selectMessageText": "将 Security 案例数据推送或更新到 Resilient 中的新问题",
     "xpack.securitySolution.case.createCase.descriptionFieldRequiredError": "描述必填。",
     "xpack.securitySolution.case.createCase.fieldTagsHelpText": "为此案例键入一个或多个定制识别标记。在每个标记后按 Enter 键可开始新的标记。",
     "xpack.securitySolution.case.createCase.titleFieldRequiredError": "标题必填。",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_params.test.tsx
index be3e8a31820c4..8c37dc940a238 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_params.test.tsx
@@ -27,6 +27,7 @@ describe('EmailParamsFields renders', () => {
         docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
       />
     );
+
     expect(wrapper.find('[data-test-subj="toEmailAddressInput"]').length > 0).toBeTruthy();
     expect(
       wrapper.find('[data-test-subj="toEmailAddressInput"]').first().prop('selectedOptions')
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.test.tsx
index 25c04bda3f536..a882e3bc43f34 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_params.test.tsx
@@ -13,6 +13,7 @@ describe('IndexParamsFields renders', () => {
     const actionParams = {
       documents: [{ test: 123 }],
     };
+
     const wrapper = mountWithIntl(
       <ParamsFields
         actionParams={actionParams}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
index 130e4496c4d04..bf54ab3f91045 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
@@ -14,6 +14,7 @@ import { TypeRegistry } from '../../type_registry';
 import { ActionTypeModel } from '../../../types';
 import { getServiceNowActionType } from './servicenow';
 import { getJiraActionType } from './jira';
+import { getResilientActionType } from './resilient';
 
 export function registerBuiltInActionTypes({
   actionTypeRegistry,
@@ -28,4 +29,5 @@ export function registerBuiltInActionTypes({
   actionTypeRegistry.register(getWebhookActionType());
   actionTypeRegistry.register(getServiceNowActionType());
   actionTypeRegistry.register(getJiraActionType());
+  actionTypeRegistry.register(getResilientActionType());
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_params.test.tsx
index 9e37047ccda50..6a11dc8d0d6a5 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_params.test.tsx
@@ -22,6 +22,7 @@ describe('PagerDutyParamsFields renders', () => {
       group: 'group',
       class: 'test class',
     };
+
     const wrapper = mountWithIntl(
       <PagerDutyParamsFields
         actionParams={actionParams}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/api.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/api.ts
new file mode 100644
index 0000000000000..4dbdf7cecfba4
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/api.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HttpSetup } from 'kibana/public';
+import { BASE_ACTION_API_PATH } from '../../../constants';
+
+export async function getIncidentTypes({
+  http,
+  signal,
+  connectorId,
+}: {
+  http: HttpSetup;
+  signal: AbortSignal;
+  connectorId: string;
+}): Promise<Record<string, any>> {
+  return await http.post(`${BASE_ACTION_API_PATH}/action/${connectorId}/_execute`, {
+    body: JSON.stringify({
+      params: { subAction: 'incidentTypes', subActionParams: {} },
+    }),
+    signal,
+  });
+}
+
+export async function getSeverity({
+  http,
+  signal,
+  connectorId,
+}: {
+  http: HttpSetup;
+  signal: AbortSignal;
+  connectorId: string;
+}): Promise<Record<string, any>> {
+  return await http.post(`${BASE_ACTION_API_PATH}/action/${connectorId}/_execute`, {
+    body: JSON.stringify({
+      params: { subAction: 'severity', subActionParams: {} },
+    }),
+    signal,
+  });
+}
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/config.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/config.ts
similarity index 88%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/resilient/config.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/config.ts
index 7d4edbf624877..a2054585c19b8 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/config.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/config.ts
@@ -4,14 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ConnectorConfiguration } from './types';
-
 import * as i18n from './translations';
 import logo from './logo.svg';
 
