diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 03a4f9520c2ba..d81f6af4cec28 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -64,11 +64,12 @@
 /src/apm.js @watson @vigneshshanmugam
 
 # Client Side Monitoring (lives in APM directories but owned by Uptime)
-/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum @elastic/uptime
+/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm @elastic/uptime
 /x-pack/plugins/apm/public/application/csmApp.tsx @elastic/uptime
 /x-pack/plugins/apm/public/components/app/RumDashboard @elastic/uptime
 /x-pack/plugins/apm/server/lib/rum_client @elastic/uptime
 /x-pack/plugins/apm/server/routes/rum_client.ts @elastic/uptime
+/x-pack/plugins/apm/server/projections/rum_overview.ts @elastic/uptime
 
 # Beats
 /x-pack/legacy/plugins/beats_management/  @elastic/beats
@@ -129,6 +130,7 @@
 /packages/kbn-test/ @elastic/kibana-operations
 /packages/kbn-ui-shared-deps/ @elastic/kibana-operations
 /packages/kbn-es-archiver/ @elastic/kibana-operations
+/packages/kbn-utils/ @elastic/kibana-operations
 /src/legacy/server/keystore/ @elastic/kibana-operations
 /src/legacy/server/pid/ @elastic/kibana-operations
 /src/legacy/server/sass/ @elastic/kibana-operations
@@ -153,6 +155,7 @@
 /x-pack/plugins/cloud/ @elastic/kibana-platform
 /x-pack/test/saved_objects_field_count/ @elastic/kibana-platform
 /packages/kbn-config-schema/ @elastic/kibana-platform
+/packages/kbn-std/ @elastic/kibana-platform
 /src/legacy/server/config/ @elastic/kibana-platform
 /src/legacy/server/http/ @elastic/kibana-platform
 /src/legacy/server/logging/ @elastic/kibana-platform
@@ -294,6 +297,7 @@ x-pack/plugins/telemetry_collection_xpack/schema/xpack_plugins.json @elastic/kib
 /x-pack/plugins/infra/**/*.scss @elastic/observability-design
 /x-pack/plugins/ingest_manager/**/*.scss @elastic/observability-design
 /x-pack/plugins/observability/**/*.scss @elastic/observability-design
+/x-pack/plugins/monitoring/**/*.scss @elastic/observability-design 
 
 # Ent. Search design
 /x-pack/plugins/enterprise_search/**/*.scss @elastic/ent-search-design
diff --git a/docs/developer/best-practices/images/state_inside_the_link.png b/docs/developer/best-practices/images/state_inside_the_link.png
new file mode 100644
index 0000000000000..833478ccbda68
Binary files /dev/null and b/docs/developer/best-practices/images/state_inside_the_link.png differ
diff --git a/docs/developer/best-practices/index.asciidoc b/docs/developer/best-practices/index.asciidoc
index 42cee6ef0e58a..13ea010d0aa96 100644
--- a/docs/developer/best-practices/index.asciidoc
+++ b/docs/developer/best-practices/index.asciidoc
@@ -122,6 +122,14 @@ In addition, if users are relying on state stored in your app’s URL as
 part of your public contract, keep in mind that you may also need to
 provide backwards compatibility for bookmarked URLs.
 
+[discrete]
+=== Routing, Navigation and URL
+
+The {kib} platform provides a set of tools to help developers build consistent experience around routing and browser navigation.
+Some of that tooling is inside `core`, some is available as part of various plugins.
+
+<<kibana-navigation, Follow this guide>> to get an idea of available tools and common approaches for handling routing and browser navigation.
+
 [discrete]
 === Testing & stability
 
@@ -131,6 +139,8 @@ Review:
 * <<stability>>
 * <<security-best-practices>>
 
+include::navigation.asciidoc[leveloffset=+1]
+
 include::stability.asciidoc[leveloffset=+1]
 
 include::security.asciidoc[leveloffset=+1]
diff --git a/docs/developer/best-practices/navigation.asciidoc b/docs/developer/best-practices/navigation.asciidoc
new file mode 100644
index 0000000000000..d01f2c2aa0f95
--- /dev/null
+++ b/docs/developer/best-practices/navigation.asciidoc
@@ -0,0 +1,226 @@
+[[kibana-navigation]]
+== Routing, Navigation and URL
+
+The {kib} platform provides a set of tools to help developers build consistent experience around routing and browser navigation.
+Some of that tooling is inside `core`, some is available as part of various plugins.
+
+The purpose of this guide is to give a high-level overview of available tools and to explain common approaches for handling routing and browser navigation.
+
+This guide covers following topics:
+
+* <<deep-linking>>
+* <<navigating-between-kibana-apps>>
+* <<routing>>
+* <<history-and-location>>
+* <<state-sync>>
+* <<preserve-state>>
+
+[[deep-linking]]
+=== Deep-linking into {kib} apps
+
+Assuming you want to link from your app to *Discover*. When building such URL there are two things to consider:
+
+1. Prepending a proper `basePath`.
+2. Specifying *Discover* state. 
+
+==== Prepending a proper `basePath`
+
+To prepend {kib}'s `basePath` use {kib-repo}tree/{branch}/docs/development/core/public/kibana-plugin-core-public.ibasepath.prepend.md[core.http.basePath.prepend] helper: 
+
+[source,typescript jsx]
+----
+const discoverUrl = core.http.basePath.prepend(`/discover`);
+
+console.log(discoverUrl); // http://localhost:5601/bpr/s/space/app/discover
+----
+
+==== Specifying state
+
+**Consider a {kib} app URL a part of app's plugin contract:**
+
+. Avoid hardcoding other app's URL in your app's code.
+. Avoid generating other app's state and serializing it into URL query params.
+
+[source,typescript jsx]
+----
+// Avoid relying on other app's state structure in your app's code:
+const discoverUrlWithSomeState = core.http.basePath.prepend(`/discover#/?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:'2020-09-10T11:39:50.203Z',to:'2020-09-10T11:40:20.249Z'))&_a=(columns:!(_source),filters:!(),index:'90943e30-9a47-11e8-b64d-95841ca0b247',interval:auto,query:(language:kuery,query:''),sort:!())`);
+----
+
+Instead, each app should expose {kib-repo}tree/{branch}/src/plugins/share/public/url_generators/README.md[a URL generator].
+Other apps should use those URL generators for creating URLs. 
+
+[source,typescript jsx]
+----
+// Properly generated URL to *Discover* app. Generator code is owned by *Discover* app and available on *Discover*'s plugin contract.
+const discoverUrl = discoverUrlGenerator.createUrl({filters, timeRange});
+----
+
+To get a better idea, take a look at *Discover* URL generator {kib-repo}tree/{branch}/src/plugins/discover/public/url_generator.ts[implementation].
+It allows specifying various **Discover** app state pieces like: index pattern, filters, query, time range and more.
+
+There are two ways to access other's app URL generator in your code:
+
+1. From a plugin contract of a destination app *(preferred)*. 
+2. Using URL generator service instance on `share` plugin contract (in case an explicit plugin dependency is not possible).
+
+In case you want other apps to link to your app, then you should create a URL generator and expose it on your plugin's contract.
+
+
+[[navigating-between-kibana-apps]]
+=== Navigating between {kib} apps
+
+{kib} is a single page application and there is a set of simple rules developers should follow
+to make sure there is no page reload when navigating from one place in {kib} to another. 
+
+For example, navigation using native browser APIs would cause a full page reload.  
+
+[source,js]
+----
+const urlToADashboard = core.http.basePath.prepend(`/dashboard/my-dashboard`);
+
+// this would cause a full page reload: 
+window.location.href = urlToADashboard; 
+----
+
+To navigate between different {kib} apps without a page reload there are APIs in `core`:
+
+* {kib-repo}tree/{branch}/docs/development/core/public/kibana-plugin-core-public.applicationstart.navigatetoapp.md[core.application.navigateToApp]
+* {kib-repo}tree/{branch}/docs/development/core/public/kibana-plugin-core-public.applicationstart.navigatetourl.md[core.application.navigateToUrl]
+
+*Rendering a link to a different {kib} app on its own would also cause a full page reload:*
+
+[source,typescript jsx]
+----
+const myLink = () => 
+  <a href={urlToADashboard}>Go to Dashboard</a>; 
+----
+
+A workaround could be to handle a click, prevent browser navigation and use `core.application.navigateToApp` API:
+
+[source,typescript jsx]
+----
+const MySPALink = () => 
+  <a 
+    href={urlToADashboard} 
+    onClick={(e) => {
+      e.preventDefault();
+      core.application.navigateToApp('dashboard', { path: '/my-dashboard' }); 
+    }}
+  > 
+    Go to Dashboard 
+  </a>;
+----
+
+As it would be too much boilerplate to do this for each {kib} link in your app, there is a handy wrapper that helps with it: 
+{kib-repo}tree/{branch}/src/plugins/kibana_react/public/app_links/redirect_app_link.tsx#L49[RedirectAppLinks].
+
+[source,typescript jsx]
+----
+const MyApp = () => 
+  <RedirectAppLinks application={core.application}>
+    {/*...*/}
+    {/* navigations using this link will happen in SPA friendly way */}
+      <a href={urlToADashboard}>Go to Dashboard</a>
+    {/*...*/}
+  </RedirectAppLinks>
+----
+
+[[routing]]
+=== Setting up internal app routing
+
+It is very common for {kib} apps to use React and React Router.
+Common rules to follow in this scenario:
+
+* Set up `BrowserRouter` and not `HashRouter`.
+* *Initialize your router with `history` instance provided by the `core`.*
+
+This is required to make sure `core` is aware of navigations triggered inside your app, so it could act accordingly when needed.
+
+* `Core`'s {kib-repo}tree/{branch}/docs/development/core/public/kibana-plugin-core-public.scopedhistory.md[ScopedHistory] instance.
+* {kib-repo}tree/{branch}/docs/development/core/public/kibana-plugin-core-public.appmountparameters.history.md[Example usage]
+* {kib-repo}tree/{branch}/test/plugin_functional/plugins/core_plugin_a/public/application.tsx#L120[Example plugin]
+
+Relative links will be resolved relative to your app's route (e.g.: `http://localhost5601/app/{your-app-id}`)
+and setting up internal links in your app in SPA friendly way would look something like:
+
+[source,typescript jsx]
+----
+import {Link} from 'react-router-dom';
+
+const MyInternalLink = () => <Link to="/my-other-page"></Link>
+----
+
+[[history-and-location]]
+=== Using history and browser location
+
+Try to avoid using `window.location` and `window.history` directly. +  
+Instead, consider using {kib-repo}tree/{branch}/docs/development/core/public/kibana-plugin-core-public.scopedhistory.md[ScopedHistory]
+instance provided by `core`.
+
+* This way `core` will know about location changes triggered within your app, and it would act accordingly.
+* Some plugins are listening to location changes. Triggering location change manually could lead to unpredictable and hard-to-catch bugs.
+
+Common use-case for using 
+`core`'s {kib-repo}tree/{branch}/docs/development/core/public/kibana-plugin-core-public.scopedhistory.md[ScopedHistory] directly: 
+
+* Reading/writing query params or hash.
+* Imperatively triggering internal navigations within your app.
+* Listening to browser location changes.
+
+
+[[state-sync]]
+=== Syncing state with URL 
+
+Historically {kib} apps store _a lot_ of application state in the URL.
+The most common pattern that {kib} apps follow today is storing state in `_a` and `_g` query params in https://github.com/w33ble/rison-node#readme[rison] format.
+[[query-params]]
+Those query params follow the convention: 
+
+* `_g` (*global*) - global UI state that should be shared and synced across multiple apps. common example from Analyze group apps: time range, refresh interval, *pinned* filters.
+* `_a` (*application*) - UI state scoped to current app.
+
+NOTE: After migrating to KP platform we got navigations without page reloads. Since then there is no real need to follow `_g` and `_a` separation anymore. It's up you to decide if you want to follow this pattern or if you prefer a single query param or something else. The need for this separation earlier is explained in <<preserve-state>>. 
+
+There are utils to help you to implement such kind of state syncing.
+
+**When you should consider using state syncing utils:**
+
+* You want to sync your application state with URL in similar manner Analyze group applications do.
+* You want to follow platform's <<history-and-location, working with browser history and location best practices>> out of the box. 
+* You want to support `state:storeInSessionStore` escape hatch for URL overflowing out of the box.
+* You should also consider using them if you'd like to serialize state to different (not `rison`) format. Utils are composable, and you can implement your own `storage`.
+* In case you want to sync part of your state with URL, but other part of it with browser storage. 
+
+**When you shouldn't use state syncing utils:**
+
+* Adding a query param flag or simple key/value to the URL. 
+
+Follow {kib-repo}tree/{branch}/src/plugins/kibana_utils/docs/state_sync#state-syncing-utilities[these] docs to learn more.
+
+
+[[preserve-state]]
+=== Preserving state between navigations
+
+Consider the scenario: 
+
+1. You are in *Dashboard* app looking at a dashboard with some filters applied;
+2. Navigate to *Discover* using in-app navigation;
+3. Change the time filter'
+4. Navigate to *Dashboard* using in-app navigation.
+
+You'd notice that you were navigated to *Dashboard* app with the *same state* that you left it with,
+except that the time filter has changed to the one you applied on *Discover* app.
+
+Historically {kib} Analyze groups apps achieve that behavior relying on state in the URL. 
+If you'd have a closer look on a link in the navigation,
+you'd notice that state is stored inside that link, and it also gets updated whenever relevant state changes happen:
+
+[role="screenshot"]
+image:images/state_inside_the_link.png[State is stored inside the navigation link]
+
+This is where <<query-params, separation>> into `_a` and `_g` query params comes into play. What is considered a *global* state gets constantly updated in those navigation links. In the example above it was a time filter.
+This is backed by {kib-repo}tree/{branch}/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.ts#L57[KbnUrlTracker] util. You can use it to achieve similar behavior.
+
+NOTE: After migrating to KP navigation works without page reloads and all plugins are loaded simultaneously.
+Hence, likely there are simpler ways to preserve state of your application, unless you want to do it through URL.
diff --git a/docs/developer/plugin/external-plugin-functional-tests.asciidoc b/docs/developer/plugin/external-plugin-functional-tests.asciidoc
index 7e5b5b79d06e9..b39d576d85268 100644
--- a/docs/developer/plugin/external-plugin-functional-tests.asciidoc
+++ b/docs/developer/plugin/external-plugin-functional-tests.asciidoc
@@ -13,7 +13,7 @@ To get started copy and paste this example to `test/functional/config.js`:
 ["source","js"]
 -----------
 import { resolve } from 'path';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { MyServiceProvider } from './services/my_service';
 import { MyAppPageProvider } from './services/my_app_page';
diff --git a/docs/development/core/public/kibana-plugin-core-public.assertnever.md b/docs/development/core/public/kibana-plugin-core-public.assertnever.md
deleted file mode 100644
index 8fefd4450d49b..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.assertnever.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [assertNever](./kibana-plugin-core-public.assertnever.md)
-
-## assertNever() function
-
-Can be used in switch statements to ensure we perform exhaustive checks, see https://www.typescriptlang.org/docs/handbook/advanced-types.html\#exhaustiveness-checking
-
-<b>Signature:</b>
-
-```typescript
-export declare function assertNever(x: never): never;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  x | <code>never</code> |  |
-
-<b>Returns:</b>
-
-`never`
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.deepfreeze.md b/docs/development/core/public/kibana-plugin-core-public.deepfreeze.md
deleted file mode 100644
index 7c879b659a852..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.deepfreeze.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [deepFreeze](./kibana-plugin-core-public.deepfreeze.md)
-
-## deepFreeze() function
-
-Apply Object.freeze to a value recursively and convert the return type to Readonly variant recursively
-
-<b>Signature:</b>
-
-```typescript
-export declare function deepFreeze<T extends Freezable>(object: T): RecursiveReadonly<T>;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  object | <code>T</code> |  |
-
-<b>Returns:</b>
-
-`RecursiveReadonly<T>`
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.freezable.md b/docs/development/core/public/kibana-plugin-core-public.freezable.md
deleted file mode 100644
index fee87dde25c28..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.freezable.md
+++ /dev/null
@@ -1,14 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [Freezable](./kibana-plugin-core-public.freezable.md)
-
-## Freezable type
-
-
-<b>Signature:</b>
-
-```typescript
-export declare type Freezable = {
-    [k: string]: any;
-} | any[];
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.getflattenedobject.md b/docs/development/core/public/kibana-plugin-core-public.getflattenedobject.md
deleted file mode 100644
index 3ef9b6bf703eb..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.getflattenedobject.md
+++ /dev/null
@@ -1,30 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [getFlattenedObject](./kibana-plugin-core-public.getflattenedobject.md)
-
-## getFlattenedObject() function
-
-Flattens a deeply nested object to a map of dot-separated paths pointing to all primitive values \*\*and arrays\*\* from `rootValue`<!-- -->.
-
-example: getFlattenedObject(<!-- -->{ a: { b: 1, c: \[2,3\] } }<!-- -->) // =<!-- -->&gt; { 'a.b': 1, 'a.c': \[2,3\] }
-
-<b>Signature:</b>
-
-```typescript
-export declare function getFlattenedObject(rootValue: Record<string, any>): {
-    [key: string]: any;
-};
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  rootValue | <code>Record&lt;string, any&gt;</code> |  |
-
-<b>Returns:</b>
-
-`{
-    [key: string]: any;
-}`
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.isrelativeurl.md b/docs/development/core/public/kibana-plugin-core-public.isrelativeurl.md
deleted file mode 100644
index 3c2ffa6340a97..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.isrelativeurl.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [isRelativeUrl](./kibana-plugin-core-public.isrelativeurl.md)
-
-## isRelativeUrl() function
-
-Determine if a url is relative. Any url including a protocol, hostname, or port is not considered relative. This means that absolute \*paths\* are considered to be relative \*urls\*
-
-<b>Signature:</b>
-
-```typescript
-export declare function isRelativeUrl(candidatePath: string): boolean;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  candidatePath | <code>string</code> |  |
-
-<b>Returns:</b>
-
-`boolean`
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.md b/docs/development/core/public/kibana-plugin-core-public.md
index 08b12190ef638..f2bf72a597656 100644
--- a/docs/development/core/public/kibana-plugin-core-public.md
+++ b/docs/development/core/public/kibana-plugin-core-public.md
@@ -27,16 +27,6 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [AppNavLinkStatus](./kibana-plugin-core-public.appnavlinkstatus.md) | Status of the application's navLink. |
 |  [AppStatus](./kibana-plugin-core-public.appstatus.md) | Accessibility status of an application. |
 
-## Functions
-
-|  Function | Description |
-|  --- | --- |
-|  [assertNever(x)](./kibana-plugin-core-public.assertnever.md) | Can be used in switch statements to ensure we perform exhaustive checks, see https://www.typescriptlang.org/docs/handbook/advanced-types.html\#exhaustiveness-checking |
-|  [deepFreeze(object)](./kibana-plugin-core-public.deepfreeze.md) | Apply Object.freeze to a value recursively and convert the return type to Readonly variant recursively |
-|  [getFlattenedObject(rootValue)](./kibana-plugin-core-public.getflattenedobject.md) | Flattens a deeply nested object to a map of dot-separated paths pointing to all primitive values \*\*and arrays\*\* from <code>rootValue</code>.<!-- -->example: getFlattenedObject(<!-- -->{ a: { b: 1, c: \[2,3\] } }<!-- -->) // =<!-- -->&gt; { 'a.b': 1, 'a.c': \[2,3\] } |
-|  [isRelativeUrl(candidatePath)](./kibana-plugin-core-public.isrelativeurl.md) | Determine if a url is relative. Any url including a protocol, hostname, or port is not considered relative. This means that absolute \*paths\* are considered to be relative \*urls\* |
-|  [modifyUrl(url, urlModifier)](./kibana-plugin-core-public.modifyurl.md) | Takes a URL and a function that takes the meaningful parts of the URL as a key-value object, modifies some or all of the parts, and returns the modified parts formatted again as a url.<!-- -->Url Parts sent: - protocol - slashes (does the url have the //) - auth - hostname (just the name of the host, no port or auth information) - port - pathname (the path after the hostname, no query or hash, starts with a slash if there was a path) - query (always an object, even when no query on original url) - hash<!-- -->Why? - The default url library in node produces several conflicting properties on the "parsed" output. Modifying any of these might lead to the modifications being ignored (depending on which property was modified) - It's not always clear whether to use path/pathname, host/hostname, so this tries to add helpful constraints |
-
 ## Interfaces
 
 |  Interface | Description |
@@ -128,7 +118,6 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [ToastOptions](./kibana-plugin-core-public.toastoptions.md) | Options available for [IToasts](./kibana-plugin-core-public.itoasts.md) APIs. |
 |  [UiSettingsParams](./kibana-plugin-core-public.uisettingsparams.md) | UiSettings parameters defined by the plugins. |
 |  [UiSettingsState](./kibana-plugin-core-public.uisettingsstate.md) |  |
-|  [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) | We define our own typings because the current version of @<!-- -->types/node declares properties to be optional "hostname?: string". Although, parse call returns "hostname: null \| string". |
 |  [UserProvidedValues](./kibana-plugin-core-public.userprovidedvalues.md) | Describes the values explicitly set by user. |
 
 ## Variables
@@ -156,7 +145,6 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [ChromeHelpExtensionMenuLink](./kibana-plugin-core-public.chromehelpextensionmenulink.md) |  |
 |  [ChromeNavLinkUpdateableFields](./kibana-plugin-core-public.chromenavlinkupdateablefields.md) |  |
 |  [FatalErrorsStart](./kibana-plugin-core-public.fatalerrorsstart.md) | FatalErrors stop the Kibana Public Core and displays a fatal error screen with details about the Kibana build and the error. |
-|  [Freezable](./kibana-plugin-core-public.freezable.md) |  |
 |  [HandlerContextType](./kibana-plugin-core-public.handlercontexttype.md) | Extracts the type of the first argument of a [HandlerFunction](./kibana-plugin-core-public.handlerfunction.md) to represent the type of the context. |
 |  [HandlerFunction](./kibana-plugin-core-public.handlerfunction.md) | A function that accepts a context object and an optional number of additional arguments. Used for the generic types in [IContextContainer](./kibana-plugin-core-public.icontextcontainer.md) |
 |  [HandlerParameters](./kibana-plugin-core-public.handlerparameters.md) | Extracts the types of the additional arguments of a [HandlerFunction](./kibana-plugin-core-public.handlerfunction.md)<!-- -->, excluding the [HandlerContextType](./kibana-plugin-core-public.handlercontexttype.md)<!-- -->. |
diff --git a/docs/development/core/public/kibana-plugin-core-public.modifyurl.md b/docs/development/core/public/kibana-plugin-core-public.modifyurl.md
deleted file mode 100644
index b174f733a5c64..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.modifyurl.md
+++ /dev/null
@@ -1,31 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [modifyUrl](./kibana-plugin-core-public.modifyurl.md)
-
-## modifyUrl() function
-
-Takes a URL and a function that takes the meaningful parts of the URL as a key-value object, modifies some or all of the parts, and returns the modified parts formatted again as a url.
-
-Url Parts sent: - protocol - slashes (does the url have the //) - auth - hostname (just the name of the host, no port or auth information) - port - pathname (the path after the hostname, no query or hash, starts with a slash if there was a path) - query (always an object, even when no query on original url) - hash
-
-Why? - The default url library in node produces several conflicting properties on the "parsed" output. Modifying any of these might lead to the modifications being ignored (depending on which property was modified) - It's not always clear whether to use path/pathname, host/hostname, so this tries to add helpful constraints
-
-<b>Signature:</b>
-
-```typescript
-export declare function modifyUrl(url: string, urlModifier: (urlParts: URLMeaningfulParts) => Partial<URLMeaningfulParts> | void): string;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  url | <code>string</code> |  |
-|  urlModifier | <code>(urlParts: URLMeaningfulParts) =&gt; Partial&lt;URLMeaningfulParts&gt; &#124; void</code> |  |
-
-<b>Returns:</b>
-
-`string`
-
-The modified and reformatted url
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.auth.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.auth.md
deleted file mode 100644
index 238dd66885896..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.auth.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [auth](./kibana-plugin-core-public.urlmeaningfulparts.auth.md)
-
-## URLMeaningfulParts.auth property
-
-<b>Signature:</b>
-
-```typescript
-auth?: string | null;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.hash.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.hash.md
deleted file mode 100644
index 161e7dc7ebfae..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.hash.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [hash](./kibana-plugin-core-public.urlmeaningfulparts.hash.md)
-
-## URLMeaningfulParts.hash property
-
-<b>Signature:</b>
-
-```typescript
-hash?: string | null;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.hostname.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.hostname.md
deleted file mode 100644
index f1884718337b5..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.hostname.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [hostname](./kibana-plugin-core-public.urlmeaningfulparts.hostname.md)
-
-## URLMeaningfulParts.hostname property
-
-<b>Signature:</b>
-
-```typescript
-hostname?: string | null;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.md
deleted file mode 100644
index 2816d4c7df541..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.md
+++ /dev/null
@@ -1,27 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md)
-
-## URLMeaningfulParts interface
-
-We define our own typings because the current version of @<!-- -->types/node declares properties to be optional "hostname?: string". Although, parse call returns "hostname: null \| string".
-
-<b>Signature:</b>
-
-```typescript
-export interface URLMeaningfulParts 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [auth](./kibana-plugin-core-public.urlmeaningfulparts.auth.md) | <code>string &#124; null</code> |  |
-|  [hash](./kibana-plugin-core-public.urlmeaningfulparts.hash.md) | <code>string &#124; null</code> |  |
-|  [hostname](./kibana-plugin-core-public.urlmeaningfulparts.hostname.md) | <code>string &#124; null</code> |  |
-|  [pathname](./kibana-plugin-core-public.urlmeaningfulparts.pathname.md) | <code>string &#124; null</code> |  |
-|  [port](./kibana-plugin-core-public.urlmeaningfulparts.port.md) | <code>string &#124; null</code> |  |
-|  [protocol](./kibana-plugin-core-public.urlmeaningfulparts.protocol.md) | <code>string &#124; null</code> |  |
-|  [query](./kibana-plugin-core-public.urlmeaningfulparts.query.md) | <code>ParsedQuery</code> |  |
-|  [slashes](./kibana-plugin-core-public.urlmeaningfulparts.slashes.md) | <code>boolean &#124; null</code> |  |
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.pathname.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.pathname.md
deleted file mode 100644
index 5ad21f004481c..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.pathname.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [pathname](./kibana-plugin-core-public.urlmeaningfulparts.pathname.md)
-
-## URLMeaningfulParts.pathname property
-
-<b>Signature:</b>
-
-```typescript
-pathname?: string | null;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.port.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.port.md
deleted file mode 100644
index 2e70da2f17421..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.port.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [port](./kibana-plugin-core-public.urlmeaningfulparts.port.md)
-
-## URLMeaningfulParts.port property
-
-<b>Signature:</b>
-
-```typescript
-port?: string | null;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.protocol.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.protocol.md
deleted file mode 100644
index cedc7f0b878e3..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.protocol.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [protocol](./kibana-plugin-core-public.urlmeaningfulparts.protocol.md)
-
-## URLMeaningfulParts.protocol property
-
-<b>Signature:</b>
-
-```typescript
-protocol?: string | null;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.query.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.query.md
deleted file mode 100644
index a9541efe0882a..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.query.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [query](./kibana-plugin-core-public.urlmeaningfulparts.query.md)
-
-## URLMeaningfulParts.query property
-
-<b>Signature:</b>
-
-```typescript
-query: ParsedQuery;
-```
diff --git a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.slashes.md b/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.slashes.md
deleted file mode 100644
index cb28a25f9e162..0000000000000
--- a/docs/development/core/public/kibana-plugin-core-public.urlmeaningfulparts.slashes.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-public.urlmeaningfulparts.md) &gt; [slashes](./kibana-plugin-core-public.urlmeaningfulparts.slashes.md)
-
-## URLMeaningfulParts.slashes property
-
-<b>Signature:</b>
-
-```typescript
-slashes?: boolean | null;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.assertnever.md b/docs/development/core/server/kibana-plugin-core-server.assertnever.md
deleted file mode 100644
index c13c88df9b9bf..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.assertnever.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [assertNever](./kibana-plugin-core-server.assertnever.md)
-
-## assertNever() function
-
-Can be used in switch statements to ensure we perform exhaustive checks, see https://www.typescriptlang.org/docs/handbook/advanced-types.html\#exhaustiveness-checking
-
-<b>Signature:</b>
-
-```typescript
-export declare function assertNever(x: never): never;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  x | <code>never</code> |  |
-
-<b>Returns:</b>
-
-`never`
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.deepfreeze.md b/docs/development/core/server/kibana-plugin-core-server.deepfreeze.md
deleted file mode 100644
index 946050bff0585..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.deepfreeze.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [deepFreeze](./kibana-plugin-core-server.deepfreeze.md)
-
-## deepFreeze() function
-
-Apply Object.freeze to a value recursively and convert the return type to Readonly variant recursively
-
-<b>Signature:</b>
-
-```typescript
-export declare function deepFreeze<T extends Freezable>(object: T): RecursiveReadonly<T>;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  object | <code>T</code> |  |
-
-<b>Returns:</b>
-
-`RecursiveReadonly<T>`
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.freezable.md b/docs/development/core/server/kibana-plugin-core-server.freezable.md
deleted file mode 100644
index 32ba89e8370c1..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.freezable.md
+++ /dev/null
@@ -1,14 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [Freezable](./kibana-plugin-core-server.freezable.md)
-
-## Freezable type
-
-
-<b>Signature:</b>
-
-```typescript
-export declare type Freezable = {
-    [k: string]: any;
-} | any[];
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.getflattenedobject.md b/docs/development/core/server/kibana-plugin-core-server.getflattenedobject.md
deleted file mode 100644
index 2e7850ca579f6..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.getflattenedobject.md
+++ /dev/null
@@ -1,30 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [getFlattenedObject](./kibana-plugin-core-server.getflattenedobject.md)
-
-## getFlattenedObject() function
-
-Flattens a deeply nested object to a map of dot-separated paths pointing to all primitive values \*\*and arrays\*\* from `rootValue`<!-- -->.
-
-example: getFlattenedObject(<!-- -->{ a: { b: 1, c: \[2,3\] } }<!-- -->) // =<!-- -->&gt; { 'a.b': 1, 'a.c': \[2,3\] }
-
-<b>Signature:</b>
-
-```typescript
-export declare function getFlattenedObject(rootValue: Record<string, any>): {
-    [key: string]: any;
-};
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  rootValue | <code>Record&lt;string, any&gt;</code> |  |
-
-<b>Returns:</b>
-
-`{
-    [key: string]: any;
-}`
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.isrelativeurl.md b/docs/development/core/server/kibana-plugin-core-server.isrelativeurl.md
deleted file mode 100644
index bff9eb05419be..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.isrelativeurl.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [isRelativeUrl](./kibana-plugin-core-server.isrelativeurl.md)
-
-## isRelativeUrl() function
-
-Determine if a url is relative. Any url including a protocol, hostname, or port is not considered relative. This means that absolute \*paths\* are considered to be relative \*urls\*
-
-<b>Signature:</b>
-
-```typescript
-export declare function isRelativeUrl(candidatePath: string): boolean;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  candidatePath | <code>string</code> |  |
-
-<b>Returns:</b>
-
-`boolean`
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.md b/docs/development/core/server/kibana-plugin-core-server.md
index c16600d1d0492..30b98b9f0553e 100644
--- a/docs/development/core/server/kibana-plugin-core-server.md
+++ b/docs/development/core/server/kibana-plugin-core-server.md
@@ -42,13 +42,8 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 
 |  Function | Description |
 |  --- | --- |
-|  [assertNever(x)](./kibana-plugin-core-server.assertnever.md) | Can be used in switch statements to ensure we perform exhaustive checks, see https://www.typescriptlang.org/docs/handbook/advanced-types.html\#exhaustiveness-checking |
-|  [deepFreeze(object)](./kibana-plugin-core-server.deepfreeze.md) | Apply Object.freeze to a value recursively and convert the return type to Readonly variant recursively |
 |  [exportSavedObjectsToStream({ types, objects, search, savedObjectsClient, exportSizeLimit, includeReferencesDeep, excludeExportDetails, namespace, })](./kibana-plugin-core-server.exportsavedobjectstostream.md) | Generates sorted saved object stream to be used for export. See the [options](./kibana-plugin-core-server.savedobjectsexportoptions.md) for more detailed information. |
-|  [getFlattenedObject(rootValue)](./kibana-plugin-core-server.getflattenedobject.md) | Flattens a deeply nested object to a map of dot-separated paths pointing to all primitive values \*\*and arrays\*\* from <code>rootValue</code>.<!-- -->example: getFlattenedObject(<!-- -->{ a: { b: 1, c: \[2,3\] } }<!-- -->) // =<!-- -->&gt; { 'a.b': 1, 'a.c': \[2,3\] } |
 |  [importSavedObjectsFromStream({ readStream, objectLimit, overwrite, createNewCopies, savedObjectsClient, typeRegistry, namespace, })](./kibana-plugin-core-server.importsavedobjectsfromstream.md) | Import saved objects from given stream. See the [options](./kibana-plugin-core-server.savedobjectsimportoptions.md) for more detailed information. |
-|  [isRelativeUrl(candidatePath)](./kibana-plugin-core-server.isrelativeurl.md) | Determine if a url is relative. Any url including a protocol, hostname, or port is not considered relative. This means that absolute \*paths\* are considered to be relative \*urls\* |
-|  [modifyUrl(url, urlModifier)](./kibana-plugin-core-server.modifyurl.md) | Takes a URL and a function that takes the meaningful parts of the URL as a key-value object, modifies some or all of the parts, and returns the modified parts formatted again as a url.<!-- -->Url Parts sent: - protocol - slashes (does the url have the //) - auth - hostname (just the name of the host, no port or auth information) - port - pathname (the path after the hostname, no query or hash, starts with a slash if there was a path) - query (always an object, even when no query on original url) - hash<!-- -->Why? - The default url library in node produces several conflicting properties on the "parsed" output. Modifying any of these might lead to the modifications being ignored (depending on which property was modified) - It's not always clear whether to use path/pathname, host/hostname, so this tries to add helpful constraints |
 |  [resolveSavedObjectsImportErrors({ readStream, objectLimit, retries, savedObjectsClient, typeRegistry, namespace, createNewCopies, })](./kibana-plugin-core-server.resolvesavedobjectsimporterrors.md) | Resolve and return saved object import errors. See the [options](./kibana-plugin-core-server.savedobjectsresolveimporterrorsoptions.md) for more detailed informations. |
 
 ## Interfaces
@@ -217,7 +212,6 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [UiSettingsParams](./kibana-plugin-core-server.uisettingsparams.md) | UiSettings parameters defined by the plugins. |
 |  [UiSettingsServiceSetup](./kibana-plugin-core-server.uisettingsservicesetup.md) |  |
 |  [UiSettingsServiceStart](./kibana-plugin-core-server.uisettingsservicestart.md) |  |
-|  [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) | We define our own typings because the current version of @<!-- -->types/node declares properties to be optional "hostname?: string". Although, parse call returns "hostname: null \| string". |
 |  [UserProvidedValues](./kibana-plugin-core-server.userprovidedvalues.md) | Describes the values explicitly set by user. |
 
 ## Variables
@@ -246,7 +240,6 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [DestructiveRouteMethod](./kibana-plugin-core-server.destructiveroutemethod.md) | Set of HTTP methods changing the state of the server. |
 |  [ElasticsearchClient](./kibana-plugin-core-server.elasticsearchclient.md) | Client used to query the elasticsearch cluster. |
 |  [ElasticsearchClientConfig](./kibana-plugin-core-server.elasticsearchclientconfig.md) | Configuration options to be used to create a [cluster client](./kibana-plugin-core-server.iclusterclient.md) using the [createClient API](./kibana-plugin-core-server.elasticsearchservicestart.createclient.md) |
-|  [Freezable](./kibana-plugin-core-server.freezable.md) |  |
 |  [GetAuthHeaders](./kibana-plugin-core-server.getauthheaders.md) | Get headers to authenticate a user against Elasticsearch. |
 |  [GetAuthState](./kibana-plugin-core-server.getauthstate.md) | Gets authentication state for a request. Returned by <code>auth</code> interceptor. |
 |  [HandlerContextType](./kibana-plugin-core-server.handlercontexttype.md) | Extracts the type of the first argument of a [HandlerFunction](./kibana-plugin-core-server.handlerfunction.md) to represent the type of the context. |
diff --git a/docs/development/core/server/kibana-plugin-core-server.modifyurl.md b/docs/development/core/server/kibana-plugin-core-server.modifyurl.md
deleted file mode 100644
index fc0bc354a3ca3..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.modifyurl.md
+++ /dev/null
@@ -1,31 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [modifyUrl](./kibana-plugin-core-server.modifyurl.md)
-
-## modifyUrl() function
-
-Takes a URL and a function that takes the meaningful parts of the URL as a key-value object, modifies some or all of the parts, and returns the modified parts formatted again as a url.
-
-Url Parts sent: - protocol - slashes (does the url have the //) - auth - hostname (just the name of the host, no port or auth information) - port - pathname (the path after the hostname, no query or hash, starts with a slash if there was a path) - query (always an object, even when no query on original url) - hash
-
-Why? - The default url library in node produces several conflicting properties on the "parsed" output. Modifying any of these might lead to the modifications being ignored (depending on which property was modified) - It's not always clear whether to use path/pathname, host/hostname, so this tries to add helpful constraints
-
-<b>Signature:</b>
-
-```typescript
-export declare function modifyUrl(url: string, urlModifier: (urlParts: URLMeaningfulParts) => Partial<URLMeaningfulParts> | void): string;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  url | <code>string</code> |  |
-|  urlModifier | <code>(urlParts: URLMeaningfulParts) =&gt; Partial&lt;URLMeaningfulParts&gt; &#124; void</code> |  |
-
-<b>Returns:</b>
-
-`string`
-
-The modified and reformatted url
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.auth.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.auth.md
deleted file mode 100644
index 0422738669a70..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.auth.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [auth](./kibana-plugin-core-server.urlmeaningfulparts.auth.md)
-
-## URLMeaningfulParts.auth property
-
-<b>Signature:</b>
-
-```typescript
-auth?: string | null;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.hash.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.hash.md
deleted file mode 100644
index 13a3f4a9c95c8..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.hash.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [hash](./kibana-plugin-core-server.urlmeaningfulparts.hash.md)
-
-## URLMeaningfulParts.hash property
-
-<b>Signature:</b>
-
-```typescript
-hash?: string | null;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.hostname.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.hostname.md
deleted file mode 100644
index 6631f6f6744c5..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.hostname.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [hostname](./kibana-plugin-core-server.urlmeaningfulparts.hostname.md)
-
-## URLMeaningfulParts.hostname property
-
-<b>Signature:</b>
-
-```typescript
-hostname?: string | null;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.md
deleted file mode 100644
index 257f7b4b634ab..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.md
+++ /dev/null
@@ -1,27 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md)
-
-## URLMeaningfulParts interface
-
-We define our own typings because the current version of @<!-- -->types/node declares properties to be optional "hostname?: string". Although, parse call returns "hostname: null \| string".
-
-<b>Signature:</b>
-
-```typescript
-export interface URLMeaningfulParts 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [auth](./kibana-plugin-core-server.urlmeaningfulparts.auth.md) | <code>string &#124; null</code> |  |
-|  [hash](./kibana-plugin-core-server.urlmeaningfulparts.hash.md) | <code>string &#124; null</code> |  |
-|  [hostname](./kibana-plugin-core-server.urlmeaningfulparts.hostname.md) | <code>string &#124; null</code> |  |
-|  [pathname](./kibana-plugin-core-server.urlmeaningfulparts.pathname.md) | <code>string &#124; null</code> |  |
-|  [port](./kibana-plugin-core-server.urlmeaningfulparts.port.md) | <code>string &#124; null</code> |  |
-|  [protocol](./kibana-plugin-core-server.urlmeaningfulparts.protocol.md) | <code>string &#124; null</code> |  |
-|  [query](./kibana-plugin-core-server.urlmeaningfulparts.query.md) | <code>ParsedQuery</code> |  |
-|  [slashes](./kibana-plugin-core-server.urlmeaningfulparts.slashes.md) | <code>boolean &#124; null</code> |  |
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.pathname.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.pathname.md
deleted file mode 100644
index 8fee8c8e146ca..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.pathname.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [pathname](./kibana-plugin-core-server.urlmeaningfulparts.pathname.md)
-
-## URLMeaningfulParts.pathname property
-
-<b>Signature:</b>
-
-```typescript
-pathname?: string | null;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.port.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.port.md
deleted file mode 100644
index dcf3517d92ba2..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.port.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [port](./kibana-plugin-core-server.urlmeaningfulparts.port.md)
-
-## URLMeaningfulParts.port property
-
-<b>Signature:</b>
-
-```typescript
-port?: string | null;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.protocol.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.protocol.md
deleted file mode 100644
index 914dcd4e8a8a5..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.protocol.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [protocol](./kibana-plugin-core-server.urlmeaningfulparts.protocol.md)
-
-## URLMeaningfulParts.protocol property
-
-<b>Signature:</b>
-
-```typescript
-protocol?: string | null;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.query.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.query.md
deleted file mode 100644
index 358adcfd3d180..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.query.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [query](./kibana-plugin-core-server.urlmeaningfulparts.query.md)
-
-## URLMeaningfulParts.query property
-
-<b>Signature:</b>
-
-```typescript
-query: ParsedQuery;
-```
diff --git a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.slashes.md b/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.slashes.md
deleted file mode 100644
index d5b598167f2f2..0000000000000
--- a/docs/development/core/server/kibana-plugin-core-server.urlmeaningfulparts.slashes.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [URLMeaningfulParts](./kibana-plugin-core-server.urlmeaningfulparts.md) &gt; [slashes](./kibana-plugin-core-server.urlmeaningfulparts.slashes.md)
-
-## URLMeaningfulParts.slashes property
-
-<b>Signature:</b>
-
-```typescript
-slashes?: boolean | null;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
index cf171d9ee9f37..e85747b8cc3d7 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinput.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-QueryStringInput: React.FC<Pick<Props, "query" | "prepend" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "isInvalid" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>
+QueryStringInput: React.FC<Pick<Props, "prepend" | "query" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "isInvalid" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.serialize.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.serialize.md
index 73ba8eb66040b..496e1ae9677d8 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.serialize.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.serialize.md
@@ -15,13 +15,13 @@ Using `createSearchSource`<!-- -->, the instance can be re-created.
 ```typescript
 serialize(): {
         searchSourceJSON: string;
-        references: import("../../../../../core/public").SavedObjectReference[];
+        references: import("../../../../../core/types").SavedObjectReference[];
     };
 ```
 <b>Returns:</b>
 
 `{
         searchSourceJSON: string;
-        references: import("../../../../../core/public").SavedObjectReference[];
+        references: import("../../../../../core/types").SavedObjectReference[];
     }`
 
diff --git a/package.json b/package.json
index 7468a49d56959..8994f327d3e65 100644
--- a/package.json
+++ b/package.json
@@ -141,6 +141,7 @@
     "@kbn/i18n": "1.0.0",
     "@kbn/interpreter": "1.0.0",
     "@kbn/pm": "1.0.0",
+    "@kbn/std": "1.0.0",
     "@kbn/telemetry-tools": "1.0.0",
     "@kbn/test-subj-selector": "0.2.1",
     "@kbn/ui-framework": "1.0.0",
@@ -290,6 +291,7 @@
     "@types/hoek": "^4.1.3",
     "@types/inert": "^5.1.2",
     "@types/jest": "^25.2.3",
+    "@types/jest-when": "^2.7.1",
     "@types/joi": "^13.4.2",
     "@types/jquery": "^3.3.31",
     "@types/js-yaml": "^3.11.1",
@@ -414,6 +416,7 @@
     "jest-cli": "^25.5.4",
     "jest-environment-jsdom-thirteen": "^1.0.1",
     "jest-raw-loader": "^1.0.1",
+    "jest-when": "^2.7.2",
     "jimp": "^0.14.0",
     "jquery": "^3.5.0",
     "js-levenshtein": "^1.1.6",
diff --git a/packages/kbn-dev-utils/package.json b/packages/kbn-dev-utils/package.json
index 4f6f995f38f31..a3fe8178822aa 100644
--- a/packages/kbn-dev-utils/package.json
+++ b/packages/kbn-dev-utils/package.json
@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@babel/core": "^7.11.1",
+    "@kbn/utils": "1.0.0",
     "axios": "^0.19.0",
     "chalk": "^4.1.0",
     "cheerio": "0.22.0",
diff --git a/packages/kbn-dev-utils/src/index.ts b/packages/kbn-dev-utils/src/index.ts
index 2871fe2ffcf4a..8217999b01128 100644
--- a/packages/kbn-dev-utils/src/index.ts
+++ b/packages/kbn-dev-utils/src/index.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+export { REPO_ROOT } from '@kbn/utils';
 export { withProcRunner, ProcRunner } from './proc_runner';
 export * from './tooling_log';
 export * from './serializers';
@@ -33,7 +34,6 @@ export {
   KBN_P12_PATH,
   KBN_P12_PASSWORD,
 } from './certs';
-export { REPO_ROOT } from './repo_root';
 export { KbnClient } from './kbn_client';
 export * from './run';
 export * from './axios';
diff --git a/packages/kbn-dev-utils/src/plugin_list/discover_plugins.ts b/packages/kbn-dev-utils/src/plugin_list/discover_plugins.ts
index 783d584656b17..5d92ddb600aa9 100644
--- a/packages/kbn-dev-utils/src/plugin_list/discover_plugins.ts
+++ b/packages/kbn-dev-utils/src/plugin_list/discover_plugins.ts
@@ -22,8 +22,8 @@ import Fs from 'fs';
 
 import MarkdownIt from 'markdown-it';
 import cheerio from 'cheerio';
+import { REPO_ROOT } from '@kbn/utils';
 
-import { REPO_ROOT } from '../repo_root';
 import { simpleKibanaPlatformPluginDiscovery } from '../simple_kibana_platform_plugin_discovery';
 import { extractAsciidocInfo } from './extract_asciidoc_info';
 
diff --git a/packages/kbn-dev-utils/src/plugin_list/generate_plugin_list.ts b/packages/kbn-dev-utils/src/plugin_list/generate_plugin_list.ts
index 43dac1cb7d418..e1a1323553113 100644
--- a/packages/kbn-dev-utils/src/plugin_list/generate_plugin_list.ts
+++ b/packages/kbn-dev-utils/src/plugin_list/generate_plugin_list.ts
@@ -20,8 +20,8 @@
 import Path from 'path';
 
 import normalizePath from 'normalize-path';
+import { REPO_ROOT } from '@kbn/utils';
 