-export const connector: ConnectorConfiguration = {
+export const connectorConfiguration = {
   id: '.resilient',
-  name: i18n.RESILIENT_TITLE,
+  name: i18n.TITLE,
   logo,
   enabled: true,
   enabledInConfig: true,
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/index.ts
similarity index 77%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/index.ts
index 33afa82c84f34..0905bd29493e7 100644
--- a/x-pack/plugins/security_solution/public/common/lib/connectors/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { getActionType as resilientActionType } from './resilient';
+export { getActionType as getResilientActionType } from './resilient';
diff --git a/x-pack/plugins/security_solution/public/common/lib/connectors/resilient/logo.svg b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/logo.svg
similarity index 100%
rename from x-pack/plugins/security_solution/public/common/lib/connectors/resilient/logo.svg
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/logo.svg
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.test.tsx
new file mode 100644
index 0000000000000..b73eb72f137c1
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.test.tsx
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { TypeRegistry } from '../../../type_registry';
+import { registerBuiltInActionTypes } from '.././index';
+import { ActionTypeModel } from '../../../../types';
+import { ResilientActionConnector } from './types';
+
+const ACTION_TYPE_ID = '.resilient';
+let actionTypeModel: ActionTypeModel;
+
+beforeAll(() => {
+  const actionTypeRegistry = new TypeRegistry<ActionTypeModel>();
+  registerBuiltInActionTypes({ actionTypeRegistry });
+  const getResult = actionTypeRegistry.get(ACTION_TYPE_ID);
+  if (getResult !== null) {
+    actionTypeModel = getResult;
+  }
+});
+
+describe('actionTypeRegistry.get() works', () => {
+  test('action type static data is as expected', () => {
+    expect(actionTypeModel.id).toEqual(ACTION_TYPE_ID);
+  });
+});
+
+describe('resilient connector validation', () => {
+  test('connector validation succeeds when connector config is valid', () => {
+    const actionConnector = {
+      secrets: {
+        apiKeyId: 'email',
+        apiKeySecret: 'token',
+      },
+      id: 'test',
+      actionTypeId: '.resilient',
+      isPreconfigured: false,
+      name: 'resilient',
+      config: {
+        apiUrl: 'https://test/',
+        orgId: '201',
+      },
+    } as ResilientActionConnector;
+
+    expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
+      errors: {
+        apiUrl: [],
+        apiKeyId: [],
+        apiKeySecret: [],
+        orgId: [],
+      },
+    });
+  });
+
+  test('connector validation fails when connector config is not valid', () => {
+    const actionConnector = ({
+      secrets: {
+        apiKeyId: 'user',
+      },
+      id: '.jira',
+      actionTypeId: '.jira',
+      name: 'jira',
+      config: {},
+    } as unknown) as ResilientActionConnector;
+
+    expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
+      errors: {
+        apiUrl: ['URL is required.'],
+        apiKeyId: [],
+        apiKeySecret: ['API key secret is required'],
+        orgId: ['Organization ID is required'],
+      },
+    });
+  });
+});
+
+describe('resilient action params validation', () => {
+  test('action params validation succeeds when action params is valid', () => {
+    const actionParams = {
+      subActionParams: { title: 'some title {{test}}' },
+    };
+
+    expect(actionTypeModel.validateParams(actionParams)).toEqual({
+      errors: { title: [] },
+    });
+  });
+
+  test('params validation fails when body is not valid', () => {
+    const actionParams = {
+      subActionParams: { title: '' },
+    };
+
+    expect(actionTypeModel.validateParams(actionParams)).toEqual({
+      errors: {
+        title: ['Title is required.'],
+      },
+    });
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.tsx
new file mode 100644
index 0000000000000..cda6935f3b73d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { lazy } from 'react';
+import { ValidationResult, ActionTypeModel } from '../../../../types';
+import { connectorConfiguration } from './config';
+import logo from './logo.svg';
+import { ResilientActionConnector, ResilientActionParams } from './types';
+import * as i18n from './translations';
+import { isValidUrl } from '../../../lib/value_validators';
+
+const validateConnector = (action: ResilientActionConnector): ValidationResult => {
+  const validationResult = { errors: {} };
+  const errors = {
+    apiUrl: new Array<string>(),
+    orgId: new Array<string>(),
+    apiKeyId: new Array<string>(),
+    apiKeySecret: new Array<string>(),
+  };
+  validationResult.errors = errors;
+
+  if (!action.config.apiUrl) {
+    errors.apiUrl = [...errors.apiUrl, i18n.API_URL_REQUIRED];
+  }
+
+  if (action.config.apiUrl && !isValidUrl(action.config.apiUrl, 'https:')) {
+    errors.apiUrl = [...errors.apiUrl, i18n.API_URL_INVALID];
+  }
+
+  if (!action.config.orgId) {
+    errors.orgId = [...errors.orgId, i18n.ORG_ID_REQUIRED];
+  }
+
+  if (!action.secrets.apiKeyId) {
+    errors.apiKeyId = [...errors.apiKeyId, i18n.API_KEY_ID_REQUIRED];
+  }
+
+  if (!action.secrets.apiKeySecret) {
+    errors.apiKeySecret = [...errors.apiKeySecret, i18n.API_KEY_SECRET_REQUIRED];
+  }
+
+  return validationResult;
+};
+
+export function getActionType(): ActionTypeModel<ResilientActionConnector, ResilientActionParams> {
+  return {
+    id: connectorConfiguration.id,
+    iconClass: logo,
+    selectMessage: i18n.DESC,
+    actionTypeTitle: connectorConfiguration.name,
+    validateConnector,
+    actionConnectorFields: lazy(() => import('./resilient_connectors')),
+    validateParams: (actionParams: ResilientActionParams): ValidationResult => {
+      const validationResult = { errors: {} };
+      const errors = {
+        title: new Array<string>(),
+      };
+      validationResult.errors = errors;
+      if (actionParams.subActionParams && !actionParams.subActionParams.title?.length) {
+        errors.title.push(i18n.TITLE_REQUIRED);
+      }
+      return validationResult;
+    },
+    actionParamsFields: lazy(() => import('./resilient_params')),
+  };
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_connectors.test.tsx
new file mode 100644
index 0000000000000..7e242f1f501d8
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_connectors.test.tsx
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { DocLinksStart } from 'kibana/public';
+import ResilientConnectorFields from './resilient_connectors';
+import { ResilientActionConnector } from './types';
+
+describe('ResilientActionConnectorFields renders', () => {
+  test('alerting Resilient connector fields is rendered', () => {
+    const actionConnector = {
+      secrets: {
+        apiKeyId: 'key',
+        apiKeySecret: 'secret',
+      },
+      id: 'test',
+      actionTypeId: '.resilient',
+      isPreconfigured: false,
+      name: 'resilient',
+      config: {
+        apiUrl: 'https://test/',
+        orgId: '201',
+      },
+    } as ResilientActionConnector;
+    const deps = {
+      docLinks: { ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart,
+    };
+    const wrapper = mountWithIntl(
+      <ResilientConnectorFields
+        action={actionConnector}
+        errors={{ apiUrl: [], apiKeyId: [], apiKeySecret: [], orgId: [] }}
+        editActionConfig={() => {}}
+        editActionSecrets={() => {}}
+        docLinks={deps!.docLinks}
+        readOnly={false}
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="apiUrlFromInput"]').length > 0).toBeTruthy();
+    expect(
+      wrapper.find('[data-test-subj="connector-resilient-orgId-form-input"]').length > 0
+    ).toBeTruthy();
+
+    expect(
+      wrapper.find('[data-test-subj="connector-resilient-apiKeySecret-form-input"]').length > 0
+    ).toBeTruthy();
+
+    expect(
+      wrapper.find('[data-test-subj="connector-resilient-apiKeySecret-form-input"]').length > 0
+    ).toBeTruthy();
+  });
+
+  test('case specific Resilient connector fields is rendered', () => {
+    const actionConnector = {
+      secrets: {
+        apiKeyId: 'email',
+        apiKeySecret: 'token',
+      },
+      id: 'test',
+      actionTypeId: '.resilient',
+      isPreconfigured: false,
+      name: 'resilient',
+      config: {
+        apiUrl: 'https://test/',
+        orgId: '201',
+      },
+    } as ResilientActionConnector;
+    const deps = {
+      docLinks: { ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart,
+    };
+    const wrapper = mountWithIntl(
+      <ResilientConnectorFields
+        action={actionConnector}
+        errors={{ apiUrl: [], apiKeyId: [], apiKeySecret: [], orgId: [] }}
+        editActionConfig={() => {}}
+        editActionSecrets={() => {}}
+        docLinks={deps!.docLinks}
+        readOnly={false}
+        consumer={'case'}
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="case-resilient-mappings"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="apiUrlFromInput"]').length > 0).toBeTruthy();
+    expect(
+      wrapper.find('[data-test-subj="connector-resilient-orgId-form-input"]').length > 0
+    ).toBeTruthy();
+
+    expect(
+      wrapper.find('[data-test-subj="connector-resilient-apiKeySecret-form-input"]').length > 0
+    ).toBeTruthy();
+
+    expect(
+      wrapper.find('[data-test-subj="connector-resilient-apiKeySecret-form-input"]').length > 0
+    ).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_connectors.tsx
new file mode 100644
index 0000000000000..7965e216f1d6c
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_connectors.tsx
@@ -0,0 +1,209 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useCallback } from 'react';
+
+import {
+  EuiFieldText,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiFieldPassword,
+  EuiSpacer,
+} from '@elastic/eui';
+
+import { isEmpty } from 'lodash';
+import { ActionConnectorFieldsProps } from '../../../../types';
+import * as i18n from './translations';
+import { ResilientActionConnector } from './types';
+import { connectorConfiguration } from './config';
+import { FieldMapping, CasesConfigurationMapping, createDefaultMapping } from '../case_mappings';
+
+const ResilientConnectorFields: React.FC<ActionConnectorFieldsProps<ResilientActionConnector>> = ({
+  action,
+  editActionSecrets,
+  editActionConfig,
+  errors,
+  consumer,
+  readOnly,
+  docLinks,
+}) => {
+  // TODO: remove incidentConfiguration later, when Case Resilient will move their fields to the level of action execution
+  const { apiUrl, orgId, incidentConfiguration, isCaseOwned } = action.config;
+  const mapping = incidentConfiguration ? incidentConfiguration.mapping : [];
+
+  const isApiUrlInvalid: boolean = errors.apiUrl.length > 0 && apiUrl != null;
+
+  const { apiKeyId, apiKeySecret } = action.secrets;
+
+  const isOrgIdInvalid: boolean = errors.orgId.length > 0 && orgId != null;
+  const isApiKeyInvalid: boolean = errors.apiKeyId.length > 0 && apiKeyId != null;
+  const isApiKeySecretInvalid: boolean = errors.apiKeySecret.length > 0 && apiKeySecret != null;
+
+  // TODO: remove this block later, when Case ServiceNow will move their fields to the level of action execution
+  if (consumer === 'case') {
+    if (isEmpty(mapping)) {
+      editActionConfig('incidentConfiguration', {
+        mapping: createDefaultMapping(connectorConfiguration.fields as any),
+      });
+    }
+
+    if (!isCaseOwned) {
+      editActionConfig('isCaseOwned', true);
+    }
+  }
+
+  const handleOnChangeActionConfig = useCallback(
+    (key: string, value: string) => editActionConfig(key, value),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    []
+  );
+
+  const handleOnChangeSecretConfig = useCallback(
+    (key: string, value: string) => editActionSecrets(key, value),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    []
+  );
+
+  const handleOnChangeMappingConfig = useCallback(
+    (newMapping: CasesConfigurationMapping[]) =>
+      editActionConfig('incidentConfiguration', {
+        ...action.config.incidentConfiguration,
+        mapping: newMapping,
+      }),
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [action.config]
+  );
+
+  return (
+    <>
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiFormRow
+            id="apiUrl"
+            fullWidth
+            error={errors.apiUrl}
+            isInvalid={isApiUrlInvalid}
+            label={i18n.API_URL_LABEL}
+          >
+            <EuiFieldText
+              fullWidth
+              isInvalid={isApiUrlInvalid}
+              name="apiUrl"
+              readOnly={readOnly}
+              value={apiUrl || ''} // Needed to prevent uncontrolled input error when value is undefined
+              data-test-subj="apiUrlFromInput"
+              placeholder="https://<site-url>"
+              onChange={(evt) => handleOnChangeActionConfig('apiUrl', evt.target.value)}
+              onBlur={() => {
+                if (!apiUrl) {
+                  editActionConfig('apiUrl', '');
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="m" />
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiFormRow
+            id="connector-resilient-orgId-key"
+            fullWidth
+            error={errors.orgId}
+            isInvalid={isOrgIdInvalid}
+            label={i18n.ORG_ID_LABEL}
+          >
+            <EuiFieldText
+              fullWidth
+              isInvalid={isOrgIdInvalid}
+              name="connector-resilient-orgId"
+              value={orgId || ''} // Needed to prevent uncontrolled input error when value is undefined
+              data-test-subj="connector-resilient-orgId-form-input"
+              onChange={(evt) => handleOnChangeActionConfig('orgId', evt.target.value)}
+              onBlur={() => {
+                if (!orgId) {
+                  editActionConfig('orgId', '');
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="m" />
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiFormRow
+            id="connector-resilient-apiKeyId"
+            fullWidth
+            error={errors.apiKeyId}
+            isInvalid={isApiKeyInvalid}
+            label={i18n.API_KEY_ID_LABEL}
+          >
+            <EuiFieldText
+              fullWidth
+              isInvalid={isApiKeyInvalid}
+              readOnly={readOnly}
+              name="connector-resilient-apiKeyId"
+              value={apiKeyId || ''} // Needed to prevent uncontrolled input error when value is undefined
+              data-test-subj="connector-resilient-apiKeyId-form-input"
+              onChange={(evt) => handleOnChangeSecretConfig('apiKeyId', evt.target.value)}
+              onBlur={() => {
+                if (!apiKeyId) {
+                  editActionSecrets('apiKeyId', '');
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="m" />
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <EuiFormRow
+            id="connector-resilient-apiKeySecret"
+            fullWidth
+            error={errors.apiKeySecret}
+            isInvalid={isApiKeySecretInvalid}
+            label={i18n.API_KEY_SECRET_LABEL}
+          >
+            <EuiFieldPassword
+              fullWidth
+              readOnly={readOnly}
+              isInvalid={isApiKeySecretInvalid}
+              name="connector-resilient-apiKeySecret"
+              value={apiKeySecret || ''} // Needed to prevent uncontrolled input error when value is undefined
+              data-test-subj="connector-resilient-apiKeySecret-form-input"
+              onChange={(evt) => handleOnChangeSecretConfig('apiKeySecret', evt.target.value)}
+              onBlur={() => {
+                if (!apiKeySecret) {
+                  editActionSecrets('apiKeySecret', '');
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      {consumer === 'case' && ( // TODO: remove this block later, when Case Resilient will move their fields to the level of action execution
+        <>
+          <EuiSpacer size="l" />
+          <EuiFlexGroup>
+            <EuiFlexItem data-test-subj="case-resilient-mappings">
+              <FieldMapping
+                disabled={true}
+                connectorConfiguration={connectorConfiguration}
+                mapping={mapping as CasesConfigurationMapping[]}
+                onChangeMapping={handleOnChangeMappingConfig}
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </>
+      )}
+    </>
+  );
+};
+
+// eslint-disable-next-line import/no-default-export
+export { ResilientConnectorFields as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_params.test.tsx
new file mode 100644
index 0000000000000..17020805757f9
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_params.test.tsx
@@ -0,0 +1,189 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import ResilientParamsFields from './resilient_params';
+import { DocLinksStart } from 'kibana/public';
+
+import { useGetIncidentTypes } from './use_get_incident_types';
+import { useGetSeverity } from './use_get_severity';
+
+jest.mock('../../../app_context', () => {
+  const post = jest.fn();
+  return {
+    useAppDependencies: jest.fn(() => ({ http: { post } })),
+  };
+});
+
+jest.mock('./use_get_incident_types');
+jest.mock('./use_get_severity');
+
+const useGetIncidentTypesMock = useGetIncidentTypes as jest.Mock;
+const useGetSeverityMock = useGetSeverity as jest.Mock;
+
+const actionParams = {
+  subAction: 'pushToService',
+  subActionParams: {
+    title: 'title',
+    description: 'some description',
+    comments: [{ commentId: '1', comment: 'comment for resilient' }],
+    incidentTypes: [1001],
+    severityCode: 6,
+    savedObjectId: '123',
+    externalId: null,
+  },
+};
+const connector = {
+  secrets: {},
+  config: {},
+  id: 'test',
+  actionTypeId: '.test',
+  name: 'Test',
+  isPreconfigured: false,
+};
+
+describe('ResilientParamsFields renders', () => {
+  const useGetIncidentTypesResponse = {
+    isLoading: false,
+    incidentTypes: [
+      {
+        id: 19,
+        name: 'Malware',
+      },
+      {
+        id: 21,
+        name: 'Denial of Service',
+      },
+    ],
+  };
+
+  const useGetSeverityResponse = {
+    isLoading: false,
+    severity: [
+      {
+        id: 4,
+        name: 'Low',
+      },
+      {
+        id: 5,
+        name: 'Medium',
+      },
+      {
+        id: 6,
+        name: 'High',
+      },
+    ],
+  };
+
+  beforeEach(() => {
+    useGetIncidentTypesMock.mockReturnValue(useGetIncidentTypesResponse);
+    useGetSeverityMock.mockReturnValue(useGetSeverityResponse);
+  });
+
+  test('all params fields are rendered', () => {
+    const wrapper = mountWithIntl(
+      <ResilientParamsFields
+        actionParams={actionParams}
+        errors={{ title: [] }}
+        editAction={() => {}}
+        index={0}
+        messageVariables={[]}
+        docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
+        actionConnector={connector}
+      />
+    );
+    expect(wrapper.find('[data-test-subj="incidentTypeComboBox"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="severitySelect"]').first().prop('value')).toStrictEqual(
+      6
+    );
+    expect(wrapper.find('[data-test-subj="titleInput"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="descriptionTextArea"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="commentsTextArea"]').length > 0).toBeTruthy();
+  });
+
+  test('it shows loading when loading incident types', () => {
+    useGetIncidentTypesMock.mockReturnValue({ ...useGetIncidentTypesResponse, isLoading: true });
+    const wrapper = mountWithIntl(
+      <ResilientParamsFields
+        actionParams={actionParams}
+        errors={{ title: [] }}
+        editAction={() => {}}
+        index={0}
+        messageVariables={[]}
+        docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
+        actionConnector={connector}
+      />
+    );
+
+    expect(
+      wrapper.find('[data-test-subj="incidentTypeComboBox"]').first().prop('isLoading')
+    ).toBeTruthy();
+  });
+
+  test('it shows loading when loading severity', () => {
+    useGetSeverityMock.mockReturnValue({
+      ...useGetSeverityResponse,
+      isLoading: true,
+    });
+
+    const wrapper = mountWithIntl(
+      <ResilientParamsFields
+        actionParams={actionParams}
+        errors={{ title: [] }}
+        editAction={() => {}}
+        index={0}
+        messageVariables={[]}
+        docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
+        actionConnector={connector}
+      />
+    );
+
+    expect(
+      wrapper.find('[data-test-subj="severitySelect"]').first().prop('isLoading')
+    ).toBeTruthy();
+  });
+
+  test('it disabled the fields when loading issue types', () => {
+    useGetIncidentTypesMock.mockReturnValue({ ...useGetIncidentTypesResponse, isLoading: true });
+
+    const wrapper = mountWithIntl(
+      <ResilientParamsFields
+        actionParams={actionParams}
+        errors={{ title: [] }}
+        editAction={() => {}}
+        index={0}
+        messageVariables={[]}
+        docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
+        actionConnector={connector}
+      />
+    );
+
+    expect(
+      wrapper.find('[data-test-subj="incidentTypeComboBox"]').first().prop('isDisabled')
+    ).toBeTruthy();
+  });
+
+  test('it disabled the fields when loading severity', () => {
+    useGetSeverityMock.mockReturnValue({
+      ...useGetSeverityResponse,
+      isLoading: true,
+    });
+
+    const wrapper = mountWithIntl(
+      <ResilientParamsFields
+        actionParams={actionParams}
+        errors={{ title: [] }}
+        editAction={() => {}}
+        index={0}
+        messageVariables={[]}
+        docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
+        actionConnector={connector}
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="severitySelect"]').first().prop('disabled')).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_params.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_params.tsx
new file mode 100644
index 0000000000000..4b157c6999985
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/resilient_params.tsx
@@ -0,0 +1,256 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Fragment, useEffect, useState } from 'react';
+import {
+  EuiFormRow,
+  EuiComboBox,
+  EuiSelect,
+  EuiSpacer,
+  EuiTitle,
+  EuiComboBoxOptionOption,
+  EuiSelectOption,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { ActionParamsProps } from '../../../../types';
+import { useAppDependencies } from '../../../app_context';
+import { ResilientActionParams } from './types';
+import { TextAreaWithMessageVariables } from '../../text_area_with_message_variables';
+import { TextFieldWithMessageVariables } from '../../text_field_with_message_variables';
+
+import { useGetIncidentTypes } from './use_get_incident_types';
+import { useGetSeverity } from './use_get_severity';
+
+const ResilientParamsFields: React.FunctionComponent<ActionParamsProps<ResilientActionParams>> = ({
+  actionParams,
+  editAction,
+  index,
+  errors,
+  messageVariables,
+  actionConnector,
+}) => {
+  const [firstLoad, setFirstLoad] = useState(false);
+  const { http, toastNotifications } = useAppDependencies();
+  const { title, description, comments, incidentTypes, severityCode, savedObjectId } =
+    actionParams.subActionParams || {};
+
+  const [incidentTypesComboBoxOptions, setIncidentTypesComboBoxOptions] = useState<
+    Array<EuiComboBoxOptionOption<string>>
+  >([]);
+
+  const [selectedIncidentTypesComboBoxOptions, setSelectedIncidentTypesComboBoxOptions] = useState<
+    Array<EuiComboBoxOptionOption<string>>
+  >([]);
+
+  const [severitySelectOptions, setSeveritySelectOptions] = useState<EuiSelectOption[]>([]);
+
+  useEffect(() => {
+    setFirstLoad(true);
+  }, []);
+
+  const {
+    isLoading: isLoadingIncidentTypes,
+    incidentTypes: allIncidentTypes,
+  } = useGetIncidentTypes({
+    http,
+    toastNotifications,
+    actionConnector,
+  });
+
+  const { isLoading: isLoadingSeverity, severity } = useGetSeverity({
+    http,
+    toastNotifications,
+    actionConnector,
+  });
+
+  const editSubActionProperty = (key: string, value: {}) => {
+    const newProps = { ...actionParams.subActionParams, [key]: value };
+    editAction('subActionParams', newProps, index);
+  };
+
+  useEffect(() => {
+    const options = severity.map((s) => ({
+      value: s.id.toString(),
+      text: s.name,
+    }));
+
+    setSeveritySelectOptions(options);
+  }, [actionConnector, severity]);
+
+  // Reset parameters when changing connector
+  useEffect(() => {
+    if (!firstLoad) {
+      return;
+    }
+
+    setIncidentTypesComboBoxOptions([]);
+    setSelectedIncidentTypesComboBoxOptions([]);
+    setSeveritySelectOptions([]);
+    editAction('subActionParams', { title, comments, description: '', savedObjectId }, index);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [actionConnector]);
+
+  useEffect(() => {
+    if (!actionParams.subAction) {
+      editAction('subAction', 'pushToService', index);
+    }
+    if (!savedObjectId && messageVariables?.find((variable) => variable.name === 'alertId')) {
+      editSubActionProperty('savedObjectId', '{{alertId}}');
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [actionConnector, savedObjectId]);
+
+  useEffect(() => {
+    setIncidentTypesComboBoxOptions(
+      allIncidentTypes
+        ? allIncidentTypes.map((type: { id: number; name: string }) => ({
+            label: type.name,
+            value: type.id.toString(),
+          }))
+        : []
+    );
+
+    const allIncidentTypesAsObject = allIncidentTypes.reduce(
+      (acc, type) => ({ ...acc, [type.id.toString()]: type.name }),
+      {} as Record<string, string>
+    );
+
+    setSelectedIncidentTypesComboBoxOptions(
+      incidentTypes
+        ? incidentTypes
+            .map((type) => ({
+              label: allIncidentTypesAsObject[type.toString()],
+              value: type.toString(),
+            }))
+            .filter((type) => type.label != null)
+        : []
+    );
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [actionConnector, allIncidentTypes]);
+
+  return (
+    <Fragment>
+      <EuiTitle size="s">
+        <h3>Incident</h3>
+      </EuiTitle>
+      <EuiSpacer size="m" />
+      <EuiFormRow
+        fullWidth
+        label={i18n.translate(
+          'xpack.triggersActionsUI.components.builtinActionTypes.resilient.urgencySelectFieldLabel',
+          {
+            defaultMessage: 'Incident Type',
+          }
+        )}
+      >
+        <EuiComboBox
+          fullWidth
+          isLoading={isLoadingIncidentTypes}
+          isDisabled={isLoadingIncidentTypes}
+          data-test-subj="incidentTypeComboBox"
+          options={incidentTypesComboBoxOptions}
+          selectedOptions={selectedIncidentTypesComboBoxOptions}
+          onChange={(selectedOptions: Array<{ label: string; value?: string }>) => {
+            setSelectedIncidentTypesComboBoxOptions(
+              selectedOptions.map((selectedOption) => ({
+                label: selectedOption.label,
+                value: selectedOption.value,
+              }))
+            );
+
+            editSubActionProperty(
+              'incidentTypes',
+              selectedOptions.map((selectedOption) => selectedOption.value ?? selectedOption.label)
+            );
+          }}
+          onBlur={() => {
+            if (!incidentTypes) {
+              editSubActionProperty('incidentTypes', []);
+            }
+          }}
+          isClearable={true}
+        />
+      </EuiFormRow>
+      <EuiSpacer size="m" />
+      <EuiFormRow
+        fullWidth
+        label={i18n.translate(
+          'xpack.triggersActionsUI.components.builtinActionTypes.resilient.severity',
+          {
+            defaultMessage: 'Severity',
+          }
+        )}
+      >
+        <EuiSelect
+          isLoading={isLoadingSeverity}
+          disabled={isLoadingSeverity}
+          fullWidth
+          data-test-subj="severitySelect"
+          options={severitySelectOptions}
+          value={severityCode}
+          onChange={(e) => {
+            editSubActionProperty('severityCode', e.target.value);
+          }}
+        />
+      </EuiFormRow>
+      <EuiSpacer size="m" />
+      <EuiFormRow
+        fullWidth
+        error={errors.title}
+        isInvalid={errors.title.length > 0 && title !== undefined}
+        label={i18n.translate(
+          'xpack.triggersActionsUI.components.builtinActionTypes.resilient.titleFieldLabel',
+          {
+            defaultMessage: 'Name',
+          }
+        )}
+      >
+        <TextFieldWithMessageVariables
+          index={index}
+          editAction={editSubActionProperty}
+          messageVariables={messageVariables}
+          paramsProperty={'title'}
+          inputTargetValue={title}
+          errors={errors.title as string[]}
+        />
+      </EuiFormRow>
+      <TextAreaWithMessageVariables
+        index={index}
+        editAction={editSubActionProperty}
+        messageVariables={messageVariables}
+        paramsProperty={'description'}
+        inputTargetValue={description}
+        label={i18n.translate(
+          'xpack.triggersActionsUI.components.builtinActionTypes.resilient.descriptionTextAreaFieldLabel',
+          {
+            defaultMessage: 'Description (optional)',
+          }
+        )}
+        errors={errors.description as string[]}
+      />
+      <TextAreaWithMessageVariables
+        index={index}
+        editAction={(key, value) => {
+          editSubActionProperty(key, [{ commentId: 'alert-comment', comment: value }]);
+        }}
+        messageVariables={messageVariables}
+        paramsProperty={'comments'}
+        inputTargetValue={comments && comments.length > 0 ? comments[0].comment : ''}
+        label={i18n.translate(
+          'xpack.triggersActionsUI.components.builtinActionTypes.resilient.commentsTextAreaFieldLabel',
+          {
+            defaultMessage: 'Additional comments (optional)',
+          }
+        )}
+        errors={errors.comments as string[]}
+      />
+    </Fragment>
+  );
+};
+
+// eslint-disable-next-line import/no-default-export
+export { ResilientParamsFields as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/translations.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/translations.ts
new file mode 100644
index 0000000000000..71ad05abfdecf
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/translations.ts
@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const DESC = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.selectMessageText',
+  {
+    defaultMessage: 'Push or update data to a new incident in Resilient.',
+  }
+);
+
+export const TITLE = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.actionTypeTitle',
+  {
+    defaultMessage: 'Resilient',
+  }
+);
+
+export const API_URL_LABEL = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.apiUrlTextFieldLabel',
+  {
+    defaultMessage: 'URL',
+  }
+);
+
+export const API_URL_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.requiredApiUrlTextField',
+  {
+    defaultMessage: 'URL is required.',
+  }
+);
+
+export const API_URL_INVALID = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.invalidApiUrlTextField',
+  {
+    defaultMessage: 'URL is invalid.',
+  }
+);
+
+export const ORG_ID_LABEL = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.orgId',
+  {
+    defaultMessage: 'Organization ID',
+  }
+);
+
+export const ORG_ID_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.requiredOrgIdTextField',
+  {
+    defaultMessage: 'Organization ID is required',
+  }
+);
+
+export const API_KEY_ID_LABEL = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.apiKeyId',
+  {
+    defaultMessage: 'API key ID',
+  }
+);
+
+export const API_KEY_ID_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.requiredApiKeyIdTextField',
+  {
+    defaultMessage: 'API key ID is required',
+  }
+);
+
+export const API_KEY_SECRET_LABEL = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.apiKeySecret',
+  {
+    defaultMessage: 'API key secret',
+  }
+);
+
+export const API_KEY_SECRET_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.requiredApiKeySecretTextField',
+  {
+    defaultMessage: 'API key secret is required',
+  }
+);
+
+export const MAPPING_FIELD_NAME = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.mappingFieldShortDescription',
+  {
+    defaultMessage: 'Name',
+  }
+);
+
+export const MAPPING_FIELD_DESC = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.mappingFieldDescription',
+  {
+    defaultMessage: 'Description',
+  }
+);
+
+export const MAPPING_FIELD_COMMENTS = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.mappingFieldComments',
+  {
+    defaultMessage: 'Comments',
+  }
+);
+
+export const DESCRIPTION_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.common.requiredDescriptionTextField',
+  {
+    defaultMessage: 'Description is required.',
+  }
+);
+
+export const TITLE_REQUIRED = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.common.requiredTitleTextField',
+  {
+    defaultMessage: 'Title is required.',
+  }
+);
+
+export const INCIDENT_TYPES_API_ERROR = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.unableToGetIncidentTypesMessage',
+  {
+    defaultMessage: 'Unable to get incident types',
+  }
+);
+
+export const SEVERITY_API_ERROR = i18n.translate(
+  'xpack.triggersActionsUI.components.builtinActionTypes.resilient.unableToGetSeverityMessage',
+  {
+    defaultMessage: 'Unable to get severity',
+  }
+);
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/types.ts
new file mode 100644
index 0000000000000..37516f5bac372
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/types.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CasesConfigurationMapping } from '../case_mappings';
+
+export interface ResilientActionConnector {
+  config: ResilientConfig;
+  secrets: ResilientSecrets;
+}
+
+export interface ResilientActionParams {
+  subAction: string;
+  subActionParams: {
+    savedObjectId: string;
+    title: string;
+    description: string;
+    externalId: string | null;
+    incidentTypes: number[];
+    severityCode: number;
+    comments: Array<{ commentId: string; comment: string }>;
+  };
+}
+
+interface IncidentConfiguration {
+  mapping: CasesConfigurationMapping[];
+}
+
+interface ResilientConfig {
+  apiUrl: string;
+  orgId: string;
+  incidentConfiguration?: IncidentConfiguration;
+  isCaseOwned?: boolean;
+}
+
+interface ResilientSecrets {
+  apiKeyId: string;
+  apiKeySecret: string;
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/use_get_incident_types.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/use_get_incident_types.tsx
new file mode 100644
index 0000000000000..219c6ac77d08d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/use_get_incident_types.tsx
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useState, useEffect, useRef } from 'react';
+import { HttpSetup, ToastsApi } from 'kibana/public';
+import { ActionConnector } from '../../../../types';
+import { getIncidentTypes } from './api';
+import * as i18n from './translations';
+
+type IncidentTypes = Array<{ id: number; name: string }>;
+
+interface Props {
+  http: HttpSetup;
+  toastNotifications: Pick<
+    ToastsApi,
+    'get$' | 'add' | 'remove' | 'addSuccess' | 'addWarning' | 'addDanger' | 'addError'
+  >;
+  actionConnector?: ActionConnector;
+}
+
+export interface UseGetIncidentTypes {
+  incidentTypes: IncidentTypes;
+  isLoading: boolean;
+}
+
+export const useGetIncidentTypes = ({
+  http,
+  toastNotifications,
+  actionConnector,
+}: Props): UseGetIncidentTypes => {
+  const [isLoading, setIsLoading] = useState(true);
+  const [incidentTypes, setIncidentTypes] = useState<IncidentTypes>([]);
+  const abortCtrl = useRef(new AbortController());
+
+  useEffect(() => {
+    let didCancel = false;
+    const fetchData = async () => {
+      if (!actionConnector) {
+        setIsLoading(false);
+        return;
+      }
+
+      abortCtrl.current = new AbortController();
+      setIsLoading(true);
+
+      try {
+        const res = await getIncidentTypes({
+          http,
+          signal: abortCtrl.current.signal,
+          connectorId: actionConnector.id,
+        });
+
+        if (!didCancel) {
+          setIsLoading(false);
+          setIncidentTypes(res.data ?? []);
+          if (res.status && res.status === 'error') {
+            toastNotifications.addDanger({
+              title: i18n.INCIDENT_TYPES_API_ERROR,
+              text: `${res.serviceMessage ?? res.message}`,
+            });
+          }
+        }
+      } catch (error) {
+        if (!didCancel) {
+          toastNotifications.addDanger({
+            title: i18n.INCIDENT_TYPES_API_ERROR,
+            text: error.message,
+          });
+        }
+      }
+    };
+
+    abortCtrl.current.abort();
+    fetchData();
+
+    return () => {
+      didCancel = true;
+      setIsLoading(false);
+      abortCtrl.current.abort();
+    };
+  }, [http, actionConnector, toastNotifications]);
+
+  return {
+    incidentTypes,
+    isLoading,
+  };
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/use_get_severity.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/use_get_severity.tsx
new file mode 100644
index 0000000000000..83689254f000f
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/use_get_severity.tsx
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useState, useEffect, useRef } from 'react';
+import { HttpSetup, ToastsApi } from 'kibana/public';
+import { ActionConnector } from '../../../../types';
+import { getSeverity } from './api';
+import * as i18n from './translations';
+
+type Severity = Array<{ id: number; name: string }>;
+
+interface Props {
+  http: HttpSetup;
+  toastNotifications: Pick<
+    ToastsApi,
+    'get$' | 'add' | 'remove' | 'addSuccess' | 'addWarning' | 'addDanger' | 'addError'
+  >;
+  actionConnector?: ActionConnector;
+}
+
+export interface UseGetSeverity {
+  severity: Severity;
+  isLoading: boolean;
+}
+
+export const useGetSeverity = ({
+  http,
+  toastNotifications,
+  actionConnector,
+}: Props): UseGetSeverity => {
+  const [isLoading, setIsLoading] = useState(true);
+  const [severity, setSeverity] = useState<Severity>([]);
+  const abortCtrl = useRef(new AbortController());
+
+  useEffect(() => {
+    let didCancel = false;
+    const fetchData = async () => {
+      if (!actionConnector) {
+        setIsLoading(false);
+        return;
+      }
+
+      abortCtrl.current = new AbortController();
+      setIsLoading(true);
+
+      try {
+        const res = await getSeverity({
+          http,
+          signal: abortCtrl.current.signal,
+          connectorId: actionConnector.id,
+        });
+
+        if (!didCancel) {
+          setIsLoading(false);
+          setSeverity(res.data ?? []);
+
+          if (res.status && res.status === 'error') {
+            toastNotifications.addDanger({
+              title: i18n.SEVERITY_API_ERROR,
+              text: `${res.serviceMessage ?? res.message}`,
+            });
+          }
+        }
+      } catch (error) {
+        if (!didCancel) {
+          toastNotifications.addDanger({
+            title: i18n.SEVERITY_API_ERROR,
+            text: error.message,
+          });
+        }
+      }
+    };
+
+    abortCtrl.current.abort();
+    fetchData();
+
+    return () => {
+      didCancel = true;
+      setIsLoading(false);
+      abortCtrl.current.abort();
+    };
+  }, [http, actionConnector, toastNotifications]);
+
+  return {
+    severity,
+    isLoading,
+  };
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
index 1fc856b1e1ab2..f4d831d7234e7 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
@@ -23,6 +23,7 @@ describe('ServiceNowParamsFields renders', () => {
         externalId: null,
       },
     };
+
     const wrapper = mountWithIntl(
       <ServiceNowParamsFields
         actionParams={actionParams}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_params.test.tsx
index 7649d2dcb62c7..45c1929ae1e22 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_params.test.tsx
@@ -13,6 +13,7 @@ describe('SlackParamsFields renders', () => {
     const actionParams = {
       message: 'test message',
     };
+
     const wrapper = mountWithIntl(
       <SlackParamsFields
         actionParams={actionParams}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.test.tsx
index 825c1372dfaf7..6a1c5cb2bfb53 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_params.test.tsx
@@ -13,6 +13,7 @@ describe('WebhookParamsFields renders', () => {
     const actionParams = {
       body: 'test message',
     };
+
     const wrapper = mountWithIntl(
       <WebhookParamsFields
         actionParams={actionParams}
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/index.ts b/x-pack/plugins/triggers_actions_ui/public/common/index.ts
index 8b728b5e178b5..32b323334654e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/common/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/common/index.ts
@@ -8,3 +8,4 @@ export * from './expression_items';
 
 export { connectorConfiguration as ServiceNowConnectorConfiguration } from '../application/components/builtin_action_types/servicenow/config';
 export { connectorConfiguration as JiraConnectorConfiguration } from '../application/components/builtin_action_types/jira/config';
+export { connectorConfiguration as ResilientConnectorConfiguration } from '../application/components/builtin_action_types/resilient/config';
diff --git a/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx b/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
index 2ff0f53d07e91..935f0209e73c2 100644
--- a/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
+++ b/x-pack/plugins/watcher/public/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
@@ -126,7 +126,7 @@ export const WatchVisualization = () => {
     isLoading,
     data: watchVisualizationData,
     error,
-    sendRequest: reload,
+    resendRequest: reload,
   } = useGetWatchVisualizationData(watchWithoutActions, visualizeOptions);
 
   useEffect(
diff --git a/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/resilient.ts b/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/resilient.ts
new file mode 100644
index 0000000000000..576ed4bbc5dfe
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/resilient.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../../../../common/ftr_provider_context';
+
+import {
+  getExternalServiceSimulatorPath,
+  ExternalServiceSimulator,
+} from '../../../../common/fixtures/plugins/actions_simulators/server/plugin';
+
+const mapping = [
+  {
+    source: 'title',
+    target: 'description',
+    actionType: 'nothing',
+  },
+  {
+    source: 'description',
+    target: 'short_description',
+    actionType: 'nothing',
+  },
+  {
+    source: 'comments',
+    target: 'comments',
+    actionType: 'nothing',
+  },
+];
+
+// eslint-disable-next-line import/no-default-export
+export default function resilientTest({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const kibanaServer = getService('kibanaServer');
+  const mockResilient = {
+    config: {
+      apiUrl: 'www.resilientisinkibanaactions.com',
+      orgId: '201',
+      incidentConfiguration: { mapping: [...mapping] },
+      isCaseOwned: true,
+    },
+    secrets: {
+      apiKeyId: 'elastic',
+      apiKeySecret: 'changeme',
+    },
+    params: {
+      savedObjectId: '123',
+      title: 'a title',
+      description: 'a description',
+      incidentTypes: [1001],
+      severityCode: 'High',
+      comments: [
+        {
+          commentId: '456',
+          comment: 'first comment',
+        },
+      ],
+    },
+  };
+  describe('resilient', () => {
+    let resilientSimulatorURL: string = '<could not determine kibana url>';
+
+    // need to wait for kibanaServer to settle ...
+    before(() => {
+      resilientSimulatorURL = kibanaServer.resolveUrl(
+        getExternalServiceSimulatorPath(ExternalServiceSimulator.RESILIENT)
+      );
+    });
+
+    it('should return 403 when creating a resilient action', async () => {
+      await supertest
+        .post('/api/actions/action')
+        .set('kbn-xsrf', 'foo')
+        .send({
+          name: 'A resilient action',
+          actionTypeId: '.resilient',
+          config: {
+            apiUrl: resilientSimulatorURL,
+            incidentConfiguration: { ...mockResilient.config.incidentConfiguration },
+            isCaseOwned: true,
+          },
+          secrets: mockResilient.secrets,
+        })
+        .expect(403, {
+          statusCode: 403,
+          error: 'Forbidden',
+          message:
+            'Action type .resilient is disabled because your basic license does not support it. Please upgrade your license.',
+        });
+    });
+  });
+}
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
index 9cbc2373ef943..d1d19da423e65 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
@@ -41,9 +41,10 @@ export default function resilientTest({ getService }: FtrProviderContext) {
 
   const mockResilient = {
     config: {
-      apiUrl: 'www.jiraisinkibanaactions.com',
+      apiUrl: 'www.resilientisinkibanaactions.com',
       orgId: '201',
-      casesConfiguration: { mapping },
+      incidentConfiguration: { mapping },
+      isCaseOwned: true,
     },
     secrets: {
       apiKeyId: 'key',
@@ -55,6 +56,8 @@ export default function resilientTest({ getService }: FtrProviderContext) {
         savedObjectId: '123',
         title: 'a title',
         description: 'a description',
+        incidentTypes: [1001],
+        severityCode: 6,
         createdAt: '2020-03-13T08:34:53.450Z',
         createdBy: { fullName: 'Elastic User', username: 'elastic' },
         updatedAt: null,
@@ -108,7 +111,8 @@ export default function resilientTest({ getService }: FtrProviderContext) {
           config: {
             apiUrl: resilientSimulatorURL,
             orgId: mockResilient.config.orgId,
-            casesConfiguration: mockResilient.config.casesConfiguration,
+            incidentConfiguration: mockResilient.config.incidentConfiguration,
+            isCaseOwned: true,
           },
         });
 