-import { REPO_ROOT } from '../repo_root';
 import { Plugins } from './discover_plugins';
 
 function* printPlugins(plugins: Plugins, includes: string[]) {
diff --git a/packages/kbn-dev-utils/src/plugin_list/run_plugin_list_cli.ts b/packages/kbn-dev-utils/src/plugin_list/run_plugin_list_cli.ts
index 553eb1dd8afa0..613f9c9c26411 100644
--- a/packages/kbn-dev-utils/src/plugin_list/run_plugin_list_cli.ts
+++ b/packages/kbn-dev-utils/src/plugin_list/run_plugin_list_cli.ts
@@ -19,10 +19,9 @@
 
 import Path from 'path';
 import Fs from 'fs';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { run } from '../run';
-import { REPO_ROOT } from '../repo_root';
-
 import { discoverPlugins } from './discover_plugins';
 import { generatePluginList } from './generate_plugin_list';
 
diff --git a/packages/kbn-dev-utils/src/precommit_hook/cli.ts b/packages/kbn-dev-utils/src/precommit_hook/cli.ts
index a83e8c2b193d9..28347f379150f 100644
--- a/packages/kbn-dev-utils/src/precommit_hook/cli.ts
+++ b/packages/kbn-dev-utils/src/precommit_hook/cli.ts
@@ -20,9 +20,9 @@
 import Path from 'path';
 import { chmod, writeFile } from 'fs';
 import { promisify } from 'util';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { run } from '../run';
-import { REPO_ROOT } from '../repo_root';
 import { SCRIPT_SOURCE } from './script_source';
 import { getGitDir } from './get_git_dir';
 
diff --git a/packages/kbn-dev-utils/src/precommit_hook/get_git_dir.ts b/packages/kbn-dev-utils/src/precommit_hook/get_git_dir.ts
index 5ca7d67d0d4ea..f75c86f510095 100644
--- a/packages/kbn-dev-utils/src/precommit_hook/get_git_dir.ts
+++ b/packages/kbn-dev-utils/src/precommit_hook/get_git_dir.ts
@@ -19,7 +19,7 @@
 
 import execa from 'execa';
 
-import { REPO_ROOT } from '../repo_root';
+import { REPO_ROOT } from '@kbn/utils';
 
 // Retrieves the correct location for the .git dir for
 // every git setup (including git worktree)
diff --git a/packages/kbn-dev-utils/src/serializers/absolute_path_serializer.ts b/packages/kbn-dev-utils/src/serializers/absolute_path_serializer.ts
index 4008cf852c3a8..cc6b8334d76cf 100644
--- a/packages/kbn-dev-utils/src/serializers/absolute_path_serializer.ts
+++ b/packages/kbn-dev-utils/src/serializers/absolute_path_serializer.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { REPO_ROOT } from '../repo_root';
+import { REPO_ROOT } from '@kbn/utils';
 
 export function createAbsolutePathSerializer(
   rootPath: string = REPO_ROOT,
diff --git a/packages/kbn-optimizer/README.md b/packages/kbn-optimizer/README.md
index 13be836f0ea88..a666907f02678 100644
--- a/packages/kbn-optimizer/README.md
+++ b/packages/kbn-optimizer/README.md
@@ -69,7 +69,8 @@ To run the optimizer from code, you can import the [`OptimizerConfig`][Optimizer
 Example:
 ```ts
 import { runOptimizer, OptimizerConfig, logOptimizerState } from '@kbn/optimizer';
-import { REPO_ROOT, ToolingLog } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { ToolingLog } from '@kbn/dev-utils';
 
 const log = new ToolingLog({
   level: 'verbose',
diff --git a/packages/kbn-optimizer/src/cli.ts b/packages/kbn-optimizer/src/cli.ts
index 542dc7255f22f..dcfb56be66efd 100644
--- a/packages/kbn-optimizer/src/cli.ts
+++ b/packages/kbn-optimizer/src/cli.ts
@@ -21,7 +21,8 @@ import 'source-map-support/register';
 
 import Path from 'path';
 
-import { run, REPO_ROOT, createFlagError, CiStatsReporter } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { run, createFlagError, CiStatsReporter } from '@kbn/dev-utils';
 
 import { logOptimizerState } from './log_optimizer_state';
 import { OptimizerConfig } from './optimizer';
diff --git a/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts b/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts
index 12f037f5080fc..de3838eb92975 100644
--- a/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts
+++ b/packages/kbn-optimizer/src/integration_tests/basic_optimization.test.ts
@@ -25,7 +25,8 @@ import { inspect } from 'util';
 import cpy from 'cpy';
 import del from 'del';
 import { toArray, tap, filter } from 'rxjs/operators';
-import { ToolingLog, REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { ToolingLog } from '@kbn/dev-utils';
 import { runOptimizer, OptimizerConfig, OptimizerUpdate, logOptimizerState } from '@kbn/optimizer';
 
 const TMP_DIR = Path.resolve(__dirname, '../__fixtures__/__tmp__');
diff --git a/packages/kbn-optimizer/src/optimizer/cache_keys.test.ts b/packages/kbn-optimizer/src/optimizer/cache_keys.test.ts
index 47d01347a8f7d..1b4c9b117c4c3 100644
--- a/packages/kbn-optimizer/src/optimizer/cache_keys.test.ts
+++ b/packages/kbn-optimizer/src/optimizer/cache_keys.test.ts
@@ -20,7 +20,8 @@
 import Path from 'path';
 
 import jestDiff from 'jest-diff';
-import { REPO_ROOT, createAbsolutePathSerializer } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { createAbsolutePathSerializer } from '@kbn/dev-utils';
 
 import { reformatJestDiff, getOptimizerCacheKey, diffCacheKey } from './cache_keys';
 import { OptimizerConfig } from './optimizer_config';
diff --git a/packages/kbn-optimizer/src/optimizer/cache_keys.ts b/packages/kbn-optimizer/src/optimizer/cache_keys.ts
index d0aaad979485d..8dde67683a739 100644
--- a/packages/kbn-optimizer/src/optimizer/cache_keys.ts
+++ b/packages/kbn-optimizer/src/optimizer/cache_keys.ts
@@ -23,7 +23,7 @@ import { promisify } from 'util';
 
 import Chalk from 'chalk';
 import execa from 'execa';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import stripAnsi from 'strip-ansi';
 
 import jestDiff from 'jest-diff';
diff --git a/packages/kbn-optimizer/src/optimizer/handle_optimizer_completion.test.ts b/packages/kbn-optimizer/src/optimizer/handle_optimizer_completion.test.ts
index 3cc58e744a7b9..6edcde56e26de 100644
--- a/packages/kbn-optimizer/src/optimizer/handle_optimizer_completion.test.ts
+++ b/packages/kbn-optimizer/src/optimizer/handle_optimizer_completion.test.ts
@@ -18,7 +18,7 @@
  */
 
 import * as Rx from 'rxjs';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { Update } from '../common';
 
diff --git a/packages/kbn-optimizer/src/optimizer/optimizer_config.test.ts b/packages/kbn-optimizer/src/optimizer/optimizer_config.test.ts
index afc2dc8952c87..fd887e8c2c012 100644
--- a/packages/kbn-optimizer/src/optimizer/optimizer_config.test.ts
+++ b/packages/kbn-optimizer/src/optimizer/optimizer_config.test.ts
@@ -32,7 +32,8 @@ jest.mock('os', () => {
 });
 
 import Path from 'path';
-import { REPO_ROOT, createAbsolutePathSerializer } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { createAbsolutePathSerializer } from '@kbn/dev-utils';
 
 import { OptimizerConfig, ParsedOptions } from './optimizer_config';
 import { parseThemeTags } from '../common';
diff --git a/packages/kbn-plugin-generator/src/ask_questions.ts b/packages/kbn-plugin-generator/src/ask_questions.ts
index b598396187245..732e22b0e2225 100644
--- a/packages/kbn-plugin-generator/src/ask_questions.ts
+++ b/packages/kbn-plugin-generator/src/ask_questions.ts
@@ -19,7 +19,7 @@
 
 import Path from 'path';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import inquirer from 'inquirer';
 
 export interface Answers {
diff --git a/packages/kbn-plugin-generator/src/cli.ts b/packages/kbn-plugin-generator/src/cli.ts
index f6966a245e46f..14c910a943fd5 100644
--- a/packages/kbn-plugin-generator/src/cli.ts
+++ b/packages/kbn-plugin-generator/src/cli.ts
@@ -21,7 +21,8 @@ import Path from 'path';
 import Fs from 'fs';
 
 import execa from 'execa';
-import { REPO_ROOT, run, createFailError, createFlagError } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { run, createFailError, createFlagError } from '@kbn/dev-utils';
 
 import { snakeCase } from './casing';
 import { askQuestions, getDefaultAnswers } from './ask_questions';
diff --git a/packages/kbn-plugin-generator/src/integration_tests/generate_plugin.test.ts b/packages/kbn-plugin-generator/src/integration_tests/generate_plugin.test.ts
index b48113afc0ca7..25669b65e1ac9 100644
--- a/packages/kbn-plugin-generator/src/integration_tests/generate_plugin.test.ts
+++ b/packages/kbn-plugin-generator/src/integration_tests/generate_plugin.test.ts
@@ -21,7 +21,8 @@ import Path from 'path';
 
 import del from 'del';
 import execa from 'execa';
-import { REPO_ROOT, createAbsolutePathSerializer } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { createAbsolutePathSerializer } from '@kbn/dev-utils';
 import globby from 'globby';
 
 const GENERATED_DIR = Path.resolve(REPO_ROOT, `plugins`);
diff --git a/packages/kbn-plugin-generator/src/plugin_types.ts b/packages/kbn-plugin-generator/src/plugin_types.ts
index ae5201f4e8dbb..778e33353a2aa 100644
--- a/packages/kbn-plugin-generator/src/plugin_types.ts
+++ b/packages/kbn-plugin-generator/src/plugin_types.ts
@@ -19,7 +19,7 @@
 
 import Path from 'path';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 export interface PluginType {
   thirdParty: boolean;
diff --git a/packages/kbn-plugin-generator/src/render_template.ts b/packages/kbn-plugin-generator/src/render_template.ts
index 894088c119651..ecb168042b1c2 100644
--- a/packages/kbn-plugin-generator/src/render_template.ts
+++ b/packages/kbn-plugin-generator/src/render_template.ts
@@ -23,7 +23,8 @@ import { promisify } from 'util';
 
 import vfs from 'vinyl-fs';
 import prettier from 'prettier';
-import { REPO_ROOT, transformFileStream } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { transformFileStream } from '@kbn/dev-utils';
 import ejs from 'ejs';
 import { Minimatch } from 'minimatch';
 
diff --git a/packages/kbn-plugin-helpers/src/integration_tests/build.test.ts b/packages/kbn-plugin-helpers/src/integration_tests/build.test.ts
index be23d8dbde646..5c1ecc4ee4ee4 100644
--- a/packages/kbn-plugin-helpers/src/integration_tests/build.test.ts
+++ b/packages/kbn-plugin-helpers/src/integration_tests/build.test.ts
@@ -21,7 +21,8 @@ import Path from 'path';
 import Fs from 'fs';
 
 import execa from 'execa';
-import { createStripAnsiSerializer, REPO_ROOT, createReplaceSerializer } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { createStripAnsiSerializer, createReplaceSerializer } from '@kbn/dev-utils';
 import extract from 'extract-zip';
 import del from 'del';
 import globby from 'globby';
diff --git a/packages/kbn-plugin-helpers/src/load_kibana_platform_plugin.ts b/packages/kbn-plugin-helpers/src/load_kibana_platform_plugin.ts
index 8f48670e49de4..8ed20a26649e7 100644
--- a/packages/kbn-plugin-helpers/src/load_kibana_platform_plugin.ts
+++ b/packages/kbn-plugin-helpers/src/load_kibana_platform_plugin.ts
@@ -19,12 +19,8 @@
 
 import Path from 'path';
 
-import {
-  REPO_ROOT,
-  parseKibanaPlatformPlugin,
-  KibanaPlatformPlugin,
-  createFailError,
-} from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { parseKibanaPlatformPlugin, KibanaPlatformPlugin, createFailError } from '@kbn/dev-utils';
 
 export type Plugin = KibanaPlatformPlugin;
 
diff --git a/packages/kbn-plugin-helpers/src/tasks/optimize.ts b/packages/kbn-plugin-helpers/src/tasks/optimize.ts
index 6cfeda8b2d81b..fc1bf48cc0e36 100644
--- a/packages/kbn-plugin-helpers/src/tasks/optimize.ts
+++ b/packages/kbn-plugin-helpers/src/tasks/optimize.ts
@@ -21,7 +21,7 @@ import Fs from 'fs';
 import Path from 'path';
 import { promisify } from 'util';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import { OptimizerConfig, runOptimizer, logOptimizerState } from '@kbn/optimizer';
 
 import { BuildContext } from '../build_context';
diff --git a/packages/kbn-pm/package.json b/packages/kbn-pm/package.json
index 914ca2fd65fa2..1fb94e4c92ce1 100644
--- a/packages/kbn-pm/package.json
+++ b/packages/kbn-pm/package.json
@@ -66,6 +66,7 @@
     "write-pkg": "^4.0.0"
   },
   "dependencies": {
+    "@kbn/utils": "1.0.0",
     "tslib": "^2.0.0"
   }
 }
diff --git a/packages/kbn-release-notes/package.json b/packages/kbn-release-notes/package.json
index 12d0122f9a4d3..f8971fa02aa87 100644
--- a/packages/kbn-release-notes/package.json
+++ b/packages/kbn-release-notes/package.json
@@ -8,6 +8,7 @@
     "kbn:watch": "tsc --watch"
   },
   "dependencies": {
+    "@kbn/utils": "1.0.0",
     "@kbn/dev-utils": "1.0.0",
     "axios": "^0.19.2",
     "cheerio": "0.22.0",
diff --git a/packages/kbn-release-notes/src/cli.ts b/packages/kbn-release-notes/src/cli.ts
index 7dcfa38078391..dff59d79cb2b2 100644
--- a/packages/kbn-release-notes/src/cli.ts
+++ b/packages/kbn-release-notes/src/cli.ts
@@ -21,7 +21,8 @@ import Fs from 'fs';
 import Path from 'path';
 import { inspect } from 'util';
 
-import { run, createFlagError, createFailError, REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { run, createFlagError, createFailError } from '@kbn/dev-utils';
 
 import { FORMATS, SomeFormat } from './formats';
 import {
diff --git a/packages/kbn-std/README.md b/packages/kbn-std/README.md
new file mode 100644
index 0000000000000..dfd98287ada4b
--- /dev/null
+++ b/packages/kbn-std/README.md
@@ -0,0 +1,3 @@
+# `@kbn/std` — Kibana standard library
+
+This package is a set of utilities that can be used both on server-side and client-side.
\ No newline at end of file
diff --git a/packages/kbn-std/package.json b/packages/kbn-std/package.json
new file mode 100644
index 0000000000000..4c67706b45d27
--- /dev/null
+++ b/packages/kbn-std/package.json
@@ -0,0 +1,21 @@
+{
+  "name": "@kbn/std",
+  "main": "./target/index.js",
+  "types": "./target/index.d.ts",
+  "version": "1.0.0",
+  "license": "Apache-2.0",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "kbn:bootstrap": "yarn build"
+  },
+  "devDependencies": {
+    "typescript": "4.0.2",
+    "tsd": "^0.13.1"
+  },
+  "dependencies": {
+    "@kbn/utility-types": "1.0.0",
+    "lodash": "^4.17.15",
+    "query-string": "5.1.1"
+  }
+}
diff --git a/src/core/utils/__snapshots__/get.test.ts.snap b/packages/kbn-std/src/__snapshots__/get.test.ts.snap
similarity index 100%
rename from src/core/utils/__snapshots__/get.test.ts.snap
rename to packages/kbn-std/src/__snapshots__/get.test.ts.snap
diff --git a/src/core/utils/assert_never.ts b/packages/kbn-std/src/assert_never.ts
similarity index 100%
rename from src/core/utils/assert_never.ts
rename to packages/kbn-std/src/assert_never.ts
diff --git a/src/core/utils/deep_freeze.test.ts b/packages/kbn-std/src/deep_freeze.test.ts
similarity index 100%
rename from src/core/utils/deep_freeze.test.ts
rename to packages/kbn-std/src/deep_freeze.test.ts
diff --git a/src/core/utils/deep_freeze.ts b/packages/kbn-std/src/deep_freeze.ts
similarity index 100%
rename from src/core/utils/deep_freeze.ts
rename to packages/kbn-std/src/deep_freeze.ts
diff --git a/src/core/utils/get.test.ts b/packages/kbn-std/src/get.test.ts
similarity index 100%
rename from src/core/utils/get.test.ts
rename to packages/kbn-std/src/get.test.ts
diff --git a/src/core/utils/get.ts b/packages/kbn-std/src/get.ts
similarity index 100%
rename from src/core/utils/get.ts
rename to packages/kbn-std/src/get.ts
diff --git a/src/core/utils/get_flattened_object.test.ts b/packages/kbn-std/src/get_flattened_object.test.ts
similarity index 100%
rename from src/core/utils/get_flattened_object.test.ts
rename to packages/kbn-std/src/get_flattened_object.test.ts
diff --git a/src/core/utils/get_flattened_object.ts b/packages/kbn-std/src/get_flattened_object.ts
similarity index 100%
rename from src/core/utils/get_flattened_object.ts
rename to packages/kbn-std/src/get_flattened_object.ts
diff --git a/packages/kbn-std/src/index.ts b/packages/kbn-std/src/index.ts
new file mode 100644
index 0000000000000..7cf70a0e28e2c
--- /dev/null
+++ b/packages/kbn-std/src/index.ts
@@ -0,0 +1,29 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { assertNever } from './assert_never';
+export { deepFreeze, Freezable } from './deep_freeze';
+export { get } from './get';
+export { mapToObject } from './map_to_object';
+export { merge } from './merge';
+export { pick } from './pick';
+export { withTimeout } from './promise';
+export { isRelativeUrl, modifyUrl, URLMeaningfulParts } from './url';
+export { unset } from './unset';
+export { getFlattenedObject } from './get_flattened_object';
diff --git a/src/core/utils/map_to_object.ts b/packages/kbn-std/src/map_to_object.ts
similarity index 100%
rename from src/core/utils/map_to_object.ts
rename to packages/kbn-std/src/map_to_object.ts
diff --git a/src/core/utils/map_utils.test.ts b/packages/kbn-std/src/map_utils.test.ts
similarity index 100%
rename from src/core/utils/map_utils.test.ts
rename to packages/kbn-std/src/map_utils.test.ts
diff --git a/src/core/utils/map_utils.ts b/packages/kbn-std/src/map_utils.ts
similarity index 100%
rename from src/core/utils/map_utils.ts
rename to packages/kbn-std/src/map_utils.ts
diff --git a/src/core/utils/merge.test.ts b/packages/kbn-std/src/merge.test.ts
similarity index 100%
rename from src/core/utils/merge.test.ts
rename to packages/kbn-std/src/merge.test.ts
diff --git a/src/core/utils/merge.ts b/packages/kbn-std/src/merge.ts
similarity index 98%
rename from src/core/utils/merge.ts
rename to packages/kbn-std/src/merge.ts
index 43878c27b1e19..c0de50544a34e 100644
--- a/src/core/utils/merge.ts
+++ b/packages/kbn-std/src/merge.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { isPlainObject } from 'lodash';
+import isPlainObject from 'lodash/isPlainObject';
 /**
  * Deeply merges two objects, omitting undefined values, and not deeply merging Arrays.
  *
diff --git a/src/core/utils/pick.ts b/packages/kbn-std/src/pick.ts
similarity index 100%
rename from src/core/utils/pick.ts
rename to packages/kbn-std/src/pick.ts
diff --git a/src/core/utils/promise.test.ts b/packages/kbn-std/src/promise.test.ts
similarity index 100%
rename from src/core/utils/promise.test.ts
rename to packages/kbn-std/src/promise.test.ts
diff --git a/src/core/utils/promise.ts b/packages/kbn-std/src/promise.ts
similarity index 100%
rename from src/core/utils/promise.ts
rename to packages/kbn-std/src/promise.ts
diff --git a/src/core/utils/unset.test.ts b/packages/kbn-std/src/unset.test.ts
similarity index 100%
rename from src/core/utils/unset.test.ts
rename to packages/kbn-std/src/unset.test.ts
diff --git a/src/core/utils/unset.ts b/packages/kbn-std/src/unset.ts
similarity index 100%
rename from src/core/utils/unset.ts
rename to packages/kbn-std/src/unset.ts
diff --git a/src/core/utils/url.test.ts b/packages/kbn-std/src/url.test.ts
similarity index 100%
rename from src/core/utils/url.test.ts
rename to packages/kbn-std/src/url.test.ts
diff --git a/src/core/utils/url.ts b/packages/kbn-std/src/url.ts
similarity index 100%
rename from src/core/utils/url.ts
rename to packages/kbn-std/src/url.ts
diff --git a/packages/kbn-std/tsconfig.json b/packages/kbn-std/tsconfig.json
new file mode 100644
index 0000000000000..5c86ad17a90e9
--- /dev/null
+++ b/packages/kbn-std/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "declaration": true,
+    "declarationDir": "./target",
+    "outDir": "./target",
+    "stripInternal": true,
+    "declarationMap": true,
+    "types": ["jest", "node"]
+  },
+  "include": [
+    "./src/**/*.ts",
+    "../../typings/query_string.d.ts"
+  ],
+  "exclude": ["target"]
+}
diff --git a/packages/kbn-std/yarn.lock b/packages/kbn-std/yarn.lock
new file mode 120000
index 0000000000000..3f82ebc9cdbae
--- /dev/null
+++ b/packages/kbn-std/yarn.lock
@@ -0,0 +1 @@
+../../yarn.lock
\ No newline at end of file
diff --git a/packages/kbn-storybook/lib/constants.js b/packages/kbn-storybook/lib/constants.js
index 9d216d347eada..4d8ca0adbfe17 100644
--- a/packages/kbn-storybook/lib/constants.js
+++ b/packages/kbn-storybook/lib/constants.js
@@ -17,10 +17,10 @@
  * under the License.
  */
 
-const { resolve, dirname } = require('path');
+const { resolve } = require('path');
+const { REPO_ROOT } = require('@kbn/utils');
 
-exports.REPO_ROOT = dirname(require.resolve('../../../package.json'));
-exports.ASSET_DIR = resolve(exports.REPO_ROOT, 'built_assets/storybook');
+exports.ASSET_DIR = resolve(REPO_ROOT, 'built_assets/storybook');
 exports.CURRENT_CONFIG = resolve(exports.ASSET_DIR, 'current.config.js');
 exports.STORY_ENTRY_PATH = resolve(exports.ASSET_DIR, 'stories.entry.js');
 exports.DLL_DIST_DIR = resolve(exports.ASSET_DIR, 'dll');
diff --git a/packages/kbn-storybook/lib/dll.js b/packages/kbn-storybook/lib/dll.js
index a9154ca972120..55bc8e43a02ec 100644
--- a/packages/kbn-storybook/lib/dll.js
+++ b/packages/kbn-storybook/lib/dll.js
@@ -20,7 +20,8 @@
 const { resolve } = require('path');
 const { existsSync } = require('fs');
 
-const { REPO_ROOT, DLL_DIST_DIR } = require('./constants');
+const { REPO_ROOT } = require('@kbn/utils');
+const { DLL_DIST_DIR } = require('./constants');
 
 exports.buildDll = async ({ rebuildDll, log, procRunner }) => {
   if (rebuildDll) {
diff --git a/packages/kbn-storybook/lib/storybook_entry.js b/packages/kbn-storybook/lib/storybook_entry.js
index 8b8aa4126ad88..fc970b1ff9d2a 100644
--- a/packages/kbn-storybook/lib/storybook_entry.js
+++ b/packages/kbn-storybook/lib/storybook_entry.js
@@ -27,11 +27,12 @@ const { promisify } = require('util');
 const watch = require('glob-watcher');
 const mkdirp = require('mkdirp'); // eslint-disable-line
 const glob = require('fast-glob');
+const { REPO_ROOT } = require('@kbn/utils');
 
 const mkdirpAsync = promisify(mkdirp);
 const writeFileAsync = promisify(Fs.writeFile);
 
-const { REPO_ROOT, STORY_ENTRY_PATH } = require('./constants');
+const { STORY_ENTRY_PATH } = require('./constants');
 const STORE_ENTRY_DIR = dirname(STORY_ENTRY_PATH);
 
 exports.generateStorybookEntry = ({ log, storyGlobs }) => {
diff --git a/packages/kbn-storybook/lib/webpack.dll.config.js b/packages/kbn-storybook/lib/webpack.dll.config.js
index 18dbe3bd049d3..6e3b4d41bd7f0 100644
--- a/packages/kbn-storybook/lib/webpack.dll.config.js
+++ b/packages/kbn-storybook/lib/webpack.dll.config.js
@@ -20,8 +20,9 @@
 const webpack = require('webpack');
 const path = require('path');
 const MiniCssExtractPlugin = require('mini-css-extract-plugin');
+const { REPO_ROOT } = require('@kbn/utils');
 
-const { DLL_NAME, REPO_ROOT, DLL_DIST_DIR } = require('./constants');
+const { DLL_NAME, DLL_DIST_DIR } = require('./constants');
 
 // This is the Webpack config for the DLL of CSS and JS assets that are
 // not expected to change during development.  This saves compile and run
diff --git a/packages/kbn-storybook/package.json b/packages/kbn-storybook/package.json
index 9f12cd1f46c68..5271ddb96d842 100644
--- a/packages/kbn-storybook/package.json
+++ b/packages/kbn-storybook/package.json
@@ -6,6 +6,7 @@
   "dependencies": {
     "@kbn/babel-preset": "1.0.0",
     "@kbn/dev-utils": "1.0.0",
+    "@kbn/utils": "1.0.0",
     "@storybook/addon-actions": "^5.3.19",
     "@storybook/addon-console": "^1.2.1",
     "@storybook/addon-info": "^5.3.19",
diff --git a/packages/kbn-storybook/storybook_config/webpack.config.js b/packages/kbn-storybook/storybook_config/webpack.config.js
index d505c4f9a0448..60b6b6add66d1 100644
--- a/packages/kbn-storybook/storybook_config/webpack.config.js
+++ b/packages/kbn-storybook/storybook_config/webpack.config.js
@@ -22,7 +22,8 @@ const webpack = require('webpack');
 const webpackMerge = require('webpack-merge');
 const { stringifyRequest } = require('loader-utils');
 const CopyWebpackPlugin = require('copy-webpack-plugin');
-const { REPO_ROOT, DLL_DIST_DIR } = require('../lib/constants');
+const { REPO_ROOT } = require('@kbn/utils');
+const { DLL_DIST_DIR } = require('../lib/constants');
 // eslint-disable-next-line import/no-unresolved
 const { currentConfig } = require('../../../built_assets/storybook/current.config');
 
diff --git a/packages/kbn-test/package.json b/packages/kbn-test/package.json
index c84b0a93311bb..8a4ff55dcf68f 100644
--- a/packages/kbn-test/package.json
+++ b/packages/kbn-test/package.json
@@ -13,6 +13,7 @@
     "@babel/cli": "^7.10.5",
     "@kbn/babel-preset": "1.0.0",
     "@kbn/dev-utils": "1.0.0",
+    "@kbn/utils": "1.0.0",
     "@types/joi": "^13.4.2",
     "@types/lodash": "^4.14.159",
     "@types/parse-link-header": "^1.0.0",
diff --git a/packages/kbn-test/src/failed_tests_reporter/run_failed_tests_reporter_cli.ts b/packages/kbn-test/src/failed_tests_reporter/run_failed_tests_reporter_cli.ts
index 3dfb1ea44d9e7..93616ce78a04a 100644
--- a/packages/kbn-test/src/failed_tests_reporter/run_failed_tests_reporter_cli.ts
+++ b/packages/kbn-test/src/failed_tests_reporter/run_failed_tests_reporter_cli.ts
@@ -19,7 +19,8 @@
 
 import Path from 'path';
 
-import { REPO_ROOT, run, createFailError, createFlagError } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { run, createFailError, createFlagError } from '@kbn/dev-utils';
 import globby from 'globby';
 
 import { getFailures, TestFailure } from './get_failures';
diff --git a/packages/kbn-test/src/functional_test_runner/__tests__/integration/basic.js b/packages/kbn-test/src/functional_test_runner/__tests__/integration/basic.js
index 133f4d2feb53e..a010d9f0b038e 100644
--- a/packages/kbn-test/src/functional_test_runner/__tests__/integration/basic.js
+++ b/packages/kbn-test/src/functional_test_runner/__tests__/integration/basic.js
@@ -21,7 +21,7 @@ import { spawnSync } from 'child_process';
 import { resolve } from 'path';
 
 import expect from '@kbn/expect';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 const SCRIPT = resolve(REPO_ROOT, 'scripts/functional_test_runner.js');
 const BASIC_CONFIG = require.resolve('../fixtures/simple_project/config.js');
diff --git a/packages/kbn-test/src/functional_test_runner/__tests__/integration/failure_hooks.js b/packages/kbn-test/src/functional_test_runner/__tests__/integration/failure_hooks.js
index 12e28d2702c5a..fa4ef88fd3e70 100644
--- a/packages/kbn-test/src/functional_test_runner/__tests__/integration/failure_hooks.js
+++ b/packages/kbn-test/src/functional_test_runner/__tests__/integration/failure_hooks.js
@@ -22,7 +22,7 @@ import { resolve } from 'path';
 
 import stripAnsi from 'strip-ansi';
 import expect from '@kbn/expect';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 const SCRIPT = resolve(REPO_ROOT, 'scripts/functional_test_runner.js');
 const FAILURE_HOOKS_CONFIG = require.resolve('../fixtures/failure_hooks/config.js');
diff --git a/packages/kbn-test/src/functional_test_runner/lib/failure_metadata.ts b/packages/kbn-test/src/functional_test_runner/lib/failure_metadata.ts
index fdf8b3c0ddfa8..e5c60f1d208b1 100644
--- a/packages/kbn-test/src/functional_test_runner/lib/failure_metadata.ts
+++ b/packages/kbn-test/src/functional_test_runner/lib/failure_metadata.ts
@@ -19,7 +19,7 @@
 
 import Path from 'path';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { Lifecycle } from './lifecycle';
 
diff --git a/packages/kbn-test/src/functional_test_runner/lib/mocha/decorate_mocha_ui.js b/packages/kbn-test/src/functional_test_runner/lib/mocha/decorate_mocha_ui.js
index 5d3d8fe7d759b..92137a8c4f841 100644
--- a/packages/kbn-test/src/functional_test_runner/lib/mocha/decorate_mocha_ui.js
+++ b/packages/kbn-test/src/functional_test_runner/lib/mocha/decorate_mocha_ui.js
@@ -17,7 +17,7 @@
  * under the License.
  */
 import { relative } from 'path';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import { createAssignmentProxy } from './assignment_proxy';
 import { wrapFunction } from './wrap_function';
 import { wrapRunnableArgs } from './wrap_runnable_args';
diff --git a/packages/kbn-test/src/functional_test_runner/lib/mocha/setup_mocha.js b/packages/kbn-test/src/functional_test_runner/lib/mocha/setup_mocha.js
index 3ac7a50cd28ea..39eb69a151918 100644
--- a/packages/kbn-test/src/functional_test_runner/lib/mocha/setup_mocha.js
+++ b/packages/kbn-test/src/functional_test_runner/lib/mocha/setup_mocha.js
@@ -19,7 +19,7 @@
 
 import Mocha from 'mocha';
 import { relative } from 'path';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { loadTestFiles } from './load_test_files';
 import { filterSuitesByTags } from './filter_suites_by_tags';
diff --git a/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.test.ts b/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.test.ts
index f879408bf2beb..5350b2709843d 100644
--- a/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.test.ts
+++ b/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.test.ts
@@ -21,7 +21,7 @@ import fs from 'fs';
 import { join, resolve } from 'path';
 
 jest.mock('fs');
-jest.mock('@kbn/dev-utils', () => {
+jest.mock('@kbn/utils', () => {
   return { REPO_ROOT: '/dev/null/root' };
 });
 
diff --git a/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.ts b/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.ts
index b346be2d58dad..6cbd74467106f 100644
--- a/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.ts
+++ b/packages/kbn-test/src/functional_test_runner/lib/suite_tracker.ts
@@ -19,7 +19,7 @@
 import fs from 'fs';
 import { dirname, relative, resolve } from 'path';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { Lifecycle } from './lifecycle';
 
diff --git a/packages/kbn-test/src/mocha/run_mocha_cli.js b/packages/kbn-test/src/mocha/run_mocha_cli.js
index 3c77fef963a76..0fc7c762be425 100644
--- a/packages/kbn-test/src/mocha/run_mocha_cli.js
+++ b/packages/kbn-test/src/mocha/run_mocha_cli.js
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import getopts from 'getopts';
 import globby from 'globby';
 
diff --git a/packages/kbn-ui-shared-deps/webpack.config.js b/packages/kbn-ui-shared-deps/webpack.config.js
index fa80dfdeef20f..b7d4e929ac93f 100644
--- a/packages/kbn-ui-shared-deps/webpack.config.js
+++ b/packages/kbn-ui-shared-deps/webpack.config.js
@@ -21,7 +21,7 @@ const Path = require('path');
 
 const MiniCssExtractPlugin = require('mini-css-extract-plugin');
 const CompressionPlugin = require('compression-webpack-plugin');
-const { REPO_ROOT } = require('@kbn/dev-utils');
+const { REPO_ROOT } = require('@kbn/utils');
 const webpack = require('webpack');
 
 const UiSharedDeps = require('./index');
diff --git a/packages/kbn-utils/README.md b/packages/kbn-utils/README.md
new file mode 100644
index 0000000000000..fd132e4312487
--- /dev/null
+++ b/packages/kbn-utils/README.md
@@ -0,0 +1,3 @@
+# @kbn/utils
+
+Shared server-side utilities shared across packages and plugins.
\ No newline at end of file
diff --git a/packages/kbn-utils/package.json b/packages/kbn-utils/package.json
new file mode 100644
index 0000000000000..15fe5c6df5648
--- /dev/null
+++ b/packages/kbn-utils/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "@kbn/utils",
+  "main": "./target/index.js",
+  "version": "1.0.0",
+  "license": "Apache-2.0",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "kbn:bootstrap": "yarn build",
+    "kbn:watch": "yarn build --watch"
+  },
+  "dependencies": {
+    "@kbn/config-schema": "1.0.0",
+    "load-json-file": "^6.2.0"
+  },
+  "devDependencies": {
+    "typescript": "4.0.2"
+  }
+}
diff --git a/packages/kbn-utils/src/index.ts b/packages/kbn-utils/src/index.ts
new file mode 100644
index 0000000000000..7a894d72d5624
--- /dev/null
+++ b/packages/kbn-utils/src/index.ts
@@ -0,0 +1,22 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export * from './package_json';
+export * from './path';
+export * from './repo_root';
diff --git a/packages/kbn-utils/src/package_json/index.test.ts b/packages/kbn-utils/src/package_json/index.test.ts
new file mode 100644
index 0000000000000..afc84102999fe
--- /dev/null
+++ b/packages/kbn-utils/src/package_json/index.test.ts
@@ -0,0 +1,31 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import path from 'path';
+import { kibanaPackageJSON } from './';
+
+it('parses package.json', () => {
+  expect(kibanaPackageJSON.name).toEqual('kibana');
+});
+
+it('includes __dirname and __filename', () => {
+  const root = path.resolve(__dirname, '../../../../');
+  expect(kibanaPackageJSON.__filename).toEqual(path.resolve(root, 'package.json'));
+  expect(kibanaPackageJSON.__dirname).toEqual(root);
+});
diff --git a/packages/kbn-utils/src/package_json/index.ts b/packages/kbn-utils/src/package_json/index.ts
new file mode 100644
index 0000000000000..f439c0100e193
--- /dev/null
+++ b/packages/kbn-utils/src/package_json/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { dirname, resolve } from 'path';
+import { REPO_ROOT } from '../repo_root';
+
+export const kibanaPackageJSON = {
+  __filename: resolve(REPO_ROOT, 'package.json'),
+  __dirname: dirname(resolve(REPO_ROOT, 'package.json')),
+  ...require(resolve(REPO_ROOT, 'package.json')),
+};
diff --git a/src/core/server/path/index.test.ts b/packages/kbn-utils/src/path/index.test.ts
similarity index 100%
rename from src/core/server/path/index.test.ts
rename to packages/kbn-utils/src/path/index.test.ts
diff --git a/src/core/server/path/index.ts b/packages/kbn-utils/src/path/index.ts
similarity index 94%
rename from src/core/server/path/index.ts
rename to packages/kbn-utils/src/path/index.ts
index 7c1a81643fbc8..a7eddca5f2fde 100644
--- a/src/core/server/path/index.ts
+++ b/packages/kbn-utils/src/path/index.ts
@@ -20,7 +20,7 @@
 import { join } from 'path';
 import { accessSync, constants } from 'fs';
 import { TypeOf, schema } from '@kbn/config-schema';
-import { fromRoot } from '../utils';
+import { REPO_ROOT } from '../repo_root';
 
 const isString = (v: any): v is string => typeof v === 'string';
 
@@ -28,19 +28,19 @@ const CONFIG_PATHS = [
   process.env.KBN_PATH_CONF && join(process.env.KBN_PATH_CONF, 'kibana.yml'),
   process.env.KIBANA_PATH_CONF && join(process.env.KIBANA_PATH_CONF, 'kibana.yml'),
   process.env.CONFIG_PATH, // deprecated
-  fromRoot('config/kibana.yml'),
+  join(REPO_ROOT, 'config/kibana.yml'),
 ].filter(isString);
 
 const CONFIG_DIRECTORIES = [
   process.env.KBN_PATH_CONF,
   process.env.KIBANA_PATH_CONF,
-  fromRoot('config'),
+  join(REPO_ROOT, 'config'),
   '/etc/kibana',
 ].filter(isString);
 
 const DATA_PATHS = [
   process.env.DATA_PATH, // deprecated
-  fromRoot('data'),
+  join(REPO_ROOT, 'data'),
   '/var/lib/kibana',
 ].filter(isString);
 
diff --git a/packages/kbn-dev-utils/src/repo_root.ts b/packages/kbn-utils/src/repo_root.ts
similarity index 100%
rename from packages/kbn-dev-utils/src/repo_root.ts
rename to packages/kbn-utils/src/repo_root.ts
diff --git a/packages/kbn-utils/tsconfig.json b/packages/kbn-utils/tsconfig.json
new file mode 100644
index 0000000000000..e9dd6313e6f79
--- /dev/null
+++ b/packages/kbn-utils/tsconfig.json
@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target",
+    "declaration": true,
+    "declarationMap": true
+  },
+  "include": [
+    "src/**/*"
+  ]
+}
diff --git a/packages/kbn-utils/yarn.lock b/packages/kbn-utils/yarn.lock
new file mode 120000
index 0000000000000..3f82ebc9cdbae
--- /dev/null
+++ b/packages/kbn-utils/yarn.lock
@@ -0,0 +1 @@
+../../yarn.lock
\ No newline at end of file
diff --git a/src/cli/cluster/cluster_manager.ts b/src/cli/cluster/cluster_manager.ts
index eb7db8dac7cb6..b1d1335eb1888 100644
--- a/src/cli/cluster/cluster_manager.ts
+++ b/src/cli/cluster/cluster_manager.ts
@@ -21,7 +21,7 @@ import { resolve } from 'path';
 import { format as formatUrl } from 'url';
 
 import opn from 'opn';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import { FSWatcher } from 'chokidar';
 import * as Rx from 'rxjs';
 import { startWith, mapTo, filter, map, take, tap } from 'rxjs/operators';
diff --git a/src/cli/cluster/run_kbn_optimizer.ts b/src/cli/cluster/run_kbn_optimizer.ts
index c231437da3943..8196cad4a99c7 100644
--- a/src/cli/cluster/run_kbn_optimizer.ts
+++ b/src/cli/cluster/run_kbn_optimizer.ts
@@ -19,12 +19,12 @@
 
 import Chalk from 'chalk';
 import moment from 'moment';
+import { REPO_ROOT } from '@kbn/utils';
 import {
   ToolingLog,
   pickLevelFromFlags,
   ToolingLogTextWriter,
   parseLogLevel,
-  REPO_ROOT,
 } from '@kbn/dev-utils';
 import { runOptimizer, OptimizerConfig, logOptimizerState } from '@kbn/optimizer';
 
diff --git a/src/cli/serve/serve.js b/src/cli/serve/serve.js
index c08f3aec64335..eeb5564667ec4 100644
--- a/src/cli/serve/serve.js
+++ b/src/cli/serve/serve.js
@@ -23,9 +23,9 @@ import { statSync } from 'fs';
 import { resolve } from 'path';
 import url from 'url';
 
+import { getConfigPath } from '@kbn/utils';
 import { IS_KIBANA_DISTRIBUTABLE } from '../../legacy/utils';
 import { fromRoot } from '../../core/server/utils';
-import { getConfigPath } from '../../core/server/path';
 import { bootstrap } from '../../core/server';
 import { readKeystore } from './read_keystore';
 
diff --git a/src/cli_keystore/get_keystore.js b/src/cli_keystore/get_keystore.js
index e181efe9196b8..b97efbb2cbf4d 100644
--- a/src/cli_keystore/get_keystore.js
+++ b/src/cli_keystore/get_keystore.js
@@ -21,7 +21,7 @@ import { existsSync } from 'fs';
 import { join } from 'path';
 
 import { Logger } from '../cli_plugin/lib/logger';
-import { getConfigDirectory, getDataPath } from '../core/server/path';
+import { getConfigDirectory, getDataPath } from '@kbn/utils';
 
 export function getKeystore() {
   const configKeystore = join(getConfigDirectory(), 'kibana.keystore');
diff --git a/src/cli_plugin/install/index.js b/src/cli_plugin/install/index.js
index bc7e95b8489f0..eff14906853c1 100644
--- a/src/cli_plugin/install/index.js
+++ b/src/cli_plugin/install/index.js
@@ -17,10 +17,10 @@
  * under the License.
  */
 
+import { getConfigPath } from '@kbn/utils';
 import { pkg } from '../../core/server/utils';
 import { install } from './install';
 import { Logger } from '../lib/logger';
-import { getConfigPath } from '../../core/server/path';
 import { parse, parseMilliseconds } from './settings';
 import { logWarnings } from '../lib/log_warnings';
 
diff --git a/src/cli_plugin/remove/index.js b/src/cli_plugin/remove/index.js
index c3bd96086db9b..b9c37c0cf802b 100644
--- a/src/cli_plugin/remove/index.js
+++ b/src/cli_plugin/remove/index.js
@@ -17,10 +17,10 @@
  * under the License.
  */
 
+import { getConfigPath } from '@kbn/utils';
 import { remove } from './remove';
 import { Logger } from '../lib/logger';
 import { parse } from './settings';
-import { getConfigPath } from '../../core/server/path';
 import { logWarnings } from '../lib/log_warnings';
 
 function processCommand(command, options) {
diff --git a/src/core/public/application/capabilities/capabilities_service.mock.ts b/src/core/public/application/capabilities/capabilities_service.mock.ts
index d7b0c27879aad..ee37854762666 100644
--- a/src/core/public/application/capabilities/capabilities_service.mock.ts
+++ b/src/core/public/application/capabilities/capabilities_service.mock.ts
@@ -16,9 +16,10 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+
+import { deepFreeze } from '@kbn/std';
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import { CapabilitiesService, CapabilitiesStart } from './capabilities_service';
-import { deepFreeze } from '../../../utils';
 
 const createStartContractMock = (): jest.Mocked<CapabilitiesStart> => ({
   capabilities: deepFreeze({
diff --git a/src/core/public/application/capabilities/capabilities_service.tsx b/src/core/public/application/capabilities/capabilities_service.tsx
index 7304a8e5a66bc..1164164aec4c5 100644
--- a/src/core/public/application/capabilities/capabilities_service.tsx
+++ b/src/core/public/application/capabilities/capabilities_service.tsx
@@ -17,9 +17,9 @@
  * under the License.
  */
 import { RecursiveReadonly } from '@kbn/utility-types';
+import { deepFreeze } from '@kbn/std';
 
 import { Capabilities } from '../../../types/capabilities';
-import { deepFreeze } from '../../../utils';
 import { HttpStart } from '../../http';
 
 interface StartDeps {
diff --git a/src/core/public/chrome/nav_links/nav_link.ts b/src/core/public/chrome/nav_links/nav_link.ts
index 4b82e0ced4505..80f0265819c40 100644
--- a/src/core/public/chrome/nav_links/nav_link.ts
+++ b/src/core/public/chrome/nav_links/nav_link.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { pick } from '../../../utils';
+import { pick } from '@kbn/std';
 import { AppCategory } from '../../';
 
 /**
diff --git a/src/core/public/core_system.ts b/src/core/public/core_system.ts
index 006d0036f7a12..a1d6f9c988b27 100644
--- a/src/core/public/core_system.ts
+++ b/src/core/public/core_system.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { pick } from '@kbn/std';
 import { CoreId } from '../server';
 import { PackageInfo, EnvironmentMode } from '../server/types';
 import { CoreSetup, CoreStart } from '.';
@@ -35,7 +36,6 @@ import { OverlayService } from './overlays';
 import { PluginsService } from './plugins';
 import { UiSettingsService } from './ui_settings';
 import { ApplicationService } from './application';
-import { pick } from '../utils/';
 import { DocLinksService } from './doc_links';
 import { RenderingService } from './rendering';
 import { SavedObjectsService } from './saved_objects';
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index fae7a272c9635..47f58a3a9fcbf 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -17,8 +17,8 @@
  * under the License.
  */
 
+import { deepFreeze } from '@kbn/std';
 import { InjectedMetadataSetup } from '../injected_metadata';
-import { deepFreeze } from '../../utils';
 
 interface StartDeps {
   injectedMetadata: InjectedMetadataSetup;
diff --git a/src/core/public/http/base_path.ts b/src/core/public/http/base_path.ts
index ac85d71c793fe..5d9eb51023b78 100644
--- a/src/core/public/http/base_path.ts
+++ b/src/core/public/http/base_path.ts
@@ -35,7 +35,7 @@
  * under the License.
  */
 
-import { modifyUrl } from '../../utils';
+import { modifyUrl } from '@kbn/std';
 
 export class BasePath {
   constructor(
diff --git a/src/core/public/index.ts b/src/core/public/index.ts
index a9774dafd2340..24d19e2d32074 100644
--- a/src/core/public/index.ts
+++ b/src/core/public/index.ts
@@ -68,7 +68,6 @@ import { UiSettingsState, IUiSettingsClient } from './ui_settings';
 import { ApplicationSetup, Capabilities, ApplicationStart } from './application';
 import { DocLinksStart } from './doc_links';
 import { SavedObjectsStart } from './saved_objects';
-export { PackageInfo, EnvironmentMode } from '../server/types';
 import {
   IContextContainer,
   IContextProvider,
@@ -78,17 +77,9 @@ import {
   HandlerParameters,
 } from './context';
 
+export { PackageInfo, EnvironmentMode } from '../server/types';
 export { CoreContext, CoreSystem } from './core_system';
-export {
-  DEFAULT_APP_CATEGORIES,
-  getFlattenedObject,
-  URLMeaningfulParts,
-  modifyUrl,
-  isRelativeUrl,
-  Freezable,
-  deepFreeze,
-  assertNever,
-} from '../utils';
+export { DEFAULT_APP_CATEGORIES } from '../utils';
 export {
   AppCategory,
   UiSettingsParams,
diff --git a/src/core/public/injected_metadata/injected_metadata_service.ts b/src/core/public/injected_metadata/injected_metadata_service.ts
index 23630a5bcf228..5b51bc823d166 100644
--- a/src/core/public/injected_metadata/injected_metadata_service.ts
+++ b/src/core/public/injected_metadata/injected_metadata_service.ts
@@ -18,6 +18,7 @@
  */
 
 import { get } from 'lodash';
+import { deepFreeze } from '@kbn/std';
 import { DiscoveredPlugin, PluginName } from '../../server';
 import {
   EnvironmentMode,
@@ -25,7 +26,6 @@ import {
   UiSettingsParams,
   UserProvidedValues,
 } from '../../server/types';
-import { deepFreeze } from '../../utils/';
 import { AppCategory } from '../';
 
 export interface InjectedPluginMetadata {
diff --git a/src/core/public/plugins/plugins_service.ts b/src/core/public/plugins/plugins_service.ts
index f9bc40ca52601..87219f4c0bdd3 100644
--- a/src/core/public/plugins/plugins_service.ts
+++ b/src/core/public/plugins/plugins_service.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { withTimeout } from '@kbn/std';
 import { PluginName, PluginOpaqueId } from '../../server';
 import { CoreService } from '../../types';
 import { CoreContext } from '../core_system';
@@ -28,7 +29,6 @@ import {
 } from './plugin_context';
 import { InternalCoreSetup, InternalCoreStart } from '../core_system';
 import { InjectedPluginMetadata } from '../injected_metadata';
-import { withTimeout } from '../../utils';
 
 const Sec = 1000;
 /** @internal */
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index a4f9234b539d6..d0b9e115bd524 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -21,7 +21,6 @@ import { Location } from 'history';
 import { LocationDescriptorObject } from 'history';
 import { MaybePromise } from '@kbn/utility-types';
 import { Observable } from 'rxjs';
-import { ParsedQuery } from 'query-string';
 import { Path } from 'history';
 import { PublicMethodsOf } from '@kbn/utility-types';
 import { PublicUiSettingsParams as PublicUiSettingsParams_2 } from 'src/core/server/types';
@@ -185,9 +184,6 @@ export type AppUpdatableFields = Pick<App, 'status' | 'navLinkStatus' | 'tooltip
 // @public
 export type AppUpdater = (app: App) => Partial<AppUpdatableFields> | undefined;
 
-// @public
-export function assertNever(x: never): never;
-
 // @public
 export interface Capabilities {
     [key: string]: Record<string, boolean | Record<string, boolean>>;
@@ -444,9 +440,6 @@ export class CoreSystem {
     stop(): void;
     }
 
-// @public
-export function deepFreeze<T extends Freezable>(object: T): RecursiveReadonly<T>;
-
 // @internal (undocumented)
 export const DEFAULT_APP_CATEGORIES: Readonly<{
     kibana: {
@@ -616,16 +609,6 @@ export interface FatalErrorsSetup {
 // @public
 export type FatalErrorsStart = FatalErrorsSetup;
 
-// @public (undocumented)
-export type Freezable = {
-    [k: string]: any;
-} | any[];
-
-// @public
-export function getFlattenedObject(rootValue: Record<string, any>): {
-    [key: string]: any;
-};
-
 // @public
 export type HandlerContextType<T extends HandlerFunction<any>> = T extends HandlerFunction<infer U> ? U : never;
 
@@ -837,9 +820,6 @@ export interface ImageValidation {
     };
 }
 
-// @public
-export function isRelativeUrl(candidatePath: string): boolean;
-
 // @public
 export type IToasts = Pick<ToastsApi, 'get$' | 'add' | 'remove' | 'addSuccess' | 'addWarning' | 'addDanger' | 'addError' | 'addInfo'>;
 
@@ -868,9 +848,6 @@ export interface IUiSettingsClient {
     set: (key: string, value: any) => Promise<boolean>;
 }
 
-// @public
-export function modifyUrl(url: string, urlModifier: (urlParts: URLMeaningfulParts) => Partial<URLMeaningfulParts> | void): string;
-
 // @public
 export type MountPoint<T extends HTMLElement = HTMLElement> = (element: T) => UnmountCallback;
 
@@ -1447,26 +1424,6 @@ export type UnmountCallback = () => void;
 // @public
 export const URL_MAX_LENGTH: number;
 
-// @public
-export interface URLMeaningfulParts {
-    // (undocumented)
-    auth?: string | null;
-    // (undocumented)
-    hash?: string | null;
-    // (undocumented)
-    hostname?: string | null;
-    // (undocumented)
-    pathname?: string | null;
-    // (undocumented)
-    port?: string | null;
-    // (undocumented)
-    protocol?: string | null;
-    // (undocumented)
-    query: ParsedQuery;
-    // (undocumented)
-    slashes?: boolean | null;
-}
-
 // @public
 export interface UserProvidedValues<T = any> {
     // (undocumented)
diff --git a/src/core/server/config/deprecation/deprecation_factory.ts b/src/core/server/config/deprecation/deprecation_factory.ts
index cbc9984924c5d..0598347d2cffc 100644
--- a/src/core/server/config/deprecation/deprecation_factory.ts
+++ b/src/core/server/config/deprecation/deprecation_factory.ts
@@ -17,10 +17,10 @@
  * under the License.
  */
 
-import { set } from '@elastic/safer-lodash-set';
 import { get } from 'lodash';
+import { set } from '@elastic/safer-lodash-set';
+import { unset } from '@kbn/std';
 import { ConfigDeprecation, ConfigDeprecationLogger, ConfigDeprecationFactory } from './types';
-import { unset } from '../../../utils';
 
 const _rename = (
   config: Record<string, any>,
diff --git a/src/core/server/config/object_to_config_adapter.ts b/src/core/server/config/object_to_config_adapter.ts
index 50b31722dceeb..c4d6ac02ccf05 100644
--- a/src/core/server/config/object_to_config_adapter.ts
+++ b/src/core/server/config/object_to_config_adapter.ts
@@ -17,10 +17,10 @@
  * under the License.
  */
 
-import { set } from '@elastic/safer-lodash-set';
 import { cloneDeep, get, has } from 'lodash';
+import { set } from '@elastic/safer-lodash-set';
+import { getFlattenedObject } from '@kbn/std';
 
-import { getFlattenedObject } from '../../utils';
 import { Config, ConfigPath } from './';
 
 /**
diff --git a/src/core/server/elasticsearch/elasticsearch_service.ts b/src/core/server/elasticsearch/elasticsearch_service.ts
index 2cc065aaaaeb1..5d07840e8bda7 100644
--- a/src/core/server/elasticsearch/elasticsearch_service.ts
+++ b/src/core/server/elasticsearch/elasticsearch_service.ts
@@ -19,9 +19,9 @@
 
 import { Observable, Subject } from 'rxjs';
 import { first, map, shareReplay, takeUntil } from 'rxjs/operators';
+import { merge } from '@kbn/std';
 
 import { CoreService } from '../../types';
-import { merge } from '../../utils';
 import { CoreContext } from '../core_context';
 import { Logger } from '../logging';
 import {
diff --git a/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts b/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts
index 3dbc1c2c647a9..6896c0a2e301f 100644
--- a/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts
+++ b/src/core/server/elasticsearch/legacy/elasticsearch_client_config.ts
@@ -22,7 +22,7 @@ import { cloneDeep } from 'lodash';
 import { Duration } from 'moment';
 import { checkServerIdentity } from 'tls';
 import url from 'url';
-import { pick } from '../../../utils';
+import { pick } from '@kbn/std';
 import { Logger } from '../../logging';
 import { ElasticsearchConfig } from '../elasticsearch_config';
 
diff --git a/src/core/server/environment/create_data_folder.test.ts b/src/core/server/environment/create_data_folder.test.ts
index 2a480a7a3954f..25c1d57996e0d 100644
--- a/src/core/server/environment/create_data_folder.test.ts
+++ b/src/core/server/environment/create_data_folder.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { PathConfigType } from '../path';
+import { PathConfigType } from '@kbn/utils';
 import { createDataFolder } from './create_data_folder';
 import { mkdir } from './fs';
 import { loggingSystemMock } from '../logging/logging_system.mock';
diff --git a/src/core/server/environment/create_data_folder.ts b/src/core/server/environment/create_data_folder.ts
index 641d95cbf9411..f90e9f93694eb 100644
--- a/src/core/server/environment/create_data_folder.ts
+++ b/src/core/server/environment/create_data_folder.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
+import { PathConfigType } from '@kbn/utils';
 import { mkdir } from './fs';
 import { Logger } from '../logging';
-import { PathConfigType } from '../path';
 
 export async function createDataFolder({
   pathConfig,
diff --git a/src/core/server/environment/environment_service.test.ts b/src/core/server/environment/environment_service.test.ts
index 06fd250ebe4f9..f6cffb5e26a9e 100644
--- a/src/core/server/environment/environment_service.test.ts
+++ b/src/core/server/environment/environment_service.test.ts
@@ -21,6 +21,7 @@ import { BehaviorSubject } from 'rxjs';
 import { EnvironmentService } from './environment_service';
 import { resolveInstanceUuid } from './resolve_uuid';
 import { createDataFolder } from './create_data_folder';
+import { writePidFile } from './write_pid_file';
 import { CoreContext } from '../core_context';
 
 import { configServiceMock } from '../config/config_service.mock';
@@ -35,12 +36,20 @@ jest.mock('./create_data_folder', () => ({
   createDataFolder: jest.fn(),
 }));
 
+jest.mock('./write_pid_file', () => ({
+  writePidFile: jest.fn(),
+}));
+
 const pathConfig = {
   data: 'data-folder',
 };
 const serverConfig = {
   uuid: 'SOME_UUID',
 };
+const pidConfig = {
+  file: '/pid/file',
+  exclusive: 'false',
+};
 
 const getConfigService = () => {
   const configService = configServiceMock.create();
@@ -51,6 +60,9 @@ const getConfigService = () => {
     if (path === 'server') {
       return new BehaviorSubject(serverConfig);
     }
+    if (path === 'pid') {
+      return new BehaviorSubject(pidConfig);
+    }
     return new BehaviorSubject({});
   });
   return configService;
@@ -76,7 +88,7 @@ describe('UuidService', () => {
       expect(resolveInstanceUuid).toHaveBeenCalledWith({
         pathConfig,
         serverConfig,
-        logger: logger.get('uuid'),
+        logger: logger.get('environment'),
       });
     });
 
@@ -86,7 +98,17 @@ describe('UuidService', () => {
       expect(createDataFolder).toHaveBeenCalledTimes(1);
       expect(createDataFolder).toHaveBeenCalledWith({
         pathConfig,
-        logger: logger.get('uuid'),
+        logger: logger.get('environment'),
+      });
+    });
+
+    it('calls writePidFile with correct parameters', async () => {
+      const service = new EnvironmentService(coreContext);
+      await service.setup();
+      expect(writePidFile).toHaveBeenCalledTimes(1);
+      expect(writePidFile).toHaveBeenCalledWith({
+        pidConfig,
+        logger: logger.get('environment'),
       });
     });
 
diff --git a/src/core/server/environment/environment_service.ts b/src/core/server/environment/environment_service.ts
index 6a0b1122c7053..b051dfbe4c7f2 100644
--- a/src/core/server/environment/environment_service.ts
+++ b/src/core/server/environment/environment_service.ts
@@ -18,13 +18,15 @@
  */
 
 import { take } from 'rxjs/operators';
+import { PathConfigType, config as pathConfigDef } from '@kbn/utils';
 import { CoreContext } from '../core_context';
 import { Logger } from '../logging';
 import { IConfigService } from '../config';
-import { PathConfigType, config as pathConfigDef } from '../path';
 import { HttpConfigType, config as httpConfigDef } from '../http';
+import { PidConfigType, config as pidConfigDef } from './pid_config';
 import { resolveInstanceUuid } from './resolve_uuid';
 import { createDataFolder } from './create_data_folder';
+import { writePidFile } from './write_pid_file';
 
 /**
  * @internal
@@ -43,17 +45,24 @@ export class EnvironmentService {
   private uuid: string = '';
 
   constructor(core: CoreContext) {
-    this.log = core.logger.get('uuid');
+    this.log = core.logger.get('environment');
     this.configService = core.configService;
   }
 
   public async setup() {
-    const [pathConfig, serverConfig] = await Promise.all([
+    const [pathConfig, serverConfig, pidConfig] = await Promise.all([
       this.configService.atPath<PathConfigType>(pathConfigDef.path).pipe(take(1)).toPromise(),
       this.configService.atPath<HttpConfigType>(httpConfigDef.path).pipe(take(1)).toPromise(),
+      this.configService.atPath<PidConfigType>(pidConfigDef.path).pipe(take(1)).toPromise(),
     ]);
 
+    // was present in the legacy `pid` file.
+    process.on('unhandledRejection', (reason) => {
+      this.log.warn(`Detected an unhandled Promise rejection.\n${reason}`);
+    });
+
     await createDataFolder({ pathConfig, logger: this.log });
+    await writePidFile({ pidConfig, logger: this.log });
 
     this.uuid = await resolveInstanceUuid({
       pathConfig,
diff --git a/src/core/server/environment/fs.ts b/src/core/server/environment/fs.ts
index dc040ccb73615..b79c70dbee280 100644
--- a/src/core/server/environment/fs.ts
+++ b/src/core/server/environment/fs.ts
@@ -23,3 +23,4 @@ import { promisify } from 'util';
 export const readFile = promisify(Fs.readFile);
 export const writeFile = promisify(Fs.writeFile);
 export const mkdir = promisify(Fs.mkdir);
+export const exists = promisify(Fs.exists);
diff --git a/src/core/server/environment/index.ts b/src/core/server/environment/index.ts
index 57a26d5ea3c79..92b57c6af2fff 100644
--- a/src/core/server/environment/index.ts
+++ b/src/core/server/environment/index.ts
@@ -18,3 +18,4 @@
  */
 
 export { EnvironmentService, InternalEnvironmentServiceSetup } from './environment_service';
+export { config, PidConfigType } from './pid_config';
diff --git a/src/core/server/environment/pid_config.ts b/src/core/server/environment/pid_config.ts
new file mode 100644
index 0000000000000..ee9963016717e
--- /dev/null
+++ b/src/core/server/environment/pid_config.ts
@@ -0,0 +1,30 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { TypeOf, schema } from '@kbn/config-schema';
+
+export const config = {
+  path: 'pid',
+  schema: schema.object({
+    file: schema.maybe(schema.string()),
+    exclusive: schema.boolean({ defaultValue: false }),
+  }),
+};
+
+export type PidConfigType = TypeOf<typeof config.schema>;
diff --git a/src/core/server/environment/resolve_uuid.test.ts b/src/core/server/environment/resolve_uuid.test.ts
index d162c9d8e364b..c6e8465507123 100644
--- a/src/core/server/environment/resolve_uuid.test.ts
+++ b/src/core/server/environment/resolve_uuid.test.ts
@@ -18,10 +18,10 @@
  */
 
 import { join } from 'path';
+import { PathConfigType } from '@kbn/utils';
 import { loggingSystemMock } from '../logging/logging_system.mock';
 import { readFile, writeFile } from './fs';
 import { resolveInstanceUuid, UUID_7_6_0_BUG } from './resolve_uuid';
-import { PathConfigType } from '../path';
 import { HttpConfigType } from '../http';
 
 jest.mock('uuid', () => ({
diff --git a/src/core/server/environment/resolve_uuid.ts b/src/core/server/environment/resolve_uuid.ts
index 0267e06939997..a640319e30af4 100644
--- a/src/core/server/environment/resolve_uuid.ts
+++ b/src/core/server/environment/resolve_uuid.ts
@@ -19,8 +19,8 @@
 
 import uuid from 'uuid';
 import { join } from 'path';
+import { PathConfigType } from '@kbn/utils';
 import { readFile, writeFile } from './fs';
-import { PathConfigType } from '../path';
 import { HttpConfigType } from '../http';
 import { Logger } from '../logging';
 
diff --git a/src/core/server/environment/write_pid_file.test.ts b/src/core/server/environment/write_pid_file.test.ts
new file mode 100644
index 0000000000000..f9eb78a486970
--- /dev/null
+++ b/src/core/server/environment/write_pid_file.test.ts
@@ -0,0 +1,144 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { writeFile, exists } from './fs';
+import { writePidFile } from './write_pid_file';
+import { loggingSystemMock } from '../logging/logging_system.mock';
+
+jest.mock('./fs', () => ({
+  writeFile: jest.fn(),
+  exists: jest.fn(),
+}));
+
+const writeFileMock = writeFile as jest.MockedFunction<typeof writeFile>;
+const existsMock = exists as jest.MockedFunction<typeof exists>;
+
+const pid = String(process.pid);
+
+describe('writePidFile', () => {
+  let logger: ReturnType<typeof loggingSystemMock.createLogger>;
+
+  beforeEach(() => {
+    logger = loggingSystemMock.createLogger();
+    jest.spyOn(process, 'once');
+
+    writeFileMock.mockImplementation(() => Promise.resolve());
+    existsMock.mockImplementation(() => Promise.resolve(false));
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  const allLogs = () =>
+    Object.entries(loggingSystemMock.collect(logger)).reduce((messages, [key, value]) => {
+      return [...messages, ...(key === 'log' ? [] : (value as any[]).map(([msg]) => [key, msg]))];
+    }, [] as any[]);
+
+  it('does nothing if `pid.file` is not set', async () => {
+    await writePidFile({
+      pidConfig: {
+        file: undefined,
+        exclusive: false,
+      },
+      logger,
+    });
+    expect(writeFile).not.toHaveBeenCalled();
+    expect(process.once).not.toHaveBeenCalled();
+    expect(allLogs()).toMatchInlineSnapshot(`Array []`);
+  });
+
+  it('writes the pid file to `pid.file`', async () => {
+    existsMock.mockResolvedValue(false);
+
+    await writePidFile({
+      pidConfig: {
+        file: '/pid-file',
+        exclusive: false,
+      },
+      logger,
+    });
+
+    expect(writeFile).toHaveBeenCalledTimes(1);
+    expect(writeFile).toHaveBeenCalledWith('/pid-file', pid);
+
+    expect(process.once).toHaveBeenCalledTimes(2);
+    expect(process.once).toHaveBeenCalledWith('exit', expect.any(Function));
+    expect(process.once).toHaveBeenCalledWith('SIGINT', expect.any(Function));
+
+    expect(allLogs()).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          "debug",
+          "wrote pid file to /pid-file",
+        ],
+      ]
+    `);
+  });
+
+  it('throws an error if the file exists and `pid.exclusive is true`', async () => {
+    existsMock.mockResolvedValue(true);
+
+    await expect(
+      writePidFile({
+        pidConfig: {
+          file: '/pid-file',
+          exclusive: true,
+        },
+        logger,
+      })
+    ).rejects.toThrowErrorMatchingInlineSnapshot(`"pid file already exists at /pid-file"`);
+
+    expect(writeFile).not.toHaveBeenCalled();
+    expect(process.once).not.toHaveBeenCalled();
+    expect(allLogs()).toMatchInlineSnapshot(`Array []`);
+  });
+
+  it('logs a warning if the file exists and `pid.exclusive` is false', async () => {
+    existsMock.mockResolvedValue(true);
+
+    await writePidFile({
+      pidConfig: {
+        file: '/pid-file',
+        exclusive: false,
+      },
+      logger,
+    });
+
+    expect(writeFile).toHaveBeenCalledTimes(1);
+    expect(writeFile).toHaveBeenCalledWith('/pid-file', pid);
+
+    expect(process.once).toHaveBeenCalledTimes(2);
+    expect(process.once).toHaveBeenCalledWith('exit', expect.any(Function));
+    expect(process.once).toHaveBeenCalledWith('SIGINT', expect.any(Function));
+
+    expect(allLogs()).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          "debug",
+          "wrote pid file to /pid-file",
+        ],
+        Array [
+          "warn",
+          "pid file already exists at /pid-file",
+        ],
+      ]
+    `);
+  });
+});
diff --git a/src/core/server/environment/write_pid_file.ts b/src/core/server/environment/write_pid_file.ts
new file mode 100644
index 0000000000000..6ee20af02d7b0
--- /dev/null
+++ b/src/core/server/environment/write_pid_file.ts
@@ -0,0 +1,64 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { unlinkSync as unlink } from 'fs';
+import once from 'lodash/once';
+import { Logger } from '../logging';
+import { writeFile, exists } from './fs';
+import { PidConfigType } from './pid_config';
+
+export const writePidFile = async ({
+  pidConfig,
+  logger,
+}: {
+  pidConfig: PidConfigType;
+  logger: Logger;
+}) => {
+  const path = pidConfig.file;
+  if (!path) {
+    return;
+  }
+
+  const pid = String(process.pid);
+
+  if (await exists(path)) {
+    const message = `pid file already exists at ${path}`;
+    if (pidConfig.exclusive) {
+      throw new Error(message);
+    } else {
+      logger.warn(message, { path, pid });
+    }
+  }
+
+  await writeFile(path, pid);
+
+  logger.debug(`wrote pid file to ${path}`, { path, pid });
+
+  const clean = once(() => {
+    unlink(path);
+  });
+
+  process.once('exit', clean); // for "natural" exits
+  process.once('SIGINT', () => {
+    // for Ctrl-C exits
+    clean();
+    // resend SIGINT
+    process.kill(process.pid, 'SIGINT');
+  });
+};
diff --git a/src/core/server/http/base_path_service.ts b/src/core/server/http/base_path_service.ts
index 093d73b2da3bf..059eb36f42dd5 100644
--- a/src/core/server/http/base_path_service.ts
+++ b/src/core/server/http/base_path_service.ts
@@ -16,9 +16,9 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { ensureRawRequest, KibanaRequest, LegacyRequest } from './router';
+import { modifyUrl } from '@kbn/std';
 
-import { modifyUrl } from '../../utils';
+import { ensureRawRequest, KibanaRequest, LegacyRequest } from './router';
 
 /**
  * Access or manipulate the Kibana base path
diff --git a/src/core/server/http/http_service.ts b/src/core/server/http/http_service.ts
index c2fd653918171..82b141c8e50dd 100644
--- a/src/core/server/http/http_service.ts
+++ b/src/core/server/http/http_service.ts
@@ -20,9 +20,9 @@
 import { Observable, Subscription, combineLatest } from 'rxjs';
 import { first, map } from 'rxjs/operators';
 import { Server } from 'hapi';
+import { pick } from '@kbn/std';
 
 import { CoreService } from '../../types';
-import { pick } from '../../utils';
 import { Logger, LoggerFactory } from '../logging';
 import { ContextSetup } from '../context';
 import { Env } from '../config';
diff --git a/src/core/server/http/router/headers.ts b/src/core/server/http/router/headers.ts
index f27f5e937b2c0..498dd153a43dd 100644
--- a/src/core/server/http/router/headers.ts
+++ b/src/core/server/http/router/headers.ts
@@ -17,8 +17,7 @@
  * under the License.
  */
 import { IncomingHttpHeaders } from 'http';
-
-import { pick } from '../../../utils';
+import { pick } from '@kbn/std';
 
 /**
  * Creates a Union type of all known keys of a given interface.
diff --git a/src/core/server/http/router/request.ts b/src/core/server/http/router/request.ts
index 76f8761a7e998..e04f8585981b5 100644
--- a/src/core/server/http/router/request.ts
+++ b/src/core/server/http/router/request.ts
@@ -23,8 +23,8 @@ import { Request, RouteOptionsApp, ApplicationState } from 'hapi';
 import { Observable, fromEvent, merge } from 'rxjs';
 import { shareReplay, first, takeUntil } from 'rxjs/operators';
 import { RecursiveReadonly } from '@kbn/utility-types';
+import { deepFreeze } from '@kbn/std';
 
-import { deepFreeze } from '../../../utils';
 import { Headers } from './headers';
 import { RouteMethod, RouteConfigOptions, validBodyOutput, isSafeMethod } from './route';
 import { KibanaSocket, IKibanaSocket } from './socket';
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index d127471348d9f..01797d073ae2e 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -322,16 +322,7 @@ export {
   MetricsServiceSetup,
 } from './metrics';
 
-export {
-  DEFAULT_APP_CATEGORIES,
-  getFlattenedObject,
-  URLMeaningfulParts,
-  modifyUrl,
-  isRelativeUrl,
-  Freezable,
-  deepFreeze,
-  assertNever,
-} from '../utils';
+export { DEFAULT_APP_CATEGORIES } from '../utils';
 
 export {
   SavedObject,
diff --git a/src/core/server/legacy/config/get_unused_config_keys.ts b/src/core/server/legacy/config/get_unused_config_keys.ts
index d10c574f04974..c15c3b270df05 100644
--- a/src/core/server/legacy/config/get_unused_config_keys.ts
+++ b/src/core/server/legacy/config/get_unused_config_keys.ts
@@ -18,8 +18,8 @@
  */
 
 import { difference } from 'lodash';
+import { getFlattenedObject } from '@kbn/std';
 import { unset } from '../../../../legacy/utils';
-import { getFlattenedObject } from '../../../utils';
 import { hasConfigPathIntersection } from '../../config';
 import { LegacyPluginSpec, LegacyConfig, LegacyVars } from '../types';
 
diff --git a/src/core/server/legacy/legacy_service.ts b/src/core/server/legacy/legacy_service.ts
index d07c81b8b5ebe..fd3e3a694e6ae 100644
--- a/src/core/server/legacy/legacy_service.ts
+++ b/src/core/server/legacy/legacy_service.ts
@@ -20,6 +20,7 @@ import type { PublicMethodsOf } from '@kbn/utility-types';
 import { combineLatest, ConnectableObservable, EMPTY, Observable, Subscription } from 'rxjs';
 import { first, map, publishReplay, tap } from 'rxjs/operators';
 
+import { PathConfigType } from '@kbn/utils';
 import { CoreService } from '../../types';
 import { Config } from '../config';
 import { CoreContext } from '../core_context';
@@ -27,7 +28,6 @@ import { CspConfigType, config as cspConfig } from '../csp';
 import { DevConfig, DevConfigType, config as devConfig } from '../dev';
 import { BasePathProxyServer, HttpConfig, HttpConfigType, config as httpConfig } from '../http';
 import { Logger } from '../logging';
-import { PathConfigType } from '../path';
 import { findLegacyPluginSpecs, logLegacyThirdPartyPluginDeprecationWarning } from './plugins';
 import {
   ILegacyInternals,
diff --git a/src/core/server/logging/appenders/appenders.ts b/src/core/server/logging/appenders/appenders.ts
index edfce4988275a..9c19ee2bd8be5 100644
--- a/src/core/server/logging/appenders/appenders.ts
+++ b/src/core/server/logging/appenders/appenders.ts
@@ -18,8 +18,8 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { assertNever } from '@kbn/std';
 
-import { assertNever } from '../../../utils';
 import {
   LegacyAppender,
   LegacyAppenderConfig,
diff --git a/src/core/server/logging/layouts/layouts.ts b/src/core/server/logging/layouts/layouts.ts
index 124c007bae104..03e8adbee6311 100644
--- a/src/core/server/logging/layouts/layouts.ts
+++ b/src/core/server/logging/layouts/layouts.ts
@@ -18,8 +18,8 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { assertNever } from '@kbn/std';
 
-import { assertNever } from '../../../utils';
 import { LogRecord } from '../log_record';
 import { JsonLayout, JsonLayoutConfigType } from './json_layout';
 import { PatternLayout, PatternLayoutConfigType } from './pattern_layout';
diff --git a/src/core/server/logging/log_level.ts b/src/core/server/logging/log_level.ts
index 577239ddae8e5..165e56e632d6d 100644
--- a/src/core/server/logging/log_level.ts
+++ b/src/core/server/logging/log_level.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { assertNever } from '../../utils';
+import { assertNever } from '@kbn/std';
 
 /**
  * Possible log level string values.
diff --git a/src/core/server/plugins/plugin_context.ts b/src/core/server/plugins/plugin_context.ts
index af0b0e19b3227..8d17300965680 100644
--- a/src/core/server/plugins/plugin_context.ts
+++ b/src/core/server/plugins/plugin_context.ts
@@ -19,6 +19,8 @@
 
 import { map, shareReplay } from 'rxjs/operators';
 import { combineLatest } from 'rxjs';
+import { PathConfigType, config as pathConfig } from '@kbn/utils';
+import { pick, deepFreeze } from '@kbn/std';
 import { CoreContext } from '../core_context';
 import { PluginWrapper } from './plugin';
 import { PluginsServiceSetupDeps, PluginsServiceStartDeps } from './plugins_service';
@@ -28,13 +30,11 @@ import {
   PluginOpaqueId,
   SharedGlobalConfigKeys,
 } from './types';
-import { PathConfigType, config as pathConfig } from '../path';
 import { KibanaConfigType, config as kibanaConfig } from '../kibana_config';
 import {
   ElasticsearchConfigType,
   config as elasticsearchConfig,
 } from '../elasticsearch/elasticsearch_config';
-import { pick, deepFreeze } from '../../utils';
 import { CoreSetup, CoreStart } from '..';
 
 export interface InstanceInfo {
diff --git a/src/core/server/plugins/plugins_service.ts b/src/core/server/plugins/plugins_service.ts
index 30cd47c9d44e1..e8fe42ee491ca 100644
--- a/src/core/server/plugins/plugins_service.ts
+++ b/src/core/server/plugins/plugins_service.ts
@@ -20,9 +20,10 @@
 import Path from 'path';
 import { Observable } from 'rxjs';
 import { filter, first, map, mergeMap, tap, toArray } from 'rxjs/operators';
+import { pick } from '@kbn/std';
+
 import { CoreService } from '../../types';
 import { CoreContext } from '../core_context';
-
 import { Logger } from '../logging';
 import { discover, PluginDiscoveryError, PluginDiscoveryErrorType } from './discovery';
 import { PluginWrapper } from './plugin';
@@ -31,7 +32,6 @@ import { PluginsConfig, PluginsConfigType } from './plugins_config';
 import { PluginsSystem } from './plugins_system';
 import { InternalCoreSetup, InternalCoreStart } from '../internal_types';
 import { IConfigService } from '../config';
-import { pick } from '../../utils';
 import { InternalEnvironmentServiceSetup } from '../environment';
 
 /** @internal */
diff --git a/src/core/server/plugins/plugins_system.ts b/src/core/server/plugins/plugins_system.ts
index b2acd9a6fd04b..72d2cfe158b37 100644
--- a/src/core/server/plugins/plugins_system.ts
+++ b/src/core/server/plugins/plugins_system.ts
@@ -17,13 +17,13 @@
  * under the License.
  */
 
+import { withTimeout } from '@kbn/std';
 import { CoreContext } from '../core_context';
 import { Logger } from '../logging';
 import { PluginWrapper } from './plugin';
 import { DiscoveredPlugin, PluginName } from './types';
 import { createPluginSetupContext, createPluginStartContext } from './plugin_context';
 import { PluginsServiceSetupDeps, PluginsServiceStartDeps } from './plugins_service';
-import { withTimeout } from '../../utils';
 import { PluginDependencies } from '.';
 
 const Sec = 1000;
diff --git a/src/core/server/plugins/types.ts b/src/core/server/plugins/types.ts
index 517261b5bc9bb..34d5e044222eb 100644
--- a/src/core/server/plugins/types.ts
+++ b/src/core/server/plugins/types.ts
@@ -20,12 +20,12 @@
 import { Observable } from 'rxjs';
 import { Type } from '@kbn/config-schema';
 import { RecursiveReadonly } from '@kbn/utility-types';
+import { PathConfigType } from '@kbn/utils';
 
 import { ConfigPath, EnvironmentMode, PackageInfo, ConfigDeprecationProvider } from '../config';
 import { LoggerFactory } from '../logging';
 import { KibanaConfigType } from '../kibana_config';
 import { ElasticsearchConfigType } from '../elasticsearch/elasticsearch_config';
-import { PathConfigType } from '../path';
 import { CoreSetup, CoreStart } from '..';
 
 /**
diff --git a/src/core/server/saved_objects/saved_objects_type_registry.ts b/src/core/server/saved_objects/saved_objects_type_registry.ts
index d0035294226ea..bb840e459bf22 100644
--- a/src/core/server/saved_objects/saved_objects_type_registry.ts
+++ b/src/core/server/saved_objects/saved_objects_type_registry.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { deepFreeze } from '../../utils';
+import { deepFreeze } from '@kbn/std';
 import { SavedObjectsType } from './types';
 
 /**
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index d6572ee8e7d3e..05eb1b8d42386 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -105,7 +105,7 @@ import { NodesInfoParams } from 'elasticsearch';
 import { NodesStatsParams } from 'elasticsearch';
 import { ObjectType } from '@kbn/config-schema';
 import { Observable } from 'rxjs';
-import { ParsedQuery } from 'query-string';
+import { PathConfigType } from '@kbn/utils';
 import { PeerCertificate } from 'tls';
 import { PingParams } from 'elasticsearch';
 import { PutScriptParams } from 'elasticsearch';
@@ -157,9 +157,6 @@ import { Url } from 'url';
 // @public (undocumented)
 export type AppenderConfigType = ConsoleAppenderConfig | FileAppenderConfig | LegacyAppenderConfig;
 
-// @public
-export function assertNever(x: never): never;
-
 // @public @deprecated (undocumented)
 export interface AssistanceAPIResponse {
     // (undocumented)
@@ -501,9 +498,6 @@ export interface CustomHttpResponseOptions<T extends HttpResponsePayload | Respo
     statusCode: number;
 }
 
-// @public
-export function deepFreeze<T extends Freezable>(object: T): RecursiveReadonly<T>;
-
 // @internal (undocumented)
 export const DEFAULT_APP_CATEGORIES: Readonly<{
     kibana: {
@@ -713,11 +707,6 @@ export interface FakeRequest {
     headers: Headers;
 }
 
-// @public (undocumented)
-export type Freezable = {
-    [k: string]: any;
-} | any[];
-
 // @public
 export type GetAuthHeaders = (request: KibanaRequest | LegacyRequest) => AuthHeaders | undefined;
 
@@ -727,11 +716,6 @@ export type GetAuthState = <T = unknown>(request: KibanaRequest | LegacyRequest)
     state: T;
 };
 
-// @public
-export function getFlattenedObject(rootValue: Record<string, any>): {
-    [key: string]: any;
-};
-
 // @public (undocumented)
 export interface GetResponse<T> {
     // (undocumented)
@@ -963,9 +947,6 @@ export interface IScopedClusterClient {
     readonly asInternalUser: ElasticsearchClient;
 }
 
-// @public
-export function isRelativeUrl(candidatePath: string): boolean;
-
 // @public
 export interface IUiSettingsClient {
     get: <T = any>(key: string) => Promise<T>;
@@ -1540,9 +1521,6 @@ export type MIGRATION_ASSISTANCE_INDEX_ACTION = 'upgrade' | 'reindex';
 // @public @deprecated (undocumented)
 export type MIGRATION_DEPRECATION_LEVEL = 'none' | 'info' | 'warning' | 'critical';
 
-// @public
-export function modifyUrl(url: string, urlModifier: (urlParts: URLMeaningfulParts) => Partial<URLMeaningfulParts> | void): string;
-
 // @public
 export type MutatingOperationRefreshSetting = boolean | 'wait_for';
 
@@ -2845,26 +2823,6 @@ export interface UiSettingsServiceStart {
 // @public
 export type UiSettingsType = 'undefined' | 'json' | 'markdown' | 'number' | 'select' | 'boolean' | 'string' | 'array' | 'image';
 
-// @public
-export interface URLMeaningfulParts {
-    // (undocumented)
-    auth?: string | null;
-    // (undocumented)
-    hash?: string | null;
-    // (undocumented)
-    hostname?: string | null;
-    // (undocumented)
-    pathname?: string | null;
-    // (undocumented)
-    port?: string | null;
-    // (undocumented)
-    protocol?: string | null;
-    // (undocumented)
-    query: ParsedQuery;
-    // (undocumented)
-    slashes?: boolean | null;
-}
-
 // @public
 export interface UserProvidedValues<T = any> {
     // (undocumented)
@@ -2883,6 +2841,5 @@ export const validBodyOutput: readonly ["data", "stream"];
 // src/core/server/legacy/types.ts:135:16 - (ae-forgotten-export) The symbol "LegacyPluginSpec" needs to be exported by the entry point index.d.ts
 // src/core/server/plugins/types.ts:272:3 - (ae-forgotten-export) The symbol "KibanaConfigType" needs to be exported by the entry point index.d.ts
 // src/core/server/plugins/types.ts:272:3 - (ae-forgotten-export) The symbol "SharedGlobalConfigKeys" needs to be exported by the entry point index.d.ts
-// src/core/server/plugins/types.ts:274:3 - (ae-forgotten-export) The symbol "PathConfigType" needs to be exported by the entry point index.d.ts
 
 ```
diff --git a/src/core/server/server.ts b/src/core/server/server.ts
index a02b0f51b559f..c689e2cb70cc9 100644
--- a/src/core/server/server.ts
+++ b/src/core/server/server.ts
@@ -17,6 +17,8 @@
  * under the License.
  */
 
+import { config as pathConfig } from '@kbn/utils';
+import { mapToObject } from '@kbn/std';
 import { ConfigService, Env, RawConfigurationProvider, coreDeprecationProvider } from './config';
 import { CoreApp } from './core_app';
 import { AuditTrailService } from './audit_trail';
@@ -31,7 +33,7 @@ import { PluginsService, config as pluginsConfig } from './plugins';
 import { SavedObjectsService } from '../server/saved_objects';
 import { MetricsService, opsConfig } from './metrics';
 import { CapabilitiesService } from './capabilities';
-import { EnvironmentService } from './environment';
+import { EnvironmentService, config as pidConfig } from './environment';
 import { StatusService } from './status/status_service';
 
 import { config as cspConfig } from './csp';
@@ -39,12 +41,10 @@ import { config as elasticsearchConfig } from './elasticsearch';
 import { config as httpConfig } from './http';
 import { config as loggingConfig } from './logging';
 import { config as devConfig } from './dev';
-import { config as pathConfig } from './path';
 import { config as kibanaConfig } from './kibana_config';
 import { savedObjectsConfig, savedObjectsMigrationConfig } from './saved_objects';
 import { config as uiSettingsConfig } from './ui_settings';
 import { config as statusConfig } from './status';
-import { mapToObject } from '../utils';
 import { ContextService } from './context';
 import { RequestHandlerContext } from '.';
 import { InternalCoreSetup, InternalCoreStart, ServiceConfigDescriptor } from './internal_types';
@@ -310,6 +310,7 @@ export class Server {
       uiSettingsConfig,
       opsConfig,
       statusConfig,
+      pidConfig,
     ];
 
     this.configService.addDeprecationProvider(rootConfigPath, coreDeprecationProvider);
diff --git a/src/core/server/status/types.ts b/src/core/server/status/types.ts
index f884b80316fa8..9fa33a8c6d40c 100644
--- a/src/core/server/status/types.ts
+++ b/src/core/server/status/types.ts
@@ -18,7 +18,7 @@
  */
 
 import { Observable } from 'rxjs';
-import { deepFreeze } from '../../utils';
+import { deepFreeze } from '@kbn/std';
 import { PluginName } from '../plugins';
 
 /**
diff --git a/src/core/server/ui_settings/settings/navigation.ts b/src/core/server/ui_settings/settings/navigation.ts
index 6483e86a1395a..ec825a2779f38 100644
--- a/src/core/server/ui_settings/settings/navigation.ts
+++ b/src/core/server/ui_settings/settings/navigation.ts
@@ -19,8 +19,8 @@
 
 import { schema } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
+import { isRelativeUrl } from '@kbn/std';
 import { UiSettingsParams } from '../../../types';
-import { isRelativeUrl } from '../../../utils';
 
 export const getNavigationSettings = (): Record<string, UiSettingsParams> => {
   return {
diff --git a/src/core/server/ui_settings/ui_settings_service.ts b/src/core/server/ui_settings/ui_settings_service.ts
index 8598cf7a62287..25062490f5b6b 100644
--- a/src/core/server/ui_settings/ui_settings_service.ts
+++ b/src/core/server/ui_settings/ui_settings_service.ts
@@ -19,10 +19,11 @@
 
 import { Observable } from 'rxjs';
 import { first } from 'rxjs/operators';
+import { mapToObject } from '@kbn/std';
+
 import { CoreService } from '../../types';
 import { CoreContext } from '../core_context';
 import { Logger } from '../logging';
-
 import { SavedObjectsClientContract } from '../saved_objects/types';
 import { InternalSavedObjectsServiceSetup } from '../saved_objects';
 import { InternalHttpServiceSetup } from '../http';
@@ -33,7 +34,6 @@ import {
   InternalUiSettingsServiceStart,
   UiSettingsParams,
 } from './types';
-import { mapToObject } from '../../utils/';
 import { uiSettingsType } from './saved_objects';
 import { registerRoutes } from './routes';
 import { getCoreSettings } from './settings';
diff --git a/src/core/utils/context.ts b/src/core/utils/context.ts
index 941bbceb0cd92..f28d3330b8e36 100644
--- a/src/core/utils/context.ts
+++ b/src/core/utils/context.ts
@@ -19,8 +19,8 @@
 
 import { flatten } from 'lodash';
 import { ShallowPromise } from '@kbn/utility-types';
-import { pick } from '.';
-import { CoreId, PluginOpaqueId } from '../server';
+import { pick } from '@kbn/std';
+import type { CoreId, PluginOpaqueId } from '../server';
 
 /**
  * Make all properties in T optional, except for the properties whose keys are in the union K
diff --git a/src/core/utils/index.ts b/src/core/utils/index.ts
index a6df0992f6cc6..c620e4e5ee155 100644
--- a/src/core/utils/index.ts
+++ b/src/core/utils/index.ts
@@ -17,15 +17,12 @@
  * under the License.
  */
 
-export * from './assert_never';
-export * from './context';
-export * from './deep_freeze';
-export * from './get';
-export * from './map_to_object';
-export * from './merge';
-export * from './pick';
-export * from './promise';
-export * from './url';
-export * from './unset';
-export * from './get_flattened_object';
-export * from './default_app_categories';
+export {
+  ContextContainer,
+  HandlerContextType,
+  HandlerFunction,
+  HandlerParameters,
+  IContextContainer,
+  IContextProvider,
+} from './context';
+export { DEFAULT_APP_CATEGORIES } from './default_app_categories';
diff --git a/src/dev/build/lib/build.test.ts b/src/dev/build/lib/build.test.ts
index 9fdf21cee6567..7ccd5b8e13a2c 100644
--- a/src/dev/build/lib/build.test.ts
+++ b/src/dev/build/lib/build.test.ts
@@ -17,7 +17,8 @@
  * under the License.
  */
 
-import { REPO_ROOT, createAbsolutePathSerializer } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { createAbsolutePathSerializer } from '@kbn/dev-utils';
 
 import { Config } from './config';
 import { Build } from './build';
diff --git a/src/dev/build/lib/config.test.ts b/src/dev/build/lib/config.test.ts
index 0539adc840a6a..bb4d4c000e9d5 100644
--- a/src/dev/build/lib/config.test.ts
+++ b/src/dev/build/lib/config.test.ts
@@ -19,7 +19,8 @@
 
 import { resolve } from 'path';
 
-import { createAbsolutePathSerializer, REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { createAbsolutePathSerializer } from '@kbn/dev-utils';
 
 import pkg from '../../../../package.json';
 import { Config } from './config';
diff --git a/src/dev/build/tasks/build_kibana_platform_plugins.ts b/src/dev/build/tasks/build_kibana_platform_plugins.ts
index 48625078e9bd1..44b441ad898c3 100644
--- a/src/dev/build/tasks/build_kibana_platform_plugins.ts
+++ b/src/dev/build/tasks/build_kibana_platform_plugins.ts
@@ -17,7 +17,8 @@
  * under the License.
  */
 
-import { CiStatsReporter, REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { CiStatsReporter } from '@kbn/dev-utils';
 import {
   runOptimizer,
   OptimizerConfig,
diff --git a/src/dev/build/tasks/nodejs/extract_node_builds_task.test.ts b/src/dev/build/tasks/nodejs/extract_node_builds_task.test.ts
index a5b9e01714f38..cd197db251093 100644
--- a/src/dev/build/tasks/nodejs/extract_node_builds_task.test.ts
+++ b/src/dev/build/tasks/nodejs/extract_node_builds_task.test.ts
@@ -20,12 +20,12 @@
 import { readFileSync } from 'fs';
 import Path from 'path';
 
+import { REPO_ROOT } from '@kbn/utils';
 import {
   ToolingLog,
   ToolingLogCollectingWriter,
   createAbsolutePathSerializer,
   createRecursiveSerializer,
-  REPO_ROOT,
 } from '@kbn/dev-utils';
 
 import { Config } from '../../lib';
diff --git a/src/dev/build/tasks/nodejs/verify_existing_node_builds_task.test.ts b/src/dev/build/tasks/nodejs/verify_existing_node_builds_task.test.ts
index 1a850890a33fe..9b03dcd828cf9 100644
--- a/src/dev/build/tasks/nodejs/verify_existing_node_builds_task.test.ts
+++ b/src/dev/build/tasks/nodejs/verify_existing_node_builds_task.test.ts
@@ -20,12 +20,12 @@
 import Path from 'path';
 import Fs from 'fs';
 
+import { REPO_ROOT } from '@kbn/utils';
 import {
   ToolingLog,
   ToolingLogCollectingWriter,
   createAnyInstanceSerializer,
   createRecursiveSerializer,
-  REPO_ROOT,
 } from '@kbn/dev-utils';
 
 import { Config, Platform } from '../../lib';
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile b/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile
index d235bfe9d6fbc..24649a52b729b 100644
--- a/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile
+++ b/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile
@@ -85,7 +85,6 @@ RUN groupadd --gid 1000 kibana && \
     useradd --uid 1000 --gid 1000 \
       --home-dir /usr/share/kibana --no-create-home \
       kibana
-USER kibana
 
 LABEL org.label-schema.build-date="{{dockerBuildDate}}" \
   org.label-schema.license="{{license}}" \
@@ -115,8 +114,13 @@ LABEL name="Kibana" \
   release="1" \
   summary="Kibana" \
   description="Your window into the Elastic Stack."
+
+RUN mkdir /licenses && \
+    cp LICENSE.txt /licenses/LICENSE
 {{/ubi}}
 
+USER kibana
+
 ENTRYPOINT ["/usr/local/bin/dumb-init", "--"]
 
 CMD ["/usr/local/bin/kibana-docker"]
diff --git a/src/dev/ci_setup/setup.sh b/src/dev/ci_setup/setup.sh
index 3351170c29e01..aabc1e75b9025 100755
--- a/src/dev/ci_setup/setup.sh
+++ b/src/dev/ci_setup/setup.sh
@@ -16,12 +16,6 @@ echo " -- TEST_ES_SNAPSHOT_VERSION='$TEST_ES_SNAPSHOT_VERSION'"
 echo " -- installing node.js dependencies"
 yarn kbn bootstrap --prefer-offline
 
-###
-### ensure Chromedriver install hook is triggered
-### when modules are up-to-date
-###
-node node_modules/chromedriver/install.js
-
 ###
 ### Download es snapshots
 ###
diff --git a/src/dev/ci_setup/setup_env.sh b/src/dev/ci_setup/setup_env.sh
index 5757d72f99582..72ec73ad810e6 100644
--- a/src/dev/ci_setup/setup_env.sh
+++ b/src/dev/ci_setup/setup_env.sh
@@ -134,13 +134,13 @@ export CYPRESS_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudf
 export CHECKS_REPORTER_ACTIVE=false
 
 # This is mainly for release-manager builds, which run in an environment that doesn't have Chrome installed
-# if [[ "$(which google-chrome-stable)" || "$(which google-chrome)" ]]; then
-#   echo "Chrome detected, setting DETECT_CHROMEDRIVER_VERSION=true"
-#   export DETECT_CHROMEDRIVER_VERSION=true
-#   export CHROMEDRIVER_FORCE_DOWNLOAD=true
-# else
-#   echo "Chrome not detected, installing default chromedriver binary for the package version"
-# fi
+if [[ "$(which google-chrome-stable)" || "$(which google-chrome)" ]]; then
+  echo "Chrome detected, setting DETECT_CHROMEDRIVER_VERSION=true"
+  export DETECT_CHROMEDRIVER_VERSION=true
+  export CHROMEDRIVER_FORCE_DOWNLOAD=true
+else
+  echo "Chrome not detected, installing default chromedriver binary for the package version"
+fi
 
 ### only run on pr jobs for elastic/kibana, checks-reporter doesn't work for other repos
 if [[ "$ghprbPullId" && "$ghprbGhRepository" == 'elastic/kibana' ]] ; then
diff --git a/src/dev/constants.ts b/src/dev/constants.ts
index d1b89719c69b7..9ce18ffdc9bcd 100644
--- a/src/dev/constants.ts
+++ b/src/dev/constants.ts
@@ -17,10 +17,6 @@
  * under the License.
  */
 