@@ -124,7 +128,8 @@ export default function resilientTest({ getService }: FtrProviderContext) {
           config: {
             apiUrl: resilientSimulatorURL,
             orgId: mockResilient.config.orgId,
-            casesConfiguration: mockResilient.config.casesConfiguration,
+            incidentConfiguration: mockResilient.config.incidentConfiguration,
+            isCaseOwned: true,
           },
         });
       });
@@ -179,7 +184,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
             config: {
               apiUrl: 'http://resilient.mynonexistent.com',
               orgId: mockResilient.config.orgId,
-              casesConfiguration: mockResilient.config.casesConfiguration,
+              incidentConfiguration: mockResilient.config.incidentConfiguration,
             },
             secrets: mockResilient.secrets,
           })
@@ -204,7 +209,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
             config: {
               apiUrl: resilientSimulatorURL,
               orgId: mockResilient.config.orgId,
-              casesConfiguration: mockResilient.config.casesConfiguration,
+              incidentConfiguration: mockResilient.config.incidentConfiguration,
             },
           })
           .expect(400)
@@ -218,30 +223,6 @@ export default function resilientTest({ getService }: FtrProviderContext) {
           });
       });
 
-      it('should respond with a 400 Bad Request when creating a ibm resilient action without casesConfiguration', async () => {
-        await supertest
-          .post('/api/actions/action')
-          .set('kbn-xsrf', 'foo')
-          .send({
-            name: 'An IBM Resilient',
-            actionTypeId: '.resilient',
-            config: {
-              apiUrl: resilientSimulatorURL,
-              orgId: mockResilient.config.orgId,
-            },
-            secrets: mockResilient.secrets,
-          })
-          .expect(400)
-          .then((resp: any) => {
-            expect(resp.body).to.eql({
-              statusCode: 400,
-              error: 'Bad Request',
-              message:
-                'error validating action type config: [casesConfiguration.mapping]: expected value of type [array] but got [undefined]',
-            });
-          });
-      });
-
       it('should respond with a 400 Bad Request when creating a ibm resilient action with empty mapping', async () => {
         await supertest
           .post('/api/actions/action')
@@ -252,7 +233,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
             config: {
               apiUrl: resilientSimulatorURL,
               orgId: mockResilient.config.orgId,
-              casesConfiguration: { mapping: [] },
+              incidentConfiguration: { mapping: [] },
             },
             secrets: mockResilient.secrets,
           })
@@ -262,7 +243,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
               statusCode: 400,
               error: 'Bad Request',
               message:
-                'error validating action type config: [casesConfiguration.mapping]: expected non-empty but got empty',
+                'error validating action type config: [incidentConfiguration.mapping]: expected non-empty but got empty',
             });
           });
       });
@@ -277,7 +258,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
             config: {
               apiUrl: resilientSimulatorURL,
               orgId: mockResilient.config.orgId,
-              casesConfiguration: {
+              incidentConfiguration: {
                 mapping: [
                   {
                     source: 'title',
@@ -307,7 +288,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
             config: {
               apiUrl: resilientSimulatorURL,
               orgId: mockResilient.config.orgId,
-              casesConfiguration: mockResilient.config.casesConfiguration,
+              incidentConfiguration: mockResilient.config.incidentConfiguration,
             },
             secrets: mockResilient.secrets,
           });
@@ -353,7 +334,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
                 status: 'error',
                 retry: false,
                 message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subAction]: expected value to equal [pushToService]',
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subAction]: expected value to equal [pushToService]\n- [3.subAction]: expected value to equal [incidentTypes]\n- [4.subAction]: expected value to equal [severity]',
               });
             });
         });
@@ -371,7 +352,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
                 status: 'error',
                 retry: false,
                 message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.savedObjectId]: expected value of type [string] but got [undefined]',
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.savedObjectId]: expected value of type [string] but got [undefined]\n- [3.subAction]: expected value to equal [incidentTypes]\n- [4.subAction]: expected value to equal [severity]',
               });
             });
         });
@@ -389,7 +370,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
                 status: 'error',
                 retry: false,
                 message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.savedObjectId]: expected value of type [string] but got [undefined]',
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.savedObjectId]: expected value of type [string] but got [undefined]\n- [3.subAction]: expected value to equal [incidentTypes]\n- [4.subAction]: expected value to equal [severity]',
               });
             });
         });
@@ -412,31 +393,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
                 status: 'error',
                 retry: false,
                 message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.title]: expected value of type [string] but got [undefined]',
-              });
-            });
-        });
-
-        it('should handle failing with a simulated success without createdAt', async () => {
-          await supertest
-            .post(`/api/actions/action/${simulatedActionId}/_execute`)
-            .set('kbn-xsrf', 'foo')
-            .send({
-              params: {
-                ...mockResilient.params,
-                subActionParams: {
-                  savedObjectId: 'success',
-                  title: 'success',
-                },
-              },
-            })
-            .then((resp: any) => {
-              expect(resp.body).to.eql({
-                actionId: simulatedActionId,
-                status: 'error',
-                retry: false,
-                message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.createdAt]: expected value of type [string] but got [undefined]',
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.title]: expected value of type [string] but got [undefined]\n- [3.subAction]: expected value to equal [incidentTypes]\n- [4.subAction]: expected value to equal [severity]',
               });
             });
         });
@@ -464,7 +421,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
                 status: 'error',
                 retry: false,
                 message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.comments]: types that failed validation:\n - [subActionParams.comments.0.0.commentId]: expected value of type [string] but got [undefined]\n - [subActionParams.comments.1]: expected value to equal [null]',
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.comments]: types that failed validation:\n - [subActionParams.comments.0.0.commentId]: expected value of type [string] but got [undefined]\n - [subActionParams.comments.1]: expected value to equal [null]\n- [3.subAction]: expected value to equal [incidentTypes]\n- [4.subAction]: expected value to equal [severity]',
               });
             });
         });
@@ -492,35 +449,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
                 status: 'error',
                 retry: false,
                 message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.comments]: types that failed validation:\n - [subActionParams.comments.0.0.comment]: expected value of type [string] but got [undefined]\n - [subActionParams.comments.1]: expected value to equal [null]',
-              });
-            });
-        });
-
-        it('should handle failing with a simulated success without comment.createdAt', async () => {
-          await supertest
-            .post(`/api/actions/action/${simulatedActionId}/_execute`)
-            .set('kbn-xsrf', 'foo')
-            .send({
-              params: {
-                ...mockResilient.params,
-                subActionParams: {
-                  ...mockResilient.params.subActionParams,
-                  savedObjectId: 'success',
-                  title: 'success',
-                  createdAt: 'success',
-                  createdBy: { username: 'elastic' },
-                  comments: [{ commentId: 'success', comment: 'success' }],
-                },
-              },
-            })
-            .then((resp: any) => {
-              expect(resp.body).to.eql({
-                actionId: simulatedActionId,
-                status: 'error',
-                retry: false,
-                message:
-                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.comments]: types that failed validation:\n - [subActionParams.comments.0.0.createdAt]: expected value of type [string] but got [undefined]\n - [subActionParams.comments.1]: expected value to equal [null]',
+                  'error validating action params: types that failed validation:\n- [0.subAction]: expected value to equal [getIncident]\n- [1.subAction]: expected value to equal [handshake]\n- [2.subActionParams.comments]: types that failed validation:\n - [subActionParams.comments.0.0.comment]: expected value of type [string] but got [undefined]\n - [subActionParams.comments.1]: expected value to equal [null]\n- [3.subAction]: expected value to equal [incidentTypes]\n- [4.subAction]: expected value to equal [severity]',
               });
             });
         });
@@ -536,7 +465,7 @@ export default function resilientTest({ getService }: FtrProviderContext) {
                 ...mockResilient.params,
                 subActionParams: {
                   ...mockResilient.params.subActionParams,
-                  comments: [],
+                  comments: null,
                 },
               },
             })
diff --git a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
index c6043b7a282d4..53a9d9e790d67 100644
--- a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
+++ b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
@@ -120,7 +120,7 @@ export default ({ getService }: FtrProviderContext) => {
           .expect(404);
 
         expect(body.error).to.eql('Not Found');
-        expect(body.message).to.eql('Not Found');
+        expect(body.message).to.eql('resource_not_found_exception');
       });
 
       describe('with deleteDestIndex setting', function () {
diff --git a/x-pack/test/api_integration/apis/ml/jobs/jobs_exist.ts b/x-pack/test/api_integration/apis/ml/jobs/jobs_exist.ts
new file mode 100644
index 0000000000000..c48376b6a14f3
--- /dev/null
+++ b/x-pack/test/api_integration/apis/ml/jobs/jobs_exist.ts
@@ -0,0 +1,145 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { COMMON_REQUEST_HEADERS } from '../../../../functional/services/ml/common_api';
+import { USER } from '../../../../functional/services/ml/security_common';
+import { SINGLE_METRIC_JOB_CONFIG, DATAFEED_CONFIG } from './common_jobs';
+
+export default ({ getService }: FtrProviderContext) => {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertestWithoutAuth');
+  const ml = getService('ml');
+
+  const testSetupJobConfigs = [SINGLE_METRIC_JOB_CONFIG];
+
+  const responseBody = {
+    [SINGLE_METRIC_JOB_CONFIG.job_id]: true,
+    [`${SINGLE_METRIC_JOB_CONFIG.job_id.slice(0, 10)}*`]: true, // wildcard, use first 10 chars
+    [`${SINGLE_METRIC_JOB_CONFIG.job_id}_fail`]: false,
+    [`${SINGLE_METRIC_JOB_CONFIG.job_id.slice(0, 10)}_fail*`]: false, // wildcard, use first 10 chars
+  };
+
+  const testDataList = [
+    {
+      testTitle: 'as ML Poweruser',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        jobIds: Object.keys(responseBody),
+      },
+      expected: {
+        responseCode: 200,
+        responseBody,
+      },
+    },
+    {
+      testTitle: 'as ML Viewer',
+      user: USER.ML_VIEWER,
+      requestBody: {
+        jobIds: Object.keys(responseBody),
+      },
+      expected: {
+        responseCode: 200,
+        responseBody,
+      },
+    },
+  ];
+
+  const testDataListUnauthorized = [
+    {
+      testTitle: 'as ML Unauthorized user',
+      user: USER.ML_UNAUTHORIZED,
+      requestBody: {
+        jobIds: Object.keys(responseBody),
+      },
+      expected: {
+        responseCode: 404,
+        error: 'Not Found',
+      },
+    },
+  ];
+
+  async function runJobsExistRequest(
+    user: USER,
+    requestBody: object,
+    expectedResponsecode: number
+  ): Promise<any> {
+    const { body } = await supertest
+      .post('/api/ml/jobs/jobs_exist')
+      .auth(user, ml.securityCommon.getPasswordForUser(user))
+      .set(COMMON_REQUEST_HEADERS)
+      .send(requestBody)
+      .expect(expectedResponsecode);
+
+    return body;
+  }
+
+  describe('jobs_exist', function () {
+    before(async () => {
+      await esArchiver.loadIfNeeded('ml/farequote');
+      await ml.testResources.createIndexPatternIfNeeded('ft_farequote', '@timestamp');
+      await ml.testResources.setKibanaTimeZoneToUTC();
+    });
+
+    after(async () => {
+      await ml.api.cleanMlIndices();
+    });
+
+    it('sets up jobs', async () => {
+      for (const job of testSetupJobConfigs) {
+        const datafeedId = `datafeed-${job.job_id}`;
+        await ml.api.createAnomalyDetectionJob(job);
+        await ml.api.openAnomalyDetectionJob(job.job_id);
+        await ml.api.createDatafeed({
+          ...DATAFEED_CONFIG,
+          datafeed_id: datafeedId,
+          job_id: job.job_id,
+        });
+      }
+    });
+
+    describe('jobs exist', function () {
+      for (const testData of testDataList) {
+        it(`${testData.testTitle}`, async () => {
+          const body = await runJobsExistRequest(
+            testData.user,
+            testData.requestBody,
+            testData.expected.responseCode
+          );
+          const expectedResponse = testData.expected.responseBody;
+          const expectedRspJobIds = Object.keys(expectedResponse).sort((a, b) =>
+            a.localeCompare(b)
+          );
+          const actualRspJobIds = Object.keys(body).sort((a, b) => a.localeCompare(b));
+
+          expect(actualRspJobIds).to.have.length(expectedRspJobIds.length);
+          expect(actualRspJobIds).to.eql(expectedRspJobIds);
+          expectedRspJobIds.forEach((id) => {
+            expect(body[id]).to.eql(testData.expected.responseBody[id]);
+          });
+        });
+      }
+    });
+
+    describe('rejects request', function () {
+      for (const testData of testDataListUnauthorized) {
+        describe('fails to check jobs exist', function () {
+          it(`${testData.testTitle}`, async () => {
+            const body = await runJobsExistRequest(
+              testData.user,
+              testData.requestBody,
+              testData.expected.responseCode
+            );
+
+            expect(body).to.have.property('error').eql(testData.expected.error);
+          });
+        });
+      }
+    });
+  });
+};
diff --git a/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/multicluster.json b/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/multicluster.json
index b7c3aee5471d7..a000324d121ea 100644
--- a/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/multicluster.json
+++ b/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/multicluster.json
@@ -102,7 +102,7 @@
   },
   "alerts": {
     "alertsMeta": {
-      "enabled": true
+      "enabled": false
     },
     "clusterMeta": {
       "enabled": false,
diff --git a/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/clusters.json b/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/clusters.json
index f938479578801..7091e584344e7 100644
--- a/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/clusters.json
+++ b/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/clusters.json
@@ -102,7 +102,7 @@
   },
   "alerts": {
     "alertsMeta": {
-      "enabled": true
+      "enabled": false
     },
     "clusterMeta": {
       "enabled": false,
@@ -170,7 +170,7 @@
   },
   "alerts": {
     "alertsMeta": {
-      "enabled": true
+      "enabled": false
     },
     "clusterMeta": {
       "enabled": false,
diff --git a/x-pack/test/apm_api_integration/common/archives_metadata.ts b/x-pack/test/apm_api_integration/common/archives_metadata.ts
index 38dde685dd3f4..ab9e3a191e24d 100644
--- a/x-pack/test/apm_api_integration/common/archives_metadata.ts
+++ b/x-pack/test/apm_api_integration/common/archives_metadata.ts
@@ -6,7 +6,7 @@
 