-import { dirname } from 'path';
-
-export const REPO_ROOT = dirname(require.resolve('../../package.json'));
-
 // Files in directories of this name will be treated as Jest integration tests with instances of
 // Elasticsearch and the Kibana server.
 export const RESERVED_DIR_JEST_INTEGRATION_TESTS = 'integration_tests';
diff --git a/src/dev/eslint/lint_files.ts b/src/dev/eslint/lint_files.ts
index ba16163fc9bd3..ebd6bedb5f56c 100644
--- a/src/dev/eslint/lint_files.ts
+++ b/src/dev/eslint/lint_files.ts
@@ -19,9 +19,9 @@
 
 import { CLIEngine } from 'eslint';
 
+import { REPO_ROOT } from '@kbn/utils';
 import { createFailError, ToolingLog } from '@kbn/dev-utils';
 import { File } from '../file';
-import { REPO_ROOT } from '../constants';
 
 /**
  * Lints a list of files with eslint. eslint reports are written to the log
diff --git a/src/dev/license_checker/run_check_licenses_cli.ts b/src/dev/license_checker/run_check_licenses_cli.ts
index 0267a1a90d4fe..70ebb43c788f9 100644
--- a/src/dev/license_checker/run_check_licenses_cli.ts
+++ b/src/dev/license_checker/run_check_licenses_cli.ts
@@ -17,12 +17,12 @@
  * under the License.
  */
 
+import { REPO_ROOT } from '@kbn/utils';
 import { run } from '@kbn/dev-utils';
 import { getInstalledPackages } from '../npm';
 
 import { LICENSE_WHITELIST, DEV_ONLY_LICENSE_WHITELIST, LICENSE_OVERRIDES } from './config';
 import { assertLicensesValid } from './valid';
-import { REPO_ROOT } from '../constants';
 
 run(
   async ({ log, flags }) => {
diff --git a/src/dev/notice/cli.js b/src/dev/notice/cli.js
index 34217ef48a33b..ea0f884bb1ea0 100644
--- a/src/dev/notice/cli.js
+++ b/src/dev/notice/cli.js
@@ -22,9 +22,9 @@ import { resolve } from 'path';
 
 import getopts from 'getopts';
 import dedent from 'dedent';
+import { REPO_ROOT } from '@kbn/utils';
 import { ToolingLog, pickLevelFromFlags } from '@kbn/dev-utils';
 
-import { REPO_ROOT } from '../constants';
 import { generateNoticeFromSource } from './generate_notice_from_source';
 
 const unknownFlags = [];
diff --git a/src/dev/npm/integration_tests/installed_packages.test.ts b/src/dev/npm/integration_tests/installed_packages.test.ts
index 58c954cbc12f7..3aeb5b106c2ec 100644
--- a/src/dev/npm/integration_tests/installed_packages.test.ts
+++ b/src/dev/npm/integration_tests/installed_packages.test.ts
@@ -21,8 +21,8 @@ import { resolve, sep } from 'path';
 
 import { uniq } from 'lodash';
 
+import { REPO_ROOT } from '@kbn/utils';
 import { getInstalledPackages, InstalledPackage } from '../installed_packages';
-import { REPO_ROOT } from '../../constants';
 
 const FIXTURE1_ROOT = resolve(__dirname, '__fixtures__/fixture1');
 
diff --git a/src/dev/precommit_hook/get_files_for_commit.js b/src/dev/precommit_hook/get_files_for_commit.js
index dc5560be0d1ad..e700b58782174 100644
--- a/src/dev/precommit_hook/get_files_for_commit.js
+++ b/src/dev/precommit_hook/get_files_for_commit.js
@@ -20,7 +20,7 @@
 import SimpleGit from 'simple-git';
 import { fromNode as fcb } from 'bluebird';
 
-import { REPO_ROOT } from '../constants';
+import { REPO_ROOT } from '@kbn/utils';
 import { File } from '../file';
 
 /**
diff --git a/src/dev/run_check_file_casing.js b/src/dev/run_check_file_casing.js
index bdbf1827897e7..3acff74430abe 100644
--- a/src/dev/run_check_file_casing.js
+++ b/src/dev/run_check_file_casing.js
@@ -19,9 +19,9 @@
 
 import globby from 'globby';
 
+import { REPO_ROOT } from '@kbn/utils';
 import { run } from '@kbn/dev-utils';
 import { File } from './file';
-import { REPO_ROOT } from './constants';
 import { checkFileCasing } from './precommit_hook/check_file_casing';
 
 run(async ({ log }) => {
diff --git a/src/dev/run_check_lockfile_symlinks.js b/src/dev/run_check_lockfile_symlinks.js
index 5ebb7952e2cf3..c4e040c4bffa3 100644
--- a/src/dev/run_check_lockfile_symlinks.js
+++ b/src/dev/run_check_lockfile_symlinks.js
@@ -21,9 +21,9 @@ import { existsSync, lstatSync, readFileSync, readlinkSync } from 'fs';
 import globby from 'globby';
 import { dirname } from 'path';
 
+import { REPO_ROOT } from '@kbn/utils';
 import { run, createFailError } from '@kbn/dev-utils';
 
-import { REPO_ROOT } from './constants';
 import { File } from './file';
 import { matchesAnyGlob } from './globs';
 
diff --git a/src/dev/storybook/commands/clean.ts b/src/dev/storybook/commands/clean.ts
index 328c4d9e2c23c..539757d0e7ad2 100644
--- a/src/dev/storybook/commands/clean.ts
+++ b/src/dev/storybook/commands/clean.ts
@@ -18,7 +18,7 @@
  */
 
 import { ToolingLog } from '@kbn/dev-utils';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import { join } from 'path';
 import del from 'del';
 
diff --git a/src/dev/storybook/run_storybook_cli.ts b/src/dev/storybook/run_storybook_cli.ts
index 7f97cff91aaaa..b1e8d882e5352 100644
--- a/src/dev/storybook/run_storybook_cli.ts
+++ b/src/dev/storybook/run_storybook_cli.ts
@@ -19,7 +19,7 @@
 
 import { join } from 'path';
 import { run, createFlagError } from '@kbn/dev-utils';
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import { storybookAliases } from './aliases';
 import { clean } from './commands/clean';
 
diff --git a/src/dev/typescript/get_ts_project_for_absolute_path.ts b/src/dev/typescript/get_ts_project_for_absolute_path.ts
index 54d7e950834a4..0057263660b77 100644
--- a/src/dev/typescript/get_ts_project_for_absolute_path.ts
+++ b/src/dev/typescript/get_ts_project_for_absolute_path.ts
@@ -18,7 +18,7 @@
  */
 
 import { relative, resolve } from 'path';
-import { REPO_ROOT } from '../constants';
+import { REPO_ROOT } from '@kbn/utils';
 import { File } from '../file';
 import { Project } from './project';
 import { PROJECTS } from './projects';
diff --git a/src/dev/typescript/project.ts b/src/dev/typescript/project.ts
index 4cf87d812a0b3..811c1792f1988 100644
--- a/src/dev/typescript/project.ts
+++ b/src/dev/typescript/project.ts
@@ -23,7 +23,7 @@ import { basename, dirname, relative, resolve } from 'path';
 import { IMinimatch, Minimatch } from 'minimatch';
 import { parseConfigFileTextToJson } from 'typescript';
 
-import { REPO_ROOT } from '../constants';
+import { REPO_ROOT } from '@kbn/utils';
 
 function makeMatchers(directory: string, patterns: string[]) {
   return patterns.map(
diff --git a/src/dev/typescript/projects.ts b/src/dev/typescript/projects.ts
index 6fa07190dc43e..4d1e549e192b6 100644
--- a/src/dev/typescript/projects.ts
+++ b/src/dev/typescript/projects.ts
@@ -19,7 +19,7 @@
 
 import glob from 'glob';
 import { resolve } from 'path';
-import { REPO_ROOT } from '../constants';
+import { REPO_ROOT } from '@kbn/utils';
 import { Project } from './project';
 
 export const PROJECTS = [
diff --git a/src/dev/typescript/run_check_ts_projects_cli.ts b/src/dev/typescript/run_check_ts_projects_cli.ts
index b0c125ea47829..a095bef047711 100644
--- a/src/dev/typescript/run_check_ts_projects_cli.ts
+++ b/src/dev/typescript/run_check_ts_projects_cli.ts
@@ -22,8 +22,8 @@ import { resolve } from 'path';
 import execa from 'execa';
 
 import { run } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
-const REPO_ROOT = resolve(__dirname, '../../../');
 import { File } from '../file';
 import { PROJECTS } from './projects';
 
diff --git a/src/dev/typescript/run_type_check_cli.ts b/src/dev/typescript/run_type_check_cli.ts
index e1fca23274a5a..00968b7259a30 100644
--- a/src/dev/typescript/run_type_check_cli.ts
+++ b/src/dev/typescript/run_type_check_cli.ts
@@ -98,7 +98,7 @@ export async function runTypeCheckCli() {
   }
 
   execInProjects(log, projects, process.execPath, (project) => [
-    '--max-old-space-size=4096',
+    '--max-old-space-size=5120',
     require.resolve('typescript/bin/tsc'),
     ...['--project', project.tsConfigPath],
     ...tscArgs,
diff --git a/src/legacy/server/config/schema.js b/src/legacy/server/config/schema.js
index ce7a500a00dc8..f8736fb30f90e 100644
--- a/src/legacy/server/config/schema.js
+++ b/src/legacy/server/config/schema.js
@@ -42,10 +42,7 @@ export default () =>
       basePathProxyTarget: Joi.number().default(5603),
     }).default(),
 
-    pid: Joi.object({
-      file: Joi.string(),
-      exclusive: Joi.boolean().default(false),
-    }).default(),
+    pid: HANDLED_IN_NEW_PLATFORM,
 
     csp: HANDLED_IN_NEW_PLATFORM,
 
diff --git a/src/legacy/server/kbn_server.js b/src/legacy/server/kbn_server.js
index a5eefd140c8fa..24d00abb99a05 100644
--- a/src/legacy/server/kbn_server.js
+++ b/src/legacy/server/kbn_server.js
@@ -29,7 +29,6 @@ import { coreMixin } from './core';
 import { loggingMixin } from './logging';
 import warningsMixin from './warnings';
 import { statusMixin } from './status';
-import pidMixin from './pid';
 import configCompleteMixin from './config/complete';
 import { optimizeMixin } from '../../optimize';
 import * as Plugins from './plugins';
@@ -93,9 +92,6 @@ export default class KbnServer {
         warningsMixin,
         statusMixin,
 
-        // writes pid file
-        pidMixin,
-
         // scan translations dirs, register locale files and initialize i18n engine.
         i18nMixin,
 
diff --git a/src/legacy/server/logging/log_interceptor.js b/src/legacy/server/logging/log_interceptor.js
index 0754557044583..2298d83aa2857 100644
--- a/src/legacy/server/logging/log_interceptor.js
+++ b/src/legacy/server/logging/log_interceptor.js
@@ -20,7 +20,11 @@
 import Stream from 'stream';
 import { get, isEqual } from 'lodash';
 
-const GET_CLIENT_HELLO = /GET_CLIENT_HELLO:http/;
+/**
+ * Matches error messages when clients connect via HTTP instead of HTTPS; see unit test for full message. Warning: this can change when Node
+ * and its bundled OpenSSL binary are upgraded.
+ */
+const OPENSSL_GET_RECORD_REGEX = /ssl3_get_record:http/;
 
 function doTagsMatch(event, tags) {
   return isEqual(get(event, 'tags'), tags);
@@ -124,7 +128,7 @@ export class LogInterceptor extends Stream.Transform {
   }
 
   downgradeIfHTTPWhenHTTPS(event) {
-    return downgradeIfErrorMessage(GET_CLIENT_HELLO, event);
+    return downgradeIfErrorMessage(OPENSSL_GET_RECORD_REGEX, event);
   }
 
   _transform(event, enc, next) {
diff --git a/src/legacy/server/logging/log_interceptor.test.js b/src/legacy/server/logging/log_interceptor.test.js
index c99373ebe0a63..492d1ffc8d167 100644
--- a/src/legacy/server/logging/log_interceptor.test.js
+++ b/src/legacy/server/logging/log_interceptor.test.js
@@ -147,7 +147,7 @@ describe('server logging LogInterceptor', () => {
   describe('#downgradeIfHTTPWhenHTTPS', () => {
     it('transforms http requests when serving https errors', () => {
       const message =
-        '40735139278848:error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request:../deps/openssl/openssl/ssl/s23_srvr.c:394';
+        '4584650176:error:1408F09C:SSL routines:ssl3_get_record:http request:../deps/openssl/openssl/ssl/record/ssl3_record.c:322:\n';
       const interceptor = new LogInterceptor();
       const event = stubClientErrorEvent({ message });
       assertDowngraded(interceptor.downgradeIfHTTPWhenHTTPS(event));
diff --git a/src/legacy/server/pid/index.js b/src/legacy/server/pid/index.js
deleted file mode 100644
index d7b9da1292252..0000000000000
--- a/src/legacy/server/pid/index.js
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-import Boom from 'boom';
-import Bluebird from 'bluebird';
-import { unlinkSync as unlink } from 'fs';
-const writeFile = Bluebird.promisify(require('fs').writeFile);
-
-export default Bluebird.method(function (kbnServer, server, config) {
-  const path = config.get('pid.file');
-  if (!path) return;
-
-  const pid = String(process.pid);
-
-  return writeFile(path, pid, { flag: 'wx' })
-    .catch(function (err) {
-      if (err.code !== 'EEXIST') throw err;
-
-      const message = `pid file already exists at ${path}`;
-      const metadata = {
-        path: path,
-        pid: pid,
-      };
-
-      if (config.get('pid.exclusive')) {
-        throw Boom.internal(message, { message, ...metadata });
-      } else {
-        server.log(['pid', 'warning'], message, metadata);
-      }
-
-      return writeFile(path, pid);
-    })
-    .then(function () {
-      server.logWithMetadata(['pid', 'debug'], `wrote pid file to ${path}`, {
-        path: path,
-        pid: pid,
-      });
-
-      const clean = _.once(function () {
-        unlink(path);
-      });
-
-      process.once('exit', clean); // for "natural" exits
-      process.once('SIGINT', function () {
-        // for Ctrl-C exits
-        clean();
-
-        // resend SIGINT
-        process.kill(process.pid, 'SIGINT');
-      });
-
-      process.on('unhandledRejection', function (reason) {
-        server.log(['warning'], `Detected an unhandled Promise rejection.\n${reason}`);
-      });
-    });
-});
diff --git a/src/plugins/apm_oss/server/tutorial/index_pattern.json b/src/plugins/apm_oss/server/tutorial/index_pattern.json
index 1d061f9e11e61..bb42b223c85ed 100644
--- a/src/plugins/apm_oss/server/tutorial/index_pattern.json
+++ b/src/plugins/apm_oss/server/tutorial/index_pattern.json
@@ -1,11 +1,11 @@
 {
   "attributes": {
-    "fieldFormatMap": "{\"client.bytes\":{\"id\":\"bytes\"},\"client.nat.port\":{\"id\":\"string\"},\"client.port\":{\"id\":\"string\"},\"destination.bytes\":{\"id\":\"bytes\"},\"destination.nat.port\":{\"id\":\"string\"},\"destination.port\":{\"id\":\"string\"},\"event.duration\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asMilliseconds\",\"outputPrecision\":1}},\"event.sequence\":{\"id\":\"string\"},\"event.severity\":{\"id\":\"string\"},\"http.request.body.bytes\":{\"id\":\"bytes\"},\"http.request.bytes\":{\"id\":\"bytes\"},\"http.response.body.bytes\":{\"id\":\"bytes\"},\"http.response.bytes\":{\"id\":\"bytes\"},\"http.response.status_code\":{\"id\":\"string\"},\"log.syslog.facility.code\":{\"id\":\"string\"},\"log.syslog.priority\":{\"id\":\"string\"},\"network.bytes\":{\"id\":\"bytes\"},\"package.size\":{\"id\":\"string\"},\"process.parent.pgid\":{\"id\":\"string\"},\"process.parent.pid\":{\"id\":\"string\"},\"process.parent.ppid\":{\"id\":\"string\"},\"process.parent.thread.id\":{\"id\":\"string\"},\"process.pgid\":{\"id\":\"string\"},\"process.pid\":{\"id\":\"string\"},\"process.ppid\":{\"id\":\"string\"},\"process.thread.id\":{\"id\":\"string\"},\"server.bytes\":{\"id\":\"bytes\"},\"server.nat.port\":{\"id\":\"string\"},\"server.port\":{\"id\":\"string\"},\"source.bytes\":{\"id\":\"bytes\"},\"source.nat.port\":{\"id\":\"string\"},\"source.port\":{\"id\":\"string\"},\"system.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.memory.actual.free\":{\"id\":\"bytes\"},\"system.memory.total\":{\"id\":\"bytes\"},\"system.process.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.process.memory.rss.bytes\":{\"id\":\"bytes\"},\"system.process.memory.size\":{\"id\":\"bytes\"},\"url.port\":{\"id\":\"string\"},\"view spans\":{\"id\":\"url\",\"params\":{\"labelTemplate\":\"View Spans\"}}}",
-    "fields": "[{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"@timestamp\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.account.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.availability_zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.machine.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.region\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.tag\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.runtime\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.data\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.ttl\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.header_flags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.op_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.subdomain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.resolved_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.response_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"ecs.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.stack_trace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.stack_trace.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.dataset\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.duration\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.end\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.ingested\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.kind\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.outcome\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score_norm\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.sequence\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.severity\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.timezone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.url\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.accessed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.attributes\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.ctime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.device\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.drive_letter\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.gid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.group\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.inode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mime_type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mtime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.owner\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.path.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.target_path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.target_path.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.content.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.method\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.referrer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.content.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.status_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"interface.alias\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"interface.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"interface.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.logger\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.priority\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.application\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.community_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.direction\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.forwarded_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.iana_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.inner\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.inner.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.inner.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.transport\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.interface.alias\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.interface.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.interface.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.interface.alias\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.interface.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.interface.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.serial_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.vendor\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.build_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.checksum\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.install_scope\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.installed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.license\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.args\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.args_count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.command_line\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.command_line.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.entity_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.executable\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.executable.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.exit_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.args\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.args_count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.command_line\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.command_line.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.entity_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.executable\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.executable.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.exit_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.pgid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.pid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.ppid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.thread.id\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.thread.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.title\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.title.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.working_directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.working_directory.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pgid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.ppid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.id\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.title\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.title.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.working_directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.working_directory.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.data.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.data.strings\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.data.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.hive\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.key\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.value\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.user\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.author\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.license\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.ruleset\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.uuid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.state\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.framework\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.cipher\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.certificate\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.certificate_chain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.issuer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.ja3\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.not_after\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.not_before\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.server_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.subject\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.supported_ciphers\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.curve\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.established\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.next_protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.resumed\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.certificate\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.certificate_chain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.issuer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.ja3s\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.not_after\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.not_before\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.subject\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.version_protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.fragment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.original.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.password\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.query\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.scheme\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.username\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.device.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.classification\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.description.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.enumeration\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.report_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.scanner.vendor\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.base\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.environmental\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.temporal\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.severity\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"fields\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"timeseries.instance\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.project.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.image.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"docker.container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.containerized\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.build\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.codename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.namespace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.labels.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.annotations.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.replicaset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.deployment.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.statefulset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.image\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.event\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"timestamp.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.request.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.finished\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.response.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.environment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.sampled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.breakdown.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.subtype\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"parent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.listening\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version_major\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"experimental\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.account.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.project.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.culprit\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.grouping_key\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.handled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.logger_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.param_message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.total\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.actual.free\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.rss.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.root\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.cpu.ns\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.samples.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.alloc_objects.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.alloc_space.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.inuse_objects.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.inuse_space.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.duration\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.filename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.filename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.bundle_filepath\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"view spans\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"child.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.start.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.sync\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.db.link\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.db.rows_affected\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.resource\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.message.queue.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.message.age.ms\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.result\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks.*.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.span_count.dropped\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.message.queue.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.message.age.ms\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.histogram\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_id\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_index\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_score\",\"scripted\":false,\"searchable\":false,\"type\":\"number\"}]",
+    "fieldFormatMap": "{\"client.bytes\":{\"id\":\"bytes\"},\"client.nat.port\":{\"id\":\"string\"},\"client.port\":{\"id\":\"string\"},\"destination.bytes\":{\"id\":\"bytes\"},\"destination.nat.port\":{\"id\":\"string\"},\"destination.port\":{\"id\":\"string\"},\"event.duration\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asMilliseconds\",\"outputPrecision\":1}},\"event.sequence\":{\"id\":\"string\"},\"event.severity\":{\"id\":\"string\"},\"http.request.body.bytes\":{\"id\":\"bytes\"},\"http.request.bytes\":{\"id\":\"bytes\"},\"http.response.body.bytes\":{\"id\":\"bytes\"},\"http.response.bytes\":{\"id\":\"bytes\"},\"http.response.status_code\":{\"id\":\"string\"},\"log.syslog.facility.code\":{\"id\":\"string\"},\"log.syslog.priority\":{\"id\":\"string\"},\"network.bytes\":{\"id\":\"bytes\"},\"package.size\":{\"id\":\"string\"},\"process.parent.pgid\":{\"id\":\"string\"},\"process.parent.pid\":{\"id\":\"string\"},\"process.parent.ppid\":{\"id\":\"string\"},\"process.parent.thread.id\":{\"id\":\"string\"},\"process.pgid\":{\"id\":\"string\"},\"process.pid\":{\"id\":\"string\"},\"process.ppid\":{\"id\":\"string\"},\"process.thread.id\":{\"id\":\"string\"},\"server.bytes\":{\"id\":\"bytes\"},\"server.nat.port\":{\"id\":\"string\"},\"server.port\":{\"id\":\"string\"},\"source.bytes\":{\"id\":\"bytes\"},\"source.nat.port\":{\"id\":\"string\"},\"source.port\":{\"id\":\"string\"},\"system.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.memory.actual.free\":{\"id\":\"bytes\"},\"system.memory.total\":{\"id\":\"bytes\"},\"system.process.cgroup.memory.mem.limit.bytes\":{\"id\":\"bytes\"},\"system.process.cgroup.memory.mem.usage.bytes\":{\"id\":\"bytes\"},\"system.process.cgroup.memory.stats.inactive_file.bytes\":{\"id\":\"bytes\"},\"system.process.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.process.memory.rss.bytes\":{\"id\":\"bytes\"},\"system.process.memory.size\":{\"id\":\"bytes\"},\"url.port\":{\"id\":\"string\"},\"view spans\":{\"id\":\"url\",\"params\":{\"labelTemplate\":\"View Spans\"}}}",
+    "fields": "[{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"@timestamp\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.account.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.availability_zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.machine.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.region\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.tag\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.runtime\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dll.pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.data\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.ttl\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.header_flags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.op_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.subdomain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.resolved_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.response_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"ecs.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.stack_trace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.stack_trace.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.dataset\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.duration\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.end\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.ingested\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.kind\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.outcome\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score_norm\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.sequence\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.severity\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.timezone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.url\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.accessed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.attributes\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.ctime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.device\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.drive_letter\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.gid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.group\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.inode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mime_type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mtime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.owner\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.path.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.target_path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.target_path.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.content.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.method\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.referrer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.content.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.status_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"interface.alias\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"interface.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"interface.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.logger\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.priority\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.application\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.community_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.direction\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.forwarded_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.iana_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.inner\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.inner.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.inner.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.transport\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.interface.alias\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.interface.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.interface.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.egress.zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.interface.alias\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.interface.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.interface.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ingress.zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.serial_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.vendor\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.build_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.checksum\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.install_scope\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.installed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.license\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.args\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.args_count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.command_line\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.command_line.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.entity_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.executable\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.executable.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.exit_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.args\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.args_count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.exists\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.status\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.subject_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.trusted\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.code_signature.valid\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.command_line\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.command_line.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.entity_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.executable\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.executable.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.exit_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.pgid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.pid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.ppid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.thread.id\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.thread.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.title\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.title.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.working_directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.parent.working_directory.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.company\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.file_version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.original_file_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pe.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pgid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.ppid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.id\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.title\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.title.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.working_directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.working_directory.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.data.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.data.strings\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.data.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.hive\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.key\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"registry.value\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.user\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.author\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.license\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.ruleset\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.uuid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"rule.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.state\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.organization.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.framework\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.cipher\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.certificate\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.certificate_chain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.issuer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.ja3\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.not_after\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.not_before\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.server_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.subject\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.client.supported_ciphers\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.curve\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.established\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.next_protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.resumed\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.certificate\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.certificate_chain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.issuer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.ja3s\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.not_after\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.not_before\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.server.subject\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tls.version_protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.fragment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.original.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.password\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.query\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.scheme\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.username\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.full_name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.device.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.full.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vlan.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vlan.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.classification\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.description.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.enumeration\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.report_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.scanner.vendor\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.base\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.environmental\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.temporal\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.score.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"vulnerability.severity\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"fields\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"timeseries.instance\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.project.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.image.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"docker.container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.containerized\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.build\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.codename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.namespace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.labels.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.annotations.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.replicaset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.deployment.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.statefulset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.image\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.event\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"timestamp.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.request.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.finished\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.response.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.environment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.sampled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.breakdown.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.subtype\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"parent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.listening\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version_major\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"experimental\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.account.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.project.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.culprit\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.grouping_key\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.handled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.logger_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.param_message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.total\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.actual.free\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.rss.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.cgroup.memory.mem.limit.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.cgroup.memory.mem.usage.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.cgroup.memory.stats.inactive_file.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.root\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.duration\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.cpu.ns\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.samples.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.alloc_objects.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.alloc_space.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.inuse_objects.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.inuse_space.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.filename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.filename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.bundle_filepath\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"view spans\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"child.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.start.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.sync\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.db.link\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.db.rows_affected\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.resource\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.message.queue.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.message.age.ms\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.result\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks.*.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.experience.cls\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.experience.fid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.experience.tbt\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.span_count.dropped\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.message.queue.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.message.age.ms\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.histogram\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"metricset.period\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.response_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.destination.service.response_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_id\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_index\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_score\",\"scripted\":false,\"searchable\":false,\"type\":\"number\"}]",
     "sourceFilters": "[{\"value\":\"sourcemap.sourcemap\"}]",
     "timeFieldName": "@timestamp"
   },
   "id": "apm-*",
   "type": "index-pattern",
   "version": "1"
-}
\ No newline at end of file
+}
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index 09da0f462a3cc..a8fbbcb08d358 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -28,7 +28,6 @@ import { ExpressionAstFunction } from 'src/plugins/expressions/common';
 import { ExpressionsSetup } from 'src/plugins/expressions/public';
 import { History } from 'history';
 import { Href } from 'history';
-import { HttpStart } from 'src/core/public';
 import { IconType } from '@elastic/eui';
 import { InjectedIntl } from '@kbn/i18n/react';
 import { ISearchOptions as ISearchOptions_2 } from 'src/plugins/data/public';
@@ -1686,7 +1685,7 @@ export interface QueryStateChange extends QueryStateChangePartial {
 // Warning: (ae-missing-release-tag) "QueryStringInput" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export const QueryStringInput: React.FC<Pick<Props_3, "query" | "prepend" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "isInvalid" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>;
+export const QueryStringInput: React.FC<Pick<Props_3, "prepend" | "query" | "size" | "className" | "placeholder" | "onChange" | "onBlur" | "onSubmit" | "isInvalid" | "indexPatterns" | "dataTestSubj" | "screenTitle" | "disableAutoFocus" | "persistedLog" | "bubbleSubmitEvent" | "languageSwitcherPopoverAnchorPosition" | "onChangeQueryInputFocus">>;
 
 // @public (undocumented)
 export type QuerySuggestion = QuerySuggestionBasic | QuerySuggestionField;
@@ -2018,7 +2017,7 @@ export class SearchSource {
     onRequestStart(handler: (searchSource: SearchSource, options?: ISearchOptions) => Promise<unknown>): void;
     serialize(): {
         searchSourceJSON: string;
-        references: import("../../../../../core/public").SavedObjectReference[];
+        references: import("../../../../../core/types").SavedObjectReference[];
     };
     setField<K extends keyof SearchSourceFields>(field: K, value: SearchSourceFields[K]): this;
     setFields(newFields: SearchSourceFields): this;
diff --git a/src/plugins/data/public/search/fetch/types.ts b/src/plugins/data/public/search/fetch/types.ts
index 224a597766909..cdf10d8f1a1b0 100644
--- a/src/plugins/data/public/search/fetch/types.ts
+++ b/src/plugins/data/public/search/fetch/types.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { HttpStart } from 'src/core/public';
-import { BehaviorSubject } from 'rxjs';
+import { SearchResponse } from 'elasticsearch';
 import { GetConfigFn } from '../../../common';
+import { LegacyFetchHandlers } from '../legacy/types';
 
 /**
  * @internal
@@ -31,9 +31,17 @@ import { GetConfigFn } from '../../../common';
 export type SearchRequest = Record<string, any>;
 
 export interface FetchHandlers {
-  config: { get: GetConfigFn };
-  http: HttpStart;
-  loadingCount$: BehaviorSubject<number>;
+  getConfig: GetConfigFn;
+  /**
+   * Callback which can be used to hook into responses, modify them, or perform
+   * side effects like displaying UI errors on the client.
+   */
+  onResponse: (request: SearchRequest, response: SearchResponse<any>) => SearchResponse<any>;
+  /**
+   * These handlers are only used by the legacy defaultSearchStrategy and can be removed
+   * once that strategy has been deprecated.
+   */
+  legacy: LegacyFetchHandlers;
 }
 
 export interface SearchError {
diff --git a/src/plugins/data/public/search/legacy/call_client.test.ts b/src/plugins/data/public/search/legacy/call_client.test.ts
index 943a02d22088d..0a7913b0a734f 100644
--- a/src/plugins/data/public/search/legacy/call_client.test.ts
+++ b/src/plugins/data/public/search/legacy/call_client.test.ts
@@ -17,18 +17,13 @@
  * under the License.
  */
 
-import { coreMock } from '../../../../../core/public/mocks';
 import { callClient } from './call_client';
 import { SearchStrategySearchParams } from './types';
 import { defaultSearchStrategy } from './default_search_strategy';
 import { FetchHandlers } from '../fetch';
-import { handleResponse } from '../fetch/handle_response';
 import { BehaviorSubject } from 'rxjs';
 
 const mockAbortFn = jest.fn();
-jest.mock('../fetch/handle_response', () => ({
-  handleResponse: jest.fn((request, response) => response),
-}));
 
 jest.mock('./default_search_strategy', () => {
   return {
@@ -50,32 +45,36 @@ jest.mock('./default_search_strategy', () => {
 });
 
 describe('callClient', () => {
+  const handleResponse = jest.fn().mockImplementation((req, res) => res);
+  const handlers = {
+    getConfig: jest.fn(),
+    onResponse: handleResponse,
+    legacy: {
+      callMsearch: jest.fn(),
+      loadingCount$: new BehaviorSubject(0),
+    },
+  } as FetchHandlers;
+
   beforeEach(() => {
-    (handleResponse as jest.Mock).mockClear();
+    handleResponse.mockClear();
   });
 
   test('Passes the additional arguments it is given to the search strategy', () => {
     const searchRequests = [{ _searchStrategyId: 0 }];
-    const args = {
-      http: coreMock.createStart().http,
-      legacySearchService: {},
-      config: { get: jest.fn() },
-      loadingCount$: new BehaviorSubject(0),
-    } as FetchHandlers;
 
-    callClient(searchRequests, [], args);
+    callClient(searchRequests, [], handlers);
 
     expect(defaultSearchStrategy.search).toBeCalled();
     expect((defaultSearchStrategy.search as any).mock.calls[0][0]).toEqual({
       searchRequests,
-      ...args,
+      ...handlers,
     });
   });
 
   test('Returns the responses in the original order', async () => {
     const searchRequests = [{ _searchStrategyId: 1 }, { _searchStrategyId: 0 }];
 
-    const responses = await Promise.all(callClient(searchRequests, [], {} as FetchHandlers));
+    const responses = await Promise.all(callClient(searchRequests, [], handlers));
 
     expect(responses[0]).toEqual({ id: searchRequests[0]._searchStrategyId });
     expect(responses[1]).toEqual({ id: searchRequests[1]._searchStrategyId });
@@ -84,7 +83,7 @@ describe('callClient', () => {
   test('Calls handleResponse with each request and response', async () => {
     const searchRequests = [{ _searchStrategyId: 0 }, { _searchStrategyId: 1 }];
 
-    const responses = callClient(searchRequests, [], {} as FetchHandlers);
+    const responses = callClient(searchRequests, [], handlers);
     await Promise.all(responses);
 
     expect(handleResponse).toBeCalledTimes(2);
@@ -105,7 +104,7 @@ describe('callClient', () => {
       },
     ];
 
-    callClient(searchRequests, requestOptions, {} as FetchHandlers);
+    callClient(searchRequests, requestOptions, handlers);
     abortController.abort();
 
     expect(mockAbortFn).toBeCalled();
diff --git a/src/plugins/data/public/search/legacy/call_client.ts b/src/plugins/data/public/search/legacy/call_client.ts
index d66796b9427a1..b87affdd59c54 100644
--- a/src/plugins/data/public/search/legacy/call_client.ts
+++ b/src/plugins/data/public/search/legacy/call_client.ts
@@ -19,7 +19,7 @@
 
 import { SearchResponse } from 'elasticsearch';
 import { ISearchOptions } from 'src/plugins/data/common';
-import { FetchHandlers, handleResponse } from '../fetch';
+import { FetchHandlers } from '../fetch';
 import { defaultSearchStrategy } from './default_search_strategy';
 import { SearchRequest } from '../index';
 
@@ -42,7 +42,7 @@ export function callClient(
   });
 
   searchRequests.forEach((request, i) => {
-    const response = searching.then((results) => handleResponse(request, results[i]));
+    const response = searching.then((results) => fetchHandlers.onResponse(request, results[i]));
     const { abortSignal = null } = requestOptionsMap.get(request) || {};
     if (abortSignal) abortSignal.addEventListener('abort', abort);
     requestResponseMap.set(request, response);
diff --git a/src/plugins/data/public/search/legacy/call_msearch.ts b/src/plugins/data/public/search/legacy/call_msearch.ts
new file mode 100644
index 0000000000000..fd4f8a07919f8
--- /dev/null
+++ b/src/plugins/data/public/search/legacy/call_msearch.ts
@@ -0,0 +1,37 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { HttpStart } from 'src/core/public';
+import { LegacyFetchHandlers } from './types';
+
+/**
+ * Wrapper for calling the internal msearch endpoint from the client.
+ * This is needed to abstract away differences in the http service
+ * between client & server.
+ *
+ * @internal
+ */
+export function getCallMsearch({ http }: { http: HttpStart }): LegacyFetchHandlers['callMsearch'] {
+  return async ({ body, signal }) => {
+    return http.post('/internal/_msearch', {
+      body: JSON.stringify(body),
+      signal,
+    });
+  };
+}
diff --git a/src/plugins/data/public/search/legacy/default_search_strategy.test.ts b/src/plugins/data/public/search/legacy/default_search_strategy.test.ts
index e74ab49131430..ad59e5c6c9625 100644
--- a/src/plugins/data/public/search/legacy/default_search_strategy.test.ts
+++ b/src/plugins/data/public/search/legacy/default_search_strategy.test.ts
@@ -19,8 +19,9 @@
 
 import { HttpStart } from 'src/core/public';
 import { coreMock } from '../../../../../core/public/mocks';
+import { getCallMsearch } from './call_msearch';
 import { defaultSearchStrategy } from './default_search_strategy';
-import { SearchStrategySearchParams } from './types';
+import { LegacyFetchHandlers, SearchStrategySearchParams } from './types';
 import { BehaviorSubject } from 'rxjs';
 
 const { search } = defaultSearchStrategy;
@@ -44,11 +45,12 @@ describe('defaultSearchStrategy', function () {
             index: { title: 'foo' },
           },
         ],
-        http,
-        config: {
-          get: jest.fn(),
-        },
-        loadingCount$: new BehaviorSubject(0) as any,
+        getConfig: jest.fn(),
+        onResponse: (req, res) => res,
+        legacy: {
+          callMsearch: getCallMsearch({ http }),
+          loadingCount$: new BehaviorSubject(0) as any,
+        } as jest.Mocked<LegacyFetchHandlers>,
       };
     });
 
diff --git a/src/plugins/data/public/search/legacy/default_search_strategy.ts b/src/plugins/data/public/search/legacy/default_search_strategy.ts
index cbcd0da20207f..bed86cb75cca6 100644
--- a/src/plugins/data/public/search/legacy/default_search_strategy.ts
+++ b/src/plugins/data/public/search/legacy/default_search_strategy.ts
@@ -29,12 +29,14 @@ export const defaultSearchStrategy: SearchStrategyProvider = {
   },
 };
 
-function msearch({ searchRequests, config, http, loadingCount$ }: SearchStrategySearchParams) {
+function msearch({ searchRequests, getConfig, legacy }: SearchStrategySearchParams) {
+  const { callMsearch, loadingCount$ } = legacy;
+
   const requests = searchRequests.map(({ index, body }) => {
     return {
       header: {
         index: index.title || index,
-        preference: getPreference(config.get),
+        preference: getPreference(getConfig),
       },
       body,
     };
@@ -55,12 +57,11 @@ function msearch({ searchRequests, config, http, loadingCount$ }: SearchStrategy
     }
   };
 
-  const searching = http
-    .post('/internal/_msearch', {
-      body: JSON.stringify({ searches: requests }),
-      signal: abortController.signal,
-    })
-    .then(({ body }) => body?.responses)
+  const searching = callMsearch({
+    body: { searches: requests },
+    signal: abortController.signal,
+  })
+    .then((res: any) => res?.body?.responses)
     .finally(() => cleanup());
 
   return {
diff --git a/src/plugins/data/public/search/legacy/fetch_soon.test.ts b/src/plugins/data/public/search/legacy/fetch_soon.test.ts
index d38a41cf5ffbc..7243ab158009a 100644
--- a/src/plugins/data/public/search/legacy/fetch_soon.test.ts
+++ b/src/plugins/data/public/search/legacy/fetch_soon.test.ts
@@ -67,25 +67,21 @@ describe('fetchSoon', () => {
   });
 
   test('should execute asap if config is set to not batch searches', () => {
-    const config = {
-      get: getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: false }),
-    };
+    const getConfig = getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: false });
     const request = {};
     const options = {};
 
-    fetchSoon(request, options, { config } as FetchHandlers);
+    fetchSoon(request, options, { getConfig } as FetchHandlers);
 
     expect(callClient).toBeCalled();
   });
 
   test('should delay by 50ms if config is set to batch searches', () => {
-    const config = {
-      get: getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true }),
-    };
+    const getConfig = getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true });
     const request = {};
     const options = {};
 
-    fetchSoon(request, options, { config } as FetchHandlers);
+    fetchSoon(request, options, { getConfig } as FetchHandlers);
 
     expect(callClient).not.toBeCalled();
     jest.advanceTimersByTime(0);
@@ -95,14 +91,12 @@ describe('fetchSoon', () => {
   });
 
   test('should send a batch of requests to callClient', () => {
-    const config = {
-      get: getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true }),
-    };
+    const getConfig = getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true });
     const requests = [{ foo: 1 }, { foo: 2 }];
     const options = [{ bar: 1 }, { bar: 2 }];
 
     requests.forEach((request, i) => {
-      fetchSoon(request, options[i] as ISearchOptions, { config } as FetchHandlers);
+      fetchSoon(request, options[i] as ISearchOptions, { getConfig } as FetchHandlers);
     });
 
     jest.advanceTimersByTime(50);
@@ -112,13 +106,11 @@ describe('fetchSoon', () => {
   });
 
   test('should return the response to the corresponding call for multiple batched requests', async () => {
-    const config = {
-      get: getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true }),
-    };
+    const getConfig = getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true });
     const requests = [{ _mockResponseId: 'foo' }, { _mockResponseId: 'bar' }];
 
     const promises = requests.map((request) => {
-      return fetchSoon(request, {}, { config } as FetchHandlers);
+      return fetchSoon(request, {}, { getConfig } as FetchHandlers);
     });
     jest.advanceTimersByTime(50);
     const results = await Promise.all(promises);
@@ -127,18 +119,16 @@ describe('fetchSoon', () => {
   });
 
   test('should wait for the previous batch to start before starting a new batch', () => {
-    const config = {
-      get: getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true }),
-    };
+    const getConfig = getConfigStub({ [UI_SETTINGS.COURIER_BATCH_SEARCHES]: true });
     const firstBatch = [{ foo: 1 }, { foo: 2 }];
     const secondBatch = [{ bar: 1 }, { bar: 2 }];
 
     firstBatch.forEach((request) => {
-      fetchSoon(request, {}, { config } as FetchHandlers);
+      fetchSoon(request, {}, { getConfig } as FetchHandlers);
     });
     jest.advanceTimersByTime(50);
     secondBatch.forEach((request) => {
-      fetchSoon(request, {}, { config } as FetchHandlers);
+      fetchSoon(request, {}, { getConfig } as FetchHandlers);
     });
 
     expect(callClient).toBeCalledTimes(1);
diff --git a/src/plugins/data/public/search/legacy/fetch_soon.ts b/src/plugins/data/public/search/legacy/fetch_soon.ts
index 37c3827bb7bba..1c0573aa895d7 100644
--- a/src/plugins/data/public/search/legacy/fetch_soon.ts
+++ b/src/plugins/data/public/search/legacy/fetch_soon.ts
@@ -32,7 +32,7 @@ export async function fetchSoon(
   options: ISearchOptions,
   fetchHandlers: FetchHandlers
 ) {
-  const msToDelay = fetchHandlers.config.get(UI_SETTINGS.COURIER_BATCH_SEARCHES) ? 50 : 0;
+  const msToDelay = fetchHandlers.getConfig(UI_SETTINGS.COURIER_BATCH_SEARCHES) ? 50 : 0;
   return delayedFetch(request, options, fetchHandlers, msToDelay);
 }
 
diff --git a/src/plugins/data/public/search/legacy/types.ts b/src/plugins/data/public/search/legacy/types.ts
index ed17db464feff..740bc22a7485c 100644
--- a/src/plugins/data/public/search/legacy/types.ts
+++ b/src/plugins/data/public/search/legacy/types.ts
@@ -17,10 +17,20 @@
  * under the License.
  */
 
+import { BehaviorSubject } from 'rxjs';
 import { SearchResponse } from 'elasticsearch';
 import { FetchHandlers } from '../fetch';
 import { SearchRequest } from '..';
 
+// @internal
+export interface LegacyFetchHandlers {
+  callMsearch: (params: {
+    body: SearchRequest;
+    signal: AbortSignal;
+  }) => Promise<Array<SearchResponse<any>>>;
+  loadingCount$: BehaviorSubject<number>;
+}
+
 export interface SearchStrategySearchParams extends FetchHandlers {
   searchRequests: SearchRequest[];
 }
diff --git a/src/plugins/data/public/search/search_service.ts b/src/plugins/data/public/search/search_service.ts
index 6b73761c5a437..c41e1f78ee74e 100644
--- a/src/plugins/data/public/search/search_service.ts
+++ b/src/plugins/data/public/search/search_service.ts
@@ -21,6 +21,8 @@ import { Plugin, CoreSetup, CoreStart } from 'src/core/public';
 import { BehaviorSubject } from 'rxjs';
 import { ISearchSetup, ISearchStart, SearchEnhancements } from './types';
 
+import { handleResponse } from './fetch';
+import { getCallMsearch } from './legacy/call_msearch';
 import { createSearchSource, SearchSource, SearchSourceDependencies } from './search_source';
 import { AggsService, AggsStartDependencies } from './aggs';
 import { IndexPatternsContract } from '../index_patterns/index_patterns';
@@ -49,7 +51,7 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   private usageCollector?: SearchUsageCollector;
 
   public setup(
-    { http, getStartServices, injectedMetadata, notifications, uiSettings }: CoreSetup,
+    { http, getStartServices, notifications, uiSettings }: CoreSetup,
     { expressions, usageCollection }: SearchServiceSetupDependencies
   ): ISearchSetup {
     this.usageCollector = createUsageCollector(getStartServices, usageCollection);
@@ -82,7 +84,7 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   }
 
   public start(
-    { application, http, injectedMetadata, notifications, uiSettings }: CoreStart,
+    { application, http, notifications, uiSettings }: CoreStart,
     { fieldFormats, indexPatterns }: SearchServiceStartDependencies
   ): ISearchStart {
     const search = ((request, options) => {
@@ -95,8 +97,11 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
     const searchSourceDependencies: SearchSourceDependencies = {
       getConfig: uiSettings.get.bind(uiSettings),
       search,
-      http,
-      loadingCount$,
+      onResponse: handleResponse,
+      legacy: {
+        callMsearch: getCallMsearch({ http }),
+        loadingCount$,
+      },
     };
 
     return {
diff --git a/src/plugins/data/public/search/search_source/create_search_source.test.ts b/src/plugins/data/public/search/search_source/create_search_source.test.ts
index bc1c7c06c8806..6b6cfb0c9b1ca 100644
--- a/src/plugins/data/public/search/search_source/create_search_source.test.ts
+++ b/src/plugins/data/public/search/search_source/create_search_source.test.ts
@@ -22,7 +22,6 @@ import { SearchSourceDependencies } from './search_source';
 import { IIndexPattern } from '../../../common/index_patterns';
 import { IndexPatternsContract } from '../../index_patterns/index_patterns';
 import { Filter } from '../../../common/es_query/filters';
-import { coreMock } from '../../../../../core/public/mocks';
 import { BehaviorSubject } from 'rxjs';
 
 describe('createSearchSource', () => {
@@ -35,8 +34,11 @@ describe('createSearchSource', () => {
     dependencies = {
       getConfig: jest.fn(),
       search: jest.fn(),
-      http: coreMock.createStart().http,
-      loadingCount$: new BehaviorSubject(0),
+      onResponse: (req, res) => res,
+      legacy: {
+        callMsearch: jest.fn(),
+        loadingCount$: new BehaviorSubject(0),
+      },
     };
 
     indexPatternContractMock = ({
diff --git a/src/plugins/data/public/search/search_source/mocks.ts b/src/plugins/data/public/search/search_source/mocks.ts
index adf53bee33fe1..f582861e37c15 100644
--- a/src/plugins/data/public/search/search_source/mocks.ts
+++ b/src/plugins/data/public/search/search_source/mocks.ts
@@ -18,7 +18,7 @@
  */
 
 import { BehaviorSubject } from 'rxjs';
-import { httpServiceMock, uiSettingsServiceMock } from '../../../../../core/public/mocks';
+import { uiSettingsServiceMock } from '../../../../../core/public/mocks';
 
 import { ISearchSource, SearchSource } from './search_source';
 import { SearchSourceFields } from './types';
@@ -54,6 +54,9 @@ export const createSearchSourceMock = (fields?: SearchSourceFields) =>
   new SearchSource(fields, {
     getConfig: uiSettingsServiceMock.createStartContract().get,
     search: jest.fn(),
-    http: httpServiceMock.createStartContract(),
-    loadingCount$: new BehaviorSubject(0),
+    onResponse: jest.fn().mockImplementation((req, res) => res),
+    legacy: {
+      callMsearch: jest.fn(),
+      loadingCount$: new BehaviorSubject(0),
+    },
   });
diff --git a/src/plugins/data/public/search/search_source/search_source.test.ts b/src/plugins/data/public/search/search_source/search_source.test.ts
index 282a33e6d01f7..d9a9fb2f4fef3 100644
--- a/src/plugins/data/public/search/search_source/search_source.test.ts
+++ b/src/plugins/data/public/search/search_source/search_source.test.ts
@@ -22,7 +22,6 @@ import { GetConfigFn } from 'src/plugins/data/common';
 import { SearchSource, SearchSourceDependencies } from './search_source';
 import { IndexPattern, SortDirection } from '../..';
 import { fetchSoon } from '../legacy';
-import { coreMock } from '../../../../../core/public/mocks';
 
 jest.mock('../legacy', () => ({
   fetchSoon: jest.fn().mockResolvedValue({}),
@@ -68,8 +67,11 @@ describe('SearchSource', () => {
     searchSourceDependencies = {
       getConfig: jest.fn(),
       search: mockSearchMethod,
-      http: coreMock.createStart().http,
-      loadingCount$: new BehaviorSubject(0),
+      onResponse: (req, res) => res,
+      legacy: {
+        callMsearch: jest.fn(),
+        loadingCount$: new BehaviorSubject(0),
+      },
     };
   });
 
diff --git a/src/plugins/data/public/search/search_source/search_source.ts b/src/plugins/data/public/search/search_source/search_source.ts
index a39898e6a9f52..4afee223454e4 100644
--- a/src/plugins/data/public/search/search_source/search_source.ts
+++ b/src/plugins/data/public/search/search_source/search_source.ts
@@ -72,19 +72,12 @@
 import { setWith } from '@elastic/safer-lodash-set';
 import { uniqueId, uniq, extend, pick, difference, omit, isObject, keys, isFunction } from 'lodash';
 import { map } from 'rxjs/operators';
-import { HttpStart } from 'src/core/public';
-import { BehaviorSubject } from 'rxjs';
 import { normalizeSortRequest } from './normalize_sort_request';
 import { filterDocvalueFields } from './filter_docvalue_fields';
 import { fieldWildcardFilter } from '../../../../kibana_utils/common';
 import { IIndexPattern, ISearchGeneric } from '../..';
 import { SearchSourceOptions, SearchSourceFields } from './types';
-import {
-  RequestFailure,
-  handleResponse,
-  getSearchParamsFromRequest,
-  SearchRequest,
-} from '../fetch';
+import { FetchHandlers, RequestFailure, getSearchParamsFromRequest, SearchRequest } from '../fetch';
 
 import {
   getEsQueryConfig,
@@ -94,7 +87,6 @@ import {
   ISearchOptions,
 } from '../../../common';
 import { getHighlightRequest } from '../../../common/field_formats';
-import { GetConfigFn } from '../../../common/types';
 import { fetchSoon } from '../legacy';
 import { extractReferences } from './extract_references';
 
@@ -114,11 +106,8 @@ export const searchSourceRequiredUiSettings = [
   UI_SETTINGS.SORT_OPTIONS,
 ];
 
-export interface SearchSourceDependencies {
-  getConfig: GetConfigFn;
+export interface SearchSourceDependencies extends FetchHandlers {
   search: ISearchGeneric;
-  http: HttpStart;
-  loadingCount$: BehaviorSubject<number>;
 }
 
 /** @public **/
@@ -321,14 +310,14 @@ export class SearchSource {
    * @return {Observable<SearchResponse<unknown>>}
    */
   private fetch$(searchRequest: SearchRequest, options: ISearchOptions) {
-    const { search, getConfig } = this.dependencies;
+    const { search, getConfig, onResponse } = this.dependencies;
 
     const params = getSearchParamsFromRequest(searchRequest, {
       getConfig,
     });
 
     return search({ params, indexType: searchRequest.indexType }, options).pipe(
-      map(({ rawResponse }) => handleResponse(searchRequest, rawResponse))
+      map(({ rawResponse }) => onResponse(searchRequest, rawResponse))
     );
   }
 
@@ -337,7 +326,7 @@ export class SearchSource {
    * @return {Promise<SearchResponse<unknown>>}
    */
   private async legacyFetch(searchRequest: SearchRequest, options: ISearchOptions) {
-    const { http, getConfig, loadingCount$ } = this.dependencies;
+    const { getConfig, legacy, onResponse } = this.dependencies;
 
     return await fetchSoon(
       searchRequest,
@@ -346,9 +335,9 @@ export class SearchSource {
         ...options,
       },
       {
-        http,
-        config: { get: getConfig },
-        loadingCount$,
+        getConfig,
+        onResponse,
+        legacy,
       }
     );
   }
diff --git a/src/plugins/data/public/ui/shard_failure_modal/shard_failure_description.tsx b/src/plugins/data/public/ui/shard_failure_modal/shard_failure_description.tsx
index 3606bfbaeb1f9..1f124291669ec 100644
--- a/src/plugins/data/public/ui/shard_failure_modal/shard_failure_description.tsx
+++ b/src/plugins/data/public/ui/shard_failure_modal/shard_failure_description.tsx
@@ -17,9 +17,9 @@
  * under the License.
  */
 import React from 'react';
+import { getFlattenedObject } from '@kbn/std';
 import { EuiCodeBlock, EuiDescriptionList, EuiSpacer } from '@elastic/eui';
 import { ShardFailure } from './shard_failure_types';
-import { getFlattenedObject } from '../../../../../core/public';
 import { ShardFailureDescriptionHeader } from './shard_failure_description_header';
 
 /**
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index cd0369a5c4551..f5b1214185f53 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -117,6 +117,7 @@ import { NodesHotThreadsParams } from 'elasticsearch';
 import { NodesInfoParams } from 'elasticsearch';
 import { NodesStatsParams } from 'elasticsearch';
 import { Observable } from 'rxjs';
+import { PathConfigType } from '@kbn/utils';
 import { PingParams } from 'elasticsearch';
 import { Plugin as Plugin_2 } from 'src/core/server';
 import { PluginInitializerContext as PluginInitializerContext_2 } from 'src/core/server';
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
index c14471991ccd3..dbf53a9f0a359 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import React, { useEffect } from 'react';
+import React, { useEffect, FunctionComponent } from 'react';
 import { act } from 'react-dom/test-utils';
 
 import { registerTestBed, TestBed } from '../shared_imports';
@@ -237,4 +237,64 @@ describe('<UseField />', () => {
       expect(serializer).not.toBeCalled();
     });
   });
+
+  describe('custom components', () => {
+    interface MyForm {
+      name: string;
+    }
+
+    let formHook: FormHook<MyForm> | null = null;
+
+    beforeEach(() => {
+      formHook = null;
+    });
+
+    const onFormHook = (_form: FormHook<MyForm>) => {
+      formHook = _form;
+    };
+
+    const TestComp = ({
+      component,
+      onForm,
+    }: {
+      component: FunctionComponent<any>;
+      onForm: (form: FormHook<MyForm>) => void;
+    }) => {
+      const { form } = useForm<MyForm>();
+
+      useEffect(() => {
+        onForm(form);
+      }, [onForm, form]);
+
+      return (
+        <Form form={form}>
+          <UseField path="name" defaultValue="myName" component={component} />
+        </Form>
+      );
+    };
+
+    it('allows function components', () => {
+      const Component = () => <textarea data-test-subj="function-component" />;
+      const setup = registerTestBed(TestComp, {
+        defaultProps: { onForm: onFormHook, component: Component },
+        memoryRouter: { wrapComponent: false },
+      });
+      const testBed = setup() as TestBed;
+
+      expect(testBed.exists('function-component')).toEqual(true);
+      expect(formHook?.getFormData()).toEqual({ name: 'myName' });
+    });
+
+    it('allows memoized function components', () => {
+      const Component = React.memo(() => <textarea data-test-subj="memoized-component" />);
+      const setup = registerTestBed(TestComp, {
+        defaultProps: { onForm: onFormHook, component: Component },
+        memoryRouter: { wrapComponent: false },
+      });
+      const testBed = setup() as TestBed;
+
+      expect(testBed.exists('memoized-component')).toEqual(true);
+      expect(formHook?.getFormData()).toEqual({ name: 'myName' });
+    });
+  });
 });
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
index 3a3ab0dab5e93..6b913f246abbb 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.tsx
@@ -49,7 +49,7 @@ function UseFieldComp<T = unknown>(props: Props<T>) {
   } = props;
 
   const form = useFormContext();
-  const componentToRender = component ?? 'input';
+  const ComponentToRender = component ?? 'input';
   // For backward compatibility we merge the "componentProps" prop into the "rest"
   const propsToForward =
     componentProps !== undefined ? { ...componentProps, ...rest } : { ...rest };
@@ -91,9 +91,9 @@ function UseFieldComp<T = unknown>(props: Props<T>) {
     return children!(field);
   }
 
-  if (componentToRender === 'input') {
+  if (ComponentToRender === 'input') {
     return (
-      <input
+      <ComponentToRender
         type={field.type}
         onChange={field.onChange}
         value={(field.value as unknown) as string}
@@ -102,7 +102,7 @@ function UseFieldComp<T = unknown>(props: Props<T>) {
     );
   }
 
-  return componentToRender({ field, ...propsToForward });
+  return <ComponentToRender {...{ field, ...propsToForward }} />;
 }
 
 export const UseField = React.memo(UseFieldComp) as typeof UseFieldComp;
diff --git a/src/plugins/kibana_react/README.md b/src/plugins/kibana_react/README.md
index 3389af9f1800b..adbdb628ea9dd 100644
--- a/src/plugins/kibana_react/README.md
+++ b/src/plugins/kibana_react/README.md
@@ -2,7 +2,6 @@
 
 Tools for building React applications in Kibana.
 
-
 ## Context
 
 You can create React context that holds Core or plugin services that your plugin depends on.
@@ -51,7 +50,6 @@ import { KibanaContextProvider } from 'kibana-react';
 </KibanaContextProvider>
 ```
 
-
 ## Accessing context
 
 Using `useKibana` hook.
@@ -61,11 +59,7 @@ import { useKibana } from 'kibana-react';
 
 const Demo = () => {
   const kibana = useKibana();
-  return (
-    <div>
-      {kibana.services.uiSettings.get('theme:darkMode') ? 'dark' : 'light'}
-    </div>
-  );
+  return <div>{kibana.services.uiSettings.get('theme:darkMode') ? 'dark' : 'light'}</div>;
 };
 ```
 
@@ -75,11 +69,7 @@ Using `withKibana()` higher order component.
 import { withKibana } from 'kibana-react';
 
 const Demo = ({ kibana }) => {
-  return (
-    <div>
-      {kibana.services.uiSettings.get('theme:darkMode') ? 'dark' : 'light'}
-    </div>
-  );
+  return <div>{kibana.services.uiSettings.get('theme:darkMode') ? 'dark' : 'light'}</div>;
 };
 
 export default withKibana(Demo);
@@ -92,21 +82,17 @@ import { UseKibana } from 'kibana-react';
 
 const Demo = () => {
   return (
-    <UseKibana>{kibana => 
-      <div>
-        {kibana.services.uiSettings.get('theme:darkMode') ? 'dark' : 'light'}
-      </div>
-    }</UseKibana>
+    <UseKibana>
+      {(kibana) => <div>{kibana.services.uiSettings.get('theme:darkMode') ? 'dark' : 'light'}</div>}
+    </UseKibana>
   );
 };
 ```
 
-
 ## `uiSettings` service
 
 Wrappers around Core's `uiSettings` service.
 
-
 ### `useUiSetting` hook
 
 `useUiSetting` synchronously returns the latest setting from `CoreStart['uiSettings']` service.
@@ -116,11 +102,7 @@ import { useUiSetting } from 'kibana-react';
 
 const Demo = () => {
   const darkMode = useUiSetting<boolean>('theme:darkMode');
-  return (
-    <div>
-      {darkMode ? 'dark' : 'light'}
-    </div>
-  );
+  return <div>{darkMode ? 'dark' : 'light'}</div>;
 };
 ```
 
@@ -130,7 +112,6 @@ const Demo = () => {
 useUiSetting<T>(key: string, defaultValue: T): T;
 ```
 
-
 ### `useUiSetting$` hook
 
 `useUiSetting$` synchronously returns the latest setting from `CoreStart['uiSettings']` service and
@@ -141,11 +122,7 @@ import { useUiSetting$ } from 'kibana-react';
 
 const Demo = () => {
   const [darkMode] = useUiSetting$<boolean>('theme:darkMode');
-  return (
-    <div>
-      {darkMode ? 'dark' : 'light'}
-    </div>
-  );
+  return <div>{darkMode ? 'dark' : 'light'}</div>;
 };
 ```
 
@@ -155,7 +132,6 @@ const Demo = () => {
 useUiSetting$<T>(key: string, defaultValue: T): [T, (newValue: T) => void];
 ```
 
-
 ## `overlays` service
 
 Wrapper around Core's `overlays` service, allows you to display React modals and flyouts
@@ -166,13 +142,11 @@ import { createKibanaReactContext } from 'kibana-react';
 
 class MyPlugin {
   start(core) {
-    const { value: { overlays } } = createKibanaReactContext(core);
+    const {
+      value: { overlays },
+    } = createKibanaReactContext(core);
 
-    overlays.openModal(
-      <div>
-        Hello world!
-      </div>
-    );
+    overlays.openModal(<div>Hello world!</div>);
   }
 }
 ```
@@ -186,16 +160,11 @@ You can access `overlays` service through React context.
 const Demo = () => {
   const { overlays } = useKibana();
   useEffect(() => {
-    overlays.openModal(
-      <div>
-        Oooops! {errorMessage}
-      </div>
-    );
+    overlays.openModal(<div>Oooops! {errorMessage}</div>);
   }, [errorMessage]);
 };
 ```
 
-
 ## `notifications` service
 
 Wrapper around Core's `notifications` service, allows you to render React elements
@@ -206,11 +175,13 @@ import { createKibanaReactContext } from 'kibana-react';
 
 class MyPlugin {
   start(core) {
-    const { value: { notifications } } = createKibanaReactContext(core);
+    const {
+      value: { notifications },
+    } = createKibanaReactContext(core);
 
     notifications.toasts.show({
       title: <div>Hello</div>,
-      body: <div>world!</div>
+      body: <div>world!</div>,
     });
   }
 }
@@ -234,3 +205,15 @@ const Demo = () => {
   }, [errorMessage]);
 };
 ```
+
+## RedirectAppLinks
+
+Utility component that will intercept click events on children anchor (`<a>`) elements to call
+`application.navigateToUrl` with the link's href. This will trigger SPA friendly navigation
+when the link points to a valid Kibana app.
+
+```tsx
+<RedirectAppLinks application={application}>
+  <a href="/base-path/app/another-app/some-path">Go to another-app</a>
+</RedirectAppLinks>
+```
diff --git a/src/plugins/kibana_utils/common/state_containers/README.md b/src/plugins/kibana_utils/common/state_containers/README.md
new file mode 100644
index 0000000000000..c623e8b306438
--- /dev/null
+++ b/src/plugins/kibana_utils/common/state_containers/README.md
@@ -0,0 +1,2 @@
+* [docs](../../docs/state_containers)
+* [api reference](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_containers)
\ No newline at end of file
diff --git a/src/plugins/kibana_utils/docs/state_sync/README.md b/src/plugins/kibana_utils/docs/state_sync/README.md
index c84bf7f236330..6b4eb0cb1749b 100644
--- a/src/plugins/kibana_utils/docs/state_sync/README.md
+++ b/src/plugins/kibana_utils/docs/state_sync/README.md
@@ -3,6 +3,18 @@
 State syncing utilities are a set of helpers for syncing your application state
 with URL or browser storage.
 
+**When you should consider using state syncing utils:**
+
+- You want to sync your application state with URL in similar manner analyze applications do that.
+- You want to follow platform's <<history-and-location, working with browser history and location best practices>> out of the box.
+- You want to support `state:storeInSessionStore` escape hatch for URL overflowing out of the box.
+- You should also consider using them if you'd like to serialize state to different (not `rison`) format. Utils are composable, and you can implement your own `storage`.
+- In case you want to sync part of your state with URL, but other part of it with browser storage.
+
+**When you shouldn't look into using state syncing utils:**
+
+- Adding a query param flag or simple key/value to URL
+
 They are designed to work together with [state containers](../state_containers). But state containers are not required.
 