 export default {
   'apm_8.0.0': {
-    start: '2020-09-10T08:07:13.274Z',
-    end: '2020-09-10T08:37:13.274Z',
+    start: '2020-09-10T06:00:00.000Z',
+    end: '2020-09-10T07:00:00.000Z',
   },
 };
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz
index 34b673790ec01..fa40458dedaff 100644
Binary files a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz and b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz differ
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/data.json.gz b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/data.json.gz
deleted file mode 100644
index d23b9e51d734d..0000000000000
Binary files a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/data.json.gz and /dev/null differ
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/mappings.json b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/mappings.json
deleted file mode 100644
index 5a5d48464b8b1..0000000000000
--- a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/ml_8.0.0/mappings.json
+++ /dev/null
@@ -1,63452 +0,0 @@
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      ".ml-annotations-read": {
-        "is_hidden": true
-      },
-      ".ml-annotations-write": {
-        "is_hidden": true
-      }
-    },
-    "index": ".ml-annotations-6",
-    "mappings": {
-      "_meta": {
-        "version": "8.0.0"
-      },
-      "properties": {
-        "annotation": {
-          "type": "text"
-        },
-        "by_field_name": {
-          "type": "keyword"
-        },
-        "by_field_value": {
-          "type": "keyword"
-        },
-        "create_time": {
-          "type": "date"
-        },
-        "create_username": {
-          "type": "keyword"
-        },
-        "detector_index": {
-          "type": "integer"
-        },
-        "end_timestamp": {
-          "type": "date"
-        },
-        "event": {
-          "type": "keyword"
-        },
-        "job_id": {
-          "type": "keyword"
-        },
-        "modified_time": {
-          "type": "date"
-        },
-        "modified_username": {
-          "type": "keyword"
-        },
-        "over_field_name": {
-          "type": "keyword"
-        },
-        "over_field_value": {
-          "type": "keyword"
-        },
-        "partition_field_name": {
-          "type": "keyword"
-        },
-        "partition_field_value": {
-          "type": "keyword"
-        },
-        "timestamp": {
-          "type": "date"
-        },
-        "type": {
-          "type": "keyword"
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "0-1",
-        "hidden": "true",
-        "number_of_replicas": "1",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      ".ml-anomalies-.write-android_homepage_high_latency_by_geo": {
-        "is_hidden": true
-      },
-      ".ml-anomalies-.write-apm-environment_not_defined-7ed6-high_mean_transaction_duration": {
-        "is_hidden": true
-      },
-      ".ml-anomalies-.write-apm-production-229a-high_mean_transaction_duration": {
-        "is_hidden": true
-      },
-      ".ml-anomalies-.write-apm-testing-d457-high_mean_transaction_duration": {
-        "is_hidden": true
-      },
-      ".ml-anomalies-.write-auto_http_0x73c4bc9426fb6908_high_latency_by_geo": {
-        "is_hidden": true
-      },
-      ".ml-anomalies-.write-kibana-logs-ui-default-default-log-entry-categories-count": {
-        "is_hidden": true
-      },
-      ".ml-anomalies-.write-kibana-logs-ui-default-default-log-entry-rate": {
-        "is_hidden": true
-      },
-      ".ml-anomalies-android_homepage_high_latency_by_geo": {
-        "filter": {
-          "term": {
-            "job_id": {
-              "boost": 1,
-              "value": "android_homepage_high_latency_by_geo"
-            }
-          }
-        },
-        "is_hidden": true
-      },
-      ".ml-anomalies-apm-environment_not_defined-7ed6-high_mean_transaction_duration": {
-        "filter": {
-          "term": {
-            "job_id": {
-              "boost": 1,
-              "value": "apm-environment_not_defined-7ed6-high_mean_transaction_duration"
-            }
-          }
-        },
-        "is_hidden": true
-      },
-      ".ml-anomalies-apm-production-229a-high_mean_transaction_duration": {
-        "filter": {
-          "term": {
-            "job_id": {
-              "boost": 1,
-              "value": "apm-production-229a-high_mean_transaction_duration"
-            }
-          }
-        },
-        "is_hidden": true
-      },
-      ".ml-anomalies-apm-testing-d457-high_mean_transaction_duration": {
-        "filter": {
-          "term": {
-            "job_id": {
-              "boost": 1,
-              "value": "apm-testing-d457-high_mean_transaction_duration"
-            }
-          }
-        },
-        "is_hidden": true
-      },
-      ".ml-anomalies-auto_http_0x73c4bc9426fb6908_high_latency_by_geo": {
-        "filter": {
-          "term": {
-            "job_id": {
-              "boost": 1,
-              "value": "auto_http_0x73c4bc9426fb6908_high_latency_by_geo"
-            }
-          }
-        },
-        "is_hidden": true
-      },
-      ".ml-anomalies-kibana-logs-ui-default-default-log-entry-categories-count": {
-        "filter": {
-          "term": {
-            "job_id": {
-              "boost": 1,
-              "value": "kibana-logs-ui-default-default-log-entry-categories-count"
-            }
-          }
-        },
-        "is_hidden": true
-      },
-      ".ml-anomalies-kibana-logs-ui-default-default-log-entry-rate": {
-        "filter": {
-          "term": {
-            "job_id": {
-              "boost": 1,
-              "value": "kibana-logs-ui-default-default-log-entry-rate"
-            }
-          }
-        },
-        "is_hidden": true
-      }
-    },
-    "index": ".ml-anomalies-shared",
-    "mappings": {
-      "_meta": {
-        "version": "8.0.0"
-      },
-      "dynamic_templates": [
-        {
-          "strings_as_keywords": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match": "*"
-          }
-        }
-      ],
-      "properties": {
-        "actual": {
-          "type": "double"
-        },
-        "all_field_values": {
-          "analyzer": "whitespace",
-          "type": "text"
-        },
-        "anomaly_score": {
-          "type": "double"
-        },
-        "average_bucket_processing_time_ms": {
-          "type": "double"
-        },
-        "bucket_allocation_failures_count": {
-          "type": "long"
-        },
-        "bucket_count": {
-          "type": "long"
-        },
-        "bucket_influencers": {
-          "properties": {
-            "anomaly_score": {
-              "type": "double"
-            },
-            "bucket_span": {
-              "type": "long"
-            },
-            "influencer_field_name": {
-              "type": "keyword"
-            },
-            "initial_anomaly_score": {
-              "type": "double"
-            },
-            "is_interim": {
-              "type": "boolean"
-            },
-            "job_id": {
-              "type": "keyword"
-            },
-            "probability": {
-              "type": "double"
-            },
-            "raw_anomaly_score": {
-              "type": "double"
-            },
-            "result_type": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date"
-            }
-          },
-          "type": "nested"
-        },
-        "bucket_span": {
-          "type": "long"
-        },
-        "by_field_name": {
-          "type": "keyword"
-        },
-        "by_field_value": {
-          "copy_to": [
-            "all_field_values"
-          ],
-          "type": "keyword"
-        },
-        "categorization_status": {
-          "type": "keyword"
-        },
-        "categorized_doc_count": {
-          "type": "keyword"
-        },
-        "category_id": {
-          "type": "long"
-        },
-        "causes": {
-          "properties": {
-            "actual": {
-              "type": "double"
-            },
-            "by_field_name": {
-              "type": "keyword"
-            },
-            "by_field_value": {
-              "copy_to": [
-                "all_field_values"
-              ],
-              "type": "keyword"
-            },
-            "correlated_by_field_value": {
-              "copy_to": [
-                "all_field_values"
-              ],
-              "type": "keyword"
-            },
-            "field_name": {
-              "type": "keyword"
-            },
-            "function": {
-              "type": "keyword"
-            },
-            "function_description": {
-              "type": "keyword"
-            },
-            "geo_results": {
-              "properties": {
-                "actual_point": {
-                  "type": "geo_point"
-                },
-                "typical_point": {
-                  "type": "geo_point"
-                }
-              }
-            },
-            "over_field_name": {
-              "type": "keyword"
-            },
-            "over_field_value": {
-              "copy_to": [
-                "all_field_values"
-              ],
-              "type": "keyword"
-            },
-            "partition_field_name": {
-              "type": "keyword"
-            },
-            "partition_field_value": {
-              "copy_to": [
-                "all_field_values"
-              ],
-              "type": "keyword"
-            },
-            "probability": {
-              "type": "double"
-            },
-            "typical": {
-              "type": "double"
-            }
-          },
-          "type": "nested"
-        },
-        "dead_category_count": {
-          "type": "keyword"
-        },
-        "description": {
-          "type": "text"
-        },
-        "detector_index": {
-          "type": "integer"
-        },
-        "earliest_record_timestamp": {
-          "type": "date"
-        },
-        "empty_bucket_count": {
-          "type": "long"
-        },
-        "event": {
-          "properties": {
-            "dataset": {
-              "type": "keyword"
-            }
-          }
-        },
-        "event_count": {
-          "type": "long"
-        },
-        "examples": {
-          "type": "text"
-        },
-        "exponential_average_bucket_processing_time_ms": {
-          "type": "double"
-        },
-        "exponential_average_calculation_context": {
-          "properties": {
-            "incremental_metric_value_ms": {
-              "type": "double"
-            },
-            "latest_timestamp": {
-              "type": "date"
-            },
-            "previous_exponential_average_ms": {
-              "type": "double"
-            }
-          }
-        },
-        "failed_category_count": {
-          "type": "keyword"
-        },
-        "field_name": {
-          "type": "keyword"
-        },
-        "forecast_create_timestamp": {
-          "type": "date"
-        },
-        "forecast_end_timestamp": {
-          "type": "date"
-        },
-        "forecast_expiry_timestamp": {
-          "type": "date"
-        },
-        "forecast_id": {
-          "type": "keyword"
-        },
-        "forecast_lower": {
-          "type": "double"
-        },
-        "forecast_memory_bytes": {
-          "type": "long"
-        },
-        "forecast_messages": {
-          "type": "keyword"
-        },
-        "forecast_prediction": {
-          "type": "double"
-        },
-        "forecast_progress": {
-          "type": "double"
-        },
-        "forecast_start_timestamp": {
-          "type": "date"
-        },
-        "forecast_status": {
-          "type": "keyword"
-        },
-        "forecast_upper": {
-          "type": "double"
-        },
-        "frequent_category_count": {
-          "type": "keyword"
-        },
-        "function": {
-          "type": "keyword"
-        },
-        "function_description": {
-          "type": "keyword"
-        },
-        "geo_results": {
-          "properties": {
-            "actual_point": {
-              "type": "geo_point"
-            },
-            "typical_point": {
-              "type": "geo_point"
-            }
-          }
-        },
-        "influencer_field_name": {
-          "type": "keyword"
-        },
-        "influencer_field_value": {
-          "copy_to": [
-            "all_field_values"
-          ],
-          "type": "keyword"
-        },
-        "influencer_score": {
-          "type": "double"
-        },
-        "influencers": {
-          "properties": {
-            "influencer_field_name": {
-              "type": "keyword"
-            },
-            "influencer_field_values": {
-              "copy_to": [
-                "all_field_values"
-              ],
-              "type": "keyword"
-            }
-          },
-          "type": "nested"
-        },
-        "initial_anomaly_score": {
-          "type": "double"
-        },
-        "initial_influencer_score": {
-          "type": "double"
-        },
-        "initial_record_score": {
-          "type": "double"
-        },
-        "input_bytes": {
-          "type": "long"
-        },
-        "input_field_count": {
-          "type": "long"
-        },
-        "input_record_count": {
-          "type": "long"
-        },
-        "invalid_date_count": {
-          "type": "long"
-        },
-        "is_interim": {
-          "type": "boolean"
-        },
-        "job_id": {
-          "copy_to": [
-            "all_field_values"
-          ],
-          "type": "keyword"
-        },
-        "last_data_time": {
-          "type": "date"
-        },
-        "latest_empty_bucket_timestamp": {
-          "type": "date"
-        },
-        "latest_record_time_stamp": {
-          "type": "date"
-        },
-        "latest_record_timestamp": {
-          "type": "date"
-        },
-        "latest_result_time_stamp": {
-          "type": "date"
-        },
-        "latest_sparse_bucket_timestamp": {
-          "type": "date"
-        },
-        "log_time": {
-          "type": "date"
-        },
-        "max_matching_length": {
-          "type": "long"
-        },
-        "maximum_bucket_processing_time_ms": {
-          "type": "double"
-        },
-        "memory_status": {
-          "type": "keyword"
-        },
-        "min_version": {
-          "type": "keyword"
-        },
-        "minimum_bucket_processing_time_ms": {
-          "type": "double"
-        },
-        "missing_field_count": {
-          "type": "long"
-        },
-        "mlcategory": {
-          "type": "keyword"
-        },
-        "model_bytes": {
-          "type": "long"
-        },
-        "model_bytes_exceeded": {
-          "type": "keyword"
-        },
-        "model_bytes_memory_limit": {
-          "type": "keyword"
-        },
-        "model_feature": {
-          "type": "keyword"
-        },
-        "model_lower": {
-          "type": "double"
-        },
-        "model_median": {
-          "type": "double"
-        },
-        "model_size_stats": {
-          "properties": {
-            "bucket_allocation_failures_count": {
-              "type": "long"
-            },
-            "categorization_status": {
-              "type": "keyword"
-            },
-            "categorized_doc_count": {
-              "type": "keyword"
-            },
-            "dead_category_count": {
-              "type": "keyword"
-            },
-            "failed_category_count": {
-              "type": "keyword"
-            },
-            "frequent_category_count": {
-              "type": "keyword"
-            },
-            "job_id": {
-              "type": "keyword"
-            },
-            "log_time": {
-              "type": "date"
-            },
-            "memory_status": {
-              "type": "keyword"
-            },
-            "model_bytes": {
-              "type": "long"
-            },
-            "model_bytes_exceeded": {
-              "type": "keyword"
-            },
-            "model_bytes_memory_limit": {
-              "type": "keyword"
-            },
-            "peak_model_bytes": {
-              "type": "long"
-            },
-            "rare_category_count": {
-              "type": "keyword"
-            },
-            "result_type": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date"
-            },
-            "total_by_field_count": {
-              "type": "long"
-            },
-            "total_category_count": {
-              "type": "keyword"
-            },
-            "total_over_field_count": {
-              "type": "long"
-            },
-            "total_partition_field_count": {
-              "type": "long"
-            }
-          }
-        },
-        "model_upper": {
-          "type": "double"
-        },
-        "monitor": {
-          "properties": {
-            "id": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            }
-          }
-        },
-        "multi_bucket_impact": {
-          "type": "double"
-        },
-        "num_matches": {
-          "type": "long"
-        },
-        "observer": {
-          "properties": {
-            "geo": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "out_of_order_timestamp_count": {
-          "type": "long"
-        },
-        "over_field_name": {
-          "type": "keyword"
-        },
-        "over_field_value": {
-          "copy_to": [
-            "all_field_values"
-          ],
-          "type": "keyword"
-        },
-        "partition_field_name": {
-          "type": "keyword"
-        },
-        "partition_field_value": {
-          "copy_to": [
-            "all_field_values"
-          ],
-          "type": "keyword"
-        },
-        "peak_model_bytes": {
-          "type": "keyword"
-        },
-        "preferred_to_categories": {
-          "type": "long"
-        },
-        "probability": {
-          "type": "double"
-        },
-        "processed_field_count": {
-          "type": "long"
-        },
-        "processed_record_count": {
-          "type": "long"
-        },
-        "processing_time_ms": {
-          "type": "long"
-        },
-        "quantiles": {
-          "enabled": false,
-          "type": "object"
-        },
-        "rare_category_count": {
-          "type": "keyword"
-        },
-        "raw_anomaly_score": {
-          "type": "double"
-        },
-        "record_score": {
-          "type": "double"
-        },
-        "regex": {
-          "type": "keyword"
-        },
-        "result_type": {
-          "type": "keyword"
-        },
-        "retain": {
-          "type": "boolean"
-        },
-        "scheduled_events": {
-          "type": "keyword"
-        },
-        "search_count": {
-          "type": "long"
-        },
-        "service": {
-          "properties": {
-            "name": {
-              "type": "keyword"
-            }
-          }
-        },
-        "snapshot_doc_count": {
-          "type": "integer"
-        },
-        "snapshot_id": {
-          "type": "keyword"
-        },
-        "sparse_bucket_count": {
-          "type": "long"
-        },
-        "terms": {
-          "type": "text"
-        },
-        "timestamp": {
-          "type": "date"
-        },
-        "total_by_field_count": {
-          "type": "long"
-        },
-        "total_category_count": {
-          "type": "keyword"
-        },
-        "total_over_field_count": {
-          "type": "long"
-        },
-        "total_partition_field_count": {
-          "type": "long"
-        },
-        "total_search_time_ms": {
-          "type": "double"
-        },
-        "transaction": {
-          "properties": {
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "typical": {
-          "type": "double"
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "0-1",
-        "hidden": "true",
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "translog": {
-          "durability": "async"
-        }
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-    },
-    "index": ".ml-config",
-    "mappings": {
-      "_meta": {
-        "version": "8.0.0"
-      },
-      "dynamic_templates": [
-        {
-          "strings_as_keywords": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match": "*"
-          }
-        }
-      ],
-      "properties": {
-        "aggregations": {
-          "enabled": false,
-          "type": "object"
-        },
-        "allow_lazy_open": {
-          "type": "keyword"
-        },
-        "analysis": {
-          "properties": {
-            "classification": {
-              "properties": {
-                "class_assignment_objective": {
-                  "type": "keyword"
-                },
-                "dependent_variable": {
-                  "type": "keyword"
-                },
-                "eta": {
-                  "type": "double"
-                },
-                "feature_bag_fraction": {
-                  "type": "double"
-                },
-                "gamma": {
-                  "type": "double"
-                },
-                "lambda": {
-                  "type": "double"
-                },
-                "max_trees": {
-                  "type": "integer"
-                },
-                "num_top_classes": {
-                  "type": "integer"
-                },
-                "num_top_feature_importance_values": {
-                  "type": "integer"
-                },
-                "prediction_field_name": {
-                  "type": "keyword"
-                },
-                "training_percent": {
-                  "type": "double"
-                }
-              }
-            },
-            "outlier_detection": {
-              "properties": {
-                "feature_influence_threshold": {
-                  "type": "double"
-                },
-                "method": {
-                  "type": "keyword"
-                },
-                "n_neighbors": {
-                  "type": "integer"
-                }
-              }
-            },
-            "regression": {
-              "properties": {
-                "dependent_variable": {
-                  "type": "keyword"
-                },
-                "eta": {
-                  "type": "double"
-                },
-                "feature_bag_fraction": {
-                  "type": "double"
-                },
-                "gamma": {
-                  "type": "double"
-                },
-                "lambda": {
-                  "type": "double"
-                },
-                "loss_function": {
-                  "type": "keyword"
-                },
-                "loss_function_parameter": {
-                  "type": "double"
-                },
-                "max_trees": {
-                  "type": "integer"
-                },
-                "num_top_feature_importance_values": {
-                  "type": "integer"
-                },
-                "prediction_field_name": {
-                  "type": "keyword"
-                },
-                "training_percent": {
-                  "type": "double"
-                }
-              }
-            }
-          }
-        },
-        "analysis_config": {
-          "properties": {
-            "bucket_span": {
-              "type": "keyword"
-            },
-            "categorization_analyzer": {
-              "enabled": false,
-              "type": "object"
-            },
-            "categorization_field_name": {
-              "type": "keyword"
-            },
-            "categorization_filters": {
-              "type": "keyword"
-            },
-            "detectors": {
-              "properties": {
-                "by_field_name": {
-                  "type": "keyword"
-                },
-                "custom_rules": {
-                  "properties": {
-                    "actions": {
-                      "type": "keyword"
-                    },
-                    "conditions": {
-                      "properties": {
-                        "applies_to": {
-                          "type": "keyword"
-                        },
-                        "operator": {
-                          "type": "keyword"
-                        },
-                        "value": {
-                          "type": "double"
-                        }
-                      },
-                      "type": "nested"
-                    },
-                    "scope": {
-                      "enabled": false,
-                      "type": "object"
-                    }
-                  },
-                  "type": "nested"
-                },
-                "detector_description": {
-                  "type": "text"
-                },
-                "detector_index": {
-                  "type": "integer"
-                },
-                "exclude_frequent": {
-                  "type": "keyword"
-                },
-                "field_name": {
-                  "type": "keyword"
-                },
-                "function": {
-                  "type": "keyword"
-                },
-                "over_field_name": {
-                  "type": "keyword"
-                },
-                "partition_field_name": {
-                  "type": "keyword"
-                },
-                "use_null": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "influencers": {
-              "type": "keyword"
-            },
-            "latency": {
-              "type": "keyword"
-            },
-            "multivariate_by_fields": {
-              "type": "boolean"
-            },
-            "per_partition_categorization": {
-              "properties": {
-                "enabled": {
-                  "type": "boolean"
-                },
-                "stop_on_warn": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "summary_count_field_name": {
-              "type": "keyword"
-            }
-          }
-        },
-        "analysis_limits": {
-          "properties": {
-            "categorization_examples_limit": {
-              "type": "long"
-            },
-            "model_memory_limit": {
-              "type": "keyword"
-            }
-          }
-        },
-        "analyzed_fields": {
-          "enabled": false,
-          "type": "object"
-        },
-        "background_persist_interval": {
-          "type": "keyword"
-        },
-        "chunking_config": {
-          "properties": {
-            "mode": {
-              "type": "keyword"
-            },
-            "time_span": {
-              "type": "keyword"
-            }
-          }
-        },
-        "config_type": {
-          "type": "keyword"
-        },
-        "create_time": {
-          "type": "date"
-        },
-        "custom_settings": {
-          "enabled": false,
-          "type": "object"
-        },
-        "daily_model_snapshot_retention_after_days": {
-          "type": "long"
-        },
-        "data_description": {
-          "properties": {
-            "field_delimiter": {
-              "type": "keyword"
-            },
-            "format": {
-              "type": "keyword"
-            },
-            "quote_character": {
-              "type": "keyword"
-            },
-            "time_field": {
-              "type": "keyword"
-            },
-            "time_format": {
-              "type": "keyword"
-            }
-          }
-        },
-        "datafeed_id": {
-          "type": "keyword"
-        },
-        "delayed_data_check_config": {
-          "properties": {
-            "check_window": {
-              "type": "keyword"
-            },
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "deleting": {
-          "type": "keyword"
-        },
-        "description": {
-          "type": "text"
-        },
-        "dest": {
-          "properties": {
-            "index": {
-              "type": "keyword"
-            },
-            "results_field": {
-              "type": "keyword"
-            }
-          }
-        },
-        "finished_time": {
-          "type": "date"
-        },
-        "frequency": {
-          "type": "keyword"
-        },
-        "groups": {
-          "type": "keyword"
-        },
-        "headers": {
-          "enabled": false,
-          "type": "object"
-        },
-        "id": {
-          "type": "keyword"
-        },
-        "indices": {
-          "type": "keyword"
-        },
-        "indices_options": {
-          "enabled": false,
-          "type": "object"
-        },
-        "job_id": {
-          "type": "keyword"
-        },
-        "job_type": {
-          "type": "keyword"
-        },
-        "job_version": {
-          "type": "keyword"
-        },
-        "max_empty_searches": {
-          "type": "keyword"
-        },
-        "max_num_threads": {
-          "type": "integer"
-        },
-        "model_plot_config": {
-          "properties": {
-            "annotations_enabled": {
-              "type": "boolean"
-            },
-            "enabled": {
-              "type": "boolean"
-            },
-            "terms": {
-              "type": "keyword"
-            }
-          }
-        },
-        "model_snapshot_id": {
-          "type": "keyword"
-        },
-        "model_snapshot_min_version": {
-          "type": "keyword"
-        },
-        "model_snapshot_retention_days": {
-          "type": "long"
-        },
-        "query": {
-          "enabled": false,
-          "type": "object"
-        },
-        "query_delay": {
-          "type": "keyword"
-        },
-        "renormalization_window_days": {
-          "type": "long"
-        },
-        "results_index_name": {
-          "type": "keyword"
-        },
-        "results_retention_days": {
-          "type": "long"
-        },
-        "script_fields": {
-          "enabled": false,
-          "type": "object"
-        },
-        "scroll_size": {
-          "type": "long"
-        },
-        "source": {
-          "properties": {
-            "_source": {
-              "enabled": false,
-              "type": "object"
-            },
-            "index": {
-              "type": "keyword"
-            },
-            "query": {
-              "enabled": false,
-              "type": "object"
-            }
-          }
-        },
-        "version": {
-          "type": "keyword"
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "0-1",
-        "max_result_window": "10000",
-        "number_of_replicas": "1",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      ".ml-state-write": {
-        "is_hidden": true
-      }
-    },
-    "index": ".ml-state-000001",
-    "mappings": {
-      "_meta": {
-        "version": "8000099"
-      },
-      "enabled": false
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "0-1",
-        "hidden": "true",
-        "lifecycle": {
-          "name": "ml-size-based-ilm-policy",
-          "rollover_alias": ".ml-state-write"
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-error": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-error-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "foo": {
-              "type": "keyword"
-            },
-            "lorem": {
-              "type": "keyword"
-            },
-            "multi-line": {
-              "type": "keyword"
-            },
-            "this-is-a-very-long-tag-name-without-any-spaces": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-error"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-error": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-error-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "customer_tier": {
-              "type": "keyword"
-            },
-            "foo": {
-              "type": "keyword"
-            },
-            "lorem": {
-              "type": "keyword"
-            },
-            "multi-line": {
-              "type": "keyword"
-            },
-            "request_id": {
-              "type": "keyword"
-            },
-            "this-is-a-very-long-tag-name-without-any-spaces": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-error"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-error": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-error-2020.07.31-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "customer_tier": {
-              "type": "keyword"
-            },
-            "foo": {
-              "type": "keyword"
-            },
-            "lorem": {
-              "type": "keyword"
-            },
-            "multi-line": {
-              "type": "keyword"
-            },
-            "request_id": {
-              "type": "keyword"
-            },
-            "this-is-a-very-long-tag-name-without-any-spaces": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-error"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-error": {
-        "is_write_index": true
-      }
-    },
-    "index": "apm-8.0.0-error-2020.07.31-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "customer_tier": {
-              "type": "keyword"
-            },
-            "request_id": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-error"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-metric": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-metric-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "golang": {
-          "properties": {
-            "goroutines": {
-              "type": "long"
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "active": {
-                      "type": "float"
-                    },
-                    "allocated": {
-                      "type": "float"
-                    },
-                    "frees": {
-                      "type": "float"
-                    },
-                    "idle": {
-                      "type": "float"
-                    },
-                    "mallocs": {
-                      "type": "float"
-                    },
-                    "objects": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "cpu_fraction": {
-                      "type": "float"
-                    },
-                    "next_gc_limit": {
-                      "type": "float"
-                    },
-                    "total_count": {
-                      "type": "long"
-                    },
-                    "total_pause": {
-                      "properties": {
-                        "ns": {
-                          "type": "float"
-                        }
-                      }
-                    }
-                  }
-                },
-                "system": {
-                  "properties": {
-                    "obtained": {
-                      "type": "float"
-                    },
-                    "released": {
-                      "type": "float"
-                    },
-                    "stack": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "jvm": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "alloc": {
-                  "type": "float"
-                },
-                "count": {
-                  "type": "long"
-                },
-                "time": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "float"
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "non_heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            },
-            "thread": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "env": {
-              "type": "keyword"
-            },
-            "hostname": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "nodejs": {
-          "properties": {
-            "eventloop": {
-              "properties": {
-                "delay": {
-                  "properties": {
-                    "avg": {
-                      "properties": {
-                        "ms": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "ns": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "handles": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "heap": {
-                  "properties": {
-                    "allocated": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "used": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "requests": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "ruby": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "slots": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    },
-                    "live": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "threads": {
-              "type": "long"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "system": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "user": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-metric"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-metric": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-metric-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "golang": {
-          "properties": {
-            "goroutines": {
-              "type": "long"
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "active": {
-                      "type": "float"
-                    },
-                    "allocated": {
-                      "type": "float"
-                    },
-                    "frees": {
-                      "type": "long"
-                    },
-                    "idle": {
-                      "type": "float"
-                    },
-                    "mallocs": {
-                      "type": "long"
-                    },
-                    "objects": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "cpu_fraction": {
-                      "type": "float"
-                    },
-                    "next_gc_limit": {
-                      "type": "float"
-                    },
-                    "total_count": {
-                      "type": "long"
-                    },
-                    "total_pause": {
-                      "properties": {
-                        "ns": {
-                          "type": "float"
-                        }
-                      }
-                    }
-                  }
-                },
-                "system": {
-                  "properties": {
-                    "obtained": {
-                      "type": "float"
-                    },
-                    "released": {
-                      "type": "float"
-                    },
-                    "stack": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "jvm": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "alloc": {
-                  "type": "float"
-                },
-                "count": {
-                  "type": "long"
-                },
-                "time": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "float"
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "non_heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            },
-            "thread": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "env": {
-              "type": "keyword"
-            },
-            "hostname": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "nodejs": {
-          "properties": {
-            "eventloop": {
-              "properties": {
-                "delay": {
-                  "properties": {
-                    "avg": {
-                      "properties": {
-                        "ms": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "ns": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "handles": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "arrayBuffers": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "external": {
-                  "properties": {
-                    "bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "heap": {
-                  "properties": {
-                    "allocated": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "used": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "requests": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "ruby": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "slots": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    },
-                    "live": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "threads": {
-              "type": "long"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "system": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "user": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-metric"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-metric": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-metric-2020.07.31-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "clr": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "gen0size": {
-                  "type": "float"
-                },
-                "gen1size": {
-                  "type": "float"
-                },
-                "gen2size": {
-                  "type": "float"
-                },
-                "gen3size": {
-                  "type": "float"
-                }
-              }
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "golang": {
-          "properties": {
-            "goroutines": {
-              "type": "long"
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "active": {
-                      "type": "float"
-                    },
-                    "allocated": {
-                      "type": "float"
-                    },
-                    "frees": {
-                      "type": "long"
-                    },
-                    "idle": {
-                      "type": "float"
-                    },
-                    "mallocs": {
-                      "type": "long"
-                    },
-                    "objects": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "cpu_fraction": {
-                      "type": "float"
-                    },
-                    "next_gc_limit": {
-                      "type": "float"
-                    },
-                    "total_count": {
-                      "type": "long"
-                    },
-                    "total_pause": {
-                      "properties": {
-                        "ns": {
-                          "type": "long"
-                        }
-                      }
-                    }
-                  }
-                },
-                "system": {
-                  "properties": {
-                    "obtained": {
-                      "type": "float"
-                    },
-                    "released": {
-                      "type": "float"
-                    },
-                    "stack": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "jvm": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "alloc": {
-                  "type": "float"
-                },
-                "count": {
-                  "type": "long"
-                },
-                "time": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "float"
-                    },
-                    "pool": {
-                      "properties": {
-                        "committed": {
-                          "type": "float"
-                        },
-                        "max": {
-                          "type": "float"
-                        },
-                        "used": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "non_heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            },
-            "thread": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "env": {
-              "type": "keyword"
-            },
-            "hostname": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "nodejs": {
-          "properties": {
-            "eventloop": {
-              "properties": {
-                "delay": {
-                  "properties": {
-                    "avg": {
-                      "properties": {
-                        "ms": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "ns": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "handles": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "arrayBuffers": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "external": {
-                  "properties": {
-                    "bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "heap": {
-                  "properties": {
-                    "allocated": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "used": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "requests": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "ruby": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "total": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "slots": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    },
-                    "live": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "threads": {
-              "type": "long"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cgroup": {
-                  "properties": {
-                    "memory": {
-                      "properties": {
-                        "mem": {
-                          "properties": {
-                            "limit": {
-                              "properties": {
-                                "bytes": {
-                                  "type": "float"
-                                }
-                              }
-                            },
-                            "usage": {
-                              "properties": {
-                                "bytes": {
-                                  "type": "float"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "stats": {
-                          "properties": {
-                            "inactive_file": {
-                              "properties": {
-                                "bytes": {
-                                  "type": "float"
-                                }
-                              }
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "cpu": {
-                  "properties": {
-                    "system": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "user": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-metric"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-metric": {