 State syncing utilities include:
@@ -42,9 +54,9 @@ stateContainer.set({ count: 2 });
 stop();
 ```
 
-## Demos Plugins
+## Demo Plugins
 
-See demos plugins [here](../../../../../examples/state_containers_examples).
+See demo plugins [here](../../../../../examples/state_containers_examples).
 
 To run them, start kibana with `--run-examples` flag.
 
diff --git a/src/plugins/kibana_utils/public/state_sync/README.md b/src/plugins/kibana_utils/public/state_sync/README.md
new file mode 100644
index 0000000000000..eb5f6e60958fc
--- /dev/null
+++ b/src/plugins/kibana_utils/public/state_sync/README.md
@@ -0,0 +1,3 @@
+- [docs](../../docs/state_sync)
+- [demo plugins](../../../../../examples/state_containers_examples): run Kibana with `--run-examples` flag.
+- [api reference](https://github.com/elastic/kibana/tree/master/src/plugins/kibana_utils/docs/state_sync)
diff --git a/src/plugins/share/server/routes/goto.ts b/src/plugins/share/server/routes/goto.ts
index 193f2acb87c95..0cd6d26adac26 100644
--- a/src/plugins/share/server/routes/goto.ts
+++ b/src/plugins/share/server/routes/goto.ts
@@ -19,11 +19,11 @@
 
 import { CoreSetup, IRouter } from 'kibana/server';
 import { schema } from '@kbn/config-schema';
+import { modifyUrl } from '@kbn/std';
 
 import { shortUrlAssertValid } from './lib/short_url_assert_valid';
 import { ShortUrlLookupService } from './lib/short_url_lookup';
 import { getGotoPath } from '../../common/short_url_routes';
-import { modifyUrl } from '../../../../core/server';
 
 export const createGotoRoute = ({
   router,
diff --git a/src/plugins/telemetry/server/config.ts b/src/plugins/telemetry/server/config.ts
index ae9b70bb9f367..f547bf55091a7 100644
--- a/src/plugins/telemetry/server/config.ts
+++ b/src/plugins/telemetry/server/config.ts
@@ -18,8 +18,7 @@
  */
 
 import { schema, TypeOf } from '@kbn/config-schema';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { getConfigPath } from '../../../core/server/path';
+import { getConfigPath } from '@kbn/utils';
 import { ENDPOINT_VERSION } from '../common/constants';
 
 export const configSchema = schema.object({
diff --git a/src/plugins/vis_type_timelion/server/plugin.ts b/src/plugins/vis_type_timelion/server/plugin.ts
index 52c50b0646299..c518b73bb3cde 100644
--- a/src/plugins/vis_type_timelion/server/plugin.ts
+++ b/src/plugins/vis_type_timelion/server/plugin.ts
@@ -21,10 +21,10 @@ import { i18n } from '@kbn/i18n';
 import { first } from 'rxjs/operators';
 import { TypeOf, schema } from '@kbn/config-schema';
 import { RecursiveReadonly } from '@kbn/utility-types';
+import { deepFreeze } from '@kbn/std';
 
 import { PluginStart } from '../../../../src/plugins/data/server';
 import { CoreSetup, PluginInitializerContext } from '../../../../src/core/server';
-import { deepFreeze } from '../../../../src/core/server';
 import { configSchema } from '../config';
 import loadFunctions from './lib/load_functions';
 import { functionsRoute } from './routes/functions';
diff --git a/src/plugins/visualizations/server/usage_collector/get_usage_collector.test.ts b/src/plugins/visualizations/server/usage_collector/get_usage_collector.test.ts
index 4a8e4b70ae070..108f270bc8eab 100644
--- a/src/plugins/visualizations/server/usage_collector/get_usage_collector.test.ts
+++ b/src/plugins/visualizations/server/usage_collector/get_usage_collector.test.ts
@@ -132,6 +132,16 @@ describe('Visualizations usage collector', () => {
     expect(usageCollector.fetch).toEqual(expect.any(Function));
   });
 
+  test('Returns undefined when no results found (undefined)', async () => {
+    const result = await usageCollector.fetch(getMockCallCluster(undefined as any));
+    expect(result).toBe(undefined);
+  });
+
+  test('Returns undefined when no results found (0 results)', async () => {
+    const result = await usageCollector.fetch(getMockCallCluster([]));
+    expect(result).toBe(undefined);
+  });
+
   test('Summarizes visualizations response data', async () => {
     const result = await usageCollector.fetch(getMockCallCluster(defaultMockSavedObjects));
 
diff --git a/src/plugins/visualizations/server/usage_collector/get_usage_collector.ts b/src/plugins/visualizations/server/usage_collector/get_usage_collector.ts
index 165c3ee649868..9ba09a3303b5f 100644
--- a/src/plugins/visualizations/server/usage_collector/get_usage_collector.ts
+++ b/src/plugins/visualizations/server/usage_collector/get_usage_collector.ts
@@ -55,7 +55,7 @@ async function getStats(callCluster: LegacyAPICaller, index: string) {
     },
   };
   const esResponse: ESResponse = await callCluster('search', searchParams);
-  const size = get(esResponse, 'hits.hits.length');
+  const size = get(esResponse, 'hits.hits.length', 0);
   if (size < 1) {
     return;
   }
diff --git a/test/functional/page_objects/vega_chart_page.ts b/test/functional/page_objects/vega_chart_page.ts
index 557c6bfada01e..044b6b61790ac 100644
--- a/test/functional/page_objects/vega_chart_page.ts
+++ b/test/functional/page_objects/vega_chart_page.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import { Key } from 'selenium-webdriver';
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../ftr_provider_context';
 
@@ -94,9 +93,9 @@ export function VegaChartPageProvider({
       const aceGutter = await this.getAceGutterContainer();
 
       await aceGutter.doubleClick();
-      await browser.pressKeys(Key.RIGHT);
-      await browser.pressKeys(Key.LEFT);
-      await browser.pressKeys(Key.LEFT);
+      await browser.pressKeys(browser.keys.RIGHT);
+      await browser.pressKeys(browser.keys.LEFT);
+      await browser.pressKeys(browser.keys.LEFT);
       await browser.pressKeys(text);
     }
 
@@ -105,7 +104,7 @@ export function VegaChartPageProvider({
 
       await retry.try(async () => {
         await aceGutter.doubleClick();
-        await browser.pressKeys(Key.BACK_SPACE);
+        await browser.pressKeys(browser.keys.BACK_SPACE);
 
         expect(await this.getSpec()).to.be('');
       });
diff --git a/test/functional/page_objects/visual_builder_page.ts b/test/functional/page_objects/visual_builder_page.ts
index a95d535281fa3..6e49fd3b03494 100644
--- a/test/functional/page_objects/visual_builder_page.ts
+++ b/test/functional/page_objects/visual_builder_page.ts
@@ -58,7 +58,10 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
     }
 
     public async checkTabIsLoaded(testSubj: string, name: string) {
-      const isPresent = await testSubjects.exists(testSubj, { timeout: 10000 });
+      let isPresent = false;
+      await retry.try(async () => {
+        isPresent = await testSubjects.exists(testSubj, { timeout: 20000 });
+      });
       if (!isPresent) {
         throw new Error(`TSVB ${name} tab is not loaded`);
       }
@@ -130,8 +133,8 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
     public async enterMarkdown(markdown: string) {
       const input = await find.byCssSelector('.tvbMarkdownEditor__editor textarea');
       await this.clearMarkdown();
-      await input.type(markdown, { charByChar: true });
-      await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+      await input.type(markdown);
+      await PageObjects.common.sleep(3000);
     }
 
     public async clearMarkdown() {
diff --git a/test/functional/services/common/browser.ts b/test/functional/services/common/browser.ts
index e81845023a8fa..2f8e87c1d58d6 100644
--- a/test/functional/services/common/browser.ts
+++ b/test/functional/services/common/browser.ts
@@ -22,9 +22,9 @@ import { Key, Origin } from 'selenium-webdriver';
 // @ts-ignore internal modules are not typed
 import { LegacyActionSequence } from 'selenium-webdriver/lib/actions';
 import { ProvidedType } from '@kbn/test/types/ftr';
+import { modifyUrl } from '@kbn/std';
 
 import Jimp from 'jimp';
-import { modifyUrl } from '../../../../src/core/utils';
 import { WebElementWrapper } from '../lib/web_element_wrapper';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { Browsers } from '../remote/browsers';
diff --git a/test/functional/services/remote/webdriver.ts b/test/functional/services/remote/webdriver.ts
index d51b32f3cc497..bd15d52bc0150 100644
--- a/test/functional/services/remote/webdriver.ts
+++ b/test/functional/services/remote/webdriver.ts
@@ -37,7 +37,7 @@ import { Executor } from 'selenium-webdriver/lib/http';
 import { getLogger } from 'selenium-webdriver/lib/logging';
 import { installDriver } from 'ms-chromium-edge-driver';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import { pollForLogEntry$ } from './poll_for_log_entry';
 import { createStdoutSocket } from './create_stdout_stream';
 import { preventParallelCalls } from './prevent_parallel_calls';
diff --git a/x-pack/plugins/actions/server/lib/license_state.ts b/x-pack/plugins/actions/server/lib/license_state.ts
index 914aada08bb2c..1686d0201e96c 100644
--- a/x-pack/plugins/actions/server/lib/license_state.ts
+++ b/x-pack/plugins/actions/server/lib/license_state.ts
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { Observable, Subscription } from 'rxjs';
-import { assertNever } from '../../../../../src/core/server';
+import { assertNever } from '@kbn/std';
 import { ILicense } from '../../../licensing/common/types';
 import { PLUGIN } from '../constants/plugin';
 import { ActionType } from '../types';
diff --git a/x-pack/plugins/alerts/server/lib/license_state.ts b/x-pack/plugins/alerts/server/lib/license_state.ts
index ea0106f717b02..b3204d886960f 100644
--- a/x-pack/plugins/alerts/server/lib/license_state.ts
+++ b/x-pack/plugins/alerts/server/lib/license_state.ts
@@ -6,9 +6,9 @@
 
 import Boom from 'boom';
 import { i18n } from '@kbn/i18n';
+import { assertNever } from '@kbn/std';
 import { Observable, Subscription } from 'rxjs';
 import { ILicense } from '../../../licensing/common/types';
-import { assertNever } from '../../../../../src/core/server';
 import { PLUGIN } from '../constants/plugin';
 
 export interface AlertingLicenseInformation {
diff --git a/x-pack/plugins/apm/e2e/cypress.json b/x-pack/plugins/apm/e2e/cypress.json
index 33304c2d8625f..19e09e6ad5bbf 100644
--- a/x-pack/plugins/apm/e2e/cypress.json
+++ b/x-pack/plugins/apm/e2e/cypress.json
@@ -21,5 +21,7 @@
   "env": {
     "elasticsearch_username": "admin",
     "elasticsearch_password": "changeme"
-  }
+  },
+  "viewportWidth": 1920,
+  "viewportHeight": 1080
 }
diff --git a/x-pack/plugins/apm/e2e/cypress/integration/rum_dashboard.feature.disabled b/x-pack/plugins/apm/e2e/cypress/integration/csm_dashboard.feature
similarity index 72%
rename from x-pack/plugins/apm/e2e/cypress/integration/rum_dashboard.feature.disabled
rename to x-pack/plugins/apm/e2e/cypress/integration/csm_dashboard.feature
index 727898773904e..ac4188a598458 100644
--- a/x-pack/plugins/apm/e2e/cypress/integration/rum_dashboard.feature.disabled
+++ b/x-pack/plugins/apm/e2e/cypress/integration/csm_dashboard.feature
@@ -1,18 +1,23 @@
-Feature: RUM Dashboard
+Feature: CSM Dashboard
+
+  Scenario: Service name filter
+    Given a user browses the APM UI application for RUM Data
+    When the user changes the selected service name
+    Then it displays relevant client metrics
 
   Scenario: Client metrics
     When a user browses the APM UI application for RUM Data
     Then should have correct client metrics
 
-  Scenario Outline: Rum page filters
+  Scenario Outline: CSM page filters
     When the user filters by "<filterName>"
-    Then it filters the client metrics
+    Then it filters the client metrics "<filterName>"
     Examples:
       | filterName |
       | os         |
       | location   |
 
-  Scenario: Display RUM Data components
+  Scenario: Display CSM Data components
     When a user browses the APM UI application for RUM Data
     Then should display percentile for page load chart
       And should display tooltip on hover
@@ -22,7 +27,3 @@ Feature: RUM Dashboard
     Given a user clicks the page load breakdown filter
     When the user selected the breakdown
     Then breakdown series should appear in chart
-
-  Scenario: Service name filter
-    When a user changes the selected service name
-    Then it displays relevant client metrics
diff --git a/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js b/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js
index 6ee204781c8a7..c37326ee5b196 100644
--- a/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js
+++ b/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js
@@ -1,18 +1,3 @@
 module.exports = {
-  "__version": "4.9.0",
-  "RUM Dashboard": {
-    "Rum page filters (example #1)": {
-      "1": "8 ",
-      "2": "0.08 sec",
-      "3": "0.01 sec"
-    },
-    "Rum page filters (example #2)": {
-      "1": "28 ",
-      "2": "0.07 sec",
-      "3": "0.01 sec"
-    },
-    "Page load distribution chart legends": {
-      "1": "Overall"
-    }
-  }
+  "__version": "4.9.0"
 }
diff --git a/x-pack/plugins/apm/e2e/cypress/integration/snapshots.ts b/x-pack/plugins/apm/e2e/cypress/integration/snapshots.ts
new file mode 100644
index 0000000000000..c255328a77c12
--- /dev/null
+++ b/x-pack/plugins/apm/e2e/cypress/integration/snapshots.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+module.exports = {
+  __version: '4.9.0',
+};
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/page_load_dist.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/breakdown_filter.ts
similarity index 60%
rename from x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/page_load_dist.ts
rename to x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/breakdown_filter.ts
index d671bdc0078eb..acfbe6e0a4e78 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/page_load_dist.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/breakdown_filter.ts
@@ -5,31 +5,38 @@
  */
 
 import { Given, When, Then } from 'cypress-cucumber-preprocessor/steps';
+import { DEFAULT_TIMEOUT } from './csm_dashboard';
 
 /** The default time in ms to wait for a Cypress command to complete */
-export const DEFAULT_TIMEOUT = 60 * 1000;
 
 Given(`a user clicks the page load breakdown filter`, () => {
   // wait for all loading to finish
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiStat__title-isLoading').should('not.be.visible');
-  const breakDownBtn = cy.get('[data-cy=breakdown-popover_pageLoad]');
+  const breakDownBtn = cy.get(
+    '[data-test-subj=pldBreakdownFilter]',
+    DEFAULT_TIMEOUT
+  );
   breakDownBtn.click();
 });
 
 When(`the user selected the breakdown`, () => {
-  cy.get('[data-cy=filter-breakdown-item_Browser]', {
-    timeout: DEFAULT_TIMEOUT,
-  }).click();
+  cy.get('[id="user_agent.name"]', DEFAULT_TIMEOUT).click();
   // click outside popover to close it
   cy.get('[data-cy=pageLoadDist]').click();
 });
 
 Then(`breakdown series should appear in chart`, () => {
   cy.get('.euiLoadingChart').should('not.be.visible');
-  cy.get('div.echLegendItem__label[title=Chrome] ', {
-    timeout: DEFAULT_TIMEOUT,
-  })
-    .invoke('text')
-    .should('eq', 'Chrome');
+
+  cy.get('[data-cy=pageLoadDist]').within(() => {
+    cy.get('div.echLegendItem__label[title=Chrome] ', DEFAULT_TIMEOUT)
+      .invoke('text')
+      .should('eq', 'Chrome');
+
+    cy.get('div.echLegendItem__label', DEFAULT_TIMEOUT).should(
+      'have.text',
+      'ChromeChrome Mobile WebViewSafariFirefoxMobile SafariChrome MobileChrome Mobile iOSOverall'
+    );
+  });
 });
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/client_metrics_helper.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/client_metrics_helper.ts
similarity index 87%
rename from x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/client_metrics_helper.ts
rename to x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/client_metrics_helper.ts
index 1cc36059b8ff8..0b26c6de66f4b 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/client_metrics_helper.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/client_metrics_helper.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DEFAULT_TIMEOUT } from './rum_dashboard';
+import { DEFAULT_TIMEOUT } from './csm_dashboard';
 
 /**
  * Verifies the behavior of the client metrics component
@@ -21,9 +21,7 @@ export function verifyClientMetrics(
   cy.get('kbnLoadingIndicator').should('not.be.visible');
 
   if (checkTitleStatus) {
-    cy.get('.euiStat__title', { timeout: DEFAULT_TIMEOUT }).should(
-      'be.visible'
-    );
+    cy.get('.euiStat__title', DEFAULT_TIMEOUT).should('be.visible');
     cy.get('.euiSelect-isLoading').should('not.be.visible');
   }
 
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_dashboard.ts
similarity index 83%
rename from x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
rename to x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_dashboard.ts
index 31aef30c4e23f..a57241a197ca4 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_dashboard.ts
@@ -9,20 +9,20 @@ import { loginAndWaitForPage } from '../../../integration/helpers';
 import { verifyClientMetrics } from './client_metrics_helper';
 
 /** The default time in ms to wait for a Cypress command to complete */
-export const DEFAULT_TIMEOUT = 60 * 1000;
+export const DEFAULT_TIMEOUT = { timeout: 60 * 1000 };
 
 Given(`a user browses the APM UI application for RUM Data`, () => {
   // open service overview page
   const RANGE_FROM = 'now-24h';
   const RANGE_TO = 'now';
-  loginAndWaitForPage(`/app/apm/rum-preview`, {
+  loginAndWaitForPage(`/app/csm`, {
     from: RANGE_FROM,
     to: RANGE_TO,
   });
 });
 
 Then(`should have correct client metrics`, () => {
-  const metrics = ['0.01 sec', '0.08 sec', '55 '];
+  const metrics = ['4 ms', '0.06 s', '55 '];
 
   verifyClientMetrics(metrics, true);
 });
@@ -30,7 +30,7 @@ Then(`should have correct client metrics`, () => {
 Then(`should display percentile for page load chart`, () => {
   const pMarkers = '[data-cy=percentile-markers] span';
 
-  cy.get('.euiLoadingChart', { timeout: DEFAULT_TIMEOUT }).should('be.visible');
+  cy.get('.euiLoadingChart', DEFAULT_TIMEOUT).should('be.visible');
 
   // wait for all loading to finish
   cy.get('kbnLoadingIndicator').should('not.be.visible');
@@ -52,10 +52,7 @@ Then(`should display chart legend`, () => {
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiLoadingChart').should('not.be.visible');
 
-  cy.get(chartLegend, { timeout: DEFAULT_TIMEOUT })
-    .eq(0)
-    .invoke('text')
-    .snapshot();
+  cy.get(chartLegend, DEFAULT_TIMEOUT).eq(0).should('have.text', 'Overall');
 });
 
 Then(`should display tooltip on hover`, () => {
@@ -67,7 +64,7 @@ Then(`should display tooltip on hover`, () => {
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiLoadingChart').should('not.be.visible');
 
-  const marker = cy.get(pMarkers, { timeout: DEFAULT_TIMEOUT }).eq(0);
+  const marker = cy.get(pMarkers, DEFAULT_TIMEOUT).eq(0);
   marker.invoke('show');
   marker.trigger('mouseover', { force: true });
   cy.get('span[data-cy=percentileTooltipTitle]').should('be.visible');
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_filters.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_filters.ts
similarity index 58%
rename from x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_filters.ts
rename to x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_filters.ts
index 2600e5d073328..c17845fd61468 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_filters.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/csm_filters.ts
@@ -5,7 +5,8 @@
  */
 
 import { When, Then } from 'cypress-cucumber-preprocessor/steps';
-import { DEFAULT_TIMEOUT } from './rum_dashboard';
+import { DEFAULT_TIMEOUT } from './csm_dashboard';
+import { verifyClientMetrics } from './client_metrics_helper';
 
 When(/^the user filters by "([^"]*)"$/, (filterName) => {
   // wait for all loading to finish
@@ -14,29 +15,26 @@ When(/^the user filters by "([^"]*)"$/, (filterName) => {
   cy.get(`#local-filter-${filterName}`).click();
 
   if (filterName === 'os') {
-    cy.get('button.euiSelectableListItem[title="Mac OS X"]', {
-      timeout: DEFAULT_TIMEOUT,
-    }).click();
+    cy.get('span.euiSelectableListItem__text', DEFAULT_TIMEOUT)
+      .contains('Mac OS X')
+      .click();
   } else {
-    cy.get('button.euiSelectableListItem[title="DE"]', {
-      timeout: DEFAULT_TIMEOUT,
-    }).click();
+    cy.get('span.euiSelectableListItem__text', DEFAULT_TIMEOUT)
+      .contains('DE')
+      .click();
   }
   cy.get('[data-cy=applyFilter]').click();
 });
 
-Then(`it filters the client metrics`, () => {
-  const clientMetrics = '[data-cy=client-metrics] .euiStat__title';
-
+Then(/^it filters the client metrics "([^"]*)"$/, (filterName) => {
   // wait for all loading to finish
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiStat__title-isLoading').should('not.be.visible');
 
-  cy.get(clientMetrics).eq(2).invoke('text').snapshot();
-
-  cy.get(clientMetrics).eq(1).invoke('text').snapshot();
+  const data =
+    filterName === 'os' ? ['5 ms', '0.06 s', '8 '] : ['4 ms', '0.05 s', '28 '];
 
-  cy.get(clientMetrics).eq(0).invoke('text').snapshot();
+  verifyClientMetrics(data, true);
 
-  cy.get('[data-cy=clearFilters]').click();
+  cy.get('[data-cy=clearFilters]', DEFAULT_TIMEOUT).click();
 });
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/service_name_filter.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/service_name_filter.ts
similarity index 83%
rename from x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/service_name_filter.ts
rename to x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/service_name_filter.ts
index 68fc4d528543a..4169149bc7339 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/service_name_filter.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/csm/service_name_filter.ts
@@ -8,16 +8,16 @@ import { When, Then } from 'cypress-cucumber-preprocessor/steps';
 import { DEFAULT_TIMEOUT } from '../apm';
 import { verifyClientMetrics } from './client_metrics_helper';
 
-When('a user changes the selected service name', (filterName) => {
+When('the user changes the selected service name', (filterName) => {
   // wait for all loading to finish
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get(`[data-cy=serviceNameFilter]`, { timeout: DEFAULT_TIMEOUT }).select(
-    'opbean-client-rum'
+    'client'
   );
 });
 
 Then(`it displays relevant client metrics`, () => {
-  const metrics = ['0.01 sec', '0.07 sec', '7 '];
+  const metrics = ['4 ms', '0.06 s', '55 '];
 
   verifyClientMetrics(metrics, false);
 });
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
index 12d8efdbd27f3..91ce57c78b993 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/Breakdowns/BreakdownFilter.tsx
@@ -18,11 +18,13 @@ import { BreakdownItem } from '../../../../../typings/ui_filters';
 interface Props {
   selectedBreakdown: BreakdownItem | null;
   onBreakdownChange: (value: BreakdownItem | null) => void;
+  dataTestSubj: string;
 }
 
 export function BreakdownFilter({
   selectedBreakdown,
   onBreakdownChange,
+  dataTestSubj,
 }: Props) {
   const NO_BREAKDOWN = 'noBreakdown';
 
@@ -84,6 +86,7 @@ export function BreakdownFilter({
       options={options}
       valueOfSelected={selectedBreakdown?.fieldName ?? NO_BREAKDOWN}
       onChange={(value) => onOptionChange(value)}
+      data-test-subj={dataTestSubj}
     />
   );
 }
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
index f63b914c73398..f97db3b42eecb 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
@@ -78,6 +78,7 @@ export function PageLoadDistribution() {
           <BreakdownFilter
             selectedBreakdown={breakdown}
             onBreakdownChange={setBreakdown}
+            dataTestSubj={'pldBreakdownFilter'}
           />
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
index 62ecc4ddbaaca..2991f9a15f085 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
@@ -56,6 +56,7 @@ export function PageViewsTrend() {
           <BreakdownFilter
             selectedBreakdown={breakdown}
             onBreakdownChange={setBreakdown}
+            dataTestSubj={'pvBreakdownFilter'}
           />
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
index 0b00c8a8bf093..41dacfd8b588a 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
@@ -4,24 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import cytoscape from 'cytoscape';
+import dagre from 'cytoscape-dagre';
+import isEqual from 'lodash/isEqual';
 import React, {
   createContext,
   CSSProperties,
+  memo,
   ReactNode,
   useEffect,
   useRef,
   useState,
 } from 'react';
-import cytoscape from 'cytoscape';
-import dagre from 'cytoscape-dagre';
-import { debounce } from 'lodash';
 import { useTheme } from '../../../hooks/useTheme';
-import {
-  getAnimationOptions,
-  getCytoscapeOptions,
-  getNodeHeight,
-} from './cytoscapeOptions';
-import { useUiTracker } from '../../../../../observability/public';
+import { getCytoscapeOptions } from './cytoscapeOptions';
+import { useCytoscapeEventHandlers } from './use_cytoscape_event_handlers';
 
 cytoscape.use(dagre);
 
@@ -59,49 +56,7 @@ function useCytoscape(options: cytoscape.CytoscapeOptions) {
   return [ref, cy] as [React.MutableRefObject<any>, cytoscape.Core | undefined];
 }
 
-function getLayoutOptions(nodeHeight: number): cytoscape.LayoutOptions {
-  return {
-    name: 'dagre',
-    fit: true,
-    padding: nodeHeight,
-    spacingFactor: 1.2,
-    // @ts-ignore
-    nodeSep: nodeHeight,
-    edgeSep: 32,
-    rankSep: 128,
-    rankDir: 'LR',
-    ranker: 'network-simplex',
-  };
-}
-
-/*
- * @notice
- * This product includes code in the function applyCubicBezierStyles that was
- * inspired by a public Codepen, which was available under a "MIT" license.
- *
- * Copyright (c) 2020 by Guillaume (https://codepen.io/guillaumethomas/pen/xxbbBKO)
- * MIT License http://www.opensource.org/licenses/mit-license
- */
-function applyCubicBezierStyles(edges: cytoscape.EdgeCollection) {
-  edges.forEach((edge) => {
-    const { x: x0, y: y0 } = edge.source().position();
-    const { x: x1, y: y1 } = edge.target().position();
-    const x = x1 - x0;
-    const y = y1 - y0;
-    const z = Math.sqrt(x * x + y * y);
-    const costheta = z === 0 ? 0 : x / z;
-    const alpha = 0.25;
-    // Two values for control-point-distances represent a pair symmetric quadratic
-    // bezier curves joined in the middle as a seamless cubic bezier curve:
-    edge.style('control-point-distances', [
-      -alpha * y * costheta,
-      alpha * y * costheta,
-    ]);
-    edge.style('control-point-weights', [alpha, 1 - alpha]);
-  });
-}
-
-export function Cytoscape({
+function CytoscapeComponent({
   children,
   elements,
   height,
@@ -113,131 +68,31 @@ export function Cytoscape({
     ...getCytoscapeOptions(theme),
     elements,
   });
+  useCytoscapeEventHandlers({ cy, serviceName, theme });
 
-  const nodeHeight = getNodeHeight(theme);
-
-  // Add the height to the div style. The height is a separate prop because it
-  // is required and can trigger rendering when changed.
-  const divStyle = { ...style, height };
-
-  const trackApmEvent = useUiTracker({ app: 'apm' });
-
-  // Set up cytoscape event handlers
+  // Add items from the elements prop to the cytoscape collection and remove
+  // items that no longer are in the list, then trigger an event to notify
+  // the handlers that data has changed.
   useEffect(() => {
-    const resetConnectedEdgeStyle = (node?: cytoscape.NodeSingular) => {
-      if (cy) {
-        cy.edges().removeClass('highlight');
-
-        if (node) {
-          node.connectedEdges().addClass('highlight');
-        }
-      }
-    };
+    if (cy && elements.length > 0) {
+      // We do a fit if we're going from 0 to >0 elements
+      const fit = cy.elements().length === 0;
 
-    const dataHandler: cytoscape.EventHandler = (event) => {
-      if (cy && cy.elements().length > 0) {
-        if (serviceName) {
-          resetConnectedEdgeStyle(cy.getElementById(serviceName));
-          // Add the "primary" class to the node if its id matches the serviceName.
-          if (cy.nodes().length > 0) {
-            cy.nodes().removeClass('primary');
-            cy.getElementById(serviceName).addClass('primary');
-          }
-        } else {
-          resetConnectedEdgeStyle();
-        }
-        cy.layout(getLayoutOptions(nodeHeight)).run();
-      }
-    };
-    let layoutstopDelayTimeout: NodeJS.Timeout;
-    const layoutstopHandler: cytoscape.EventHandler = (event) => {
-      // This 0ms timer is necessary to prevent a race condition
-      // between the layout finishing rendering and viewport centering
-      layoutstopDelayTimeout = setTimeout(() => {
-        if (serviceName) {
-          event.cy.animate({
-            ...getAnimationOptions(theme),
-            fit: {
-              eles: event.cy.elements(),
-              padding: nodeHeight,
-            },
-            center: {
-              eles: event.cy.getElementById(serviceName),
-            },
-          });
-        } else {
-          event.cy.fit(undefined, nodeHeight);
-        }
-      }, 0);
-      applyCubicBezierStyles(event.cy.edges());
-    };
-    // debounce hover tracking so it doesn't spam telemetry with redundant events
-    const trackNodeEdgeHover = debounce(
-      () => trackApmEvent({ metric: 'service_map_node_or_edge_hover' }),
-      1000
-    );
-    const mouseoverHandler: cytoscape.EventHandler = (event) => {
-      trackNodeEdgeHover();
-      event.target.addClass('hover');
-      event.target.connectedEdges().addClass('nodeHover');
-    };
-    const mouseoutHandler: cytoscape.EventHandler = (event) => {
-      event.target.removeClass('hover');
-      event.target.connectedEdges().removeClass('nodeHover');
-    };
-    const selectHandler: cytoscape.EventHandler = (event) => {
-      trackApmEvent({ metric: 'service_map_node_select' });
-      resetConnectedEdgeStyle(event.target);
-    };
-    const unselectHandler: cytoscape.EventHandler = (event) => {
-      resetConnectedEdgeStyle(
-        serviceName ? event.cy.getElementById(serviceName) : undefined
-      );
-    };
-    const debugHandler: cytoscape.EventHandler = (event) => {
-      const debugEnabled = sessionStorage.getItem('apm_debug') === 'true';
-      if (debugEnabled) {
-        // eslint-disable-next-line no-console
-        console.debug('cytoscape:', event);
-      }
-    };
-    const dragHandler: cytoscape.EventHandler = (event) => {
-      applyCubicBezierStyles(event.target.connectedEdges());
-    };
-
-    if (cy) {
-      cy.on('data layoutstop select unselect', debugHandler);
-      cy.on('data', dataHandler);
-      cy.on('layoutstop', layoutstopHandler);
-      cy.on('mouseover', 'edge, node', mouseoverHandler);
-      cy.on('mouseout', 'edge, node', mouseoutHandler);
-      cy.on('select', 'node', selectHandler);
-      cy.on('unselect', 'node', unselectHandler);
-      cy.on('drag', 'node', dragHandler);
-
-      cy.remove(cy.elements());
       cy.add(elements);
-      cy.trigger('data');
+      // Remove any old elements that don't exist in the new set of elements.
+      const elementIds = elements.map((element) => element.data.id);
+      cy.elements().forEach((element) => {
+        if (!elementIds.includes(element.data('id'))) {
+          cy.remove(element);
+        }
+      });
+      cy.trigger('custom:data', [fit]);
     }
+  }, [cy, elements]);
 
-    return () => {
-      if (cy) {
-        cy.removeListener(
-          'data layoutstop select unselect',
-          undefined,
-          debugHandler
-        );
-        cy.removeListener('data', undefined, dataHandler);
-        cy.removeListener('layoutstop', undefined, layoutstopHandler);
-        cy.removeListener('mouseover', 'edge, node', mouseoverHandler);
-        cy.removeListener('mouseout', 'edge, node', mouseoutHandler);
-        cy.removeListener('select', 'node', selectHandler);
-        cy.removeListener('unselect', 'node', unselectHandler);
-        cy.removeListener('drag', 'node', dragHandler);
-      }
-      clearTimeout(layoutstopDelayTimeout);
-    };
-  }, [cy, elements, height, serviceName, trackApmEvent, nodeHeight, theme]);
+  // Add the height to the div style. The height is a separate prop because it
+  // is required and can trigger rendering when changed.
+  const divStyle = { ...style, height };
 
   return (
     <CytoscapeContext.Provider value={cy}>
@@ -247,3 +102,20 @@ export function Cytoscape({
     </CytoscapeContext.Provider>
   );
 }
+
+export const Cytoscape = memo(CytoscapeComponent, (prevProps, nextProps) => {
+  const prevElementIds = prevProps.elements
+    .map((element) => element.data.id)
+    .sort();
+  const nextElementIds = nextProps.elements
+    .map((element) => element.data.id)
+    .sort();
+
+  const propsAreEqual =
+    prevProps.height === nextProps.height &&
+    prevProps.serviceName === nextProps.serviceName &&
+    isEqual(prevProps.style, nextProps.style) &&
+    isEqual(prevElementIds, nextElementIds);
+
+  return propsAreEqual;
+});
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
index 8291d94d91c48..c4272d2869016 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
@@ -70,7 +70,7 @@ export function Popover({ focusedServiceName }: PopoverProps) {
     if (cy) {
       cy.on('select', 'node', selectHandler);
       cy.on('unselect', 'node', deselect);
-      cy.on('data viewport', deselect);
+      cy.on('viewport', deselect);
       cy.on('drag', 'node', deselect);
     }
 
@@ -78,7 +78,7 @@ export function Popover({ focusedServiceName }: PopoverProps) {
       if (cy) {
         cy.removeListener('select', 'node', selectHandler);
         cy.removeListener('unselect', 'node', deselect);
-        cy.removeListener('data viewport', undefined, deselect);
+        cy.removeListener('viewport', undefined, deselect);
         cy.removeListener('drag', 'node', deselect);
       }
     };
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/use_cytoscape_event_handlers.test.tsx b/x-pack/plugins/apm/public/components/app/ServiceMap/use_cytoscape_event_handlers.test.tsx
new file mode 100644
index 0000000000000..4212d866c0853
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/use_cytoscape_event_handlers.test.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { renderHook } from '@testing-library/react-hooks';
+import cytoscape from 'cytoscape';
+import { EuiTheme } from '../../../../../observability/public';
+import { useCytoscapeEventHandlers } from './use_cytoscape_event_handlers';
+import dagre from 'cytoscape-dagre';
+
+cytoscape.use(dagre);
+
+const theme = ({
+  eui: { avatarSizing: { l: { size: 10 } } },
+} as unknown) as EuiTheme;
+
+describe('useCytoscapeEventHandlers', () => {
+  describe('when cytoscape is undefined', () => {
+    it('runs', () => {
+      expect(() => {
+        renderHook(() => useCytoscapeEventHandlers({ cy: undefined, theme }));
+      }).not.toThrowError();
+    });
+  });
+
+  describe('when an element is dragged', () => {
+    it('sets the hasBeenDragged data', () => {
+      const cy = cytoscape({ elements: [{ data: { id: 'test' } }] });
+
+      renderHook(() => useCytoscapeEventHandlers({ cy, theme }));
+      cy.getElementById('test').trigger('drag');
+
+      expect(cy.getElementById('test').data('hasBeenDragged')).toEqual(true);
+    });
+  });
+
+  describe('when a node is hovered', () => {
+    it('applies the hover class', () => {
+      const cy = cytoscape({
+        elements: [{ data: { id: 'test' } }],
+      });
+      const node = cy.getElementById('test');
+
+      renderHook(() => useCytoscapeEventHandlers({ cy, theme }));
+      node.trigger('mouseover');
+
+      expect(node.hasClass('hover')).toEqual(true);
+    });
+  });
+
+  describe('when a node is un-hovered', () => {
+    it('removes the hover class', () => {
+      const cy = cytoscape({
+        elements: [{ data: { id: 'test' }, classes: 'hover' }],
+      });
+      const node = cy.getElementById('test');
+
+      renderHook(() => useCytoscapeEventHandlers({ cy, theme }));
+      node.trigger('mouseout');
+
+      expect(node.hasClass('hover')).toEqual(false);
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/public/components/app/ServiceMap/use_cytoscape_event_handlers.ts b/x-pack/plugins/apm/public/components/app/ServiceMap/use_cytoscape_event_handlers.ts
new file mode 100644
index 0000000000000..3f879196f2a4f
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/ServiceMap/use_cytoscape_event_handlers.ts
@@ -0,0 +1,188 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import cytoscape from 'cytoscape';
+import debounce from 'lodash/debounce';
+import { useEffect } from 'react';
+import { EuiTheme, useUiTracker } from '../../../../../observability/public';
+import { getAnimationOptions, getNodeHeight } from './cytoscapeOptions';
+
+/*
+ * @notice
+ * This product includes code in the function applyCubicBezierStyles that was
+ * inspired by a public Codepen, which was available under a "MIT" license.
+ *
+ * Copyright (c) 2020 by Guillaume (https://codepen.io/guillaumethomas/pen/xxbbBKO)
+ * MIT License http://www.opensource.org/licenses/mit-license
+ */
+function applyCubicBezierStyles(edges: cytoscape.EdgeCollection) {
+  edges.forEach((edge) => {
+    const { x: x0, y: y0 } = edge.source().position();
+    const { x: x1, y: y1 } = edge.target().position();
+    const x = x1 - x0;
+    const y = y1 - y0;
+    const z = Math.sqrt(x * x + y * y);
+    const costheta = z === 0 ? 0 : x / z;
+    const alpha = 0.25;
+    // Two values for control-point-distances represent a pair symmetric quadratic
+    // bezier curves joined in the middle as a seamless cubic bezier curve:
+    edge.style('control-point-distances', [
+      -alpha * y * costheta,
+      alpha * y * costheta,
+    ]);
+    edge.style('control-point-weights', [alpha, 1 - alpha]);
+  });
+}
+
+function getLayoutOptions({
+  fit = false,
+  nodeHeight,
+  theme,
+}: {
+  fit?: boolean;
+  nodeHeight: number;
+  theme: EuiTheme;
+}): cytoscape.LayoutOptions {
+  const animationOptions = getAnimationOptions(theme);
+
+  // @ts-expect-error Some of the dagre-specific layout options don't work with
+  // the types.
+  return {
+    animationDuration: animationOptions.duration,
+    animationEasing: animationOptions.easing,
+    fit,
+    name: 'dagre',
+    animate: !fit,
+    padding: nodeHeight,
+    spacingFactor: 1.2,
+    nodeSep: nodeHeight,
+    edgeSep: 32,
+    rankSep: 128,
+    rankDir: 'LR',
+    ranker: 'network-simplex',
+  };
+}
+
+export function useCytoscapeEventHandlers({
+  cy,
+  serviceName,
+  theme,
+}: {
+  cy?: cytoscape.Core;
+  serviceName?: string;
+  theme: EuiTheme;
+}) {
+  const trackApmEvent = useUiTracker({ app: 'apm' });
+
+  useEffect(() => {
+    const nodeHeight = getNodeHeight(theme);
+
+    const resetConnectedEdgeStyle = (
+      cytoscapeInstance: cytoscape.Core,
+      node?: cytoscape.NodeSingular
+    ) => {
+      cytoscapeInstance.edges().removeClass('highlight');
+      if (node) {
+        node.connectedEdges().addClass('highlight');
+      }
+    };
+
+    const dataHandler: cytoscape.EventHandler = (event, fit) => {
+      if (serviceName) {
+        const node = event.cy.getElementById(serviceName);
+        resetConnectedEdgeStyle(event.cy, node);
+        // Add the "primary" class to the node if its id matches the serviceName.
+        if (event.cy.nodes().length > 0) {
+          event.cy.nodes().removeClass('primary');
+          node.addClass('primary');
+        }
+      } else {
+        resetConnectedEdgeStyle(event.cy);
+      }
+
+      // Run the layout on nodes that are not selected and have not been manually
+      // positioned.
+      event.cy
+        .elements('[!hasBeenDragged]')
+        .difference('node:selected')
+        .layout(getLayoutOptions({ fit, nodeHeight, theme }))
+        .run();
+    };
+
+    const layoutstopHandler: cytoscape.EventHandler = (event) => {
+      applyCubicBezierStyles(event.cy.edges());
+    };
+
+    // debounce hover tracking so it doesn't spam telemetry with redundant events
+    const trackNodeEdgeHover = debounce(
+      () => trackApmEvent({ metric: 'service_map_node_or_edge_hover' }),
+      1000
+    );
+
+    const mouseoverHandler: cytoscape.EventHandler = (event) => {
+      trackNodeEdgeHover();
+      event.target.addClass('hover');
+      event.target.connectedEdges().addClass('nodeHover');
+    };
+    const mouseoutHandler: cytoscape.EventHandler = (event) => {
+      event.target.removeClass('hover');
+      event.target.connectedEdges().removeClass('nodeHover');
+    };
+    const selectHandler: cytoscape.EventHandler = (event) => {
+      trackApmEvent({ metric: 'service_map_node_select' });
+      resetConnectedEdgeStyle(event.target);
+    };
+    const unselectHandler: cytoscape.EventHandler = (event) => {
+      resetConnectedEdgeStyle(
+        event.cy,
+        serviceName ? event.cy.getElementById(serviceName) : undefined
+      );
+    };
+    const debugHandler: cytoscape.EventHandler = (event) => {
+      const debugEnabled = sessionStorage.getItem('apm_debug') === 'true';
+      if (debugEnabled) {
+        // eslint-disable-next-line no-console
+        console.debug('cytoscape:', event);
+      }
+    };
+
+    const dragHandler: cytoscape.EventHandler = (event) => {
+      applyCubicBezierStyles(event.target.connectedEdges());
+
+      if (!event.target.data('hasBeenDragged')) {
+        event.target.data('hasBeenDragged', true);
+      }
+    };
+
+    if (cy) {
+      cy.on('custom:data drag layoutstop select unselect', debugHandler);
+      cy.on('custom:data', dataHandler);
+      cy.on('layoutstop', layoutstopHandler);
+      cy.on('mouseover', 'edge, node', mouseoverHandler);
+      cy.on('mouseout', 'edge, node', mouseoutHandler);
+      cy.on('select', 'node', selectHandler);
+      cy.on('unselect', 'node', unselectHandler);
+      cy.on('drag', 'node', dragHandler);
+    }
+
+    return () => {
+      if (cy) {
+        cy.removeListener(
+          'custom:data drag layoutstop select unselect',
+          undefined,
+          debugHandler
+        );
+        cy.removeListener('custom:data', undefined, dataHandler);
+        cy.removeListener('layoutstop', undefined, layoutstopHandler);
+        cy.removeListener('mouseover', 'edge, node', mouseoverHandler);
+        cy.removeListener('mouseout', 'edge, node', mouseoutHandler);
+        cy.removeListener('select', 'node', selectHandler);
+        cy.removeListener('unselect', 'node', unselectHandler);
+        cy.removeListener('drag', 'node', dragHandler);
+      }
+    };
+  }, [cy, serviceName, trackApmEvent, theme]);
+}
diff --git a/x-pack/plugins/canvas/server/routes/shareables/download.test.ts b/x-pack/plugins/canvas/server/routes/shareables/download.test.ts
index 1edf9f52e164a..8c0203eaf1042 100644
--- a/x-pack/plugins/canvas/server/routes/shareables/download.test.ts
+++ b/x-pack/plugins/canvas/server/routes/shareables/download.test.ts
@@ -4,9 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('fs');
-
 import fs from 'fs';
+import { when } from 'jest-when';
+import { SHAREABLE_RUNTIME_FILE } from '../../../shareable_runtime/constants';
+
 import { kibanaResponseFactory, RequestHandlerContext, RequestHandler } from 'src/core/server';
 import { httpServerMock } from 'src/core/server/mocks';
 import { initializeDownloadShareableWorkpadRoute } from './download';
@@ -14,7 +15,6 @@ import { getMockedRouterDeps } from '../test_helpers';
 
 const mockRouteContext = {} as RequestHandlerContext;
 const path = `api/canvas/workpad/find`;
-const mockRuntime = 'Canvas shareable runtime';
 
 describe('Download Canvas shareables runtime', () => {
   let routeHandler: RequestHandler<any, any, any>;
@@ -31,17 +31,18 @@ describe('Download Canvas shareables runtime', () => {
   });
 
   it(`returns 200 with canvas shareables runtime`, async () => {
+    const content = 'Canvas shareable runtime';
+    const spy = jest.spyOn(fs, 'readFileSync').mockImplementation();
+    when(spy).calledWith(SHAREABLE_RUNTIME_FILE).mockReturnValue(content);
+
     const request = httpServerMock.createKibanaRequest({
       method: 'get',
       path,
     });
 
-    const readFileSyncMock = fs.readFileSync as jest.Mock;
-    readFileSyncMock.mockReturnValueOnce(mockRuntime);
-
     const response = await routeHandler(mockRouteContext, request, kibanaResponseFactory);
 
     expect(response.status).toBe(200);
-    expect(response.payload).toMatchInlineSnapshot(`"Canvas shareable runtime"`);
+    expect(response.payload).toMatchInlineSnapshot(`"${content}"`);
   });
 });
diff --git a/x-pack/plugins/canvas/server/routes/shareables/mock_shareable_workpad.json b/x-pack/plugins/canvas/server/routes/shareables/mock_shareable_workpad.json
deleted file mode 100644
index e69de29bb2d1d..0000000000000
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx
index 4053f2f4bb613..623e6e47167d2 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.test.tsx
@@ -6,7 +6,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { EuiPageSideBar, EuiButton } from '@elastic/eui';
+import { EuiPageSideBar, EuiButton, EuiPageBody } from '@elastic/eui';
 
 import { Layout, INavContext } from './layout';
 
@@ -15,6 +15,13 @@ describe('Layout', () => {
     const wrapper = shallow(<Layout navigation={null} />);
 
     expect(wrapper.find('.enterpriseSearchLayout')).toHaveLength(1);
+    expect(wrapper.find(EuiPageBody).prop('restrictWidth')).toBeFalsy();
+  });
+
+  it('passes the restrictWidth prop', () => {
+    const wrapper = shallow(<Layout navigation={null} restrictWidth />);
+
+    expect(wrapper.find(EuiPageBody).prop('restrictWidth')).toEqual(true);
   });
 
   it('renders navigation', () => {
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx
index b4497140b65b7..e122c4d5cfdfa 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/layout.tsx
@@ -14,6 +14,7 @@ import './layout.scss';
 
 interface ILayoutProps {
   navigation: React.ReactNode;
+  restrictWidth?: boolean;
 }
 
 export interface INavContext {
@@ -21,7 +22,7 @@ export interface INavContext {
 }
 export const NavContext = React.createContext({});
 
-export const Layout: React.FC<ILayoutProps> = ({ children, navigation }) => {
+export const Layout: React.FC<ILayoutProps> = ({ children, navigation, restrictWidth }) => {
   const [isNavOpen, setIsNavOpen] = useState(false);
   const toggleNavigation = () => setIsNavOpen(!isNavOpen);
   const closeNavigation = () => setIsNavOpen(false);
@@ -54,7 +55,9 @@ export const Layout: React.FC<ILayoutProps> = ({ children, navigation }) => {
         </div>
         <NavContext.Provider value={{ closeNavigation }}>{navigation}</NavContext.Provider>
       </EuiPageSideBar>
-      <EuiPageBody className="enterpriseSearchLayout__body">{children}</EuiPageBody>
+      <EuiPageBody className="enterpriseSearchLayout__body" restrictWidth={restrictWidth}>
+        {children}
+      </EuiPageBody>
     </EuiPage>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/plugin.ts b/x-pack/plugins/enterprise_search/public/plugin.ts
index 63f334811ce31..0ef58a7c03f10 100644
--- a/x-pack/plugins/enterprise_search/public/plugin.ts
+++ b/x-pack/plugins/enterprise_search/public/plugin.ts
@@ -53,6 +53,7 @@ export class EnterpriseSearchPlugin implements Plugin {
     core.application.register({
       id: ENTERPRISE_SEARCH_PLUGIN.ID,
       title: ENTERPRISE_SEARCH_PLUGIN.NAV_TITLE,
+      euiIconType: ENTERPRISE_SEARCH_PLUGIN.LOGO,
       appRoute: ENTERPRISE_SEARCH_PLUGIN.URL,
       category: DEFAULT_APP_CATEGORIES.enterpriseSearch,
       mount: async (params: AppMountParameters) => {
diff --git a/x-pack/plugins/features/server/plugin.ts b/x-pack/plugins/features/server/plugin.ts
index 8a799887bba09..857bba4c606d4 100644
--- a/x-pack/plugins/features/server/plugin.ts
+++ b/x-pack/plugins/features/server/plugin.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { RecursiveReadonly } from '@kbn/utility-types';
+import { deepFreeze } from '@kbn/std';
 import {
   CoreSetup,
   CoreStart,
@@ -12,7 +13,6 @@ import {
   PluginInitializerContext,
 } from '../../../../src/core/server';
 import { Capabilities as UICapabilities } from '../../../../src/core/server';
-import { deepFreeze } from '../../../../src/core/server';
 import { PluginSetupContract as TimelionSetupContract } from '../../../../src/plugins/vis_type_timelion/server';
 import { FeatureRegistry } from './feature_registry';
 import { uiCapabilitiesForFeatures } from './ui_capabilities_for_features';
diff --git a/x-pack/plugins/global_search_bar/public/components/search_bar.tsx b/x-pack/plugins/global_search_bar/public/components/search_bar.tsx
index 25ca1b07321c7..d00349e21a7e4 100644
--- a/x-pack/plugins/global_search_bar/public/components/search_bar.tsx
+++ b/x-pack/plugins/global_search_bar/public/components/search_bar.tsx
@@ -197,18 +197,6 @@ export function SearchBar({ globalSearch, navigateToUrl }: Props) {
                 ),
               }}
             />
-            <FormattedMessage
-              id="xpack.globalSearchBar.searchBar.shortcut"
-              defaultMessage="{what}{how}"
-              values={{
-                what: <EuiFlexItem grow={false}>Shortcut</EuiFlexItem>,
-                how: (
-                  <EuiFlexItem grow={false}>
-                    <EuiBadge>{isMac ? 'Command + /' : 'Control + /'}</EuiBadge>
-                  </EuiFlexItem>
-                ),
-              }}
-            />
           </EuiFlexGroup>
         </EuiText>
       }
diff --git a/x-pack/plugins/graph/public/state_management/url_templates.ts b/x-pack/plugins/graph/public/state_management/url_templates.ts
index 19de52d444209..9149a27a4f986 100644
--- a/x-pack/plugins/graph/public/state_management/url_templates.ts
+++ b/x-pack/plugins/graph/public/state_management/url_templates.ts
@@ -7,6 +7,7 @@
 import actionCreatorFactory from 'typescript-fsa';
 import { reducerWithInitialState } from 'typescript-fsa-reducers/dist';
 import { i18n } from '@kbn/i18n';
+import { modifyUrl } from '@kbn/std';
 import rison from 'rison-node';
 import { takeEvery, select } from 'redux-saga/effects';
 import { format, parse } from 'url';
@@ -17,7 +18,6 @@ import { setDatasource, IndexpatternDatasource, requestDatasource } from './data
 import { outlinkEncoders } from '../helpers/outlink_encoders';
 import { urlTemplatePlaceholder } from '../helpers/url_template';
 import { matchesOne } from './helpers';
-import { modifyUrl } from '../../../../../src/core/public';
 
 const actionCreator = actionCreatorFactory('x-pack/graph/urlTemplates');
 
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx b/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
index 28b25c3eb4530..3867c30655379 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.tsx
@@ -275,6 +275,40 @@ describe('edit policy', () => {
       save(rendered);
       expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
     });
+    test('should show forcemerge input when rollover enabled', () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      expect(findTestSubject(rendered, 'hot-forceMergeSwitch').exists()).toBeTruthy();
+    });
+    test('should hide forcemerge input when rollover is disabled', () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      noRollover(rendered);
+      rendered.update();
+      expect(findTestSubject(rendered, 'hot-forceMergeSwitch').exists()).toBeFalsy();
+    });
+    test('should show positive number required above zero error when trying to save hot phase with 0 for force merge', async () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      findTestSubject(rendered, 'hot-forceMergeSwitch').simulate('click');
+      rendered.update();
+      const forcemergeInput = findTestSubject(rendered, 'hot-selectedForceMergeSegments');
+      forcemergeInput.simulate('change', { target: { value: '0' } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
+    test('should show positive number above 0 required error when trying to save hot phase with -1 for force merge', async () => {
+      const rendered = mountWithIntl(component);
+      setPolicyName(rendered, 'mypolicy');
+      findTestSubject(rendered, 'hot-forceMergeSwitch').simulate('click');
+      rendered.update();
+      const forcemergeInput = findTestSubject(rendered, 'hot-selectedForceMergeSegments');
+      forcemergeInput.simulate('change', { target: { value: '-1' } });
+      rendered.update();
+      save(rendered);
+      expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
+    });
     test('should show positive number required error when trying to save with -1 for index priority', () => {
       const rendered = mountWithIntl(component);
       noRollover(rendered);
@@ -364,10 +398,10 @@ describe('edit policy', () => {
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'warm');
       setPhaseAfter(rendered, 'warm', '1');
-      findTestSubject(rendered, 'forceMergeSwitch').simulate('click');
+      findTestSubject(rendered, 'warm-forceMergeSwitch').simulate('click');
       rendered.update();
-      const shrinkInput = rendered.find('input#warm-selectedForceMergeSegments');
-      shrinkInput.simulate('change', { target: { value: '0' } });
+      const forcemergeInput = findTestSubject(rendered, 'warm-selectedForceMergeSegments');
+      forcemergeInput.simulate('change', { target: { value: '0' } });
       rendered.update();
       save(rendered);
       expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
@@ -378,10 +412,10 @@ describe('edit policy', () => {
       setPolicyName(rendered, 'mypolicy');
       await activatePhase(rendered, 'warm');
       setPhaseAfter(rendered, 'warm', '1');
-      findTestSubject(rendered, 'forceMergeSwitch').simulate('click');
+      findTestSubject(rendered, 'warm-forceMergeSwitch').simulate('click');
       rendered.update();
-      const shrinkInput = rendered.find('input#warm-selectedForceMergeSegments');
-      shrinkInput.simulate('change', { target: { value: '-1' } });
+      const forcemergeInput = findTestSubject(rendered, 'warm-selectedForceMergeSegments');
+      forcemergeInput.simulate('change', { target: { value: '-1' } });
       rendered.update();
       save(rendered);
       expectedErrorMessages(rendered, [positiveNumbersAboveZeroErrorMessage]);
diff --git a/x-pack/plugins/index_lifecycle_management/common/types/policies.ts b/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
index d88d5b5021a25..97effee44533a 100644
--- a/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
+++ b/x-pack/plugins/index_lifecycle_management/common/types/policies.ts
@@ -41,6 +41,9 @@ export interface SerializedHotPhase extends SerializedPhase {
       max_age?: string;
       max_docs?: number;
     };
+    forcemerge?: {
+      max_num_segments: number;
+    };
     set_priority?: {
       priority: number | null;
     };
@@ -131,7 +134,15 @@ export interface PhaseWithIndexPriority {
   phaseIndexPriority: string;
 }
 
-export interface HotPhase extends CommonPhaseSettings, PhaseWithIndexPriority {
+export interface PhaseWithForcemergeAction {
+  forceMergeEnabled: boolean;
+  selectedForceMergeSegments: string;
+}
+
+export interface HotPhase
+  extends CommonPhaseSettings,
+    PhaseWithIndexPriority,
+    PhaseWithForcemergeAction {
   rolloverEnabled: boolean;
   selectedMaxSizeStored: string;
   selectedMaxSizeStoredUnits: string;
@@ -144,12 +155,11 @@ export interface WarmPhase
   extends CommonPhaseSettings,
     PhaseWithMinAge,
     PhaseWithAllocationAction,
-    PhaseWithIndexPriority {
+    PhaseWithIndexPriority,
+    PhaseWithForcemergeAction {
   warmPhaseOnRollover: boolean;
   shrinkEnabled: boolean;
   selectedPrimaryShardCount: string;
-  forceMergeEnabled: boolean;
-  selectedForceMergeSegments: string;
 }
 
 export interface ColdPhase
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts b/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
index 4fd74da06f1b3..f11860d36faf8 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/constants/policy.ts
@@ -20,6 +20,8 @@ export const defaultNewHotPhase: HotPhase = {
   selectedMaxAgeUnits: 'd',
   selectedMaxSizeStored: '50',
   selectedMaxSizeStoredUnits: 'gb',
+  forceMergeEnabled: false,
+  selectedForceMergeSegments: '',
   phaseIndexPriority: '100',
   selectedMaxDocuments: '',
 };
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/forcemerge.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/forcemerge.tsx
new file mode 100644
index 0000000000000..50cc7fd8b3274
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/forcemerge.tsx
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiDescribedFormGroup,
+  EuiFieldNumber,
+  EuiSpacer,
+  EuiSwitch,
+  EuiTextColor,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+import { LearnMoreLink } from './learn_more_link';
+import { ErrableFormRow } from './form_errors';
+import { Phases, PhaseWithForcemergeAction } from '../../../../../common/types';
+import { PhaseValidationErrors } from '../../../services/policies/policy_validation';
+
+const forcemergeLabel = i18n.translate('xpack.indexLifecycleMgmt.warmPhase.forceMergeDataLabel', {
+  defaultMessage: 'Force merge data',
+});
+
+interface Props {
+  errors?: PhaseValidationErrors<PhaseWithForcemergeAction>;
+  phase: keyof Phases & string;
+  phaseData: PhaseWithForcemergeAction;
+  setPhaseData: (dataKey: keyof PhaseWithForcemergeAction, value: boolean | string) => void;
+  isShowingErrors: boolean;
+}
+export const Forcemerge: React.FunctionComponent<Props> = ({
+  errors,
+  phaseData,
+  phase,
+  setPhaseData,
+  isShowingErrors,
+}) => {
+  return (
+    <EuiDescribedFormGroup
+      title={
+        <h3>
+          <FormattedMessage
+            id="xpack.indexLifecycleMgmt.editPolicy.warmPhase.forceMergeDataText"
+            defaultMessage="Force merge"
+          />
+        </h3>
+      }
+      description={
+        <EuiTextColor color="subdued">
+          <FormattedMessage
+            id="xpack.indexLifecycleMgmt.editPolicy.warmPhase.forceMergeDataExplanationText"
+            defaultMessage="Reduce the number of segments in your shard by merging smaller files and clearing deleted ones."
+          />{' '}
+          <LearnMoreLink docPath="indices-forcemerge.html" />
+        </EuiTextColor>
+      }
+      titleSize="xs"
+      fullWidth
+    >
+      <EuiSwitch
+        data-test-subj={`${phase}-forceMergeSwitch`}
+        label={forcemergeLabel}
+        aria-label={forcemergeLabel}
+        checked={phaseData.forceMergeEnabled}
+        onChange={(e) => {
+          setPhaseData('forceMergeEnabled', e.target.checked);
+        }}
+        aria-controls="forcemergeContent"
+      />
+
+      <EuiSpacer />
+      <div id="forcemergeContent" aria-live="polite" role="region">
+        {phaseData.forceMergeEnabled ? (
+          <ErrableFormRow
+            id={`${phase}-selectedForceMergeSegments`}
+            label={i18n.translate('xpack.indexLifecycleMgmt.warmPhase.numberOfSegmentsLabel', {
+              defaultMessage: 'Number of segments',
+            })}
+            isShowingErrors={isShowingErrors}
+            errors={errors?.selectedForceMergeSegments}
+          >
+            <EuiFieldNumber
+              data-test-subj={`${phase}-selectedForceMergeSegments`}
+              value={phaseData.selectedForceMergeSegments}
+              onChange={(e) => {
+                setPhaseData('selectedForceMergeSegments', e.target.value);
+              }}
+              min={1}
+            />
+          </ErrableFormRow>
+        ) : null}
+      </div>
+    </EuiDescribedFormGroup>
+  );
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts
index e933c46e98491..4410c4bb38397 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/components/index.ts
@@ -15,3 +15,4 @@ export { PhaseErrorMessage } from './phase_error_message';
 export { PolicyJsonFlyout } from './policy_json_flyout';
 export { SetPriorityInput } from './set_priority_input';
 export { SnapshotPolicies } from './snapshot_policies';
+export { Forcemerge } from './forcemerge';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx
index 59949ad93fa5d..7682b92488086 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/hot_phase.tsx
@@ -27,6 +27,7 @@ import {
   PhaseErrorMessage,
   ErrableFormRow,
   SetPriorityInput,
+  Forcemerge,
 } from '../components';
 
 const maxSizeStoredUnits = [
@@ -313,6 +314,15 @@ export class HotPhase extends PureComponent<Props> {
             </Fragment>
           ) : null}
         </EuiDescribedFormGroup>
+        {phaseData.rolloverEnabled ? (
+          <Forcemerge
+            phase={'hot'}
+            phaseData={phaseData}
+            setPhaseData={setPhaseData}
+            isShowingErrors={isShowingErrors}
+            errors={errors}
+          />
+        ) : null}
         <SetPriorityInput<HotPhaseInterface>
           errors={errors}
           phaseData={phaseData}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
index 71286475bcfe9..c806056899cac 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/phases/warm_phase.tsx
@@ -29,6 +29,7 @@ import {
   SetPriorityInput,
   NodeAllocation,
   MinAgeInput,
+  Forcemerge,
 } from '../components';
 
 const shrinkLabel = i18n.translate('xpack.indexLifecycleMgmt.warmPhase.shrinkIndexLabel', {
@@ -42,10 +43,6 @@ const moveToWarmPhaseOnRolloverLabel = i18n.translate(
   }
 );
 
-const forcemergeLabel = i18n.translate('xpack.indexLifecycleMgmt.warmPhase.forceMergeDataLabel', {
-  defaultMessage: 'Force merge data',
-});
-
 const warmProperty: keyof Phases = 'warm';
 const phaseProperty = (propertyName: keyof WarmPhaseInterface) => propertyName;
 
@@ -262,64 +259,13 @@ export class WarmPhase extends PureComponent<Props> {
                 </div>
               </Fragment>
             </EuiDescribedFormGroup>
-            <EuiDescribedFormGroup
-              title={
-                <h3>
-                  <FormattedMessage
-                    id="xpack.indexLifecycleMgmt.editPolicy.warmPhase.forceMergeDataText"
-                    defaultMessage="Force merge"
-                  />
-                </h3>
-              }
-              description={
-                <EuiTextColor color="subdued">
-                  <FormattedMessage
-                    id="xpack.indexLifecycleMgmt.editPolicy.warmPhase.forceMergeDataExplanationText"