-        "is_write_index": true
-      }
-    },
-    "index": "apm-8.0.0-metric-2020.07.31-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "clr": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "gen0size": {
-                  "type": "float"
-                },
-                "gen1size": {
-                  "type": "float"
-                },
-                "gen2size": {
-                  "type": "float"
-                },
-                "gen3size": {
-                  "type": "float"
-                }
-              }
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "golang": {
-          "properties": {
-            "goroutines": {
-              "type": "long"
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "active": {
-                      "type": "float"
-                    },
-                    "allocated": {
-                      "type": "float"
-                    },
-                    "frees": {
-                      "type": "float"
-                    },
-                    "idle": {
-                      "type": "float"
-                    },
-                    "mallocs": {
-                      "type": "float"
-                    },
-                    "objects": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "gc": {
-                  "properties": {
-                    "cpu_fraction": {
-                      "type": "float"
-                    },
-                    "next_gc_limit": {
-                      "type": "float"
-                    },
-                    "total_count": {
-                      "type": "long"
-                    },
-                    "total_pause": {
-                      "properties": {
-                        "ns": {
-                          "type": "float"
-                        }
-                      }
-                    }
-                  }
-                },
-                "system": {
-                  "properties": {
-                    "obtained": {
-                      "type": "float"
-                    },
-                    "released": {
-                      "type": "float"
-                    },
-                    "stack": {
-                      "type": "long"
-                    },
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "jvm": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "alloc": {
-                  "type": "float"
-                },
-                "count": {
-                  "type": "long"
-                },
-                "time": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "float"
-                    },
-                    "pool": {
-                      "properties": {
-                        "committed": {
-                          "type": "float"
-                        },
-                        "max": {
-                          "type": "float"
-                        },
-                        "used": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "non_heap": {
-                  "properties": {
-                    "committed": {
-                      "type": "float"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "used": {
-                      "type": "float"
-                    }
-                  }
-                }
-              }
-            },
-            "thread": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "env": {
-              "type": "keyword"
-            },
-            "hostname": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "nodejs": {
-          "properties": {
-            "eventloop": {
-              "properties": {
-                "delay": {
-                  "properties": {
-                    "avg": {
-                      "properties": {
-                        "ms": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "ns": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "handles": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "arrayBuffers": {
-                  "properties": {
-                    "bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "external": {
-                  "properties": {
-                    "bytes": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "heap": {
-                  "properties": {
-                    "allocated": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    },
-                    "used": {
-                      "properties": {
-                        "bytes": {
-                          "type": "float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "requests": {
-              "properties": {
-                "active": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "ruby": {
-          "properties": {
-            "gc": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "heap": {
-              "properties": {
-                "allocations": {
-                  "properties": {
-                    "total": {
-                      "type": "float"
-                    }
-                  }
-                },
-                "slots": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    },
-                    "live": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "threads": {
-              "type": "long"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cgroup": {
-                  "properties": {
-                    "memory": {
-                      "properties": {
-                        "mem": {
-                          "properties": {
-                            "limit": {
-                              "properties": {
-                                "bytes": {
-                                  "type": "float"
-                                }
-                              }
-                            },
-                            "usage": {
-                              "properties": {
-                                "bytes": {
-                                  "type": "float"
-                                }
-                              }
-                            }
-                          }
-                        },
-                        "stats": {
-                          "properties": {
-                            "inactive_file": {
-                              "properties": {
-                                "bytes": {
-                                  "type": "float"
-                                }
-                              }
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "cpu": {
-                  "properties": {
-                    "system": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "user": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "type": "float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-metric"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-span": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-span-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "foo": {
-              "type": "keyword"
-            },
-            "productId": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-span"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-span": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-span-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "foo": {
-              "type": "keyword"
-            },
-            "productId": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-span"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-span": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-span-2020.07.31-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "foo": {
-              "type": "keyword"
-            },
-            "productId": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-span"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-span": {
-        "is_write_index": true
-      }
-    },
-    "index": "apm-8.0.0-span-2020.07.31-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "foo": {
-              "type": "keyword"
-            },
-            "productId": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-span"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-transaction": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-transaction-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "customer_email": {
-              "type": "keyword"
-            },
-            "customer_name": {
-              "type": "keyword"
-            },
-            "foo": {
-              "type": "keyword"
-            },
-            "lorem": {
-              "type": "keyword"
-            },
-            "multi-line": {
-              "type": "keyword"
-            },
-            "served_from_cache": {
-              "type": "keyword"
-            },
-            "this-is-a-very-long-tag-name-without-any-spaces": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                },
-                "agent": {
-                  "properties": {
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "firstContentfulPaint": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "largestContentfulPaint": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "timeToFirstByte": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                },
-                "navigationTiming": {
-                  "properties": {
-                    "connectEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "connectStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domLoading": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "fetchStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "requestStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-transaction"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-transaction": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-transaction-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "customer_email": {
-              "type": "keyword"
-            },
-            "customer_name": {
-              "type": "keyword"
-            },
-            "customer_tier": {
-              "type": "keyword"
-            },
-            "foo": {
-              "type": "keyword"
-            },
-            "lorem": {
-              "type": "keyword"
-            },
-            "multi-line": {
-              "type": "keyword"
-            },
-            "request_id": {
-              "type": "keyword"
-            },
-            "served_from_cache": {
-              "type": "keyword"
-            },
-            "this-is-a-very-long-tag-name-without-any-spaces": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                },
-                "agent": {
-                  "properties": {
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "firstContentfulPaint": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "largestContentfulPaint": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "timeToFirstByte": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                },
-                "navigationTiming": {
-                  "properties": {
-                    "connectEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "connectStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domLoading": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "fetchStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "requestStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "false",
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-transaction"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "0",
-        "number_of_shards": "1",
-        "priority": "50",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-transaction": {
-        "is_write_index": false
-      }
-    },
-    "index": "apm-8.0.0-transaction-2020.07.31-000001",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "customer_email": {
-              "type": "keyword"
-            },
-            "customer_name": {
-              "type": "keyword"
-            },
-            "customer_tier": {
-              "type": "keyword"
-            },
-            "foo": {
-              "type": "keyword"
-            },
-            "lorem": {
-              "type": "keyword"
-            },
-            "multi-line": {
-              "type": "keyword"
-            },
-            "request_id": {
-              "type": "keyword"
-            },
-            "served_from_cache": {
-              "type": "keyword"
-            },
-            "this-is-a-very-long-tag-name-without-any-spaces": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                },
-                "agent": {
-                  "properties": {
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "timeToFirstByte": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                },
-                "navigationTiming": {
-                  "properties": {
-                    "connectEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "connectStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domLoading": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "fetchStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "requestStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "indexing_complete": "true",
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-transaction"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
-
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      "apm-8.0.0-transaction": {
-        "is_write_index": true
-      }
-    },
-    "index": "apm-8.0.0-transaction-2020.07.31-000002",
-    "mappings": {
-      "_meta": {
-        "beat": "apm",
-        "version": "8.0.0"
-      },
-      "date_detection": false,
-      "dynamic_templates": [
-        {
-          "labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "container.labels.*"
-          }
-        },
-        {
-          "dns.answers": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "dns.answers.*"
-          }
-        },
-        {
-          "log.syslog": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "log.syslog.*"
-          }
-        },
-        {
-          "network.inner": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "network.inner.*"
-          }
-        },
-        {
-          "observer.egress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.egress.*"
-          }
-        },
-        {
-          "observer.ingress": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "observer.ingress.*"
-          }
-        },
-        {
-          "fields": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "fields.*"
-          }
-        },
-        {
-          "docker.container.labels": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "docker.container.labels.*"
-          }
-        },
-        {
-          "kubernetes.labels.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.labels.*"
-          }
-        },
-        {
-          "kubernetes.annotations.*": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "path_match": "kubernetes.annotations.*"
-          }
-        },
-        {
-          "labels_string": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_boolean": {
-            "mapping": {
-              "type": "boolean"
-            },
-            "match_mapping_type": "boolean",
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "labels_*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "labels.*"
-          }
-        },
-        {
-          "transaction.marks": {
-            "mapping": {
-              "type": "keyword"
-            },
-            "match_mapping_type": "string",
-            "path_match": "transaction.marks.*"
-          }
-        },
-        {
-          "transaction.marks.*.*": {
-            "mapping": {
-              "scaling_factor": 1000000,
-              "type": "scaled_float"
-            },
-            "path_match": "transaction.marks.*.*"
-          }
-        },
-        {
-          "strings_as_keyword": {
-            "mapping": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "match_mapping_type": "string"
-          }
-        }
-      ],
-      "properties": {
-        "@timestamp": {
-          "type": "date"
-        },
-        "agent": {
-          "dynamic": "false",
-          "properties": {
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hostname": {
-              "path": "agent.name",
-              "type": "alias"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "as": {
-          "properties": {
-            "number": {
-              "type": "long"
-            },
-            "organization": {
-              "properties": {
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "child": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "client": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "cloud": {
-          "properties": {
-            "account": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "availability_zone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "instance": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "machine": {
-              "dynamic": "false",
-              "properties": {
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "project": {
-              "dynamic": "false",
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "code_signature": {
-          "properties": {
-            "exists": {
-              "type": "boolean"
-            },
-            "status": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "subject_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "trusted": {
-              "type": "boolean"
-            },
-            "valid": {
-              "type": "boolean"
-            }
-          }
-        },
-        "container": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "image": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "tag": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "type": "object"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "runtime": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "destination": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dll": {
-          "properties": {
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "dns": {
-          "properties": {
-            "answers": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "data": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ttl": {
-                  "type": "long"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "header_flags": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "op_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "question": {
-              "properties": {
-                "class": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "registered_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subdomain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "top_level_domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "resolved_ip": {
-              "type": "ip"
-            },
-            "response_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "docker": {
-          "properties": {
-            "container": {
-              "properties": {
-                "labels": {
-                  "type": "object"
-                }
-              }
-            }
-          }
-        },
-        "ecs": {
-          "properties": {
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "error": {
-          "dynamic": "false",
-          "properties": {
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "culprit": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exception": {
-              "properties": {
-                "code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "handled": {
-                  "type": "boolean"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "grouping_key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "log": {
-              "properties": {
-                "level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "logger_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "message": {
-                  "norms": false,
-                  "type": "text"
-                },
-                "param_message": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "message": {
-              "norms": false,
-              "type": "text"
-            },
-            "stack_trace": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "event": {
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "created": {
-              "type": "date"
-            },
-            "dataset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "duration": {
-              "type": "long"
-            },
-            "end": {
-              "type": "date"
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingested": {
-              "type": "date"
-            },
-            "kind": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "module": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "outcome": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "provider": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "risk_score": {
-              "type": "float"
-            },
-            "risk_score_norm": {
-              "type": "float"
-            },
-            "sequence": {
-              "type": "long"
-            },
-            "severity": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "timezone": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "url": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "experimental": {
-          "dynamic": "true",
-          "type": "object"
-        },
-        "fields": {
-          "type": "object"
-        },
-        "file": {
-          "properties": {
-            "accessed": {
-              "type": "date"
-            },
-            "attributes": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "ctime": {
-              "type": "date"
-            },
-            "device": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "directory": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "drive_letter": {
-              "ignore_above": 1,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "gid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "inode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mime_type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mode": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "owner": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "geo": {
-          "properties": {
-            "city_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "continent_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "country_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "location": {
-              "type": "geo_point"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_iso_code": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "region_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "group": {
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "hash": {
-          "properties": {
-            "md5": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha1": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha256": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sha512": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "host": {
-          "dynamic": "false",
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "containerized": {
-              "type": "boolean"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "build": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "codename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "http": {
-          "dynamic": "false",
-          "properties": {
-            "request": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "method": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "referrer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "response": {
-              "properties": {
-                "body": {
-                  "properties": {
-                    "bytes": {
-                      "type": "long"
-                    },
-                    "content": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "bytes": {
-                  "type": "long"
-                },
-                "finished": {
-                  "type": "boolean"
-                },
-                "headers": {
-                  "enabled": false,
-                  "type": "object"
-                },
-                "status_code": {
-                  "type": "long"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "interface": {
-          "properties": {
-            "alias": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "kubernetes": {
-          "dynamic": "false",
-          "properties": {
-            "annotations": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "container": {
-              "properties": {
-                "image": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "deployment": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "labels": {
-              "properties": {
-                "*": {
-                  "type": "object"
-                }
-              }
-            },
-            "namespace": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pod": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "replicaset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "statefulset": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "labels": {
-          "dynamic": "true",
-          "properties": {
-            "company": {
-              "type": "keyword"
-            },
-            "customer_email": {
-              "type": "keyword"
-            },
-            "customer_name": {
-              "type": "keyword"
-            },
-            "customer_tier": {
-              "type": "keyword"
-            },
-            "foo": {
-              "type": "keyword"
-            },
-            "lorem": {
-              "type": "keyword"
-            },
-            "multi-line": {
-              "type": "keyword"
-            },
-            "request_id": {
-              "type": "keyword"
-            },
-            "served_from_cache": {
-              "type": "keyword"
-            },
-            "this-is-a-very-long-tag-name-without-any-spaces": {
-              "type": "keyword"
-            }
-          }
-        },
-        "log": {
-          "properties": {
-            "level": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "logger": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "origin": {
-              "properties": {
-                "file": {
-                  "properties": {
-                    "line": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "syslog": {
-              "properties": {
-                "facility": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "priority": {
-                  "type": "long"
-                },
-                "severity": {
-                  "properties": {
-                    "code": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "message": {
-          "norms": false,
-          "type": "text"
-        },
-        "network": {
-          "properties": {
-            "application": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "community_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "direction": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "forwarded_ip": {
-              "type": "ip"
-            },
-            "iana_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "inner": {
-              "properties": {
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "packets": {
-              "type": "long"
-            },
-            "protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "transport": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vlan": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "observer": {
-          "dynamic": "false",
-          "properties": {
-            "egress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hostname": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ingress": {
-              "properties": {
-                "interface": {
-                  "properties": {
-                    "alias": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "vlan": {
-                  "properties": {
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "zone": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "listening": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "serial_number": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "vendor": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_major": {
-              "type": "byte"
-            }
-          }
-        },
-        "organization": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "os": {
-          "properties": {
-            "family": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "kernel": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "platform": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "package": {
-          "properties": {
-            "architecture": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "build_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "checksum": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "install_scope": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "installed": {
-              "type": "date"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "size": {
-              "type": "long"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "parent": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "pe": {
-          "properties": {
-            "company": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "file_version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original_file_name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "product": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "process": {
-          "dynamic": "false",
-          "properties": {
-            "args": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "args_count": {
-              "type": "long"
-            },
-            "code_signature": {
-              "properties": {
-                "exists": {
-                  "type": "boolean"
-                },
-                "status": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "trusted": {
-                  "type": "boolean"
-                },
-                "valid": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "command_line": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "entity_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "executable": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "exit_code": {
-              "type": "long"
-            },
-            "hash": {
-              "properties": {
-                "md5": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha1": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha256": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "sha512": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "parent": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "title": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "uptime": {
-                  "type": "long"
-                },
-                "working_directory": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pe": {
-              "properties": {
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "pgid": {
-              "type": "long"
-            },
-            "pid": {
-              "type": "long"
-            },
-            "ppid": {
-              "type": "long"
-            },
-            "start": {
-              "type": "date"
-            },
-            "thread": {
-              "properties": {
-                "id": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uptime": {
-              "type": "long"
-            },
-            "working_directory": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "processor": {
-          "properties": {
-            "event": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "profile": {
-          "dynamic": "false",
-          "properties": {
-            "alloc_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "alloc_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "cpu": {
-              "properties": {
-                "ns": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "type": "long"
-            },
-            "inuse_objects": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "inuse_space": {
-              "properties": {
-                "bytes": {
-                  "type": "long"
-                }
-              }
-            },
-            "samples": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "stack": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            },
-            "top": {
-              "dynamic": "false",
-              "properties": {
-                "filename": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "function": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "line": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "registry": {
-          "properties": {
-            "data": {
-              "properties": {
-                "bytes": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "strings": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hive": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "key": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "value": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "related": {
-          "properties": {
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "rule": {
-          "properties": {
-            "author": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "license": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ruleset": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "uuid": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "service": {
-          "dynamic": "false",
-          "properties": {
-            "environment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "ephemeral_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "framework": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "language": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "node": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "runtime": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "state": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "source": {
-          "dynamic": "false",
-          "properties": {
-            "address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "as": {
-              "properties": {
-                "number": {
-                  "type": "long"
-                },
-                "organization": {
-                  "properties": {
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "bytes": {
-              "type": "long"
-            },
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "geo": {
-              "properties": {
-                "city_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "continent_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "country_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "location": {
-                  "type": "geo_point"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_iso_code": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "sourcemap": {
-          "dynamic": "false",
-          "properties": {
-            "bundle_filepath": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "service": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "span": {
-          "dynamic": "false",
-          "properties": {
-            "action": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "db": {
-              "dynamic": "false",
-              "properties": {
-                "link": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "rows_affected": {
-                  "type": "long"
-                }
-              }
-            },
-            "destination": {
-              "dynamic": "false",
-              "properties": {
-                "service": {
-                  "dynamic": "false",
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "resource": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "start": {
-              "properties": {
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "subtype": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "sync": {
-              "type": "boolean"
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "system": {
-          "properties": {
-            "cpu": {
-              "properties": {
-                "total": {
-                  "properties": {
-                    "norm": {
-                      "properties": {
-                        "pct": {
-                          "scaling_factor": 1000,
-                          "type": "scaled_float"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            "memory": {
-              "properties": {
-                "actual": {
-                  "properties": {
-                    "free": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "total": {
-                  "type": "long"
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "cpu": {
-                  "properties": {
-                    "total": {
-                      "properties": {
-                        "norm": {
-                          "properties": {
-                            "pct": {
-                              "scaling_factor": 1000,
-                              "type": "scaled_float"
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                },
-                "memory": {
-                  "properties": {
-                    "rss": {
-                      "properties": {
-                        "bytes": {
-                          "type": "long"
-                        }
-                      }
-                    },
-                    "size": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "threat": {
-          "properties": {
-            "framework": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "tactic": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "technique": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "reference": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "timeseries": {
-          "properties": {
-            "instance": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "timestamp": {
-          "properties": {
-            "us": {
-              "type": "long"
-            }
-          }
-        },
-        "tls": {
-          "properties": {
-            "cipher": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "client": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "server_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "supported_ciphers": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "curve": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "established": {
-              "type": "boolean"
-            },
-            "next_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "resumed": {
-              "type": "boolean"
-            },
-            "server": {
-              "properties": {
-                "certificate": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "certificate_chain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "issuer": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "ja3s": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "subject": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "version_protocol": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "trace": {
-          "dynamic": "false",
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "tracing": {
-          "properties": {
-            "trace": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "transaction": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "transaction": {
-          "dynamic": "false",
-          "properties": {
-            "breakdown": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                }
-              }
-            },
-            "duration": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "histogram": {
-                  "type": "histogram"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "us": {
-                  "type": "long"
-                }
-              }
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "marks": {
-              "dynamic": "true",
-              "properties": {
-                "*": {
-                  "properties": {
-                    "*": {
-                      "dynamic": "true",
-                      "type": "object"
-                    }
-                  }
-                },
-                "agent": {
-                  "properties": {
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "timeToFirstByte": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                },
-                "navigationTiming": {
-                  "properties": {
-                    "connectEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "connectStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domComplete": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domContentLoadedEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domInteractive": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domLoading": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "domainLookupStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "fetchStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "loadEventStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "requestStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseEnd": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    },
-                    "responseStart": {
-                      "scaling_factor": 1000000,
-                      "type": "scaled_float"
-                    }
-                  }
-                }
-              }
-            },
-            "message": {
-              "dynamic": "false",
-              "properties": {
-                "age": {
-                  "properties": {
-                    "ms": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "queue": {
-                  "properties": {
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "result": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "root": {
-              "type": "boolean"
-            },
-            "sampled": {
-              "type": "boolean"
-            },
-            "self_time": {
-              "properties": {
-                "count": {
-                  "type": "long"
-                },
-                "sum": {
-                  "properties": {
-                    "us": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "span_count": {
-              "properties": {
-                "dropped": {
-                  "type": "long"
-                }
-              }
-            },
-            "type": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "url": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "extension": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "fragment": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "password": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "path": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "port": {
-              "type": "long"
-            },
-            "query": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scheme": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "username": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user": {
-          "dynamic": "false",
-          "properties": {
-            "domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "email": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "full_name": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "group": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "hash": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "user_agent": {
-          "dynamic": "false",
-          "properties": {
-            "device": {
-              "properties": {
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "original": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "os": {
-              "properties": {
-                "family": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "kernel": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "platform": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "version": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "view spans": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "vlan": {
-          "properties": {
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "name": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        },
-        "vulnerability": {
-          "properties": {
-            "category": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "classification": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "description": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "enumeration": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "reference": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "report_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "scanner": {
-              "properties": {
-                "vendor": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "score": {
-              "properties": {
-                "base": {
-                  "type": "float"
-                },
-                "environmental": {
-                  "type": "float"
-                },
-                "temporal": {
-                  "type": "float"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "severity": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "codec": "best_compression",
-        "lifecycle": {
-          "name": "apm-rollover-30-days",
-          "rollover_alias": "apm-8.0.0-transaction"
-        },
-        "mapping": {
-          "total_fields": {
-            "limit": "2000"
-          }
-        },
-        "number_of_replicas": "1",
-        "number_of_shards": "1",
-        "priority": "100",
-        "refresh_interval": "5s"
-      }
-    }
-  }
-}
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts b/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
index aadff2c31a17b..84a86b46942ed 100644
--- a/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
+++ b/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
@@ -6,6 +6,7 @@
 