-                    defaultMessage="Reduce the number of segments in your shard by merging smaller files and clearing deleted ones."
-                  />{' '}
-                  <LearnMoreLink docPath="indices-forcemerge.html" />
-                </EuiTextColor>
-              }
-              titleSize="xs"
-              fullWidth
-            >
-              <EuiSwitch
-                data-test-subj="forceMergeSwitch"
-                label={forcemergeLabel}
-                aria-label={forcemergeLabel}
-                checked={phaseData.forceMergeEnabled}
-                onChange={(e) => {
-                  setPhaseData(phaseProperty('forceMergeEnabled'), e.target.checked);
-                }}
-                aria-controls="forcemergeContent"
-              />
-
-              <EuiSpacer />
-              <div id="forcemergeContent" aria-live="polite" role="region">
-                {phaseData.forceMergeEnabled ? (
-                  <ErrableFormRow
-                    id={`${warmProperty}-${phaseProperty('selectedForceMergeSegments')}`}
-                    label={i18n.translate(
-                      'xpack.indexLifecycleMgmt.warmPhase.numberOfSegmentsLabel',
-                      {
-                        defaultMessage: 'Number of segments',
-                      }
-                    )}
-                    isShowingErrors={isShowingErrors}
-                    errors={errors?.selectedForceMergeSegments}
-                  >
-                    <EuiFieldNumber
-                      id={`${warmProperty}-${phaseProperty('selectedForceMergeSegments')}`}
-                      value={phaseData.selectedForceMergeSegments}
-                      onChange={(e) => {
-                        setPhaseData(phaseProperty('selectedForceMergeSegments'), e.target.value);
-                      }}
-                      min={1}
-                    />
-                  </ErrableFormRow>
-                ) : null}
-              </div>
-            </EuiDescribedFormGroup>
+            <Forcemerge
+              phase={'warm'}
+              phaseData={phaseData}
+              setPhaseData={setPhaseData}
+              isShowingErrors={isShowingErrors}
+              errors={errors}
+            />
             <SetPriorityInput<WarmPhaseInterface>
               errors={errors}
               phaseData={phaseData}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts
index fb7f74efeb66e..4ef4890b5ffe3 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/services/policies/hot_phase.ts
@@ -24,6 +24,8 @@ const hotPhaseInitialization: HotPhase = {
   selectedMaxAgeUnits: 'd',
   selectedMaxSizeStored: '',
   selectedMaxSizeStoredUnits: 'gb',
+  forceMergeEnabled: false,
+  selectedForceMergeSegments: '',
   phaseIndexPriority: '',
   selectedMaxDocuments: '',
 };
@@ -58,6 +60,12 @@ export const hotPhaseFromES = (phaseSerialized?: SerializedHotPhase): HotPhase =
       }
     }
 
+    if (actions.forcemerge) {
+      const forcemerge = actions.forcemerge;
+      phase.forceMergeEnabled = true;
+      phase.selectedForceMergeSegments = forcemerge.max_num_segments.toString();
+    }
+
     if (actions.set_priority) {
       phase.phaseIndexPriority = actions.set_priority.priority
         ? actions.set_priority.priority.toString()
@@ -93,8 +101,19 @@ export const hotPhaseToES = (
     if (isNumber(phase.selectedMaxDocuments)) {
       esPhase.actions.rollover.max_docs = parseInt(phase.selectedMaxDocuments, 10);
     }
+    if (phase.forceMergeEnabled && isNumber(phase.selectedForceMergeSegments)) {
+      esPhase.actions.forcemerge = {
+        max_num_segments: parseInt(phase.selectedForceMergeSegments, 10),
+      };
+    } else {
+      delete esPhase.actions.forcemerge;
+    }
   } else {
     delete esPhase.actions.rollover;
+    // forcemerge is only allowed if rollover is enabled
+    if (esPhase.actions.forcemerge) {
+      delete esPhase.actions.forcemerge;
+    }
   }
 
   if (isNumber(phase.phaseIndexPriority)) {
@@ -147,6 +166,15 @@ export const validateHotPhase = (phase: HotPhase): PhaseValidationErrors<HotPhas
     if (isNumber(phase.selectedMaxDocuments) && parseInt(phase.selectedMaxDocuments, 10) < 1) {
       phaseErrors.selectedMaxDocuments = [positiveNumbersAboveZeroErrorMessage];
     }
+
+    // if forcemerge is enabled, force merge segments needs to be a number above zero
+    if (phase.forceMergeEnabled) {
+      if (!isNumber(phase.selectedForceMergeSegments)) {
+        phaseErrors.selectedForceMergeSegments = [numberRequiredMessage];
+      } else if (parseInt(phase.selectedForceMergeSegments, 10) < 1) {
+        phaseErrors.selectedForceMergeSegments = [positiveNumbersAboveZeroErrorMessage];
+      }
+    }
   }
 
   return {
diff --git a/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts b/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
index 9b51164fd4c28..ba6b8665479a9 100644
--- a/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
@@ -50,6 +50,12 @@ const allocateSchema = schema.maybe(
   })
 );
 
+const forcemergeSchema = schema.maybe(
+  schema.object({
+    max_num_segments: schema.number(),
+  })
+);
+
 const hotPhaseSchema = schema.object({
   min_age: minAgeSchema,
   actions: schema.object({
@@ -62,6 +68,7 @@ const hotPhaseSchema = schema.object({
         max_docs: schema.maybe(schema.number()),
       })
     ),
+    forcemerge: forcemergeSchema,
   }),
 });
 
@@ -78,11 +85,7 @@ const warmPhaseSchema = schema.maybe(
           number_of_shards: schema.number(),
         })
       ),
-      forcemerge: schema.maybe(
-        schema.object({
-          max_num_segments: schema.number(),
-        })
-      ),
+      forcemerge: forcemergeSchema,
     }),
   })
 );
diff --git a/x-pack/plugins/infra/common/saved_objects/inventory_view.ts b/x-pack/plugins/infra/common/saved_objects/inventory_view.ts
index cca838e526e67..c81de3145ec43 100644
--- a/x-pack/plugins/infra/common/saved_objects/inventory_view.ts
+++ b/x-pack/plugins/infra/common/saved_objects/inventory_view.ts
@@ -17,135 +17,7 @@ export const inventoryViewSavedObjectType: SavedObjectsType = {
     importableAndExportable: true,
   },
   mappings: {
-    properties: {
-      name: {
-        type: 'keyword',
-      },
-      sort: {
-        properties: {
-          by: {
-            type: 'keyword',
-          },
-          direction: {
-            type: 'keyword',
-          },
-        },
-      },
-      metric: {
-        properties: {
-          type: {
-            type: 'keyword',
-          },
-          field: {
-            type: 'keyword',
-          },
-          aggregation: {
-            type: 'keyword',
-          },
-          id: {
-            type: 'keyword',
-          },
-          label: {
-            type: 'keyword',
-          },
-        },
-      },
-      legend: {
-        properties: {
-          palette: {
-            type: 'keyword',
-          },
-          steps: {
-            type: 'long',
-          },
-          reverseColors: {
-            type: 'boolean',
-          },
-        },
-      },
-      groupBy: {
-        type: 'nested',
-        properties: {
-          label: {
-            type: 'keyword',
-          },
-          field: {
-            type: 'keyword',
-          },
-        },
-      },
-      nodeType: {
-        type: 'keyword',
-      },
-      view: {
-        type: 'keyword',
-      },
-      customOptions: {
-        type: 'nested',
-        properties: {
-          text: {
-            type: 'keyword',
-          },
-          field: {
-            type: 'keyword',
-          },
-        },
-      },
-      customMetrics: {
-        type: 'nested',
-        properties: {
-          type: {
-            type: 'keyword',
-          },
-          field: {
-            type: 'keyword',
-          },
-          aggregation: {
-            type: 'keyword',
-          },
-          id: {
-            type: 'keyword',
-          },
-          label: {
-            type: 'keyword',
-          },
-        },
-      },
-      boundsOverride: {
-        properties: {
-          max: {
-            type: 'integer',
-          },
-          min: {
-            type: 'integer',
-          },
-        },
-      },
-      autoBounds: {
-        type: 'boolean',
-      },
-      time: {
-        type: 'long',
-      },
-      autoReload: {
-        type: 'boolean',
-      },
-      filterQuery: {
-        properties: {
-          kind: {
-            type: 'keyword',
-          },
-          expression: {
-            type: 'keyword',
-          },
-        },
-      },
-      accountId: {
-        type: 'keyword',
-      },
-      region: {
-        type: 'keyword',
-      },
-    },
+    dynamic: false,
+    properties: {},
   },
 };
diff --git a/x-pack/plugins/infra/common/saved_objects/metrics_explorer_view.ts b/x-pack/plugins/infra/common/saved_objects/metrics_explorer_view.ts
index a92809022c7e8..83441ac370a40 100644
--- a/x-pack/plugins/infra/common/saved_objects/metrics_explorer_view.ts
+++ b/x-pack/plugins/infra/common/saved_objects/metrics_explorer_view.ts
@@ -17,75 +17,7 @@ export const metricsExplorerViewSavedObjectType: SavedObjectsType = {
     importableAndExportable: true,
   },
   mappings: {
-    properties: {
-      name: {
-        type: 'keyword',
-      },
-      options: {
-        properties: {
-          forceInterval: {
-            type: 'boolean',
-          },
-          metrics: {
-            type: 'nested',
-            properties: {
-              aggregation: {
-                type: 'keyword',
-              },
-              field: {
-                type: 'keyword',
-              },
-              color: {
-                type: 'keyword',
-              },
-              label: {
-                type: 'keyword',
-              },
-            },
-          },
-          limit: {
-            type: 'integer',
-          },
-          groupBy: {
-            type: 'keyword',
-          },
-          filterQuery: {
-            type: 'keyword',
-          },
-          aggregation: {
-            type: 'keyword',
-          },
-          source: {
-            type: 'keyword',
-          },
-        },
-      },
-      chartOptions: {
-        properties: {
-          type: {
-            type: 'keyword',
-          },
-          yAxisMode: {
-            type: 'keyword',
-          },
-          stack: {
-            type: 'boolean',
-          },
-        },
-      },
-      currentTimerange: {
-        properties: {
-          from: {
-            type: 'keyword',
-          },
-          to: {
-            type: 'keyword',
-          },
-          interval: {
-            type: 'keyword',
-          },
-        },
-      },
-    },
+    dynamic: false,
+    properties: {},
   },
 };
diff --git a/x-pack/plugins/infra/server/lib/sources/saved_object_type.ts b/x-pack/plugins/infra/server/lib/sources/saved_object_type.ts
index 11db18d6bf799..19c866f8f331d 100644
--- a/x-pack/plugins/infra/server/lib/sources/saved_object_type.ts
+++ b/x-pack/plugins/infra/server/lib/sources/saved_object_type.ts
@@ -17,74 +17,8 @@ export const infraSourceConfigurationSavedObjectType: SavedObjectsType = {
     importableAndExportable: true,
   },
   mappings: {
-    properties: {
-      name: {
-        type: 'text',
-      },
-      description: {
-        type: 'text',
-      },
-      metricAlias: {
-        type: 'keyword',
-      },
-      logAlias: {
-        type: 'keyword',
-      },
-      inventoryDefaultView: {
-        type: 'keyword',
-      },
-      metricsExplorerDefaultView: {
-        type: 'keyword',
-      },
-      fields: {
-        properties: {
-          container: {
-            type: 'keyword',
-          },
-          host: {
-            type: 'keyword',
-          },
-          pod: {
-            type: 'keyword',
-          },
-          tiebreaker: {
-            type: 'keyword',
-          },
-          timestamp: {
-            type: 'keyword',
-          },
-        },
-      },
-      logColumns: {
-        type: 'nested',
-        properties: {
-          timestampColumn: {
-            properties: {
-              id: {
-                type: 'keyword',
-              },
-            },
-          },
-          messageColumn: {
-            properties: {
-              id: {
-                type: 'keyword',
-              },
-            },
-          },
-          fieldColumn: {
-            properties: {
-              id: {
-                type: 'keyword',
-              },
-              field: {
-                type: 'keyword',
-              },
-            },
-          },
-        },
-      },
-    },
+    dynamic: false,
+    properties: {},
   },
   migrations: {
     '7.9.0': addNewIndexingStrategyIndexNames,
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts
index 56179b02c5ba2..2c9e8b84d4069 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { getFlattenedObject } from '../../../../../../../src/core/public';
+export { getFlattenedObject } from '@kbn/std';
 
 export {
   AgentStatusKueryHelper,
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx
index 2e7a47e0c93de..e46e5156e30f3 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.helpers.tsx
@@ -126,7 +126,7 @@ const createActions = (testBed: TestBed<TestSubject>) => {
         });
       });
       await act(async () => {
-        find('processorSettingsForm.submitButton').simulate('click');
+        find('addProcessorForm.submitButton').simulate('click');
       });
     },
 
@@ -166,7 +166,7 @@ const createActions = (testBed: TestBed<TestSubject>) => {
         });
       });
       await act(async () => {
-        find('processorSettingsForm.submitButton').simulate('click');
+        find('addProcessorForm.submitButton').simulate('click');
       });
     },
 
@@ -202,8 +202,10 @@ type TestSubject =
   | 'pipelineEditorDoneButton'
   | 'pipelineEditorOnFailureToggle'
   | 'addProcessorsButtonLevel1'
-  | 'processorSettingsForm'
-  | 'processorSettingsForm.submitButton'
+  | 'editProcessorForm'
+  | 'editProcessorForm.submitButton'
+  | 'addProcessorForm.submitButton'
+  | 'addProcessorForm'
   | 'processorOptionsEditor'
   | 'processorSettingsFormFlyout'
   | 'processorTypeSelector'
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx
index 38c652f41e5e1..74ae8b8894b9f 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx
@@ -180,7 +180,7 @@ describe('Pipeline Editor', () => {
     it('prevents moving a processor while in edit mode', () => {
       const { find, exists } = testBed;
       find('processors>0.manageItemButton').simulate('click');
-      expect(exists('processorSettingsForm')).toBe(true);
+      expect(exists('editProcessorForm')).toBe(true);
       expect(find('processors>0.moveItemButton').props().disabled).toBe(true);
       expect(find('processors>1.moveItemButton').props().disabled).toBe(true);
     });
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.helpers.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.helpers.tsx
index fec3259fa019b..f4c89d7a1058a 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.helpers.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.helpers.tsx
@@ -140,8 +140,8 @@ const createActions = (testBed: TestBed<TestSubject>) => {
       component.update();
     },
 
-    clickProcessorOutputTab() {
-      act(() => {
+    async clickProcessorOutputTab() {
+      await act(async () => {
         find('outputTab').simulate('click');
       });
       component.update();
@@ -224,7 +224,8 @@ type TestSubject =
   | 'processorStatusIcon'
   | 'documentsTab'
   | 'manageItemButton'
-  | 'processorSettingsForm'
+  | 'addProcessorForm'
+  | 'editProcessorForm'
   | 'configurationTab'
   | 'outputTab'
   | 'processorOutputTabContent'
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.test.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.test.tsx
index 339c840bb86f1..e5118a6e465af 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.test.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/test_pipeline.test.tsx
@@ -44,7 +44,7 @@ describe('Test pipeline', () => {
 
   describe('Test pipeline actions', () => {
     it('should successfully add sample documents and execute the pipeline', async () => {
-      const { find, actions, exists } = testBed;
+      const { actions, exists } = testBed;
 
       httpRequestsMockHelpers.setSimulatePipelineResponse(SIMULATE_RESPONSE);
 
@@ -59,7 +59,6 @@ describe('Test pipeline', () => {
       expect(exists('testPipelineFlyout')).toBe(true);
       expect(exists('documentsTabContent')).toBe(true);
       expect(exists('outputTabContent')).toBe(false);
-      expect(find('outputTab').props().disabled).toEqual(true);
 
       // Add sample documents and click run
       actions.addDocumentsJson(JSON.stringify(DOCUMENTS));
@@ -89,21 +88,25 @@ describe('Test pipeline', () => {
       });
 
       // Verify output tab is active
-      expect(find('outputTab').props().disabled).toEqual(false);
       expect(exists('documentsTabContent')).toBe(false);
       expect(exists('outputTabContent')).toBe(true);
 
       // Click reload button and verify request
       const totalRequests = server.requests.length;
       await actions.clickRefreshOutputButton();
-      expect(server.requests.length).toBe(totalRequests + 1);
+      // There will be two requests made to the simulate API
+      // the second request will have verbose enabled to update the processor results
+      expect(server.requests.length).toBe(totalRequests + 2);
+      expect(server.requests[server.requests.length - 2].url).toBe(
+        '/api/ingest_pipelines/simulate'
+      );
       expect(server.requests[server.requests.length - 1].url).toBe(
         '/api/ingest_pipelines/simulate'
       );
 
       // Click verbose toggle and verify request
       await actions.toggleVerboseSwitch();
-      expect(server.requests.length).toBe(totalRequests + 2);
+      expect(server.requests.length).toBe(totalRequests + 3);
       expect(server.requests[server.requests.length - 1].url).toBe(
         '/api/ingest_pipelines/simulate'
       );
@@ -228,10 +231,10 @@ describe('Test pipeline', () => {
         // Click processor to open manage flyout
         await actions.clickProcessor('processors>0');
         // Verify flyout opened
-        expect(exists('processorSettingsForm')).toBe(true);
+        expect(exists('editProcessorForm')).toBe(true);
 
         // Navigate to "Output" tab
-        actions.clickProcessorOutputTab();
+        await actions.clickProcessorOutputTab();
         // Verify content
         expect(exists('processorOutputTabContent')).toBe(true);
       });
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/documents_dropdown.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/documents_dropdown.scss
deleted file mode 100644
index c5b14dc129b0e..0000000000000
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/documents_dropdown.scss
+++ /dev/null
@@ -1,3 +0,0 @@
-.documentsDropdown__selectContainer {
- max-width: 200px;
-}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/documents_dropdown.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/documents_dropdown.tsx
deleted file mode 100644
index e26b6a2890fe4..0000000000000
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/documents_dropdown.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { i18n } from '@kbn/i18n';
-import React, { FunctionComponent } from 'react';
-import { EuiSelect, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
-
-import { Document } from '../../types';
-
-import './documents_dropdown.scss';
-
-const i18nTexts = {
-  ariaLabel: i18n.translate(
-    'xpack.ingestPipelines.pipelineEditor.testPipeline.documentsDropdownAriaLabel',
-    {
-      defaultMessage: 'Select documents',
-    }
-  ),
-  dropdownLabel: i18n.translate(
-    'xpack.ingestPipelines.pipelineEditor.testPipeline.documentsdropdownLabel',
-    {
-      defaultMessage: 'Documents:',
-    }
-  ),
-  buttonLabel: i18n.translate('xpack.ingestPipelines.pipelineEditor.testPipeline.buttonLabel', {
-    defaultMessage: 'Add documents',
-  }),
-};
-
-const getDocumentOptions = (documents: Document[]) =>
-  documents.map((doc, index) => ({
-    value: index,
-    text: doc._id,
-  }));
-
-interface Props {
-  documents: Document[];
-  selectedDocumentIndex: number;
-  updateSelectedDocument: (index: number) => void;
-}
-
-export const DocumentsDropdown: FunctionComponent<Props> = ({
-  documents,
-  selectedDocumentIndex,
-  updateSelectedDocument,
-}) => {
-  return (
-    <EuiFlexGroup alignItems="baseline" gutterSize="s" className="documentsDropdown">
-      <EuiFlexItem grow={false}>
-        <EuiText>
-          <span>{i18nTexts.dropdownLabel}</span>
-        </EuiText>
-      </EuiFlexItem>
-      <EuiFlexItem grow={false} className="documentsDropdown__selectContainer">
-        <EuiSelect
-          compressed
-          options={getDocumentOptions(documents)}
-          value={selectedDocumentIndex}
-          onChange={(e) => {
-            updateSelectedDocument(Number(e.target.value));
-          }}
-          aria-label={i18nTexts.ariaLabel}
-          data-test-subj="documentsDropdown"
-        />
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts
index 435d0ed66c4b0..d476202aa43bb 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts
@@ -4,11 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export {
-  ManageProcessorForm,
-  ManageProcessorFormOnSubmitArg,
-  OnSubmitHandler,
-} from './manage_processor_form';
+export { ProcessorForm, ProcessorFormOnSubmitArg, OnSubmitHandler } from './processor_form';
 
 export { ProcessorsTree, ProcessorInfo, OnActionHandler } from './processors_tree';
 
@@ -22,6 +18,4 @@ export { OnDoneLoadJsonHandler, LoadFromJsonButton } from './load_from_json';
 
 export { TestPipelineActions } from './test_pipeline';
 
-export { DocumentsDropdown } from './documents_dropdown';
-
 export { PipelineProcessorsItemTooltip, Position } from './pipeline_processors_editor_item_tooltip';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/manage_processor_form.container.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/manage_processor_form.container.tsx
deleted file mode 100644
index 083529921b0a7..0000000000000
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/manage_processor_form.container.tsx
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { FunctionComponent, useCallback, useEffect } from 'react';
-
-import { useForm, OnFormUpdateArg, FormData, useKibana } from '../../../../../shared_imports';
-import { ProcessorInternal } from '../../types';
-
-import { ManageProcessorForm as ViewComponent } from './manage_processor_form';
-
-export type ManageProcessorFormOnSubmitArg = Omit<ProcessorInternal, 'id'>;
-
-export type OnSubmitHandler = (processor: ManageProcessorFormOnSubmitArg) => void;
-
-export type OnFormUpdateHandler = (form: OnFormUpdateArg<any>) => void;
-
-interface Props {
-  onFormUpdate: OnFormUpdateHandler;
-  onSubmit: OnSubmitHandler;
-  isOnFailure: boolean;
-  onOpen: () => void;
-  onClose: () => void;
-  processor?: ProcessorInternal;
-}
-
-export const ManageProcessorForm: FunctionComponent<Props> = ({
-  processor,
-  onFormUpdate,
-  onSubmit,
-  ...rest
-}) => {
-  const { services } = useKibana();
-
-  const handleSubmit = useCallback(
-    async (data: FormData, isValid: boolean) => {
-      if (isValid) {
-        const { type, customOptions, fields } = data;
-        onSubmit({
-          type,
-          options: customOptions ? customOptions : fields,
-        });
-      }
-    },
-    [onSubmit]
-  );
-
-  const maybeProcessorOptions = processor?.options;
-  const { form } = useForm({
-    defaultValue: { fields: maybeProcessorOptions ?? {} },
-    onSubmit: handleSubmit,
-  });
-
-  useEffect(() => {
-    const subscription = form.subscribe(onFormUpdate);
-    return subscription.unsubscribe;
-
-    // TODO: Address this issue
-    // For some reason adding `form` object to the dependencies array here is causing an
-    // infinite update loop.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [onFormUpdate]);
-
-  return (
-    <ViewComponent
-      {...rest}
-      processor={processor}
-      form={form}
-      esDocsBasePath={services.documentation.getEsDocsBasePath()}
-    />
-  );
-};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/manage_processor_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/manage_processor_form.tsx
deleted file mode 100644
index ee8ca71e58446..0000000000000
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/manage_processor_form.tsx
+++ /dev/null
@@ -1,236 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import React, { FunctionComponent, memo, useEffect, useState } from 'react';
-import {
-  EuiButton,
-  EuiButtonEmpty,
-  EuiFlyout,
-  EuiFlyoutHeader,
-  EuiFlyoutBody,
-  EuiFlyoutFooter,
-  EuiTabs,
-  EuiTab,
-  EuiTitle,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-} from '@elastic/eui';
-
-import { Form, FormDataProvider, FormHook } from '../../../../../shared_imports';
-import { ProcessorInternal } from '../../types';
-import { useTestPipelineContext } from '../../context';
-import { getProcessorDescriptor } from '../shared';
-
-import { ProcessorSettingsFields } from './processor_settings_fields';
-import { DocumentationButton } from './documentation_button';
-import { ProcessorOutput } from './processor_output';
-
-export interface Props {
-  isOnFailure: boolean;
-  processor?: ProcessorInternal;
-  form: FormHook;
-  onClose: () => void;
-  onOpen: () => void;
-  esDocsBasePath: string;
-}
-
-const updateButtonLabel = i18n.translate(
-  'xpack.ingestPipelines.settingsFormOnFailureFlyout.updateButtonLabel',
-  { defaultMessage: 'Update' }
-);
-
-const addButtonLabel = i18n.translate(
-  'xpack.ingestPipelines.settingsFormOnFailureFlyout.addButtonLabel',
-  { defaultMessage: 'Add' }
-);
-
-const cancelButtonLabel = i18n.translate(
-  'xpack.ingestPipelines.settingsFormOnFailureFlyout.cancelButtonLabel',
-  { defaultMessage: 'Cancel' }
-);
-
-export type TabType = 'configuration' | 'output';
-
-interface Tab {
-  id: TabType;
-  name: string;
-}
-
-const tabs: Tab[] = [
-  {
-    id: 'configuration',
-    name: i18n.translate(
-      'xpack.ingestPipelines.settingsFormOnFailureFlyout.configurationTabTitle',
-      {
-        defaultMessage: 'Configuration',
-      }
-    ),
-  },
-  {
-    id: 'output',
-    name: i18n.translate('xpack.ingestPipelines.settingsFormOnFailureFlyout.outputTabTitle', {
-      defaultMessage: 'Output',
-    }),
-  },
-];
-
-const getFlyoutTitle = (isOnFailure: boolean, isExistingProcessor: boolean) => {
-  if (isExistingProcessor) {
-    return isOnFailure ? (
-      <FormattedMessage
-        id="xpack.ingestPipelines.settingsFormOnFailureFlyout.manageOnFailureTitle"
-        defaultMessage="Manage on-failure processor"
-      />
-    ) : (
-      <FormattedMessage
-        id="xpack.ingestPipelines.settingsFormOnFailureFlyout.manageTitle"
-        defaultMessage="Manage processor"
-      />
-    );
-  }
-
-  return isOnFailure ? (
-    <FormattedMessage
-      id="xpack.ingestPipelines.settingsFormOnFailureFlyout.configureOnFailureTitle"
-      defaultMessage="Configure on-failure processor"
-    />
-  ) : (
-    <FormattedMessage
-      id="xpack.ingestPipelines.settingsFormOnFailureFlyout.configureTitle"
-      defaultMessage="Configure processor"
-    />
-  );
-};
-
-export const ManageProcessorForm: FunctionComponent<Props> = memo(
-  ({ processor, form, isOnFailure, onClose, onOpen, esDocsBasePath }) => {
-    const { testPipelineData, setCurrentTestPipelineData } = useTestPipelineContext();
-    const {
-      testOutputPerProcessor,
-      config: { selectedDocumentIndex, documents },
-    } = testPipelineData;
-
-    const processorOutput =
-      processor &&
-      testOutputPerProcessor &&
-      testOutputPerProcessor[selectedDocumentIndex][processor.id];
-
-    const updateSelectedDocument = (index: number) => {
-      setCurrentTestPipelineData({
-        type: 'updateActiveDocument',
-        payload: {
-          config: {
-            selectedDocumentIndex: index,
-          },
-        },
-      });
-    };
-
-    useEffect(
-      () => {
-        onOpen();
-      },
-      [] /* eslint-disable-line react-hooks/exhaustive-deps */
-    );
-
-    const [activeTab, setActiveTab] = useState<TabType>('configuration');
-
-    let flyoutContent: React.ReactNode;
-
-    if (activeTab === 'output') {
-      flyoutContent = (
-        <ProcessorOutput
-          processorOutput={processorOutput}
-          documents={documents!}
-          selectedDocumentIndex={selectedDocumentIndex}
-          updateSelectedDocument={updateSelectedDocument}
-        />
-      );
-    } else {
-      flyoutContent = <ProcessorSettingsFields processor={processor} />;
-    }
-
-    return (
-      <Form data-test-subj="processorSettingsForm" form={form}>
-        <EuiFlyout size="m" maxWidth={720} onClose={onClose}>
-          <EuiFlyoutHeader>
-            <EuiFlexGroup gutterSize="xs">
-              <EuiFlexItem>
-                <div>
-                  <EuiTitle size="m">
-                    <h2>{getFlyoutTitle(isOnFailure, Boolean(processor))}</h2>
-                  </EuiTitle>
-                </div>
-              </EuiFlexItem>
-              <EuiFlexItem grow={false}>
-                <FormDataProvider pathsToWatch="type">
-                  {({ type }) => {
-                    const formDescriptor = getProcessorDescriptor(type as any);
-
-                    if (formDescriptor) {
-                      return (
-                        <DocumentationButton
-                          processorLabel={formDescriptor.label}
-                          docLink={esDocsBasePath + formDescriptor.docLinkPath}
-                        />
-                      );
-                    }
-                    return null;
-                  }}
-                </FormDataProvider>
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          </EuiFlyoutHeader>
-          <EuiFlyoutBody>
-            {processor ? (
-              <>
-                <EuiTabs>
-                  {tabs.map((tab) => (
-                    <EuiTab
-                      onClick={() => {
-                        setActiveTab(tab.id);
-                      }}
-                      isSelected={tab.id === activeTab}
-                      key={tab.id}
-                      data-test-subj={`${tab.id}Tab`}
-                      disabled={
-                        (tab.id === 'output' && Boolean(testOutputPerProcessor) === false) ||
-                        Boolean(processorOutput) === false
-                      }
-                    >
-                      {tab.name}
-                    </EuiTab>
-                  ))}
-                </EuiTabs>
-                <EuiSpacer />
-              </>
-            ) : undefined}
-
-            {flyoutContent}
-          </EuiFlyoutBody>
-          <EuiFlyoutFooter>
-            <EuiFlexGroup justifyContent="flexEnd">
-              <EuiFlexItem grow={false}>
-                <EuiButtonEmpty onClick={onClose}>{cancelButtonLabel}</EuiButtonEmpty>
-              </EuiFlexItem>
-              <EuiFlexItem grow={false}>
-                <EuiButton fill data-test-subj="submitButton" onClick={form.submit}>
-                  {processor ? updateButtonLabel : addButtonLabel}
-                </EuiButton>
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          </EuiFlyoutFooter>
-        </EuiFlyout>
-      </Form>
-    );
-  },
-  (previous, current) => {
-    return previous.processor === current.processor;
-  }
-);
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_output.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_output.tsx
deleted file mode 100644
index c30fdad969b24..0000000000000
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_output.tsx
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-
-import {
-  EuiAccordion,
-  EuiCallOut,
-  EuiCodeBlock,
-  EuiText,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-} from '@elastic/eui';
-
-import { ProcessorResult, Document } from '../../types';
-import { DocumentsDropdown } from '../documents_dropdown';
-
-export interface Props {
-  processorOutput?: ProcessorResult;
-  documents: Document[];
-  selectedDocumentIndex: number;
-  updateSelectedDocument: (index: number) => void;
-}
-
-const i18nTexts = {
-  noOutputCalloutTitle: i18n.translate(
-    'xpack.ingestPipelines.processorOutput.noOutputCalloutTitle',
-    {
-      defaultMessage: 'Unable to load the processor output.',
-    }
-  ),
-  tabDescription: i18n.translate('xpack.ingestPipelines.processorOutput.descriptionText', {
-    defaultMessage:
-      'View how the processor affects the ingest document as it passes through the pipeline.',
-  }),
-  skippedCalloutTitle: i18n.translate('xpack.ingestPipelines.processorOutput.skippedCalloutTitle', {
-    defaultMessage: 'The processor was not run.',
-  }),
-  droppedCalloutTitle: i18n.translate('xpack.ingestPipelines.processorOutput.droppedCalloutTitle', {
-    defaultMessage: 'The document was dropped.',
-  }),
-  processorOutputLabel: i18n.translate(
-    'xpack.ingestPipelines.processorOutput.processorOutputCodeBlockLabel',
-    {
-      defaultMessage: 'Processor output',
-    }
-  ),
-  processorErrorLabel: i18n.translate(
-    'xpack.ingestPipelines.processorOutput.processorErrorCodeBlockLabel',
-    {
-      defaultMessage: 'Processor error',
-    }
-  ),
-  prevProcessorLabel: i18n.translate(
-    'xpack.ingestPipelines.processorOutput.previousOutputCodeBlockLabel',
-    {
-      defaultMessage: 'View previous processor output',
-    }
-  ),
-  processorIgnoredErrorLabel: i18n.translate(
-    'xpack.ingestPipelines.processorOutput.ignoredErrorCodeBlockLabel',
-    {
-      defaultMessage: 'View ignored error',
-    }
-  ),
-};
-
-export const ProcessorOutput: React.FunctionComponent<Props> = ({
-  processorOutput,
-  documents,
-  selectedDocumentIndex,
-  updateSelectedDocument,
-}) => {
-  // This code should not be reached,
-  // but if for some reason the output is undefined, we render a callout message
-  if (!processorOutput) {
-    return <EuiCallOut title={i18nTexts.noOutputCalloutTitle} color="danger" iconType="alert" />;
-  }
-
-  const {
-    prevProcessorResult,
-    doc: currentResult,
-    ignored_error: ignoredError,
-    error,
-    status,
-  } = processorOutput!;
-
-  return (
-    <div data-test-subj="processorOutputTabContent">
-      <EuiText>
-        <p>{i18nTexts.tabDescription}</p>
-      </EuiText>
-
-      {/* There is no output for "skipped" status, so we render an info callout */}
-      {status === 'skipped' && (
-        <>
-          <EuiSpacer />
-          <EuiCallOut size="s" title={i18nTexts.skippedCalloutTitle} iconType="pin" />
-        </>
-      )}
-
-      {/* There is no output for "dropped status", so we render a warning callout */}
-      {status === 'dropped' && (
-        <>
-          <EuiSpacer />
-          <EuiCallOut
-            size="s"
-            title={i18nTexts.droppedCalloutTitle}
-            iconType="pin"
-            color="warning"
-          />
-        </>
-      )}
-
-      {currentResult && (
-        <>
-          <EuiSpacer />
-
-          <EuiFlexGroup justifyContent="spaceBetween" gutterSize="s" alignItems="baseline">
-            <EuiFlexItem>
-              <p>{i18nTexts.processorOutputLabel}</p>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <DocumentsDropdown
-                documents={documents}
-                selectedDocumentIndex={selectedDocumentIndex}
-                updateSelectedDocument={updateSelectedDocument}
-              />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-
-          <EuiSpacer size="xs" />
-
-          <EuiCodeBlock paddingSize="s" language="json" isCopyable>
-            {JSON.stringify(currentResult, null, 2)}
-          </EuiCodeBlock>
-        </>
-      )}
-
-      {error && (
-        <>
-          <EuiSpacer />
-
-          <EuiFlexGroup justifyContent="spaceBetween" gutterSize="s" alignItems="baseline">
-            <EuiFlexItem>
-              <p>{i18nTexts.processorErrorLabel}</p>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <DocumentsDropdown
-                documents={documents}
-                selectedDocumentIndex={selectedDocumentIndex}
-                updateSelectedDocument={updateSelectedDocument}
-              />
-            </EuiFlexItem>
-          </EuiFlexGroup>
-
-          <EuiSpacer size="xs" />
-
-          <EuiCodeBlock paddingSize="s" language="json" isCopyable>
-            {JSON.stringify(error, null, 2)}
-          </EuiCodeBlock>
-        </>
-      )}
-
-      {prevProcessorResult?.doc && (
-        <>
-          <EuiSpacer />
-
-          <EuiAccordion
-            id="prev_accordion"
-            buttonContent={
-              <EuiText>
-                <p>{i18nTexts.prevProcessorLabel}</p>
-              </EuiText>
-            }
-          >
-            <>
-              <EuiSpacer />
-
-              <EuiCodeBlock paddingSize="s" language="json" isCopyable>
-                {JSON.stringify(prevProcessorResult.doc, null, 2)}
-              </EuiCodeBlock>
-            </>
-          </EuiAccordion>
-        </>
-      )}
-
-      {ignoredError && (
-        <>
-          <EuiSpacer />
-
-          <EuiAccordion
-            id="ignored_error_accordion"
-            buttonContent={
-              <EuiText>
-                <p>{i18nTexts.processorIgnoredErrorLabel}</p>
-              </EuiText>
-            }
-          >
-            <>
-              <EuiSpacer />
-
-              <EuiCodeBlock paddingSize="s" language="json" isCopyable>
-                {JSON.stringify(ignoredError, null, 2)}
-              </EuiCodeBlock>
-            </>
-          </EuiAccordion>
-        </>
-      )}
-    </div>
-  );
-};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss
index d9c3d84eec082..55630fa96d9b0 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item/pipeline_processors_editor_item.scss
@@ -63,6 +63,6 @@
 
   &__statusContainer {
     // Prevent content jump when spinner renders
-    min-width: 12px;
+    min-width: 15px;
   }
 }
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item_status.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item_status.tsx
index a58d482022b4d..08d456b47180c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item_status.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/pipeline_processors_editor_item_status.tsx
@@ -6,11 +6,12 @@
 
 import React, { FunctionComponent } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiToolTip, EuiIcon } from '@elastic/eui';
+import { EuiToolTip, EuiIcon, IconType } from '@elastic/eui';
 import { ProcessorStatus } from '../types';
+import { ErrorIcon, ErrorIgnoredIcon, SkippedIcon } from './shared';
 
 interface ProcessorStatusIcon {
-  icon: string;
+  icon: IconType;
   iconColor: string;
   label: string;
 }
@@ -24,28 +25,28 @@ const processorStatusToIconMap: Record<ProcessorStatus, ProcessorStatusIcon> = {
     }),
   },
   error: {
-    icon: 'crossInACircleFilled',
+    icon: ErrorIcon,
     iconColor: 'danger',
     label: i18n.translate('xpack.ingestPipelines.pipelineEditorItem.errorStatusAriaLabel', {
       defaultMessage: 'Error',
     }),
   },
   error_ignored: {
-    icon: 'alert',
-    iconColor: 'warning',
+    icon: ErrorIgnoredIcon,
+    iconColor: 'danger',
     label: i18n.translate('xpack.ingestPipelines.pipelineEditorItem.errorIgnoredStatusAriaLabel', {
       defaultMessage: 'Error ignored',
     }),
   },
   dropped: {
-    icon: 'alert',
-    iconColor: 'warning',
+    icon: 'indexClose',
+    iconColor: 'subdued',
     label: i18n.translate('xpack.ingestPipelines.pipelineEditorItem.droppedStatusAriaLabel', {
       defaultMessage: 'Dropped',
     }),
   },
   skipped: {
-    icon: 'dot',
+    icon: SkippedIcon,
     iconColor: 'subdued',
     label: i18n.translate('xpack.ingestPipelines.pipelineEditorItem.skippedStatusAriaLabel', {
       defaultMessage: 'Skipped',
@@ -53,7 +54,7 @@ const processorStatusToIconMap: Record<ProcessorStatus, ProcessorStatusIcon> = {
   },
   inactive: {
     icon: 'dot',
-    iconColor: 'subdued',
+    iconColor: '#D3DAE6', // $euiColorLightShade
     label: i18n.translate('xpack.ingestPipelines.pipelineEditorItem.inactiveStatusAriaLabel', {
       defaultMessage: 'Not run',
     }),
@@ -64,7 +65,7 @@ const processorStatusToIconMap: Record<ProcessorStatus, ProcessorStatusIcon> = {
 // This is not expected and likely means we need to modify the code to support a new status
 const unknownStatus = {
   icon: 'dot',
-  iconColor: 'subdued',
+  iconColor: '#D3DAE6', // $euiColorLightShade
   label: i18n.translate('xpack.ingestPipelines.pipelineEditorItem.unknownStatusAriaLabel', {
     defaultMessage: 'Unknown',
   }),
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/add_processor_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/add_processor_form.tsx
new file mode 100644
index 0000000000000..5231a3d17811b
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/add_processor_form.tsx
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { FunctionComponent, useEffect } from 'react';
+import {
+  EuiButton,
+  EuiButtonEmpty,
+  EuiFlyout,
+  EuiFlyoutHeader,
+  EuiFlyoutBody,
+  EuiFlyoutFooter,
+  EuiTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+} from '@elastic/eui';
+
+import { Form, FormDataProvider, FormHook } from '../../../../../shared_imports';
+import { getProcessorDescriptor } from '../shared';
+
+import { DocumentationButton } from './documentation_button';
+import { ProcessorSettingsFields } from './processor_settings_fields';
+
+interface Fields {
+  fields: { [key: string]: any };
+}
+export interface Props {
+  isOnFailure: boolean;
+  form: FormHook<Fields>;
+  onOpen: () => void;
+  esDocsBasePath: string;
+  closeFlyout: () => void;
+  handleSubmit: (shouldCloseFlyout?: boolean) => Promise<void>;
+}
+
+const addButtonLabel = i18n.translate(
+  'xpack.ingestPipelines.addProcessorFormOnFailureFlyout.addButtonLabel',
+  { defaultMessage: 'Add' }
+);
+
+const cancelButtonLabel = i18n.translate(
+  'xpack.ingestPipelines.addProcesorFormOnFailureFlyout.cancelButtonLabel',
+  { defaultMessage: 'Cancel' }
+);
+
+const getFlyoutTitle = (isOnFailure: boolean) => {
+  return isOnFailure ? (
+    <FormattedMessage
+      id="xpack.ingestPipelines.settingsFormOnFailureFlyout.configureOnFailureTitle"
+      defaultMessage="Configure on-failure processor"
+    />
+  ) : (
+    <FormattedMessage
+      id="xpack.ingestPipelines.settingsFormOnFailureFlyout.configureTitle"
+      defaultMessage="Configure processor"
+    />
+  );
+};
+
+export const AddProcessorForm: FunctionComponent<Props> = ({
+  isOnFailure,
+  onOpen,
+  form,
+  esDocsBasePath,
+  closeFlyout,
+  handleSubmit,
+}) => {
+  useEffect(
+    () => {
+      onOpen();
+    },
+    [] /* eslint-disable-line react-hooks/exhaustive-deps */
+  );
+
+  return (
+    <Form data-test-subj="addProcessorForm" form={form} onSubmit={handleSubmit}>
+      <EuiFlyout size="m" maxWidth={720} onClose={closeFlyout}>
+        <EuiFlyoutHeader>
+          <EuiFlexGroup gutterSize="xs">
+            <EuiFlexItem>
+              <div>
+                <EuiTitle size="m">
+                  <h2>{getFlyoutTitle(isOnFailure)}</h2>
+                </EuiTitle>
+              </div>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <FormDataProvider pathsToWatch="type">
+                {({ type }) => {
+                  const formDescriptor = getProcessorDescriptor(type as any);
+
+                  if (formDescriptor) {
+                    return (
+                      <DocumentationButton
+                        processorLabel={formDescriptor.label}
+                        docLink={esDocsBasePath + formDescriptor.docLinkPath}
+                      />
+                    );
+                  }
+                  return null;
+                }}
+              </FormDataProvider>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutHeader>
+        <EuiFlyoutBody>
+          <ProcessorSettingsFields />
+        </EuiFlyoutBody>
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="flexEnd">
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty onClick={closeFlyout}>{cancelButtonLabel}</EuiButtonEmpty>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                fill
+                data-test-subj="submitButton"
+                onClick={async () => {
+                  await handleSubmit();
+                }}
+              >
+                {addButtonLabel}
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      </EuiFlyout>
+    </Form>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/documentation_button.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/documentation_button.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/documentation_button.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/documentation_button.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/edit_processor_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/edit_processor_form.tsx
new file mode 100644
index 0000000000000..e449ed75b6343
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/edit_processor_form.tsx
@@ -0,0 +1,253 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { FunctionComponent, useEffect, useState } from 'react';
+import {
+  EuiButton,
+  EuiButtonEmpty,
+  EuiFlyout,
+  EuiFlyoutHeader,
+  EuiFlyoutBody,
+  EuiFlyoutFooter,
+  EuiTabs,
+  EuiTab,
+  EuiTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+} from '@elastic/eui';
+
+import { Form, FormDataProvider, FormHook } from '../../../../../shared_imports';
+import { ProcessorInternal } from '../../types';
+import { useTestPipelineContext } from '../../context';
+import { getProcessorDescriptor } from '../shared';
+
+import { ProcessorSettingsFields } from './processor_settings_fields';
+import { DocumentationButton } from './documentation_button';
+import { ProcessorOutput } from './processor_output';
+import { Fields } from './processor_form.container';
+
+export interface Props {
+  isOnFailure: boolean;
+  form: FormHook<Fields>;
+  onOpen: () => void;
+  esDocsBasePath: string;
+  closeFlyout: () => void;
+  resetProcessors: () => void;
+  handleSubmit: (shouldCloseFlyout?: boolean) => Promise<void>;
+  getProcessor: () => ProcessorInternal;
+}
+
+const updateButtonLabel = i18n.translate(
+  'xpack.ingestPipelines.processorFormFlyout.updateButtonLabel',
+  { defaultMessage: 'Update' }
+);
+
+const cancelButtonLabel = i18n.translate(
+  'xpack.ingestPipelines.processorFormFlyout.cancelButtonLabel',
+  { defaultMessage: 'Cancel' }
+);
+
+export type TabType = 'configuration' | 'output';
+
+interface Tab {
+  id: TabType;
+  name: string;
+}
+
+const tabs: Tab[] = [
+  {
+    id: 'configuration',
+    name: i18n.translate(
+      'xpack.ingestPipelines.settingsFormOnFailureFlyout.configurationTabTitle',
+      {
+        defaultMessage: 'Configuration',
+      }
+    ),
+  },
+  {
+    id: 'output',
+    name: i18n.translate('xpack.ingestPipelines.settingsFormOnFailureFlyout.outputTabTitle', {
+      defaultMessage: 'Output',
+    }),
+  },
+];
+
+const getFlyoutTitle = (isOnFailure: boolean) => {
+  return isOnFailure ? (
+    <FormattedMessage
+      id="xpack.ingestPipelines.settingsFormOnFailureFlyout.manageOnFailureTitle"
+      defaultMessage="Manage on-failure processor"
+    />
+  ) : (
+    <FormattedMessage
+      id="xpack.ingestPipelines.settingsFormOnFailureFlyout.manageTitle"
+      defaultMessage="Manage processor"
+    />
+  );
+};
+
+export const EditProcessorForm: FunctionComponent<Props> = ({
+  getProcessor,
+  form,
+  isOnFailure,
+  onOpen,
+  esDocsBasePath,
+  closeFlyout,
+  handleSubmit,
+  resetProcessors,
+}) => {
+  const { testPipelineData, setCurrentTestPipelineData } = useTestPipelineContext();
+  const {
+    testOutputPerProcessor,
+    config: { selectedDocumentIndex, documents },
+    isExecutingPipeline,
+  } = testPipelineData;
+
+  const processor = getProcessor();
+
+  const processorOutput =
+    processor &&
+    testOutputPerProcessor &&
+    testOutputPerProcessor[selectedDocumentIndex][processor.id];
+
+  const updateSelectedDocument = (index: number) => {
+    setCurrentTestPipelineData({
+      type: 'updateActiveDocument',
+      payload: {
+        config: {
+          selectedDocumentIndex: index,
+        },
+      },
+    });
+  };
+
+  useEffect(
+    () => {
+      onOpen();
+    },
+    [] /* eslint-disable-line react-hooks/exhaustive-deps */
+  );
+
+  const [activeTab, setActiveTab] = useState<TabType>('configuration');
+
+  let flyoutContent: React.ReactNode;
+
+  if (activeTab === 'output') {
+    flyoutContent = (
+      <ProcessorOutput
+        processorOutput={processorOutput}
+        documents={documents!}
+        selectedDocumentIndex={selectedDocumentIndex}
+        updateSelectedDocument={updateSelectedDocument}
+        isExecuting={isExecutingPipeline}
+      />
+    );
+  } else {
+    flyoutContent = <ProcessorSettingsFields processor={processor} />;
+  }
+
+  return (
+    <Form data-test-subj="editProcessorForm" form={form} onSubmit={handleSubmit}>
+      <EuiFlyout
+        size="m"
+        maxWidth={720}
+        onClose={() => {
+          resetProcessors();
+          closeFlyout();
+        }}
+      >
+        <EuiFlyoutHeader>
+          <EuiFlexGroup gutterSize="xs">
+            <EuiFlexItem>
+              <div>
+                <EuiTitle size="m">
+                  <h2>{getFlyoutTitle(isOnFailure)}</h2>
+                </EuiTitle>
+              </div>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <FormDataProvider pathsToWatch="type">
+                {({ type }) => {
+                  const formDescriptor = getProcessorDescriptor(type as any);
+
+                  if (formDescriptor) {
+                    return (
+                      <DocumentationButton
+                        processorLabel={formDescriptor.label}
+                        docLink={esDocsBasePath + formDescriptor.docLinkPath}
+                      />
+                    );
+                  }
+                  return null;
+                }}
+              </FormDataProvider>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutHeader>
+        <EuiFlyoutBody>
+          <EuiTabs>
+            {tabs.map((tab) => (
+              <EuiTab
+                onClick={async () => {
+                  if (tab.id === 'output') {
+                    await handleSubmit(false);
+                  } else {
+                    form.reset({ defaultValue: { fields: processor.options } });
+                  }
+                  setActiveTab(tab.id);
+                }}
+                isSelected={tab.id === activeTab}
+                key={tab.id}
+                data-test-subj={`${tab.id}Tab`}
+                disabled={
+                  tab.id === 'output' &&
+                  (Boolean(testOutputPerProcessor) === false || Boolean(processorOutput) === false)
+                }
+              >
+                {tab.name}
+              </EuiTab>
+            ))}
+          </EuiTabs>
+
+          <EuiSpacer />
+
+          {flyoutContent}
+        </EuiFlyoutBody>
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="flexEnd">
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty
+                onClick={() => {
+                  resetProcessors();
+                  closeFlyout();
+                }}
+              >
+                {cancelButtonLabel}
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                fill
+                data-test-subj="submitButton"
+                onClick={async () => {
+                  if (activeTab === 'output') {
+                    return closeFlyout();
+                  }
+                  await handleSubmit();
+                }}
+              >
+                {updateButtonLabel}
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      </EuiFlyout>
+    </Form>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/field_components/index.ts
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/index.ts
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/field_components/index.ts
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/text_editor.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/field_components/text_editor.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/text_editor.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/field_components/text_editor.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/xjson_editor.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/field_components/xjson_editor.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/field_components/xjson_editor.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/field_components/xjson_editor.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/index.ts
similarity index 71%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/index.ts
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/index.ts
index 986bd52e911bf..5a8d2522f1376 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/index.ts
@@ -5,7 +5,7 @@
  */
 
 export {
-  ManageProcessorForm,
-  ManageProcessorFormOnSubmitArg,
+  ProcessorFormContainer as ProcessorForm,
+  ProcessorFormOnSubmitArg,
   OnSubmitHandler,
-} from './manage_processor_form.container';
+} from './processor_form.container';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_form.container.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_form.container.tsx
new file mode 100644
index 0000000000000..332908d0756f2
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_form.container.tsx
@@ -0,0 +1,127 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent, useCallback, useEffect, useRef } from 'react';
+
+import { useForm, OnFormUpdateArg, FormData, useKibana } from '../../../../../shared_imports';
+import { ProcessorInternal } from '../../types';
+
+import { EditProcessorForm } from './edit_processor_form';
+import { AddProcessorForm } from './add_processor_form';
+
+export type ProcessorFormOnSubmitArg = Omit<ProcessorInternal, 'id'>;
+
+export type OnSubmitHandler = (processor: ProcessorFormOnSubmitArg) => void;
+
+export type OnFormUpdateHandler = (form: OnFormUpdateArg<any>) => void;
+
+export interface Fields {
+  fields: { [key: string]: any };
+}
+
+interface Props {
+  onFormUpdate: OnFormUpdateHandler;
+  onSubmit: OnSubmitHandler;
+  isOnFailure: boolean;
+  onOpen: () => void;
+  onClose: () => void;
+  processor?: ProcessorInternal;
+}
+
+export const ProcessorFormContainer: FunctionComponent<Props> = ({
+  processor,
+  onFormUpdate,
+  onSubmit,
+  onClose,
+  ...rest
+}) => {
+  const { services } = useKibana();
+
+  // We need to keep track of the processor form state if the user
+  // has made config changes, navigated between tabs (Configuration vs. Output)
+  // and has not yet submitted the form
+  const unsavedFormState = useRef<ProcessorInternal['options'] | undefined>();
+
+  const getProcessor = useCallback((): ProcessorInternal => {
+    let options;
+
+    if (unsavedFormState?.current) {
+      options = unsavedFormState.current;
+    } else {
+      options = processor?.options ?? {};
+    }
+
+    return { ...processor, options } as ProcessorInternal;
+  }, [processor, unsavedFormState]);
+
+  const { form } = useForm({
+    defaultValue: { fields: getProcessor().options },
+  });
+
+  const handleSubmit = useCallback(
+    async (shouldCloseFlyout: boolean = true) => {
+      const { isValid, data } = await form.submit();
+
+      if (isValid) {
+        const { type, customOptions, fields } = data as FormData;
+        const options = customOptions ? customOptions : fields;
+
+        unsavedFormState.current = options;
+
+        onSubmit({
+          type,
+          options,
+        });
+
+        if (shouldCloseFlyout) {
+          onClose();
+        }
+      }
+    },
+    [form, onClose, onSubmit]
+  );
+
+  const resetProcessors = useCallback(() => {
+    onSubmit({
+      type: processor!.type,
+      options: processor?.options || {},
+    });
+  }, [onSubmit, processor]);
+
+  useEffect(() => {
+    const subscription = form.subscribe(onFormUpdate);
+    return subscription.unsubscribe;
+
+    // TODO: Address this issue
+    // For some reason adding `form` object to the dependencies array here is causing an
+    // infinite update loop.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [onFormUpdate]);
+
+  if (processor) {
+    return (
+      <EditProcessorForm
+        {...rest}
+        form={form}
+        getProcessor={getProcessor}
+        esDocsBasePath={services.documentation.getEsDocsBasePath()}
+        closeFlyout={onClose}
+        resetProcessors={resetProcessors}
+        handleSubmit={handleSubmit}
+      />
+    );
+  } else {
+    return (
+      <AddProcessorForm
+        {...rest}
+        form={form}
+        esDocsBasePath={services.documentation.getEsDocsBasePath()}
+        closeFlyout={onClose}
+        handleSubmit={handleSubmit}
+      />
+    );
+  }
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/index.ts
new file mode 100644
index 0000000000000..3b506fc9296e3
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { ProcessorOutput } from './processor_output';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/processor_output.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/processor_output.scss
new file mode 100644
index 0000000000000..e1b5eb83584ff
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/processor_output.scss
@@ -0,0 +1,12 @@
+.processorOutput {
+  &__callOut {
+    &--customIcon {
+      .euiCallOutHeader {
+        align-items: center;
+      }
+    }
+    &__codeBlock > pre {
+      background: transparent;
+    }
+  }
+}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/processor_output.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/processor_output.tsx
new file mode 100644
index 0000000000000..bd0ce6ca2cd52
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_output/processor_output.tsx
@@ -0,0 +1,240 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import {
+  EuiAccordion,
+  EuiCallOut,
+  EuiCodeBlock,
+  EuiText,
+  EuiSpacer,
+  EuiSelect,
+} from '@elastic/eui';
+
+import { SectionLoading } from '../../../../../../shared_imports';
+import { ProcessorResult, Document } from '../../../types';
+import { ErrorIcon, ErrorIgnoredIcon, SkippedIcon } from '../../shared';
+
+import './processor_output.scss';
+
+export interface Props {
+  processorOutput?: ProcessorResult;
+  documents: Document[];
+  selectedDocumentIndex: number;
+  updateSelectedDocument: (index: number) => void;
+  isExecuting?: boolean;
+}
+
+const i18nTexts = {
+  tabDescription: i18n.translate('xpack.ingestPipelines.processorOutput.descriptionText', {
+    defaultMessage:
+      'View how the processor affects the ingest document as it passes through the pipeline.',
+  }),
+  skippedCalloutTitle: i18n.translate('xpack.ingestPipelines.processorOutput.skippedCalloutTitle', {
+    defaultMessage: 'The processor was not run.',
+  }),
+  droppedCalloutTitle: i18n.translate('xpack.ingestPipelines.processorOutput.droppedCalloutTitle', {
+    defaultMessage: 'The document was dropped.',
+  }),
+  noOutputCalloutTitle: i18n.translate(
+    'xpack.ingestPipelines.processorOutput.noOutputCalloutTitle',
+    {
+      defaultMessage: 'Output is not available for this processor.',
+    }
+  ),
+  processorOutputLabel: i18n.translate(
+    'xpack.ingestPipelines.processorOutput.processorOutputCodeBlockLabel',
+    {
+      defaultMessage: 'Data out',
+    }
+  ),
+  processorErrorTitle: i18n.translate(
+    'xpack.ingestPipelines.processorOutput.processorErrorCodeBlockLabel',
+    {
+      defaultMessage: 'There was an error',
+    }
+  ),
+  prevProcessorLabel: i18n.translate(
+    'xpack.ingestPipelines.processorOutput.processorInputCodeBlockLabel',
+    {
+      defaultMessage: 'Data in',
+    }
+  ),
+  processorIgnoredErrorTitle: i18n.translate(
+    'xpack.ingestPipelines.processorOutput.ignoredErrorCodeBlockLabel',
+    {
+      defaultMessage: 'There was an error that was ignored',
+    }
+  ),
+  documentsDropdownLabel: i18n.translate(
+    'xpack.ingestPipelines.processorOutput.documentsDropdownLabel',
+    {
+      defaultMessage: 'Test data:',
+    }
+  ),
+  loadingMessage: i18n.translate('xpack.ingestPipelines.processorOutput.loadingMessage', {
+    defaultMessage: 'Loading processor output…',
+  }),
+};
+
+export const ProcessorOutput: FunctionComponent<Props> = ({
+  processorOutput,
+  documents,
+  selectedDocumentIndex,
+  updateSelectedDocument,
+  isExecuting,
+}) => {
+  if (isExecuting) {
+    return <SectionLoading inline>{i18nTexts.loadingMessage}</SectionLoading>;
+  }
+
+  if (!processorOutput) {
+    return <EuiCallOut title={i18nTexts.noOutputCalloutTitle} color="danger" iconType="alert" />;
+  }
+
+  const {
+    processorInput,
+    doc: currentResult,
+    ignored_error: ignoredError,
+    error,
+    status,
+  } = processorOutput!;
+
+  const NoOutputCallOut: FunctionComponent = () => (
+    <EuiCallOut title={i18nTexts.noOutputCalloutTitle} iconType="pin" />
+  );
+
+  const getOutputContent = () => {
+    switch (status) {
+      case 'skipped':
+        return (
+          <EuiCallOut
+            title={i18nTexts.skippedCalloutTitle}
+            iconType={SkippedIcon}
+            className="processorOutput__callOut processorOutput__callOut--customIcon"
+          />
+        );
+      case 'dropped':
+        return <EuiCallOut title={i18nTexts.droppedCalloutTitle} iconType="indexClose" />;
+      case 'success':
+        if (currentResult) {
+          return (
+            <EuiCodeBlock paddingSize="s" language="json" isCopyable>
+              {JSON.stringify(currentResult, null, 2)}
+            </EuiCodeBlock>
+          );
+        }
+
+        return <NoOutputCallOut />;
+      case 'error':
+        return (
+          <EuiCallOut
+            iconType={ErrorIcon}
+            title={i18nTexts.processorErrorTitle}