 import querystring from 'querystring';
 import expect from '@kbn/expect';
+import { isEmpty } from 'lodash';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 export default function serviceMapsApiTests({ getService }: FtrProviderContext) {
@@ -287,34 +288,25 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
     });
 
     describe('when there is data with anomalies', () => {
-      before(() => esArchiver.load('ml_8.0.0'));
-      after(() => esArchiver.unload('ml_8.0.0'));
+      before(() => esArchiver.load('apm_8.0.0'));
+      after(() => esArchiver.unload('apm_8.0.0'));
 
       it('returns service map elements', async () => {
-        const response = await supertest.get(
-          '/api/apm/service-map?start=2020-08-26T11%3A00%3A00.000Z&end=2020-08-26T11%3A30%3A00.000Z'
-        );
+        const start = encodeURIComponent('2020-09-10T06:00:00.000Z');
+        const end = encodeURIComponent('2020-09-10T07:00:00.000Z');
+
+        const response = await supertest.get(`/api/apm/service-map?start=${start}&end=${end}`);
 
         expect(response.status).to.be(200);
-        const opbeansJavaWithAnomaly = response.body.elements.filter(
-          (el: { data: { id: string } }) => el.data.id === 'opbeans-java'
+        const dataWithAnomalies = response.body.elements.filter(
+          (el: { data: { serviceAnomalyStats?: {} } }) => !isEmpty(el.data.serviceAnomalyStats)
         );
-        expect(opbeansJavaWithAnomaly).to.eql([
-          {
-            data: {
-              id: 'opbeans-java',
-              'service.environment': 'production',
-              'service.name': 'opbeans-java',
-              'agent.name': 'java',
-              serviceAnomalyStats: {
-                transactionType: 'request',
-                anomalyScore: 0.21359169006333134,
-                actualValue: 1526662.1320754716,
-                jobId: 'apm-production-229a-high_mean_transaction_duration',
-              },
-            },
-          },
-        ]);
+        expect(dataWithAnomalies).to.not.empty();
+        dataWithAnomalies.forEach(({ data }: any) => {
+          expect(
+            Object.values(data.serviceAnomalyStats).filter((value) => isEmpty(value))
+          ).to.not.empty();
+        });
       });
     });
   });
diff --git a/x-pack/test/case_api_integration/common/lib/utils.ts b/x-pack/test/case_api_integration/common/lib/utils.ts
index c23df53c4feef..41f92d022f06c 100644
--- a/x-pack/test/case_api_integration/common/lib/utils.ts
+++ b/x-pack/test/case_api_integration/common/lib/utils.ts
@@ -99,7 +99,7 @@ export const getResilientConnector = () => ({
   config: {
     apiUrl: 'http://some.non.existent.com',
     orgId: 'pkey',
-    casesConfiguration: {
+    incidentConfiguration: {
       mapping: [
         {
           source: 'title',
@@ -118,6 +118,7 @@ export const getResilientConnector = () => ({
         },
       ],
     },
+    isCaseOwned: true,
   },
 });
 
diff --git a/x-pack/test/functional/es_archives/endpoint/metadata/destination_index/data.json b/x-pack/test/functional/es_archives/endpoint/metadata/destination_index/data.json
new file mode 100644
index 0000000000000..b19e5e2cbf1d7
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/metadata/destination_index/data.json
@@ -0,0 +1,223 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "M92ScEJT9M9QusfIi3hpEb0AAAAAAAAA",
+    "index": "metrics-endpoint.metadata_current-default",
+    "source": {
+      "HostDetails": {
+        "@timestamp": 1579881969541,
+        "Endpoint": {
+          "policy": {
+            "applied": {
+              "id": "00000000-0000-0000-0000-000000000000",
+              "name": "Default",
+              "status": "failure"
+            }
+          },
+          "status": "enrolled"
+        },
+        "agent": {
+          "id": "3838df35-a095-4af4-8fce-0b6d78793f2e",
+          "name": "Elastic Endpoint",
+          "version": "6.8.0"
+        },
+        "elastic": {
+          "agent": {
+            "id": "023fa40c-411d-4188-a941-4147bfadd095"
+          }
+        },
+        "event": {
+          "action": "endpoint_metadata",
+          "category": [
+            "host"
+          ],
+          "created": 1579881969541,
+          "dataset": "endpoint.metadata",
+          "id": "32f5fda2-48e4-4fae-b89e-a18038294d16",
+          "ingested": "2020-09-09T18:25:15.853783Z",
+          "kind": "metric",
+          "module": "endpoint",
+          "type": [
+            "info"
+          ]
+        },
+        "host": {
+          "hostname": "rezzani-7.example.com",
+          "id": "fc0ff548-feba-41b6-8367-65e8790d0eaf",
+          "ip": [
+            "10.101.149.26",
+            "2606:a000:ffc0:39:11ef:37b9:3371:578c"
+          ],
+          "mac": [
+            "e2-6d-f9-0-46-2e"
+          ],
+          "name": "rezzani-7.example.com",
+          "os": {
+            "Ext": {
+              "variant": "Windows Pro"
+            },
+            "family": "Windows",
+            "full": "Windows 10",
+            "name": "windows 10.0",
+            "platform": "Windows",
+            "version": "10.0"
+          }
+        }
+      },
+      "agent": {
+        "id": "3838df35-a095-4af4-8fce-0b6d78793f2e"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "OU3RgCJaNnR90byeDEHutp8AAAAAAAAA",
+    "index": "metrics-endpoint.metadata_current-default",
+    "source": {
+      "HostDetails": {
+        "@timestamp": 1579881969541,
+        "Endpoint": {
+          "policy": {
+            "applied": {
+              "id": "C2A9093E-E289-4C0A-AA44-8C32A414FA7A",
+              "name": "Default",
+              "status": "failure"
+            }
+          },
+          "status": "enrolled"
+        },
+        "agent": {
+          "id": "963b081e-60d1-482c-befd-a5815fa8290f",
+          "name": "Elastic Endpoint",
+          "version": "6.6.1"
+        },
+        "elastic": {
+          "agent": {
+            "id": "11488bae-880b-4e7b-8d28-aac2aa9de816"
+          }
+        },
+        "event": {
+          "action": "endpoint_metadata",
+          "category": [
+            "host"
+          ],
+          "created": 1579881969541,
+          "dataset": "endpoint.metadata",
+          "id": "32f5fda2-48e4-4fae-b89e-a18038294d14",
+          "ingested": "2020-09-09T18:25:14.919526Z",
+          "kind": "metric",
+          "module": "endpoint",
+          "type": [
+            "info"
+          ]
+        },
+        "host": {
+          "architecture": "x86",
+          "hostname": "cadmann-4.example.com",
+          "id": "1fb3e58f-6ab0-4406-9d2a-91911207a712",
+          "ip": [
+            "10.192.213.130",
+            "10.70.28.129"
+          ],
+          "mac": [
+            "a9-71-6a-cc-93-85",
+            "f7-31-84-d3-21-68",
+            "2-95-12-39-ca-71"
+          ],
+          "name": "cadmann-4.example.com",
+          "os": {
+            "Ext": {
+              "variant": "Windows Pro"
+            },
+            "family": "Windows",
+            "full": "Windows 10",
+            "name": "windows 10.0",
+            "platform": "Windows",
+            "version": "10.0"
+          }
+        }
+      },
+      "agent": {
+        "id": "963b081e-60d1-482c-befd-a5815fa8290f"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "YjqDCEuI6JmLeLOSyZx_NhMAAAAAAAAA",
+    "index": "metrics-endpoint.metadata_current-default",
+    "source": {
+      "HostDetails": {
+        "@timestamp": 1579881969541,
+        "Endpoint": {
+          "policy": {
+            "applied": {
+              "id": "C2A9093E-E289-4C0A-AA44-8C32A414FA7A",
+              "name": "Default",
+              "status": "success"
+            }
+          },
+          "status": "enrolled"
+        },
+        "agent": {
+          "id": "b3412d6f-b022-4448-8fee-21cc936ea86b",
+          "name": "Elastic Endpoint",
+          "version": "6.0.0"
+        },
+        "elastic": {
+          "agent": {
+            "id": "92ac1ce0-e1f7-409e-8af6-f17e97b1fc71"
+          }
+        },
+        "event": {
+          "action": "endpoint_metadata",
+          "category": [
+            "host"
+          ],
+          "created": 1579881969541,
+          "dataset": "endpoint.metadata",
+          "id": "32f5fda2-48e4-4fae-b89e-a18038294d15",
+          "ingested": "2020-09-09T18:25:15.853404Z",
+          "kind": "metric",
+          "module": "endpoint",
+          "type": [
+            "info"
+          ]
+        },
+        "host": {
+          "architecture": "x86_64",
+          "hostname": "thurlow-9.example.com",
+          "id": "2f735e3d-be14-483b-9822-bad06e9045ca",
+          "ip": [
+            "10.46.229.234"
+          ],
+          "mac": [
+            "30-8c-45-55-69-b8",
+            "e5-36-7e-8f-a3-84",
+            "39-a1-37-20-18-74"
+          ],
+          "name": "thurlow-9.example.com",
+          "os": {
+            "Ext": {
+              "variant": "Windows Server"
+            },
+            "family": "Windows",
+            "full": "Windows Server 2016",
+            "name": "windows 10.0",
+            "platform": "Windows",
+            "version": "10.0"
+          }
+        }
+      },
+      "agent": {
+        "id": "b3412d6f-b022-4448-8fee-21cc936ea86b"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts
index 2b4bb335dfc5c..68e02933f5650 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/fleet/agents/actions.ts
@@ -28,13 +28,12 @@ export default function (providerContext: FtrProviderContext) {
           action: {
             type: 'CONFIG_CHANGE',
             data: { data: 'action_data' },
-            sent_at: '2020-03-18T19:45:02.620Z',
           },
         })
         .expect(200);
 
+      expect(apiResponse.item.type).to.eql('CONFIG_CHANGE');
       expect(apiResponse.item.data).to.eql({ data: 'action_data' });
-      expect(apiResponse.item.sent_at).to.be('2020-03-18T19:45:02.620Z');
     });
 
     it('should return a 400 when request does not have type information', async () => {
diff --git a/x-pack/test/saved_object_api_integration/common/suites/bulk_update.ts b/x-pack/test/saved_object_api_integration/common/suites/bulk_update.ts
index 0b5656004492a..2e3c55f029d29 100644
--- a/x-pack/test/saved_object_api_integration/common/suites/bulk_update.ts
+++ b/x-pack/test/saved_object_api_integration/common/suites/bulk_update.ts
@@ -8,12 +8,7 @@ import expect from '@kbn/expect';
 import { SuperTest } from 'supertest';
 import { SAVED_OBJECT_TEST_CASES as CASES } from '../lib/saved_object_test_cases';
 import { SPACES } from '../lib/spaces';
-import {
-  createRequest,
-  expectResponses,
-  getUrlPrefix,
-  getTestTitle,
-} from '../lib/saved_object_test_utils';
+import { expectResponses, getUrlPrefix, getTestTitle } from '../lib/saved_object_test_utils';
 import { ExpectResponseBody, TestCase, TestDefinition, TestSuite } from '../lib/types';
 
 export interface BulkUpdateTestDefinition extends TestDefinition {
@@ -21,6 +16,7 @@ export interface BulkUpdateTestDefinition extends TestDefinition {
 }
 export type BulkUpdateTestSuite = TestSuite<BulkUpdateTestDefinition>;
 export interface BulkUpdateTestCase extends TestCase {
+  namespace?: string; // used to define individual "object namespace" strings, e.g., bulkUpdate across multiple namespaces
   failure?: 404; // only used for permitted response case
 }
 
@@ -30,6 +26,12 @@ const NEW_ATTRIBUTE_VAL = `Updated attribute value ${Date.now()}`;
 const DOES_NOT_EXIST = Object.freeze({ type: 'dashboard', id: 'does-not-exist' });
 export const TEST_CASES = Object.freeze({ ...CASES, DOES_NOT_EXIST });
 
+const createRequest = ({ type, id, namespace }: BulkUpdateTestCase) => ({
+  type,
+  id,
+  ...(namespace && { namespace }), // individual "object namespace" string
+});
+
 export function bulkUpdateTestSuiteFactory(esArchiver: any, supertest: SuperTest<any>) {
   const expectForbidden = expectResponses.forbiddenTypes('bulk_update');
   const expectResponseBody = (
diff --git a/x-pack/test/saved_object_api_integration/security_and_spaces/apis/bulk_update.ts b/x-pack/test/saved_object_api_integration/security_and_spaces/apis/bulk_update.ts
index 90f72e0b34449..1e11d1fc61110 100644
--- a/x-pack/test/saved_object_api_integration/security_and_spaces/apis/bulk_update.ts
+++ b/x-pack/test/saved_object_api_integration/security_and_spaces/apis/bulk_update.ts
@@ -39,7 +39,18 @@ const createTestCases = (spaceId: string) => {
   ];
   const hiddenType = [{ ...CASES.HIDDEN, ...fail404() }];
   const allTypes = normalTypes.concat(hiddenType);
-  return { normalTypes, hiddenType, allTypes };
+  // an "object namespace" string can be specified for individual objects (to bulkUpdate across namespaces)
+  const withObjectNamespaces = [
+    { ...CASES.SINGLE_NAMESPACE_DEFAULT_SPACE, namespace: DEFAULT_SPACE_ID },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_1, namespace: SPACE_1_ID },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_2, namespace: SPACE_1_ID, ...fail404() }, // intentional 404 test case
+    { ...CASES.MULTI_NAMESPACE_DEFAULT_AND_SPACE_1, namespace: DEFAULT_SPACE_ID }, // SPACE_1_ID would also work
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_1, namespace: SPACE_2_ID, ...fail404() }, // intentional 404 test case
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_2, namespace: SPACE_2_ID },
+    CASES.NAMESPACE_AGNOSTIC, // any namespace would work and would make no difference
+    { ...CASES.DOES_NOT_EXIST, ...fail404() },
+  ];
+  return { normalTypes, hiddenType, allTypes, withObjectNamespaces };
 };
 
 export default function ({ getService }: FtrProviderContext) {
@@ -51,26 +62,42 @@ export default function ({ getService }: FtrProviderContext) {
     supertest
   );
   const createTests = (spaceId: string) => {
-    const { normalTypes, hiddenType, allTypes } = createTestCases(spaceId);
+    const { normalTypes, hiddenType, allTypes, withObjectNamespaces } = createTestCases(spaceId);
     // use singleRequest to reduce execution time and/or test combined cases
+    const authorizedCommon = [
+      createTestDefinitions(normalTypes, false, { singleRequest: true }),
+      createTestDefinitions(hiddenType, true),
+      createTestDefinitions(allTypes, true, {
+        singleRequest: true,
+        responseBodyOverride: expectForbidden(['hiddentype']),
+      }),
+    ].flat();
     return {
-      unauthorized: createTestDefinitions(allTypes, true),
-      authorized: [
-        createTestDefinitions(normalTypes, false, { singleRequest: true }),
-        createTestDefinitions(hiddenType, true),
-        createTestDefinitions(allTypes, true, {
-          singleRequest: true,
-          responseBodyOverride: expectForbidden(['hiddentype']),
-        }),
+      unauthorized: [
+        createTestDefinitions(allTypes, true),
+        createTestDefinitions(withObjectNamespaces, true, { singleRequest: true }),
+      ].flat(),
+      authorizedAtSpace: [
+        authorizedCommon,
+        createTestDefinitions(withObjectNamespaces, true, { singleRequest: true }),
+      ].flat(),
+      authorizedAllSpaces: [
+        authorizedCommon,
+        createTestDefinitions(withObjectNamespaces, false, { singleRequest: true }),
+      ].flat(),
+      superuser: [
+        createTestDefinitions(allTypes, false, { singleRequest: true }),
+        createTestDefinitions(withObjectNamespaces, false, { singleRequest: true }),
       ].flat(),
-      superuser: createTestDefinitions(allTypes, false, { singleRequest: true }),
     };
   };
 
   describe('_bulk_update', () => {
     getTestScenarios().securityAndSpaces.forEach(({ spaceId, users }) => {
       const suffix = ` within the ${spaceId} space`;
-      const { unauthorized, authorized, superuser } = createTests(spaceId);
+      const { unauthorized, authorizedAtSpace, authorizedAllSpaces, superuser } = createTests(
+        spaceId
+      );
       const _addTests = (user: TestUser, tests: BulkUpdateTestDefinition[]) => {
         addTests(`${user.description}${suffix}`, { user, spaceId, tests });
       };
@@ -85,8 +112,11 @@ export default function ({ getService }: FtrProviderContext) {
       ].forEach((user) => {
         _addTests(user, unauthorized);
       });
-      [users.dualAll, users.allGlobally, users.allAtSpace].forEach((user) => {
-        _addTests(user, authorized);
+      [users.allAtSpace].forEach((user) => {
+        _addTests(user, authorizedAtSpace);
+      });
+      [users.dualAll, users.allGlobally].forEach((user) => {
+        _addTests(user, authorizedAllSpaces);
       });
       _addTests(users.superuser, superuser);
     });
diff --git a/x-pack/test/saved_object_api_integration/security_only/apis/bulk_update.ts b/x-pack/test/saved_object_api_integration/security_only/apis/bulk_update.ts
index d42eb25b81cf5..39ceb5a70d1b2 100644
--- a/x-pack/test/saved_object_api_integration/security_only/apis/bulk_update.ts
+++ b/x-pack/test/saved_object_api_integration/security_only/apis/bulk_update.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { SPACES } from '../../common/lib/spaces';
 import { testCaseFailures, getTestScenarios } from '../../common/lib/saved_object_test_utils';
 import { TestUser } from '../../common/lib/types';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
@@ -13,6 +14,11 @@ import {
   BulkUpdateTestDefinition,
 } from '../../common/suites/bulk_update';
 
+const {
+  DEFAULT: { spaceId: DEFAULT_SPACE_ID },
+  SPACE_1: { spaceId: SPACE_1_ID },
+  SPACE_2: { spaceId: SPACE_2_ID },
+} = SPACES;
 const { fail404 } = testCaseFailures;
 
 const createTestCases = () => {
@@ -30,7 +36,19 @@ const createTestCases = () => {
   ];
   const hiddenType = [{ ...CASES.HIDDEN, ...fail404() }];
   const allTypes = normalTypes.concat(hiddenType);
-  return { normalTypes, hiddenType, allTypes };
+  // an "object namespace" string can be specified for individual objects (to bulkUpdate across namespaces)
+  // even if the Spaces plugin is disabled, this should work, as `namespace` is handled by the Core API
+  const withObjectNamespaces = [
+    { ...CASES.SINGLE_NAMESPACE_DEFAULT_SPACE, namespace: DEFAULT_SPACE_ID },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_1, namespace: SPACE_1_ID },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_2, namespace: SPACE_1_ID, ...fail404() }, // intentional 404 test case
+    { ...CASES.MULTI_NAMESPACE_DEFAULT_AND_SPACE_1, namespace: DEFAULT_SPACE_ID }, // SPACE_1_ID would also work
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_1, namespace: SPACE_2_ID, ...fail404() }, // intentional 404 test case
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_2, namespace: SPACE_2_ID },
+    CASES.NAMESPACE_AGNOSTIC, // any namespace would work and would make no difference
+    { ...CASES.DOES_NOT_EXIST, ...fail404() },
+  ];
+  return { normalTypes, hiddenType, allTypes, withObjectNamespaces };
 };
 
 export default function ({ getService }: FtrProviderContext) {
@@ -42,10 +60,13 @@ export default function ({ getService }: FtrProviderContext) {
     supertest
   );
   const createTests = () => {
-    const { normalTypes, hiddenType, allTypes } = createTestCases();
+    const { normalTypes, hiddenType, allTypes, withObjectNamespaces } = createTestCases();
     // use singleRequest to reduce execution time and/or test combined cases
     return {
-      unauthorized: createTestDefinitions(allTypes, true),
+      unauthorized: [
+        createTestDefinitions(allTypes, true),
+        createTestDefinitions(withObjectNamespaces, true, { singleRequest: true }),
+      ].flat(),
       authorized: [
         createTestDefinitions(normalTypes, false, { singleRequest: true }),
         createTestDefinitions(hiddenType, true),
@@ -53,8 +74,12 @@ export default function ({ getService }: FtrProviderContext) {
           singleRequest: true,
           responseBodyOverride: expectForbidden(['hiddentype']),
         }),
+        createTestDefinitions(withObjectNamespaces, false, { singleRequest: true }),
+      ].flat(),
+      superuser: [
+        createTestDefinitions(allTypes, false, { singleRequest: true }),
+        createTestDefinitions(withObjectNamespaces, false, { singleRequest: true }),
       ].flat(),
-      superuser: createTestDefinitions(allTypes, false, { singleRequest: true }),
     };
   };
 
diff --git a/x-pack/test/saved_object_api_integration/spaces_only/apis/bulk_update.ts b/x-pack/test/saved_object_api_integration/spaces_only/apis/bulk_update.ts
index 93e44e357918a..b51ec303fadf3 100644
--- a/x-pack/test/saved_object_api_integration/spaces_only/apis/bulk_update.ts
+++ b/x-pack/test/saved_object_api_integration/spaces_only/apis/bulk_update.ts
@@ -16,22 +16,37 @@ const {
 } = SPACES;
 const { fail404 } = testCaseFailures;
 
-const createTestCases = (spaceId: string) => [
+const createTestCases = (spaceId: string) => {
   // for each outcome, if failure !== undefined then we expect to receive
   // an error; otherwise, we expect to receive a success result
-  { ...CASES.SINGLE_NAMESPACE_DEFAULT_SPACE, ...fail404(spaceId !== DEFAULT_SPACE_ID) },
-  { ...CASES.SINGLE_NAMESPACE_SPACE_1, ...fail404(spaceId !== SPACE_1_ID) },
-  { ...CASES.SINGLE_NAMESPACE_SPACE_2, ...fail404(spaceId !== SPACE_2_ID) },
-  {
-    ...CASES.MULTI_NAMESPACE_DEFAULT_AND_SPACE_1,
-    ...fail404(spaceId !== DEFAULT_SPACE_ID && spaceId !== SPACE_1_ID),
-  },
-  { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_1, ...fail404(spaceId !== SPACE_1_ID) },
-  { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_2, ...fail404(spaceId !== SPACE_2_ID) },
-  CASES.NAMESPACE_AGNOSTIC,
-  { ...CASES.HIDDEN, ...fail404() },
-  { ...CASES.DOES_NOT_EXIST, ...fail404() },
-];
+  const normal = [
+    { ...CASES.SINGLE_NAMESPACE_DEFAULT_SPACE, ...fail404(spaceId !== DEFAULT_SPACE_ID) },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_1, ...fail404(spaceId !== SPACE_1_ID) },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_2, ...fail404(spaceId !== SPACE_2_ID) },
+    {
+      ...CASES.MULTI_NAMESPACE_DEFAULT_AND_SPACE_1,
+      ...fail404(spaceId !== DEFAULT_SPACE_ID && spaceId !== SPACE_1_ID),
+    },
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_1, ...fail404(spaceId !== SPACE_1_ID) },
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_2, ...fail404(spaceId !== SPACE_2_ID) },
+    CASES.NAMESPACE_AGNOSTIC,
+    { ...CASES.HIDDEN, ...fail404() },
+    { ...CASES.DOES_NOT_EXIST, ...fail404() },
+  ];
+
+  // an "object namespace" string can be specified for individual objects (to bulkUpdate across namespaces)
+  const withObjectNamespaces = [
+    { ...CASES.SINGLE_NAMESPACE_DEFAULT_SPACE, namespace: DEFAULT_SPACE_ID },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_1, namespace: SPACE_1_ID },
+    { ...CASES.SINGLE_NAMESPACE_SPACE_2, namespace: SPACE_1_ID, ...fail404() }, // intentional 404 test case
+    { ...CASES.MULTI_NAMESPACE_DEFAULT_AND_SPACE_1, namespace: DEFAULT_SPACE_ID }, // SPACE_1_ID would also work
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_1, namespace: SPACE_2_ID, ...fail404() }, // intentional 404 test case
+    { ...CASES.MULTI_NAMESPACE_ONLY_SPACE_2, namespace: SPACE_2_ID },
+    CASES.NAMESPACE_AGNOSTIC, // any namespace would work and would make no difference
+    { ...CASES.DOES_NOT_EXIST, ...fail404() },
+  ];
+  return { normal, withObjectNamespaces };
+};
 
 export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
@@ -39,8 +54,11 @@ export default function ({ getService }: FtrProviderContext) {
 
   const { addTests, createTestDefinitions } = bulkUpdateTestSuiteFactory(esArchiver, supertest);
   const createTests = (spaceId: string) => {
-    const testCases = createTestCases(spaceId);
-    return createTestDefinitions(testCases, false, { singleRequest: true });
+    const { normal, withObjectNamespaces } = createTestCases(spaceId);
+    return [
+      createTestDefinitions(normal, false, { singleRequest: true }),
+      createTestDefinitions(withObjectNamespaces, false, { singleRequest: true }),
+    ].flat();
   };
 
   describe('_bulk_update', () => {
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
index ebd5ff0afee77..00b4b82f9d602 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/endpoint_list.ts
@@ -10,6 +10,7 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 import {
   deleteMetadataCurrentStream,
   deleteMetadataStream,
+  deleteAllDocsFromMetadataCurrentIndex,
 } from '../../../security_solution_endpoint_api_int/apis/data_stream_helper';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
@@ -68,11 +69,13 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       before(async () => {
         await deleteMetadataStream(getService);
         await deleteMetadataCurrentStream(getService);
+        await deleteAllDocsFromMetadataCurrentIndex(getService);
         await pageObjects.endpoint.navigateToEndpointList();
       });
       after(async () => {
         await deleteMetadataStream(getService);
         await deleteMetadataCurrentStream(getService);
+        await deleteAllDocsFromMetadataCurrentIndex(getService);
       });
 
       it('finds no data in list and prompts onboarding to add policy', async () => {
@@ -80,8 +83,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       });
 
       it('finds data after load and polling', async () => {
-        await esArchiver.load('endpoint/metadata/api_feature', { useCreate: true });
-        await pageObjects.endpoint.waitForTableToHaveData('endpointListTable', 120000);
+        await esArchiver.load('endpoint/metadata/destination_index', { useCreate: true });
+        await pageObjects.endpoint.waitForTableToHaveData('endpointListTable', 1100);
         const tableData = await pageObjects.endpointPageUtils.tableData('endpointListTable');
         expect(tableData).to.eql(expectedData);
       });
@@ -89,13 +92,13 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     describe('when there is data,', () => {
       before(async () => {
-        await esArchiver.load('endpoint/metadata/api_feature', { useCreate: true });
-        await sleep(120000);
+        await esArchiver.load('endpoint/metadata/destination_index', { useCreate: true });
         await pageObjects.endpoint.navigateToEndpointList();
       });
       after(async () => {
         await deleteMetadataStream(getService);
         await deleteMetadataCurrentStream(getService);
+        await deleteAllDocsFromMetadataCurrentIndex(getService);
       });
 
       it('finds page title', async () => {
@@ -212,6 +215,91 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       });
     });
 
+    describe('displays the correct table data for the kql queries', () => {
+      before(async () => {
+        await esArchiver.load('endpoint/metadata/destination_index', { useCreate: true });
+        await pageObjects.endpoint.navigateToEndpointList();
+      });
+      after(async () => {
+        await deleteMetadataStream(getService);
+        await deleteMetadataCurrentStream(getService);
+        await deleteAllDocsFromMetadataCurrentIndex(getService);
+      });
+      it('for the kql query: na, table shows an empty list', async () => {
+        await testSubjects.setValue('adminSearchBar', 'na');
+        await (await testSubjects.find('querySubmitButton')).click();
+        const expectedDataFromQuery = [
+          [
+            'Hostname',
+            'Agent Status',
+            'Integration',
+            'Configuration Status',
+            'Operating System',
+            'IP Address',
+            'Version',
+            'Last Active',
+          ],
+          ['No items found'],
+        ];
+
+        await pageObjects.endpoint.waitForTableToNotHaveData('endpointListTable');
+        const tableData = await pageObjects.endpointPageUtils.tableData('endpointListTable');
+        expect(tableData).to.eql(expectedDataFromQuery);
+      });
+
+      it('for the kql query: HostDetails.Endpoint.policy.applied.id : "C2A9093E-E289-4C0A-AA44-8C32A414FA7A", table shows 2 items', async () => {
+        await testSubjects.setValue('adminSearchBar', ' ');
+        await (await testSubjects.find('querySubmitButton')).click();
+
+        const endpointListTableTotal = await testSubjects.getVisibleText('endpointListTableTotal');
+
+        await testSubjects.setValue(
+          'adminSearchBar',
+          'HostDetails.Endpoint.policy.applied.id : "C2A9093E-E289-4C0A-AA44-8C32A414FA7A" '
+        );
+        await (await testSubjects.find('querySubmitButton')).click();
+        const expectedDataFromQuery = [
+          [
+            'Hostname',
+            'Agent Status',
+            'Integration',
+            'Configuration Status',
+            'Operating System',
+            'IP Address',
+            'Version',
+            'Last Active',
+          ],
+          [
+            'cadmann-4.example.com',
+            'Error',
+            'Default',
+            'Failure',
+            'windows 10.0',
+            '10.192.213.130, 10.70.28.129',
+            '6.6.1',
+            'Jan 24, 2020 @ 16:06:09.541',
+          ],
+          [
+            'thurlow-9.example.com',
+            'Error',
+            'Default',
+            'Success',
+            'windows 10.0',
+            '10.46.229.234',
+            '6.0.0',
+            'Jan 24, 2020 @ 16:06:09.541',
+          ],
+        ];
+
+        await pageObjects.endpoint.waitForVisibleTextToChange(
+          'endpointListTableTotal',
+          endpointListTableTotal
+        );
+        const tableData = await pageObjects.endpointPageUtils.tableData('endpointListTable');
+        expect(tableData).to.eql(expectedDataFromQuery);
+      });
+    });
+
     describe.skip('when there is no data,', () => {
       before(async () => {
         // clear out the data and reload the page
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/alerts.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/alerts.ts
index 82d844aae8016..bf7ed711b75a5 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/alerts.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/alerts.ts
@@ -4,7 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
-import { eventId } from '../../../../plugins/security_solution/common/endpoint/models/event';
+import {
+  eventIDSafeVersion,
+  timestampSafeVersion,
+} from '../../../../plugins/security_solution/common/endpoint/models/event';
 import { ResolverRelatedAlerts } from '../../../../plugins/security_solution/common/endpoint/types';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import {
@@ -69,7 +72,7 @@ export default function ({ getService }: FtrProviderContext) {
     });
 
     it('should allow alerts to be filtered', async () => {
-      const filter = `not event.id:"${tree.origin.relatedAlerts[0].event.id}"`;
+      const filter = `not event.id:"${tree.origin.relatedAlerts[0].event?.id}"`;
       const { body }: { body: ResolverRelatedAlerts } = await supertest
         .post(`/api/endpoint/resolver/${tree.origin.id}/alerts`)
         .set('kbn-xsrf', 'xxx')
@@ -84,7 +87,7 @@ export default function ({ getService }: FtrProviderContext) {
       // should not find the alert that we excluded in the filter
       expect(
         body.alerts.find((bodyAlert) => {
-          return eventId(bodyAlert) === tree.origin.relatedAlerts[0].event.id;
+          return eventIDSafeVersion(bodyAlert) === tree.origin.relatedAlerts[0].event?.id;
         })
       ).to.not.be.ok();
     });
@@ -135,14 +138,16 @@ export default function ({ getService }: FtrProviderContext) {
         .expect(200);
       const sortedAsc = [...tree.origin.relatedAlerts].sort((event1, event2) => {
         // this sorts the events by timestamp in ascending order
-        const diff = event1['@timestamp'] - event2['@timestamp'];
+        const diff = (timestampSafeVersion(event1) ?? 0) - (timestampSafeVersion(event2) ?? 0);
+        const event1ID = eventIDSafeVersion(event1) ?? 0;
+        const event2ID = eventIDSafeVersion(event2) ?? 0;
         // if the timestamps are the same, fallback to the event.id sorted in
         // ascending order
         if (diff === 0) {
-          if (event1.event.id < event2.event.id) {
+          if (event1ID < event2ID) {
             return -1;
           }
-          if (event1.event.id > event2.event.id) {
+          if (event1ID > event2ID) {
             return 1;
           }
           return 0;
@@ -152,7 +157,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       expect(body.alerts.length).to.eql(4);
       for (let i = 0; i < body.alerts.length; i++) {
-        expect(eventId(body.alerts[i])).to.equal(sortedAsc[i].event.id);
+        expect(eventIDSafeVersion(body.alerts[i])).to.equal(sortedAsc[i].event?.id);
       }
     });
   });
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts
index 2dec3c755a93b..49e24ff67fa77 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts
@@ -5,14 +5,17 @@
  */
 import expect from '@kbn/expect';
 import { SearchResponse } from 'elasticsearch';
-import { entityId } from '../../../../plugins/security_solution/common/endpoint/models/event';
+import {
+  entityIDSafeVersion,
+  timestampSafeVersion,
+} from '../../../../plugins/security_solution/common/endpoint/models/event';
 import { eventsIndexPattern } from '../../../../plugins/security_solution/common/endpoint/constants';
 import { ChildrenPaginationBuilder } from '../../../../plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination';
 import { ChildrenQuery } from '../../../../plugins/security_solution/server/endpoint/routes/resolver/queries/children';
 import {
-  ResolverTree,
-  ResolverEvent,
-  ResolverChildren,
+  SafeResolverTree,
+  SafeResolverEvent,
+  SafeResolverChildren,
 } from '../../../../plugins/security_solution/common/endpoint/types';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import {
@@ -20,6 +23,7 @@ import {
   EndpointDocGenerator,
 } from '../../../../plugins/security_solution/common/endpoint/generate_data';
 import { InsertedEvents } from '../../services/resolver';
+import { createAncestryArray } from './common';
 
 export default function resolverAPIIntegrationTests({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
@@ -40,20 +44,20 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC
         // Origin -> infoEvent -> startEvent -> execEvent
         origin = generator.generateEvent();
         infoEvent = generator.generateEvent({
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
           eventType: ['info'],
         });
 
         startEvent = generator.generateEvent({
-          parentEntityID: infoEvent.process.entity_id,
-          ancestry: [infoEvent.process.entity_id, origin.process.entity_id],
+          parentEntityID: entityIDSafeVersion(infoEvent),
+          ancestry: createAncestryArray([infoEvent, origin]),
           eventType: ['start'],
         });
 
         execEvent = generator.generateEvent({
-          parentEntityID: startEvent.process.entity_id,
-          ancestry: [startEvent.process.entity_id, infoEvent.process.entity_id],
+          parentEntityID: entityIDSafeVersion(startEvent),
+          ancestry: createAncestryArray([startEvent, infoEvent]),
           eventType: ['change'],
         });
         genData = await resolver.insertEvents([origin, infoEvent, startEvent, execEvent]);
@@ -64,13 +68,13 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC
       });
 
       it('finds all the children of the origin', async () => {
-        const { body }: { body: ResolverTree } = await supertest
-          .get(`/api/endpoint/resolver/${origin.process.entity_id}?children=100`)
+        const { body }: { body: SafeResolverTree } = await supertest
+          .get(`/api/endpoint/resolver/${origin.process?.entity_id}?children=100`)
           .expect(200);
         expect(body.children.childNodes.length).to.be(3);
-        expect(body.children.childNodes[0].entityID).to.be(infoEvent.process.entity_id);
-        expect(body.children.childNodes[1].entityID).to.be(startEvent.process.entity_id);
-        expect(body.children.childNodes[2].entityID).to.be(execEvent.process.entity_id);
+        expect(body.children.childNodes[0].entityID).to.be(infoEvent.process?.entity_id);
+        expect(body.children.childNodes[1].entityID).to.be(startEvent.process?.entity_id);
+        expect(body.children.childNodes[2].entityID).to.be(execEvent.process?.entity_id);
       });
     });
 
@@ -86,23 +90,23 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC
         // Origin -> (infoEvent, startEvent, execEvent are all for the same node)
         origin = generator.generateEvent();
         startEvent = generator.generateEvent({
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
           eventType: ['start'],
         });
 
         infoEvent = generator.generateEvent({
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
-          entityID: startEvent.process.entity_id,
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
+          entityID: entityIDSafeVersion(startEvent),
           eventType: ['info'],
         });
 
         execEvent = generator.generateEvent({
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
           eventType: ['change'],
-          entityID: startEvent.process.entity_id,
+          entityID: entityIDSafeVersion(startEvent),
         });
         genData = await resolver.insertEvents([origin, infoEvent, startEvent, execEvent]);
       });
@@ -117,12 +121,12 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC
           eventsIndexPattern
         );
         // [1] here gets the body portion of the array
-        const [, query] = childrenQuery.buildMSearch(origin.process.entity_id);
-        const { body } = await es.search<SearchResponse<ResolverEvent>>({ body: query });
+        const [, query] = childrenQuery.buildMSearch(entityIDSafeVersion(origin) ?? '');
+        const { body } = await es.search<SearchResponse<SafeResolverEvent>>({ body: query });
         expect(body.hits.hits.length).to.be(1);
 
         const event = body.hits.hits[0]._source;
-        expect(entityId(event)).to.be(startEvent.process.entity_id);
+        expect(entityIDSafeVersion(event)).to.be(startEvent.process?.entity_id);
         expect(event.event?.type).to.eql(['start']);
       });
     });
@@ -139,25 +143,25 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC
         // Origin -> (infoEvent, startEvent, execEvent are all for the same node)
         origin = generator.generateEvent();
         startEvent = generator.generateEvent({
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
           eventType: ['start'],
         });
 
         infoEvent = generator.generateEvent({
-          timestamp: startEvent['@timestamp'] + 100,
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
-          entityID: startEvent.process.entity_id,
+          timestamp: (timestampSafeVersion(startEvent) ?? 0) + 100,
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
+          entityID: entityIDSafeVersion(startEvent),
           eventType: ['info'],
         });
 
         execEvent = generator.generateEvent({
-          timestamp: infoEvent['@timestamp'] + 100,
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
+          timestamp: (timestampSafeVersion(infoEvent) ?? 0) + 100,
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
           eventType: ['change'],
-          entityID: startEvent.process.entity_id,
+          entityID: entityIDSafeVersion(startEvent),
         });
         genData = await resolver.insertEvents([origin, infoEvent, startEvent, execEvent]);
       });
@@ -167,37 +171,37 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC
       });
 
       it('retrieves the same node three times', async () => {
-        let { body }: { body: ResolverChildren } = await supertest
-          .get(`/api/endpoint/resolver/${origin.process.entity_id}/children?children=1`)
+        let { body }: { body: SafeResolverChildren } = await supertest
+          .get(`/api/endpoint/resolver/${origin.process?.entity_id}/children?children=1`)
           .expect(200);
         expect(body.childNodes.length).to.be(1);
         expect(body.nextChild).to.not.be(null);
-        expect(body.childNodes[0].entityID).to.be(startEvent.process.entity_id);
-        expect(body.childNodes[0].lifecycle[0].event?.type).to.eql(startEvent.event.type);
+        expect(body.childNodes[0].entityID).to.be(startEvent.process?.entity_id);
+        expect(body.childNodes[0].lifecycle[0].event?.type).to.eql(startEvent.event?.type);
 
         ({ body } = await supertest
           .get(
-            `/api/endpoint/resolver/${origin.process.entity_id}/children?children=1&afterChild=${body.nextChild}`
+            `/api/endpoint/resolver/${origin.process?.entity_id}/children?children=1&afterChild=${body.nextChild}`
           )
           .expect(200));
         expect(body.childNodes.length).to.be(1);
         expect(body.nextChild).to.not.be(null);
-        expect(body.childNodes[0].entityID).to.be(infoEvent.process.entity_id);
-        expect(body.childNodes[0].lifecycle[1].event?.type).to.eql(infoEvent.event.type);
+        expect(body.childNodes[0].entityID).to.be(infoEvent.process?.entity_id);
+        expect(body.childNodes[0].lifecycle[1].event?.type).to.eql(infoEvent.event?.type);
 
         ({ body } = await supertest
           .get(
-            `/api/endpoint/resolver/${origin.process.entity_id}/children?children=1&afterChild=${body.nextChild}`
+            `/api/endpoint/resolver/${origin.process?.entity_id}/children?children=1&afterChild=${body.nextChild}`
           )
           .expect(200));
         expect(body.childNodes.length).to.be(1);
         expect(body.nextChild).to.not.be(null);
-        expect(body.childNodes[0].entityID).to.be(infoEvent.process.entity_id);
-        expect(body.childNodes[0].lifecycle[2].event?.type).to.eql(execEvent.event.type);
+        expect(body.childNodes[0].entityID).to.be(infoEvent.process?.entity_id);
+        expect(body.childNodes[0].lifecycle[2].event?.type).to.eql(execEvent.event?.type);
 
         ({ body } = await supertest
           .get(
-            `/api/endpoint/resolver/${origin.process.entity_id}/children?children=1&afterChild=${body.nextChild}`
+            `/api/endpoint/resolver/${origin.process?.entity_id}/children?children=1&afterChild=${body.nextChild}`
           )
           .expect(200));
         expect(body.childNodes.length).to.be(0);
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/common.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/common.ts
index 92d14fb94a2d8..2c59863099ae7 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/common.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/common.ts
@@ -6,14 +6,15 @@
 import _ from 'lodash';
 import expect from '@kbn/expect';
 import {
-  ResolverChildNode,
-  ResolverLifecycleNode,
-  ResolverEvent,
+  SafeResolverChildNode,
+  SafeResolverLifecycleNode,
+  SafeResolverEvent,
   ResolverNodeStats,
 } from '../../../../plugins/security_solution/common/endpoint/types';
 import {
-  parentEntityId,
-  eventId,
+  parentEntityIDSafeVersion,
+  entityIDSafeVersion,
+  eventIDSafeVersion,
 } from '../../../../plugins/security_solution/common/endpoint/models/event';
 import {
   Event,
@@ -23,13 +24,33 @@ import {
   categoryMapping,
 } from '../../../../plugins/security_solution/common/endpoint/generate_data';
 
+/**
+ * Creates the ancestry array based on an array of events. The order of the ancestry array will match the order
+ * of the events passed in.
+ *
+ * @param events an array of generated events
+ */
+export const createAncestryArray = (events: Event[]) => {
+  const ancestry: string[] = [];
+  for (const event of events) {
+    const entityID = entityIDSafeVersion(event);
+    if (entityID) {
+      ancestry.push(entityID);
+    }
+  }
+  return ancestry;
+};
+
 /**
  * Check that the given lifecycle is in the resolver tree's corresponding map
  *
  * @param node a lifecycle node containing the start and end events for a node
  * @param nodeMap a map of entity_ids to nodes to look for the passed in `node`
  */
-const expectLifecycleNodeInMap = (node: ResolverLifecycleNode, nodeMap: Map<string, TreeNode>) => {
+const expectLifecycleNodeInMap = (
+  node: SafeResolverLifecycleNode,
+  nodeMap: Map<string, TreeNode>
+) => {
   const genNode = nodeMap.get(node.entityID);
   expect(genNode).to.be.ok();
   compareArrays(genNode!.lifecycle, node.lifecycle, true);
@@ -44,7 +65,7 @@ const expectLifecycleNodeInMap = (node: ResolverLifecycleNode, nodeMap: Map<stri
  *  does not contain all the ancestors, the last one will not have the parent
  */
 export const verifyAncestry = (
-  ancestors: ResolverLifecycleNode[],
+  ancestors: SafeResolverLifecycleNode[],
   tree: Tree,
   verifyLastParent: boolean
 ) => {
@@ -52,7 +73,7 @@ export const verifyAncestry = (
   const groupedAncestors = _.groupBy(ancestors, (ancestor) => ancestor.entityID);
   // group by parent entity_id
   const groupedAncestorsParent = _.groupBy(ancestors, (ancestor) =>
-    parentEntityId(ancestor.lifecycle[0])
+    parentEntityIDSafeVersion(ancestor.lifecycle[0])
   );
   // make sure there aren't any nodes with the same entity_id
   expect(Object.keys(groupedAncestors).length).to.eql(ancestors.length);
@@ -69,7 +90,7 @@ export const verifyAncestry = (
   let foundParents = 0;
   let node = ancestors[0];
   for (let i = 0; i < ancestors.length; i++) {
-    const parentID = parentEntityId(node.lifecycle[0]);
+    const parentID = parentEntityIDSafeVersion(node.lifecycle[0]);
     if (parentID !== undefined) {
       const nextNode = groupedAncestors[parentID];
       if (!nextNode) {
@@ -95,12 +116,12 @@ export const verifyAncestry = (
  *
  * @param ancestors an array of ancestor nodes
  */
-export const retrieveDistantAncestor = (ancestors: ResolverLifecycleNode[]) => {
+export const retrieveDistantAncestor = (ancestors: SafeResolverLifecycleNode[]) => {
   // group the ancestors by their entity_id mapped to a lifecycle node
   const groupedAncestors = _.groupBy(ancestors, (ancestor) => ancestor.entityID);
   let node = ancestors[0];
   for (let i = 0; i < ancestors.length; i++) {
-    const parentID = parentEntityId(node.lifecycle[0]);
+    const parentID = parentEntityIDSafeVersion(node.lifecycle[0]);
     if (parentID !== undefined) {
       const nextNode = groupedAncestors[parentID];
       if (nextNode) {
@@ -122,7 +143,7 @@ export const retrieveDistantAncestor = (ancestors: ResolverLifecycleNode[]) => {
  * @param childrenPerParent an optional number to compare that there are a certain number of children for each parent
  */
 export const verifyChildren = (
-  children: ResolverChildNode[],
+  children: SafeResolverChildNode[],
   tree: Tree,
   numberOfParents?: number,
   childrenPerParent?: number
@@ -132,7 +153,9 @@ export const verifyChildren = (
   // make sure each child is unique
   expect(Object.keys(groupedChildren).length).to.eql(children.length);
   if (numberOfParents !== undefined) {
-    const groupParent = _.groupBy(children, (child) => parentEntityId(child.lifecycle[0]));
+    const groupParent = _.groupBy(children, (child) =>
+      parentEntityIDSafeVersion(child.lifecycle[0])
+    );
     expect(Object.keys(groupParent).length).to.eql(numberOfParents);
     if (childrenPerParent !== undefined) {
       Object.values(groupParent).forEach((childNodes) =>
@@ -155,7 +178,7 @@ export const verifyChildren = (
  */
 export const compareArrays = (
   expected: Event[],
-  toTest: ResolverEvent[],
+  toTest: SafeResolverEvent[],
   lengthCheck: boolean = false
 ) => {
   if (lengthCheck) {
@@ -168,7 +191,7 @@ export const compareArrays = (
         // we're only checking that the event ids are the same here. The reason we can't check the entire document
         // is because ingest pipelines are used to add fields to the document when it is received by elasticsearch,
         // therefore it will not be the same as the document created by the generator
-        return eventId(toTestEvent) === eventId(arrEvent);
+        return eventIDSafeVersion(toTestEvent) === eventIDSafeVersion(arrEvent);
       })
     ).to.be.ok();
   });
@@ -212,7 +235,7 @@ export const verifyStats = (
  * @param categories the related event info used when generating the resolver tree
  */
 export const verifyLifecycleStats = (
-  nodes: ResolverLifecycleNode[],
+  nodes: SafeResolverLifecycleNode[],
   categories: RelatedEventInfo[],
   relatedAlerts: number
 ) => {
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/entity_id.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/entity_id.ts
index cb6c49e17c712..e6d5e8fccd00d 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/entity_id.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/entity_id.ts
@@ -4,9 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
+import { entityIDSafeVersion } from '../../../../plugins/security_solution/common/endpoint/models/event';
 import { eventsIndexPattern } from '../../../../plugins/security_solution/common/endpoint/constants';
 import {
-  ResolverTree,
+  SafeResolverTree,
   ResolverEntityIndex,
 } from '../../../../plugins/security_solution/common/endpoint/types';
 import { FtrProviderContext } from '../../ftr_provider_context';
@@ -15,19 +16,26 @@ import {
   Event,
 } from '../../../../plugins/security_solution/common/endpoint/generate_data';
 import { InsertedEvents } from '../../services/resolver';
+import { createAncestryArray } from './common';
 
 export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const resolver = getService('resolverGenerator');
   const generator = new EndpointDocGenerator('resolver');
 
+  const setEntityIDEmptyString = (event: Event) => {
+    if (event.process?.entity_id) {
+      event.process.entity_id = '';
+    }
+  };
+
   describe('Resolver handling of entity ids', () => {
     describe('entity api', () => {
       let origin: Event;
       let genData: InsertedEvents;
       before(async () => {
         origin = generator.generateEvent({ parentEntityID: 'a' });
-        origin.process.entity_id = '';
+        setEntityIDEmptyString(origin);
         genData = await resolver.insertEvents([origin]);
       });
 
@@ -57,16 +65,16 @@ export default function ({ getService }: FtrProviderContext) {
         // should not be returned by the backend.
         origin = generator.generateEvent({ entityID: 'a' });
         childNoEntityID = generator.generateEvent({
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
         });
         // force it to be empty
-        childNoEntityID.process.entity_id = '';
+        setEntityIDEmptyString(childNoEntityID);
 
         childWithEntityID = generator.generateEvent({
           entityID: 'b',
-          parentEntityID: origin.process.entity_id,
-          ancestry: [origin.process.entity_id],
+          parentEntityID: entityIDSafeVersion(origin),
+          ancestry: createAncestryArray([origin]),
         });
         events = [origin, childNoEntityID, childWithEntityID];
         genData = await resolver.insertEvents(events);
@@ -77,11 +85,11 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('does not find children without a process entity_id', async () => {
-        const { body }: { body: ResolverTree } = await supertest
-          .get(`/api/endpoint/resolver/${origin.process.entity_id}`)
+        const { body }: { body: SafeResolverTree } = await supertest
+          .get(`/api/endpoint/resolver/${origin.process?.entity_id}`)
           .expect(200);
         expect(body.children.childNodes.length).to.be(1);
-        expect(body.children.childNodes[0].entityID).to.be(childWithEntityID.process.entity_id);
+        expect(body.children.childNodes[0].entityID).to.be(childWithEntityID.process?.entity_id);
       });
     });
 
@@ -101,21 +109,21 @@ export default function ({ getService }: FtrProviderContext) {
         });
         ancestor1 = generator.generateEvent({
           entityID: '1',
-          parentEntityID: ancestor2.process.entity_id,
-          ancestry: [ancestor2.process.entity_id],
+          parentEntityID: entityIDSafeVersion(ancestor2),
+          ancestry: createAncestryArray([ancestor2]),
         });
 
         // we'll insert an event that doesn't have an entity id so if the backend does search for it, it should be
         // returned and our test should fail
         ancestorNoEntityID = generator.generateEvent({
-          ancestry: [ancestor2.process.entity_id],
+          ancestry: createAncestryArray([ancestor2]),
         });
-        ancestorNoEntityID.process.entity_id = '';
+        setEntityIDEmptyString(ancestorNoEntityID);
 
         origin = generator.generateEvent({
           entityID: 'a',
-          parentEntityID: ancestor1.process.entity_id,
-          ancestry: ['', ancestor2.process.entity_id],
+          parentEntityID: entityIDSafeVersion(ancestor1),
+          ancestry: ['', ...createAncestryArray([ancestor2])],
         });
 
         events = [origin, ancestor1, ancestor2, ancestorNoEntityID];
@@ -127,11 +135,11 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('does not query for ancestors that have an empty string for the entity_id', async () => {
-        const { body }: { body: ResolverTree } = await supertest
-          .get(`/api/endpoint/resolver/${origin.process.entity_id}`)
+        const { body }: { body: SafeResolverTree } = await supertest
+          .get(`/api/endpoint/resolver/${origin.process?.entity_id}`)
           .expect(200);
         expect(body.ancestry.ancestors.length).to.be(1);
-        expect(body.ancestry.ancestors[0].entityID).to.be(ancestor2.process.entity_id);
+        expect(body.ancestry.ancestors[0].entityID).to.be(ancestor2.process?.entity_id);
       });
     });
   });
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts
index c0e4e466c7b62..4e248f52ec297 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/events.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
-import { eventId } from '../../../../plugins/security_solution/common/endpoint/models/event';
-import { ResolverRelatedEvents } from '../../../../plugins/security_solution/common/endpoint/types';
+import { eventIDSafeVersion } from '../../../../plugins/security_solution/common/endpoint/models/event';
+import { SafeResolverRelatedEvents } from '../../../../plugins/security_solution/common/endpoint/types';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import {
   Tree,
@@ -59,7 +59,7 @@ export default function ({ getService }: FtrProviderContext) {
       const cursor = 'eyJ0aW1lc3RhbXAiOjE1ODE0NTYyNTUwMDAsImV2ZW50SUQiOiI5NDA0MyJ9';
 
       it('should return details for the root node', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/${entityID}/events?legacyEndpointID=${endpointID}`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
@@ -69,7 +69,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('returns no values when there is no more data', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           // after is set to the document id of the last event so there shouldn't be any more after it
           .post(
             `/api/endpoint/resolver/${entityID}/events?legacyEndpointID=${endpointID}&afterEvent=${cursor}`
@@ -82,7 +82,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should return the first page of information when the cursor is invalid', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(
             `/api/endpoint/resolver/${entityID}/events?legacyEndpointID=${endpointID}&afterEvent=blah`
           )
@@ -93,7 +93,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should return no results for an invalid endpoint ID', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/${entityID}/events?legacyEndpointID=foo`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
@@ -120,7 +120,7 @@ export default function ({ getService }: FtrProviderContext) {
 
     describe('endpoint events', () => {
       it('should not find any events', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/5555/events`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
@@ -129,7 +129,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should return details for the root node', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/${tree.origin.id}/events`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
@@ -140,7 +140,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       it('should allow for the events to be filtered', async () => {
         const filter = `event.category:"${RelatedEventCategory.Driver}"`;
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/${tree.origin.id}/events`)
           .set('kbn-xsrf', 'xxx')
           .send({
@@ -156,7 +156,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should return paginated results for the root node', async () => {
-        let { body }: { body: ResolverRelatedEvents } = await supertest
+        let { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/${tree.origin.id}/events?events=2`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
@@ -185,7 +185,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should return the first page of information when the cursor is invalid', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/${tree.origin.id}/events?afterEvent=blah`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
@@ -195,7 +195,7 @@ export default function ({ getService }: FtrProviderContext) {
       });
 
       it('should sort the events in descending order', async () => {
-        const { body }: { body: ResolverRelatedEvents } = await supertest
+        const { body }: { body: SafeResolverRelatedEvents } = await supertest
           .post(`/api/endpoint/resolver/${tree.origin.id}/events`)
           .set('kbn-xsrf', 'xxx')
           .expect(200);
@@ -204,8 +204,8 @@ export default function ({ getService }: FtrProviderContext) {
         // the last element in the array so let's reverse it
         const relatedEvents = tree.origin.relatedEvents.reverse();
         for (let i = 0; i < body.events.length; i++) {
-          expect(body.events[i].event?.category).to.equal(relatedEvents[i].event.category);
-          expect(eventId(body.events[i])).to.equal(relatedEvents[i].event.id);
+          expect(body.events[i].event?.category).to.equal(relatedEvents[i].event?.category);
+          expect(eventIDSafeVersion(body.events[i])).to.equal(relatedEvents[i].event?.id);
         }
       });
     });
diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts
index 957d559087f5e..837af6a940f5c 100644
--- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts
@@ -5,12 +5,12 @@
  */
 import expect from '@kbn/expect';
 import {
-  ResolverAncestry,
-  ResolverChildren,
-  ResolverTree,
-  LegacyEndpointEvent,
+  SafeResolverAncestry,
+  SafeResolverChildren,
+  SafeResolverTree,
+  SafeLegacyEndpointEvent,
 } from '../../../../plugins/security_solution/common/endpoint/types';
-import { parentEntityId } from '../../../../plugins/security_solution/common/endpoint/models/event';
+import { parentEntityIDSafeVersion } from '../../../../plugins/security_solution/common/endpoint/models/event';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import {
   Tree,
@@ -71,7 +71,7 @@ export default function ({ getService }: FtrProviderContext) {
         const entityID = '94042';
 
         it('should return details for the root node', async () => {
-          const { body }: { body: ResolverAncestry } = await supertest
+          const { body }: { body: SafeResolverAncestry } = await supertest
             .get(
               `/api/endpoint/resolver/${entityID}/ancestry?legacyEndpointID=${endpointID}&ancestors=5`
             )
@@ -82,7 +82,7 @@ export default function ({ getService }: FtrProviderContext) {
         });
 
         it('should have a populated next parameter', async () => {
-          const { body }: { body: ResolverAncestry } = await supertest
+          const { body }: { body: SafeResolverAncestry } = await supertest
             .get(
               `/api/endpoint/resolver/${entityID}/ancestry?legacyEndpointID=${endpointID}&ancestors=0`
             )
@@ -91,7 +91,7 @@ export default function ({ getService }: FtrProviderContext) {
         });
 
         it('should handle an ancestors param request', async () => {
-          let { body }: { body: ResolverAncestry } = await supertest
+          let { body }: { body: SafeResolverAncestry } = await supertest
             .get(
               `/api/endpoint/resolver/${entityID}/ancestry?legacyEndpointID=${endpointID}&ancestors=0`
             )
@@ -110,14 +110,14 @@ export default function ({ getService }: FtrProviderContext) {
 
       describe('endpoint events', () => {
         it('should return the origin node at the front of the array', async () => {
-          const { body }: { body: ResolverAncestry } = await supertest
+          const { body }: { body: SafeResolverAncestry } = await supertest
             .get(`/api/endpoint/resolver/${tree.origin.id}/ancestry?ancestors=9`)
             .expect(200);
           expect(body.ancestors[0].entityID).to.eql(tree.origin.id);
         });
 
         it('should return details for the root node', async () => {
-          const { body }: { body: ResolverAncestry } = await supertest
+          const { body }: { body: SafeResolverAncestry } = await supertest
             .get(`/api/endpoint/resolver/${tree.origin.id}/ancestry?ancestors=9`)
             .expect(200);
           // the tree we generated had 5 ancestors + 1 origin node
@@ -128,7 +128,7 @@ export default function ({ getService }: FtrProviderContext) {
         });
 
         it('should handle an invalid id', async () => {
-          const { body }: { body: ResolverAncestry } = await supertest
+          const { body }: { body: SafeResolverAncestry } = await supertest
             .get(`/api/endpoint/resolver/alskdjflasj/ancestry`)
             .expect(200);
           expect(body.ancestors).to.be.empty();
@@ -136,18 +136,20 @@ export default function ({ getService }: FtrProviderContext) {
         });
 
         it('should have a populated next parameter', async () => {
-          const { body }: { body: ResolverAncestry } = await supertest
+          const { body }: { body: SafeResolverAncestry } = await supertest
             .get(`/api/endpoint/resolver/${tree.origin.id}/ancestry?ancestors=2`)
             .expect(200);
           // it should have 2 ancestors + 1 origin
           expect(body.ancestors.length).to.eql(3);
           verifyAncestry(body.ancestors, tree, false);
           const distantGrandparent = retrieveDistantAncestor(body.ancestors);
-          expect(body.nextAncestor).to.eql(parentEntityId(distantGrandparent.lifecycle[0]));
+          expect(body.nextAncestor).to.eql(
+            parentEntityIDSafeVersion(distantGrandparent.lifecycle[0])
+          );
         });
 
         it('should handle multiple ancestor requests', async () => {
-          let { body }: { body: ResolverAncestry } = await supertest
+          let { body }: { body: SafeResolverAncestry } = await supertest
             .get(`/api/endpoint/resolver/${tree.origin.id}/ancestry?ancestors=3`)
             .expect(200);
           expect(body.ancestors.length).to.eql(4);
@@ -171,7 +173,7 @@ export default function ({ getService }: FtrProviderContext) {
         const entityID = '94041';
 
         it('returns child process lifecycle events', async () => {
-          const { body }: { body: ResolverChildren } = await supertest
+          const { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/${entityID}/children?legacyEndpointID=${endpointID}`)
             .expect(200);
           expect(body.childNodes.length).to.eql(1);
@@ -179,12 +181,12 @@ export default function ({ getService }: FtrProviderContext) {
           expect(
             // for some reason the ts server doesn't think `endgame` exists even though we're using ResolverEvent
             // here, so to avoid it complaining we'll just force it
-            (body.childNodes[0].lifecycle[0] as LegacyEndpointEvent).endgame.unique_pid
+            (body.childNodes[0].lifecycle[0] as SafeLegacyEndpointEvent).endgame.unique_pid
           ).to.eql(94042);
         });
 
         it('returns multiple levels of child process lifecycle events', async () => {
-          const { body }: { body: ResolverChildren } = await supertest
+          const { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/93802/children?legacyEndpointID=${endpointID}&children=10`)
             .expect(200);
           expect(body.childNodes.length).to.eql(10);
@@ -193,12 +195,12 @@ export default function ({ getService }: FtrProviderContext) {
           expect(
             // for some reason the ts server doesn't think `endgame` exists even though we're using ResolverEvent
             // here, so to avoid it complaining we'll just force it
-            (body.childNodes[0].lifecycle[0] as LegacyEndpointEvent).endgame.unique_pid
+            (body.childNodes[0].lifecycle[0] as SafeLegacyEndpointEvent).endgame.unique_pid
           ).to.eql(93932);
         });
 
         it('returns no values when there is no more data', async () => {
-          let { body }: { body: ResolverChildren } = await supertest
+          let { body }: { body: SafeResolverChildren } = await supertest
             .get(
               // there should only be a single child for this node
               `/api/endpoint/resolver/94041/children?legacyEndpointID=${endpointID}&children=1`
@@ -216,7 +218,7 @@ export default function ({ getService }: FtrProviderContext) {
         });
 
         it('returns the first page of information when the cursor is invalid', async () => {
-          const { body }: { body: ResolverChildren } = await supertest
+          const { body }: { body: SafeResolverChildren } = await supertest
             .get(
               `/api/endpoint/resolver/${entityID}/children?legacyEndpointID=${endpointID}&afterChild=blah`
             )
@@ -236,7 +238,7 @@ export default function ({ getService }: FtrProviderContext) {
         });
 
         it('returns empty events without a matching entity id', async () => {
-          const { body }: { body: ResolverChildren } = await supertest
+          const { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/5555/children`)
             .expect(200);
           expect(body.nextChild).to.eql(null);
@@ -244,7 +246,7 @@ export default function ({ getService }: FtrProviderContext) {
         });
 
         it('returns empty events with an invalid endpoint id', async () => {
-          const { body }: { body: ResolverChildren } = await supertest
+          const { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/${entityID}/children?legacyEndpointID=foo`)
             .expect(200);
           expect(body.nextChild).to.eql(null);
@@ -254,7 +256,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       describe('endpoint events', () => {
         it('returns all children for the origin', async () => {
-          const { body }: { body: ResolverChildren } = await supertest
+          const { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/${tree.origin.id}/children?children=100`)
             .expect(200);
           // there are 2 levels in the children part of the tree and 3 nodes for each =
@@ -269,7 +271,7 @@ export default function ({ getService }: FtrProviderContext) {
           // this gets a node should have 3 children which were created in succession so that the timestamps
           // are ordered correctly to be retrieved in a single call
           const distantChildEntityID = Array.from(tree.childrenLevels[0].values())[0].id;
-          const { body }: { body: ResolverChildren } = await supertest
+          const { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/${distantChildEntityID}/children?children=3`)
             .expect(200);
           expect(body.childNodes.length).to.eql(3);
@@ -281,7 +283,7 @@ export default function ({ getService }: FtrProviderContext) {
           // this gets a node should have 3 children which were created in succession so that the timestamps
           // are ordered correctly to be retrieved in a single call
           const distantChildEntityID = Array.from(tree.childrenLevels[0].values())[0].id;
-          let { body }: { body: ResolverChildren } = await supertest
+          let { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/${distantChildEntityID}/children?children=1`)
             .expect(200);
           expect(body.childNodes.length).to.eql(1);
@@ -308,7 +310,7 @@ export default function ({ getService }: FtrProviderContext) {
 
         it('gets all children in two queries', async () => {
           // should get all the children of the origin
-          let { body }: { body: ResolverChildren } = await supertest
+          let { body }: { body: SafeResolverChildren } = await supertest
             .get(`/api/endpoint/resolver/${tree.origin.id}/children?children=3`)
             .expect(200);
           expect(body.childNodes.length).to.eql(3);
@@ -334,7 +336,7 @@ export default function ({ getService }: FtrProviderContext) {
         const endpointID = '5a0c957f-b8e7-4538-965e-57e8bb86ad3a';
 
         it('returns ancestors, events, children, and current process lifecycle', async () => {
-          const { body }: { body: ResolverTree } = await supertest
+          const { body }: { body: SafeResolverTree } = await supertest
             .get(`/api/endpoint/resolver/93933?legacyEndpointID=${endpointID}`)
             .expect(200);
           expect(body.ancestry.nextAncestor).to.equal(null);
@@ -348,7 +350,7 @@ export default function ({ getService }: FtrProviderContext) {
 
       describe('endpoint events', () => {
         it('returns a tree', async () => {
-          const { body }: { body: ResolverTree } = await supertest
+          const { body }: { body: SafeResolverTree } = await supertest
             .get(
               `/api/endpoint/resolver/${tree.origin.id}?children=100&ancestors=5&events=5&alerts=5`
             )
diff --git a/x-pack/test/security_solution_endpoint_api_int/services/resolver.ts b/x-pack/test/security_solution_endpoint_api_int/services/resolver.ts
index 7e4d4177affac..c5855281f55c9 100644
--- a/x-pack/test/security_solution_endpoint_api_int/services/resolver.ts
+++ b/x-pack/test/security_solution_endpoint_api_int/services/resolver.ts
@@ -9,6 +9,7 @@ import {
   EndpointDocGenerator,
   Event,
 } from '../../../plugins/security_solution/common/endpoint/generate_data';
+import { firstNonNullValue } from '../../../plugins/security_solution/common/endpoint/models/ecs_safety_helpers';
 import { FtrProviderContext } from '../ftr_provider_context';
 
 export const processEventsIndex = 'logs-endpoint.events.process-default';
@@ -87,7 +88,7 @@ export function ResolverGeneratorProvider({ getService }: FtrProviderContext) {
         const tree = generator.generateTree(options);
         const body = tree.allEvents.reduce((array: Array<BulkCreateHeader | Event>, doc) => {
           let index = eventsIndex;
-          if (doc.event.kind === 'alert') {
+          if (firstNonNullValue(doc.event?.kind) === 'alert') {
             index = alertsIndex;
           }
           /**