+            color="danger"
+            className="processorOutput__callOut processorOutput__callOut--customIcon"
+          >
+            <EuiCodeBlock
+              language="json"
+              paddingSize="none"
+              className="processorOutput__callOut__codeBlock"
+              transparentBackground
+            >
+              {JSON.stringify(error, null, 2)}
+            </EuiCodeBlock>
+          </EuiCallOut>
+        );
+      case 'error_ignored':
+        return (
+          <EuiCallOut
+            iconType={ErrorIgnoredIcon}
+            title={i18nTexts.processorIgnoredErrorTitle}
+            color="warning"
+            className="processorOutput__callOut processorOutput__callOut--customIcon"
+          >
+            <EuiCodeBlock
+              className="processorOutput__callOut__codeBlock"
+              language="json"
+              paddingSize="none"
+              transparentBackground
+            >
+              {JSON.stringify(ignoredError, null, 2)}
+            </EuiCodeBlock>
+          </EuiCallOut>
+        );
+      default:
+        return <NoOutputCallOut />;
+    }
+  };
+
+  return (
+    <div data-test-subj="processorOutputTabContent" className="processorOutput">
+      <EuiText>
+        <p>{i18nTexts.tabDescription}</p>
+      </EuiText>
+
+      <EuiSpacer />
+
+      {/* Documents dropdown */}
+      <EuiSelect
+        compressed
+        options={documents.map((doc, index) => ({
+          value: index,
+          text: i18n.translate('xpack.ingestPipelines.processorOutput.documentLabel', {
+            defaultMessage: 'Document {number}',
+            values: {
+              number: index + 1,
+            },
+          }),
+        }))}
+        value={selectedDocumentIndex}
+        onChange={(e) => {
+          updateSelectedDocument(Number(e.target.value));
+        }}
+        aria-label={i18nTexts.documentsDropdownLabel}
+        prepend={i18nTexts.documentsDropdownLabel}
+      />
+
+      <EuiSpacer />
+
+      {/* Data-in accordion */}
+      <EuiAccordion
+        id="processor_input_accordion"
+        buttonContent={
+          <EuiText>
+            <p>{i18nTexts.prevProcessorLabel}</p>
+          </EuiText>
+        }
+      >
+        <>
+          <EuiSpacer />
+
+          <EuiCodeBlock paddingSize="s" language="json" isCopyable>
+            {/* If there is no processorInput defined (i.e., it's the first processor), we provide the sample document */}
+            {JSON.stringify(
+              processorInput ? processorInput : documents[selectedDocumentIndex],
+              null,
+              2
+            )}
+          </EuiCodeBlock>
+        </>
+      </EuiAccordion>
+
+      <EuiSpacer />
+
+      {/* Data-out content */}
+      <EuiText>
+        <span>{i18nTexts.processorOutputLabel}</span>
+      </EuiText>
+
+      <EuiSpacer size="xs" />
+
+      {getOutputContent()}
+    </div>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_settings_fields.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_settings_fields.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processor_settings_fields.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processor_settings_fields.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/append.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/append.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/append.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/append.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/bytes.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/bytes.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/bytes.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/bytes.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/circle.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/circle.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/circle.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/circle.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/common_processor_fields.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/common_processor_fields.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/common_processor_fields.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/common_processor_fields.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/field_name_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/field_name_field.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/field_name_field.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/field_name_field.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/ignore_missing_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/ignore_missing_field.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/ignore_missing_field.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/ignore_missing_field.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/index.ts
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/index.ts
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/index.ts
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/processor_type_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/processor_type_field.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/processor_type_field.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/processor_type_field.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/properties_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/properties_field.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/properties_field.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/properties_field.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/target_field.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/target_field.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/common_fields/target_field.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/common_fields/target_field.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/convert.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/convert.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/convert.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/convert.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/csv.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/csv.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/csv.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/csv.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/custom.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/custom.tsx
similarity index 96%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/custom.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/custom.tsx
index c2aab62cf8933..f49e77501f931 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/custom.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/custom.tsx
@@ -17,6 +17,7 @@ import {
 const { emptyField, isJsonField } = fieldValidators;
 
 import { XJsonEditor } from '../field_components';
+import { Fields } from '../processor_form.container';
 import { EDITOR_PX_HEIGHT } from './shared';
 
 const customConfig: FieldConfig = {
@@ -60,7 +61,7 @@ const customConfig: FieldConfig = {
 };
 
 interface Props {
-  defaultOptions?: any;
+  defaultOptions?: Fields['fields'];
 }
 
 /**
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/date.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/date.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date_index_name.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/date_index_name.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/date_index_name.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/date_index_name.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dissect.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/dissect.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dissect.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/dissect.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dot_expander.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/dot_expander.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/dot_expander.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/dot_expander.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/drop.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/drop.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/drop.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/drop.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/enrich.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/enrich.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/enrich.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/enrich.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/fail.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/fail.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/fail.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/fail.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/foreach.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/foreach.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/foreach.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/foreach.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/geoip.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/geoip.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/geoip.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/geoip.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/grok.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/grok.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/grok.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/grok.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/gsub.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/gsub.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/gsub.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/gsub.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/html_strip.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/html_strip.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/html_strip.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/html_strip.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/index.ts
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/index.ts
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/index.ts
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/inference.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/inference.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/inference.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/inference.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/join.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/join.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/join.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/join.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/json.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/json.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/json.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/json.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/kv.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/kv.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/kv.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/kv.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/lowercase.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/lowercase.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/lowercase.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/lowercase.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/pipeline.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/pipeline.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/pipeline.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/pipeline.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/remove.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/remove.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/remove.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/remove.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/rename.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/rename.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/rename.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/rename.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/script.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/script.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/script.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/script.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/set.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/set.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set_security_user.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/set_security_user.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/set_security_user.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/set_security_user.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/shared.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/shared.ts
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/shared.ts
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/shared.ts
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/sort.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/sort.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/sort.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/sort.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/split.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/split.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/split.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/split.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/trim.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/trim.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/trim.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/trim.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/uppercase.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/uppercase.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/uppercase.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/uppercase.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/url_decode.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/url_decode.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/url_decode.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/url_decode.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/user_agent.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/user_agent.tsx
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/manage_processor_form/processors/user_agent.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_form/processors/user_agent.tsx
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/index.ts
index 1b4b975b5305e..3f258bf279e42 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/index.ts
@@ -9,3 +9,5 @@ export {
   mapProcessorTypeToDescriptor,
   ProcessorType,
 } from './map_processor_type_to_form';
+
+export { ErrorIcon, ErrorIgnoredIcon, SkippedIcon } from './status_icons';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
index 95a8d35c119a6..8d9260f3c822c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/map_processor_type_to_form.tsx
@@ -46,7 +46,7 @@ import {
   UrlDecode,
   UserAgent,
   FormFieldsComponent,
-} from '../manage_processor_form/processors';
+} from '../processor_form/processors';
 
 interface FieldDescriptor {
   FieldsComponent?: FormFieldsComponent;
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/error_icon.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/error_icon.tsx
new file mode 100644
index 0000000000000..58cb56d4f768d
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/error_icon.tsx
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+
+export const ErrorIcon: FunctionComponent = () => (
+  <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M1.1221 12.5211C0.758621 13.1875 1.24093 14 1.99999 14H14C14.7591 14 15.2414 13.1875 14.8779 12.5211L8.87789 1.52115C8.49887 0.826284 7.50112 0.826284 7.1221 1.52115L1.1221 12.5211ZM7.34999 5.18143L7.5896 10.0586H8.40019L8.64999 5.18143H7.34999ZM7.53642 11.7736C7.66071 11.8979 7.80999 11.96 7.98428 11.96C8.14999 11.96 8.2957 11.8986 8.42142 11.7757C8.54713 11.6529 8.60999 11.5043 8.60999 11.33C8.60999 11.1529 8.54785 11.0036 8.42356 10.8822C8.29928 10.7607 8.15285 10.7 7.98428 10.7C7.80999 10.7 7.66071 10.7614 7.53642 10.8843C7.41213 11.0072 7.34999 11.1557 7.34999 11.33C7.34999 11.5014 7.41213 11.6493 7.53642 11.7736Z"
+      fill="#BD271E"
+    />
+  </svg>
+);
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/error_ignored_icon.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/error_ignored_icon.tsx
new file mode 100644
index 0000000000000..74ceda7687f02
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/error_ignored_icon.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+
+export const ErrorIgnoredIcon: FunctionComponent = () => (
+  <svg width="17" height="16" viewBox="0 0 17 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M6.69297 4.58336L6.89831 8.76292H7.59296L7.80703 4.58336H6.69297ZM6.85273 10.2326C6.95924 10.3391 7.08717 10.3924 7.23653 10.3924C7.37855 10.3924 7.50342 10.3397 7.61115 10.2345C7.71889 10.1292 7.77275 10.0019 7.77275 9.8525C7.77275 9.70069 7.7195 9.57276 7.61299 9.4687C7.50648 9.36464 7.38099 9.31261 7.23653 9.31261C7.08717 9.31261 6.95924 9.36525 6.85273 9.47053C6.74622 9.57582 6.69297 9.70314 6.69297 9.8525C6.69297 9.99941 6.74622 10.1261 6.85273 10.2326ZM1.35585 10.8733C1.04436 11.4443 1.45769 12.1406 2.10818 12.1406H8.38069C8.31594 11.8631 8.2743 11.5767 8.25791 11.2836H2.10818L7.25 1.85697L10.1132 7.10614C10.3362 6.92628 10.5749 6.76519 10.827 6.62525L8.00233 1.44661C7.67752 0.851131 6.82248 0.851131 6.49767 1.44661L1.35585 10.8733Z"
+      fill="#BD271E"
+    />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M12.25 6C10.0409 6 8.25 7.79086 8.25 10C8.25 12.2091 10.0409 14 12.25 14C14.4591 14 16.25 12.2091 16.25 10C16.25 7.79086 14.4591 6 12.25 6ZM12.632 11.0522L14.5087 9.28831L15.0441 9.8565L12.25 12.4813L9.45584 9.8565L9.99126 9.28831L11.8515 11.0367V7.51871H12.632V11.0522Z"
+      fill="#BD271E"
+    />
+  </svg>
+);
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/index.ts
new file mode 100644
index 0000000000000..9fe0871e445eb
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { ErrorIcon } from './error_icon';
+export { ErrorIgnoredIcon } from './error_ignored_icon';
+export { SkippedIcon } from './skipped_icon';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/skipped_icon.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/skipped_icon.tsx
new file mode 100644
index 0000000000000..c540bd3790fb0
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/shared/status_icons/skipped_icon.tsx
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+
+export const SkippedIcon: FunctionComponent = () => (
+  <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M4.00586 2C2.94746 2 2.08199 2.81827 2.0055 3.85616L2 4.00586V9.99414C2 11.0525 2.81827 11.918 3.85616 11.9945L4 11.9998L4.00417 11.9999L4.00586 12L12.5167 11.9999L10.6067 13.8199C10.553 13.8687 10.5101 13.9281 10.4807 13.9944C10.4514 14.0607 10.4362 14.1324 10.4362 14.2049C10.4362 14.2774 10.4514 14.3492 10.4807 14.4155C10.5101 14.4818 10.553 14.5412 10.6067 14.5899C10.8337 14.8029 11.2067 14.8029 11.4347 14.5899L13.4847 12.6399C13.6468 12.4944 13.7765 12.3163 13.8653 12.1173C13.9541 11.9183 14 11.7028 14 11.4849C14 11.267 13.9541 11.0516 13.8653 10.8526C13.7765 10.6536 13.6468 10.4755 13.4847 10.3299L11.4347 8.37994C11.3212 8.27699 11.1734 8.21997 11.0202 8.21997C10.8669 8.21997 10.7192 8.27699 10.6057 8.37994C10.552 8.42868 10.5091 8.48811 10.4797 8.55441C10.4504 8.62072 10.4352 8.69243 10.4352 8.76494C10.4352 8.83745 10.4504 8.90916 10.4797 8.97546C10.5091 9.04177 10.552 9.1012 10.6057 9.14994L12.5487 10.9999H4C3.48642 10.997 3.0646 10.6103 3.00676 10.1116L3 9.99414V4.00586C3 3.48963 3.38781 3.06482 3.88845 3.00676L4.00586 3H13.5C13.7761 3 14 2.77614 14 2.5C14 2.25454 13.8231 2.05039 13.5899 2.00806L13.5 2H4.00586Z"
+      fill="#69707D"
+    />
+  </svg>
+);
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/add_documents_button.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/add_documents_button.tsx
index e3ef9a9ee5390..26492454cbcf5 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/add_documents_button.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/add_documents_button.tsx
@@ -6,6 +6,7 @@
 import { i18n } from '@kbn/i18n';
 import React, { FunctionComponent } from 'react';
 import { EuiButtonEmpty } from '@elastic/eui';
+import { TestPipelineFlyoutTab } from './test_pipeline_flyout_tabs';
 
 const i18nTexts = {
   buttonLabel: i18n.translate('xpack.ingestPipelines.pipelineEditor.testPipeline.buttonLabel', {
@@ -14,16 +15,15 @@ const i18nTexts = {
 };
 
 interface Props {
-  openTestPipelineFlyout: () => void;
+  openFlyout: (activeFlyoutTab: TestPipelineFlyoutTab) => void;
 }
 
-export const AddDocumentsButton: FunctionComponent<Props> = ({ openTestPipelineFlyout }) => {
+export const AddDocumentsButton: FunctionComponent<Props> = ({ openFlyout }) => {
   return (
     <EuiButtonEmpty
       size="s"
-      onClick={openTestPipelineFlyout}
+      onClick={() => openFlyout('documents')}
       data-test-subj="addDocumentsButton"
-      iconType="plusInCircleFilled"
     >
       {i18nTexts.buttonLabel}
     </EuiButtonEmpty>
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/documents_dropdown.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/documents_dropdown.scss
new file mode 100644
index 0000000000000..5deb48a2f01a7
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/documents_dropdown.scss
@@ -0,0 +1,3 @@
+.documentsDropdownPanel {
+  min-width: 200px;
+}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/documents_dropdown.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/documents_dropdown.tsx
new file mode 100644
index 0000000000000..269a697a33c17
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/documents_dropdown.tsx
@@ -0,0 +1,138 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+import React, { FunctionComponent, useState } from 'react';
+import {
+  EuiButton,
+  EuiPopover,
+  EuiButtonEmpty,
+  EuiPopoverTitle,
+  EuiSelectable,
+  EuiHorizontalRule,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+} from '@elastic/eui';
+
+import { Document } from '../../../types';
+
+import { TestPipelineFlyoutTab } from '../test_pipeline_flyout_tabs';
+
+import './documents_dropdown.scss';
+
+const i18nTexts = {
+  dropdownLabel: i18n.translate(
+    'xpack.ingestPipelines.pipelineEditor.testPipeline.documentsdropdown.dropdownLabel',
+    {
+      defaultMessage: 'Documents:',
+    }
+  ),
+  addDocumentsButtonLabel: i18n.translate(
+    'xpack.ingestPipelines.pipelineEditor.testPipeline.documentsDropdown.buttonLabel',
+    {
+      defaultMessage: 'Add documents',
+    }
+  ),
+  popoverTitle: i18n.translate(
+    'xpack.ingestPipelines.pipelineEditor.testPipeline.documentsDropdown.popoverTitle',
+    {
+      defaultMessage: 'Test documents',
+    }
+  ),
+};
+
+interface Props {
+  documents: Document[];
+  selectedDocumentIndex: number;
+  updateSelectedDocument: (index: number) => void;
+  openFlyout: (activeFlyoutTab: TestPipelineFlyoutTab) => void;
+}
+
+export const DocumentsDropdown: FunctionComponent<Props> = ({
+  documents,
+  selectedDocumentIndex,
+  updateSelectedDocument,
+  openFlyout,
+}) => {
+  const [showPopover, setShowPopover] = useState<boolean>(false);
+
+  const managePipelineButton = (
+    <EuiButtonEmpty
+      data-test-subj="documentsButton"
+      onClick={() => setShowPopover((previousBool) => !previousBool)}
+      iconType="arrowDown"
+      iconSide="right"
+    >
+      {i18n.translate('xpack.ingestPipelines.pipelineEditor.testPipeline.selectedDocumentLabel', {
+        defaultMessage: 'Document {selectedDocument}',
+        values: {
+          selectedDocument: selectedDocumentIndex + 1,
+        },
+      })}
+    </EuiButtonEmpty>
+  );
+
+  return (
+    <EuiPopover
+      isOpen={showPopover}
+      closePopover={() => setShowPopover(false)}
+      button={managePipelineButton}
+      panelPaddingSize="none"
+      withTitle
+      repositionOnScroll
+      data-test-subj="documentsDropdown"
+      panelClassName="documentsDropdownPanel"
+    >
+      <EuiSelectable
+        singleSelection
+        options={documents.map((doc, index) => ({
+          key: index.toString(),
+          checked: selectedDocumentIndex === index ? 'on' : undefined,
+          label: i18n.translate('xpack.ingestPipelines.pipelineEditor.testPipeline.documentLabel', {
+            defaultMessage: 'Document {documentNumber}',
+            values: {
+              documentNumber: index + 1,
+            },
+          }),
+        }))}
+        onChange={(newOptions) => {
+          const selectedOption = newOptions.find((option) => option.checked === 'on');
+          if (selectedOption) {
+            updateSelectedDocument(Number(selectedOption.key!));
+          }
+
+          setShowPopover(false);
+        }}
+      >
+        {(list, search) => (
+          <div>
+            <EuiPopoverTitle>{i18nTexts.popoverTitle}</EuiPopoverTitle>
+            {list}
+          </div>
+        )}
+      </EuiSelectable>
+
+      <EuiHorizontalRule margin="xs" />
+
+      <EuiFlexGroup justifyContent="center">
+        <EuiFlexItem grow={false}>
+          <EuiButton
+            size="s"
+            onClick={() => {
+              openFlyout('documents');
+              setShowPopover(false);
+            }}
+            data-test-subj="addDocumentsButton"
+          >
+            {i18nTexts.addDocumentsButtonLabel}
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+
+      <EuiSpacer size="s" />
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/index.ts
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/documents_dropdown/index.ts
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/documents_dropdown/index.ts
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_output_button.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_output_button.tsx
index 6fd1adad54f84..9018042229590 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_output_button.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_output_button.tsx
@@ -5,7 +5,8 @@
  */
 import { i18n } from '@kbn/i18n';
 import React, { FunctionComponent } from 'react';
-import { EuiButton, EuiToolTip } from '@elastic/eui';
+import { EuiButton } from '@elastic/eui';
+import { TestPipelineFlyoutTab } from './test_pipeline_flyout_tabs';
 
 const i18nTexts = {
   buttonLabel: i18n.translate(
@@ -14,46 +15,15 @@ const i18nTexts = {
       defaultMessage: 'View output',
     }
   ),
-  disabledButtonTooltipLabel: i18n.translate(
-    'xpack.ingestPipelines.pipelineEditor.testPipeline.outputButtonTooltipLabel',
-    {
-      defaultMessage: 'Add documents to view the output',
-    }
-  ),
 };
 
 interface Props {
-  isDisabled: boolean;
-  openTestPipelineFlyout: () => void;
+  openFlyout: (activeFlyoutTab: TestPipelineFlyoutTab) => void;
 }
 
-export const TestOutputButton: FunctionComponent<Props> = ({
-  isDisabled,
-  openTestPipelineFlyout,
-}) => {
-  if (isDisabled) {
-    return (
-      <EuiToolTip position="top" content={<p>{i18nTexts.disabledButtonTooltipLabel}</p>}>
-        <EuiButton
-          size="s"
-          onClick={openTestPipelineFlyout}
-          data-test-subj="viewOutputButton"
-          iconType="crossInACircleFilled"
-          isDisabled={isDisabled}
-        >
-          {i18nTexts.buttonLabel}
-        </EuiButton>
-      </EuiToolTip>
-    );
-  }
-
+export const TestOutputButton: FunctionComponent<Props> = ({ openFlyout }) => {
   return (
-    <EuiButton
-      size="s"
-      onClick={openTestPipelineFlyout}
-      data-test-subj="viewOutputButton"
-      iconType="checkInCircleFilled"
-    >
+    <EuiButton size="s" onClick={() => openFlyout('output')} data-test-subj="viewOutputButton">
       {i18nTexts.buttonLabel}
     </EuiButton>
   );
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_actions.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_actions.tsx
index eb9d9352e4b90..cec02db26729d 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_actions.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_actions.tsx
@@ -4,15 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import React, { FunctionComponent, useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
 
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { useTestPipelineContext, usePipelineProcessorsContext } from '../../context';
-
-import { DocumentsDropdown } from '../documents_dropdown';
+import { DocumentsDropdown } from './documents_dropdown';
 import { TestPipelineFlyoutTab } from './test_pipeline_flyout_tabs';
 import { AddDocumentsButton } from './add_documents_button';
 import { TestOutputButton } from './test_output_button';
-import { TestPipelineFlyout } from './test_pipeline_flyout';
+import { TestPipelineFlyout } from './test_pipeline_flyout.container';
+
+const i18nTexts = {
+  testPipelineActionsLabel: i18n.translate(
+    'xpack.ingestPipelines.pipelineEditor.testPipeline.testPipelineActionsLabel',
+    {
+      defaultMessage: 'Test pipeline:',
+    }
+  ),
+};
 
 export const TestPipelineActions: FunctionComponent = () => {
   const { testPipelineData, setCurrentTestPipelineData } = useTestPipelineContext();
@@ -40,35 +49,42 @@ export const TestPipelineActions: FunctionComponent = () => {
     });
   };
 
+  const openFlyout = (activeTab: TestPipelineFlyoutTab) => {
+    setOpenTestPipelineFlyout(true);
+    setActiveFlyoutTab(activeTab);
+  };
+
   return (
     <>
-      <EuiFlexGroup gutterSize="s">
+      <EuiFlexGroup gutterSize="s" alignItems="baseline">
+        <EuiFlexItem grow={false}>
+          <EuiText>
+            <span>
+              <strong>{i18nTexts.testPipelineActionsLabel}</strong>
+            </span>
+          </EuiText>
+        </EuiFlexItem>
+
         <EuiFlexItem grow={false}>
           {documents ? (
             <DocumentsDropdown
               documents={documents}
               selectedDocumentIndex={selectedDocumentIndex}
               updateSelectedDocument={updateSelectedDocument}
+              openFlyout={openFlyout}
             />
           ) : (
-            <AddDocumentsButton
-              openTestPipelineFlyout={() => {
-                setOpenTestPipelineFlyout(true);
-                setActiveFlyoutTab('documents');
-              }}
-            />
+            <AddDocumentsButton openFlyout={openFlyout} />
           )}
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <TestOutputButton
-            isDisabled={Boolean(testOutputPerProcessor) === false}
-            openTestPipelineFlyout={() => {
-              setOpenTestPipelineFlyout(true);
-              setActiveFlyoutTab('output');
-            }}
-          />
-        </EuiFlexItem>
+
+        {testOutputPerProcessor && (
+          <EuiFlexItem grow={false}>
+            <TestOutputButton openFlyout={openFlyout} />
+          </EuiFlexItem>
+        )}
       </EuiFlexGroup>
+
       {openTestPipelineFlyout && (
         <TestPipelineFlyout
           activeTab={activeFlyoutTab}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout.container.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout.container.tsx
new file mode 100644
index 0000000000000..b49eea5b59ab0
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout.container.tsx
@@ -0,0 +1,177 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, useCallback, useEffect } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { useKibana, useForm } from '../../../../../shared_imports';
+import { useTestPipelineContext } from '../../context';
+import { serialize } from '../../serialize';
+import { DeserializeResult } from '../../deserialize';
+import { Document } from '../../types';
+import { TestPipelineFlyout as ViewComponent } from './test_pipeline_flyout';
+
+import { TestPipelineFlyoutTab } from './test_pipeline_flyout_tabs';
+import { documentsSchema } from './test_pipeline_flyout_tabs/documents_schema';
+
+export interface Props {
+  activeTab: TestPipelineFlyoutTab;
+  onClose: () => void;
+  processors: DeserializeResult;
+}
+
+export interface TestPipelineConfig {
+  documents: Document[];
+  verbose?: boolean;
+}
+
+export const TestPipelineFlyout: React.FunctionComponent<Props> = ({
+  onClose,
+  activeTab,
+  processors,
+}) => {
+  const { services } = useKibana();
+
+  const {
+    testPipelineData,
+    setCurrentTestPipelineData,
+    updateTestOutputPerProcessor,
+  } = useTestPipelineContext();
+
+  const {
+    config: { documents: cachedDocuments, verbose: cachedVerbose },
+  } = testPipelineData;
+
+  const { form } = useForm({
+    schema: documentsSchema,
+    defaultValue: {
+      documents: cachedDocuments || '',
+    },
+  });
+
+  const [selectedTab, setSelectedTab] = useState<TestPipelineFlyoutTab>(activeTab);
+
+  const [isRunningTest, setIsRunningTest] = useState<boolean>(false);
+  const [testingError, setTestingError] = useState<any>(null);
+  const [testOutput, setTestOutput] = useState<any>(undefined);
+
+  const handleTestPipeline = useCallback(
+    async (
+      { documents, verbose }: TestPipelineConfig,
+      updateProcessorOutput?: boolean
+    ): Promise<{ isSuccessful: boolean }> => {
+      const serializedProcessors = serialize({ pipeline: processors });
+
+      setIsRunningTest(true);
+      setTestingError(null);
+
+      const { error, data: currentTestOutput } = await services.api.simulatePipeline({
+        documents,
+        verbose,
+        pipeline: { ...serializedProcessors },
+      });
+
+      setIsRunningTest(false);
+
+      if (error) {
+        setTestingError(error);
+
+        // reset the per-processor output
+        // this is needed in the scenario where the pipeline has already executed,
+        // but you modified the sample documents and there was an error on re-execution
+        setCurrentTestPipelineData({
+          type: 'updateOutputPerProcessor',
+          payload: {
+            isExecutingPipeline: false,
+            testOutputPerProcessor: undefined,
+          },
+        });
+
+        return { isSuccessful: false };
+      }
+
+      setCurrentTestPipelineData({
+        type: 'updateConfig',
+        payload: {
+          config: {
+            documents,
+            verbose,
+          },
+        },
+      });
+
+      // We sometimes need to manually refresh the per-processor output
+      // e.g., when clicking the "Refresh output" button and there have been no state changes
+      if (updateProcessorOutput) {
+        updateTestOutputPerProcessor(documents, processors);
+      }
+
+      setTestOutput(currentTestOutput);
+
+      services.notifications.toasts.addSuccess(
+        i18n.translate('xpack.ingestPipelines.testPipelineFlyout.successNotificationText', {
+          defaultMessage: 'Pipeline executed',
+        }),
+        {
+          toastLifeTimeMs: 1000,
+        }
+      );
+
+      return { isSuccessful: true };
+    },
+    [
+      processors,
+      services.api,
+      services.notifications.toasts,
+      setCurrentTestPipelineData,
+      updateTestOutputPerProcessor,
+    ]
+  );
+
+  const validateAndTestPipeline = async () => {
+    const { isValid, data } = await form.submit();
+
+    if (!isValid) {
+      return;
+    }
+
+    const { documents } = data as { documents: Document[] };
+
+    const { isSuccessful } = await handleTestPipeline({
+      documents: documents!,
+      verbose: cachedVerbose,
+    });
+
+    if (isSuccessful) {
+      setSelectedTab('output');
+    }
+  };
+
+  useEffect(() => {
+    if (cachedDocuments && activeTab === 'output') {
+      handleTestPipeline({ documents: cachedDocuments, verbose: cachedVerbose }, true);
+    }
+    // We only want to know on initial mount if
+    // there are cached documents and we are on the output tab
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  return (
+    <ViewComponent
+      handleTestPipeline={handleTestPipeline}
+      isRunningTest={isRunningTest}
+      cachedVerbose={cachedVerbose}
+      cachedDocuments={cachedDocuments}
+      testOutput={testOutput}
+      form={form}
+      validateAndTestPipeline={validateAndTestPipeline}
+      selectedTab={selectedTab}
+      setSelectedTab={setSelectedTab}
+      testingError={testingError}
+      onClose={onClose}
+    />
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout.tsx
index b26c6f536366d..46271a6bce51c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout.tsx
@@ -4,9 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useState, useCallback, useEffect } from 'react';
+import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { i18n } from '@kbn/i18n';
 
 import {
   EuiFlyout,
@@ -17,112 +16,46 @@ import {
   EuiCallOut,
 } from '@elastic/eui';
 
-import { useKibana } from '../../../../../shared_imports';
-import { useTestPipelineContext } from '../../context';
-import { serialize } from '../../serialize';
-import { DeserializeResult } from '../../deserialize';
+import { Form, FormHook } from '../../../../../shared_imports';
 import { Document } from '../../types';
 
 import { Tabs, TestPipelineFlyoutTab, OutputTab, DocumentsTab } from './test_pipeline_flyout_tabs';
 
 export interface Props {
-  activeTab: TestPipelineFlyoutTab;
   onClose: () => void;
-  processors: DeserializeResult;
+  handleTestPipeline: (
+    testPipelineConfig: TestPipelineConfig,
+    refreshOutputPerProcessor?: boolean
+  ) => Promise<{ isSuccessful: boolean }>;
+  isRunningTest: boolean;
+  cachedVerbose?: boolean;
+  cachedDocuments?: Document[];
+  testOutput?: any;
+  form: FormHook;
+  validateAndTestPipeline: () => Promise<void>;
+  selectedTab: TestPipelineFlyoutTab;
+  setSelectedTab: (selectedTa: TestPipelineFlyoutTab) => void;
+  testingError: any;
 }
 
-export interface HandleTestPipelineArgs {
+export interface TestPipelineConfig {
   documents: Document[];
   verbose?: boolean;
 }
 
 export const TestPipelineFlyout: React.FunctionComponent<Props> = ({
+  handleTestPipeline,
+  isRunningTest,
+  cachedVerbose,
+  cachedDocuments,
+  testOutput,
+  form,
+  validateAndTestPipeline,
+  selectedTab,
+  setSelectedTab,
+  testingError,
   onClose,
-  activeTab,
-  processors,
 }) => {
-  const { services } = useKibana();
-
-  const {
-    testPipelineData,
-    setCurrentTestPipelineData,
-    updateTestOutputPerProcessor,
-  } = useTestPipelineContext();
-
-  const {
-    config: { documents: cachedDocuments, verbose: cachedVerbose },
-  } = testPipelineData;
-
-  const [selectedTab, setSelectedTab] = useState<TestPipelineFlyoutTab>(activeTab);
-
-  const [shouldTestImmediately, setShouldTestImmediately] = useState<boolean>(false);
-  const [isRunningTest, setIsRunningTest] = useState<boolean>(false);
-  const [testingError, setTestingError] = useState<any>(null);
-  const [testOutput, setTestOutput] = useState<any>(undefined);
-
-  const handleTestPipeline = useCallback(
-    async ({ documents, verbose }: HandleTestPipelineArgs) => {
-      const serializedProcessors = serialize({ pipeline: processors });
-
-      setIsRunningTest(true);
-      setTestingError(null);
-
-      const { error, data: currentTestOutput } = await services.api.simulatePipeline({
-        documents,
-        verbose,
-        pipeline: { ...serializedProcessors },
-      });
-
-      setIsRunningTest(false);
-
-      if (error) {
-        setTestingError(error);
-        return;
-      }
-
-      setCurrentTestPipelineData({
-        type: 'updateConfig',
-        payload: {
-          config: {
-            documents,
-            verbose,
-          },
-        },
-      });
-
-      setTestOutput(currentTestOutput);
-
-      services.notifications.toasts.addSuccess(
-        i18n.translate('xpack.ingestPipelines.testPipelineFlyout.successNotificationText', {
-          defaultMessage: 'Pipeline executed',
-        }),
-        {
-          toastLifeTimeMs: 1000,
-        }
-      );
-
-      setSelectedTab('output');
-    },
-    [services.api, processors, setCurrentTestPipelineData, services.notifications.toasts]
-  );
-
-  useEffect(() => {
-    if (cachedDocuments) {
-      setShouldTestImmediately(true);
-    }
-    // We only want to know on initial mount if there are cached documents
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  useEffect(() => {
-    // If the user has already tested the pipeline once,
-    // use the cached test config and automatically execute the pipeline
-    if (shouldTestImmediately) {
-      setShouldTestImmediately(false);
-      handleTestPipeline({ documents: cachedDocuments!, verbose: cachedVerbose });
-    }
-  }, [handleTestPipeline, cachedDocuments, cachedVerbose, shouldTestImmediately]);
-
   let tabContent;
 
   if (selectedTab === 'output') {
@@ -138,13 +71,19 @@ export const TestPipelineFlyout: React.FunctionComponent<Props> = ({
   } else {
     // default to "Documents" tab
     tabContent = (
-      <DocumentsTab
-        isRunningTest={isRunningTest}
-        handleTestPipeline={handleTestPipeline}
-        setPerProcessorOutput={updateTestOutputPerProcessor}
-        processors={processors}
-        testPipelineData={testPipelineData}
-      />
+      <Form
+        form={form}
+        data-test-subj="testPipelineForm"
+        isInvalid={form.isSubmitted && !form.isValid}
+        onSubmit={validateAndTestPipeline}
+        error={form.getErrors()}
+      >
+        <DocumentsTab
+          validateAndTestPipeline={validateAndTestPipeline}
+          isRunningTest={isRunningTest}
+          isSubmitButtonDisabled={form.isSubmitted && !form.isValid}
+        />
+      </Form>
     );
   }
 
@@ -163,9 +102,17 @@ export const TestPipelineFlyout: React.FunctionComponent<Props> = ({
 
       <EuiFlyoutBody>
         <Tabs
-          onTabChange={setSelectedTab}
+          onTabChange={async (nextTab) => {
+            if (nextTab === 'output') {
+              // When switching to the output tab,
+              // we automatically run the pipeline if documents are defined
+              validateAndTestPipeline();
+            } else {
+              form.reset({ defaultValue: { documents: cachedDocuments! } });
+              setSelectedTab(nextTab);
+            }
+          }}
           selectedTab={selectedTab}
-          getIsDisabled={(tabId) => !testOutput && tabId === 'output'}
         />
 
         <EuiSpacer />
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_documents.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_documents.tsx
index dd12cdab0c934..b2326644340a7 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_documents.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_documents.tsx
@@ -10,67 +10,23 @@ import { i18n } from '@kbn/i18n';
 
 import { EuiSpacer, EuiText, EuiButton, EuiLink } from '@elastic/eui';
 
-import {
-  getUseField,
-  Field,
-  JsonEditorField,
-  Form,
-  useForm,
-  useKibana,
-} from '../../../../../../shared_imports';
-
-import { TestPipelineContext } from '../../../context';
-import { Document } from '../../../types';
-import { DeserializeResult } from '../../../deserialize';
-import { HandleTestPipelineArgs } from '../test_pipeline_flyout';
-import { documentsSchema } from './documents_schema';
+import { getUseField, Field, JsonEditorField, useKibana } from '../../../../../../shared_imports';
 
 const UseField = getUseField({ component: Field });
 
 interface Props {
-  handleTestPipeline: (data: HandleTestPipelineArgs) => void;
-  setPerProcessorOutput: (documents: Document[] | undefined, processors: DeserializeResult) => void;
+  validateAndTestPipeline: () => Promise<void>;
   isRunningTest: boolean;
-  processors: DeserializeResult;
-  testPipelineData: TestPipelineContext['testPipelineData'];
+  isSubmitButtonDisabled: boolean;
 }
 
 export const DocumentsTab: React.FunctionComponent<Props> = ({
-  handleTestPipeline,
+  validateAndTestPipeline,
+  isSubmitButtonDisabled,
   isRunningTest,
-  setPerProcessorOutput,
-  processors,
-  testPipelineData,
 }) => {
   const { services } = useKibana();
 
-  const {
-    config: { documents: cachedDocuments, verbose: cachedVerbose },
-  } = testPipelineData;
-
-  const testPipeline = async () => {
-    const { isValid, data } = await form.submit();
-
-    if (!isValid) {
-      return;
-    }
-
-    const { documents } = data as { documents: Document[] };
-
-    await handleTestPipeline({ documents: documents!, verbose: cachedVerbose });
-
-    // This is necessary to update the status and output of each processor
-    // as verbose may not be enabled
-    setPerProcessorOutput(documents, processors);
-  };
-
-  const { form } = useForm({
-    schema: documentsSchema,
-    defaultValue: {
-      documents: cachedDocuments || '',
-    },
-  });
-
   return (
     <div data-test-subj="documentsTabContent">
       <EuiText>
@@ -100,53 +56,46 @@ export const DocumentsTab: React.FunctionComponent<Props> = ({
 
       <EuiSpacer size="m" />
 
-      <Form
-        form={form}
-        data-test-subj="testPipelineForm"
-        isInvalid={form.isSubmitted && !form.isValid}
-        onSubmit={testPipeline}
-        error={form.getErrors()}
-      >
-        {/* Documents editor */}
-        <UseField
-          path="documents"
-          component={JsonEditorField}
-          componentProps={{
-            euiCodeEditorProps: {
-              'data-test-subj': 'documentsEditor',
-              height: '300px',
-              'aria-label': i18n.translate(
-                'xpack.ingestPipelines.testPipelineFlyout.documentsTab.editorFieldAriaLabel',
-                {
-                  defaultMessage: 'Documents JSON editor',
-                }
-              ),
-            },
-          }}
-        />
+      {/* Documents editor */}
+      <UseField
+        path="documents"
+        component={JsonEditorField}
+        componentProps={{
+          euiCodeEditorProps: {
+            'data-test-subj': 'documentsEditor',
+            height: '300px',
+            'aria-label': i18n.translate(
+              'xpack.ingestPipelines.testPipelineFlyout.documentsTab.editorFieldAriaLabel',
+              {
+                defaultMessage: 'Documents JSON editor',
+              }
+            ),
+          },
+        }}
+      />
 
-        <EuiSpacer size="m" />
+      <EuiSpacer size="m" />
 
-        <EuiButton
-          data-test-subj="runPipelineButton"
-          onClick={testPipeline}
-          size="s"
-          isLoading={isRunningTest}
-          disabled={form.isSubmitted && !form.isValid}
-        >
-          {isRunningTest ? (
-            <FormattedMessage
-              id="xpack.ingestPipelines.testPipelineFlyout.documentsTab.runningButtonLabel"
-              defaultMessage="Running"
-            />
-          ) : (
-            <FormattedMessage
-              id="xpack.ingestPipelines.testPipelineFlyout.documentsTab.runButtonLabel"
-              defaultMessage="Run the pipeline"
-            />
-          )}
-        </EuiButton>
-      </Form>
+      <EuiButton
+        onClick={validateAndTestPipeline}
+        data-test-subj="runPipelineButton"
+        size="s"
+        isLoading={isRunningTest}
+        disabled={isSubmitButtonDisabled}
+        iconType="play"
+      >
+        {isRunningTest ? (
+          <FormattedMessage
+            id="xpack.ingestPipelines.testPipelineFlyout.documentsTab.runningButtonLabel"
+            defaultMessage="Running"
+          />
+        ) : (
+          <FormattedMessage
+            id="xpack.ingestPipelines.testPipelineFlyout.documentsTab.runButtonLabel"
+            defaultMessage="Run the pipeline"
+          />
+        )}
+      </EuiButton>
     </div>
   );
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_output.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_output.tsx
index 926bab6da993c..db6a020e307a5 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_output.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/tab_output.tsx
@@ -18,10 +18,13 @@ import {
 } from '@elastic/eui';
 
 import { Document } from '../../../types';
-import { HandleTestPipelineArgs } from '../test_pipeline_flyout';
+import { TestPipelineConfig } from '../test_pipeline_flyout.container';
 
 interface Props {
-  handleTestPipeline: (data: HandleTestPipelineArgs) => void;
+  handleTestPipeline: (
+    testPipelineConfig: TestPipelineConfig,
+    refreshOutputPerProcessor?: boolean
+  ) => Promise<{ isSuccessful: boolean }>;
   isRunningTest: boolean;
   cachedVerbose?: boolean;
   cachedDocuments: Document[];
@@ -37,12 +40,6 @@ export const OutputTab: React.FunctionComponent<Props> = ({
 }) => {
   const [isVerboseEnabled, setIsVerboseEnabled] = useState(Boolean(cachedVerbose));
 
-  const onEnableVerbose = (isVerbose: boolean) => {
-    setIsVerboseEnabled(isVerbose);
-
-    handleTestPipeline({ documents: cachedDocuments!, verbose: isVerbose });
-  };
-
   let content: React.ReactNode | undefined;
 
   if (isRunningTest) {
@@ -78,15 +75,23 @@ export const OutputTab: React.FunctionComponent<Props> = ({
               />
             }
             checked={isVerboseEnabled}
-            onChange={(e) => onEnableVerbose(e.target.checked)}
             data-test-subj="verboseOutputToggle"
+            onChange={async (e) => {
+              const isVerbose = e.target.checked;
+              setIsVerboseEnabled(isVerbose);
+
+              await handleTestPipeline({ documents: cachedDocuments!, verbose: isVerbose });
+            }}
           />
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
           <EuiButton
             size="s"
-            onClick={() =>
-              handleTestPipeline({ documents: cachedDocuments!, verbose: isVerboseEnabled })
+            onClick={async () =>
+              await handleTestPipeline(
+                { documents: cachedDocuments!, verbose: isVerboseEnabled },
+                true
+              )
             }
             iconType="refresh"
             data-test-subj="refreshOutputButton"
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/test_pipeline_tabs.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/test_pipeline_tabs.tsx
index abfb86c2afda1..b13fb2df90984 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/test_pipeline_tabs.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/test_pipeline/test_pipeline_flyout_tabs/test_pipeline_tabs.tsx
@@ -13,14 +13,9 @@ export type TestPipelineFlyoutTab = 'documents' | 'output';
 interface Props {
   onTabChange: (tab: TestPipelineFlyoutTab) => void;
   selectedTab: TestPipelineFlyoutTab;
-  getIsDisabled: (tab: TestPipelineFlyoutTab) => boolean;
 }
 
-export const Tabs: React.FunctionComponent<Props> = ({
-  onTabChange,
-  selectedTab,
-  getIsDisabled,
-}) => {
+export const Tabs: React.FunctionComponent<Props> = ({ onTabChange, selectedTab }) => {
   const tabs: Array<{
     id: TestPipelineFlyoutTab;
     name: React.ReactNode;
@@ -29,8 +24,8 @@ export const Tabs: React.FunctionComponent<Props> = ({
       id: 'documents',
       name: (
         <FormattedMessage
-          id="xpack.ingestPipelines.tabs.configurationTabTitle"
-          defaultMessage="Configuration"
+          id="xpack.ingestPipelines.tabs.documentsTabTitle"
+          defaultMessage="Documents"
         />
       ),
     },
@@ -49,7 +44,6 @@ export const Tabs: React.FunctionComponent<Props> = ({
           onClick={() => onTabChange(tab.id)}
           isSelected={tab.id === selectedTab}
           key={tab.id}
-          disabled={getIsDisabled(tab.id)}
           data-test-subj={tab.id.toLowerCase() + 'Tab'}
         >
           {tab.name}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/processors_context.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/processors_context.tsx
index 8c59d484acd08..6595437c01810 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/processors_context.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/processors_context.tsx
@@ -38,7 +38,7 @@ import { OnActionHandler } from '../components/processors_tree';
 import {
   ProcessorRemoveModal,
   PipelineProcessorsItemTooltip,
-  ManageProcessorForm,
+  ProcessorForm,
   OnSubmitHandler,
 } from '../components';
 
@@ -159,12 +159,12 @@ export const PipelineProcessorsContextProvider: FunctionComponent<Props> = ({
               selector: mode.arg.selector,
             },
           });
+
           break;
         default:
       }
-      setMode({ id: 'idle' });
     },
-    [processorsDispatch, mode, setMode]
+    [processorsDispatch, mode]
   );
 
   const onCloseSettingsForm = useCallback(() => {
@@ -208,8 +208,8 @@ export const PipelineProcessorsContextProvider: FunctionComponent<Props> = ({
     };
   }, [mode, setMode, processorsState, processorsDispatch]);
 
-  // Update the test output whenever the processorsState changes (e.g., on move, update, delete)
-  // Note: updateTestOutputPerProcessor() will only simulate if the user has added sample documents
+  // Make a request to the simulate API and update the processor output
+  // whenever the documents or processorsState changes (e.g., on move, update, delete)
   useEffect(() => {
     updateTestOutputPerProcessor(documents, processorsState);
   }, [documents, processorsState, updateTestOutputPerProcessor]);
@@ -233,7 +233,7 @@ export const PipelineProcessorsContextProvider: FunctionComponent<Props> = ({
       )}
 
       {mode.id === 'managingProcessor' || mode.id === 'creatingProcessor' ? (
-        <ManageProcessorForm
+        <ProcessorForm
           isOnFailure={isOnFailureSelector(mode.arg.selector)}
           processor={mode.id === 'managingProcessor' ? mode.arg.processor : undefined}
           onOpen={onFlyoutOpen}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/test_pipeline_context.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/test_pipeline_context.tsx
index f764f403de79b..9aafeafa10b27 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/test_pipeline_context.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context/test_pipeline_context.tsx
@@ -5,6 +5,8 @@
  */
 
 import React, { useCallback, useContext, useReducer, Reducer } from 'react';
+import { i18n } from '@kbn/i18n';
+
 import { useKibana } from '../../../../shared_imports';
 import {
   DeserializedProcessorResult,
@@ -161,6 +163,12 @@ export const TestPipelineContextProvider = ({ children }: { children: React.Reac
           },
         });
 
+        services.notifications.toasts.addError(error, {
+          title: i18n.translate('xpack.ingestPipelines.testPipeline.errorNotificationText', {
+            defaultMessage: 'Error executing pipeline',
+          }),
+        });
+
         return;
       }
 
@@ -172,7 +180,7 @@ export const TestPipelineContextProvider = ({ children }: { children: React.Reac
         },
       });
     },
-    [services.api]
+    [services.api, services.notifications.toasts]
   );
 
   return (
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/deserialize.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/deserialize.ts
index 50f35becc52ba..987bf323f6c25 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/deserialize.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/deserialize.ts
@@ -5,7 +5,13 @@
  */
 import uuid from 'uuid';
 import { Processor } from '../../../../common/types';
-import { ProcessorInternal, VerboseTestOutput, ProcessorResult } from './types';
+import {
+  ProcessorInternal,
+  VerboseTestOutput,
+  Document,
+  ProcessorResult,
+  ProcessorResults,
+} from './types';
 
 export interface DeserializeArgs {
   processors: Processor[];
@@ -62,6 +68,33 @@ export const deserialize = ({ processors, onFailure }: DeserializeArgs): Deseria
 export interface DeserializedProcessorResult {
   [key: string]: ProcessorResult;
 }
+
+/**
+ * Find the previous state of the sample document in the pipeline
+ * This typically will be the result from the previous processor
+ * unless the previous processor had a "skipped" status
+ */
+const getProcessorInput = (
+  processorIndex: number,
+  document: ProcessorResults,
+  count = 1
+): Document | undefined => {
+  const previousProcessorIndex = processorIndex - count;
+
+  if (previousProcessorIndex >= 0) {
+    const processorResult = document.processor_results[previousProcessorIndex];
+
+    if (!processorResult.doc) {
+      const newCount = count + 1;
+      return getProcessorInput(processorIndex, document, newCount);
+    }
+
+    return processorResult.doc;
+  }
+
+  return undefined;
+};
+
 /**
  * This function takes the verbose response of the simulate API
  * and maps the results to each processor in the pipeline by the "tag" field
@@ -81,11 +114,9 @@ export const deserializeVerboseTestOutput = (
         const result = { ...currentResult };
         const resultId = result.tag;
 
+        // We skip index 0, as the first processor will not have a previous result
         if (index !== 0) {
-          // Add the result from the previous processor so that the user
-          // can easily compare current output to the previous output
-          // This may be a result from an on_failure processor
-          result.prevProcessorResult = doc.processor_results[index - 1];
+          result.processorInput = getProcessorInput(index, doc);
         }
 
         // The tag is added programatically as a way to map
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/index.ts
index 71b2e2fa8f7f1..c462b19c79327 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/index.ts
@@ -14,9 +14,4 @@ export { OnUpdateHandlerArg, OnUpdateHandler } from './types';
 
 export { SerializeResult } from './serialize';
 
-export {
-  LoadFromJsonButton,
-  OnDoneLoadJsonHandler,
-  TestPipelineActions,
-  DocumentsDropdown,
-} from './components';
+export { LoadFromJsonButton, OnDoneLoadJsonHandler, TestPipelineActions } from './components';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/types.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/types.ts
index 5229f5eb0bb21..42201b3102c28 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/types.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/types.ts
@@ -94,7 +94,7 @@ export interface ProcessorResult {
   tag: string;
   ignored_error?: any;
   error?: any;
-  prevProcessorResult?: ProcessorResult;
+  processorInput?: Document;
   [key: string]: any;
 }
 
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
index f1dc3fa306d15..e6503cb793a8e 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
@@ -338,7 +338,6 @@ export function SuggestionPanel({
                 if (lastSelectedSuggestion === index) {
                   rollbackToCurrentVisualization();
                 } else {
-                  trackSuggestionEvent(`position_${index}_of_${suggestions.length}`);
                   setLastSelectedSuggestion(index);
                   switchToSuggestion(dispatch, suggestion);
                 }
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx
index 98e9389a85819..153757ac37da1 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_editor.tsx
@@ -213,9 +213,6 @@ export function DimensionEditor(props: DimensionEditorProps) {
             previousColumn: selectedColumn,
           });
 
-          trackUiEvent(
-            `indexpattern_dimension_operation_from_${selectedColumn.operationType}_to_${operationType}`
-          );
           setState(
             changeColumn({
               state,
diff --git a/x-pack/plugins/licensing/public/services/feature_usage_service.test.ts b/x-pack/plugins/licensing/public/services/feature_usage_service.test.ts
index eba2d1e67b509..faefb1501376d 100644
--- a/x-pack/plugins/licensing/public/services/feature_usage_service.test.ts
+++ b/x-pack/plugins/licensing/public/services/feature_usage_service.test.ts
@@ -29,6 +29,13 @@ describe('FeatureUsageService', () => {
           }),
         });
       });
+
+      it('does not call endpoint if on anonymous path', async () => {
+        http.anonymousPaths.isAnonymous.mockReturnValue(true);
+        const setup = service.setup({ http });
+        await setup.register('my-feature', 'platinum');
+        expect(http.post).not.toHaveBeenCalled();
+      });
     });
   });
 
@@ -64,6 +71,14 @@ describe('FeatureUsageService', () => {
           }),
         });
       });
+
+      it('does not call endpoint if on anonymous path', async () => {
+        http.anonymousPaths.isAnonymous.mockReturnValue(true);
+        service.setup({ http });
+        const start = service.start({ http });
+        await start.notifyUsage('my-feature', 42);
+        expect(http.post).not.toHaveBeenCalled();
+      });
     });
   });
 });
diff --git a/x-pack/plugins/licensing/public/services/feature_usage_service.ts b/x-pack/plugins/licensing/public/services/feature_usage_service.ts
index 588d22eeb818d..c076bff58359f 100644
--- a/x-pack/plugins/licensing/public/services/feature_usage_service.ts
+++ b/x-pack/plugins/licensing/public/services/feature_usage_service.ts
@@ -42,6 +42,11 @@ export class FeatureUsageService {
   public setup({ http }: SetupDeps): FeatureUsageServiceSetup {
     return {
       register: async (featureName, licenseType) => {
+        // Skip registration if on logged-out page
+        // NOTE: this only works because the login page does a full-page refresh after logging in
+        // If this is ever changed, this code will need to buffer registrations and call them after the user logs in.
+        if (http.anonymousPaths.isAnonymous(window.location.pathname)) return;
+
         await http.post('/internal/licensing/feature_usage/register', {
           body: JSON.stringify({
             featureName,
@@ -55,6 +60,9 @@ export class FeatureUsageService {
   public start({ http }: StartDeps): FeatureUsageServiceStart {
     return {
       notifyUsage: async (featureName, usedAt = Date.now()) => {
+        // Skip notification if on logged-out page
+        if (http.anonymousPaths.isAnonymous(window.location.pathname)) return;
+
         const lastUsed = isDate(usedAt) ? usedAt.getTime() : usedAt;
         await http.post('/internal/licensing/feature_usage/notify', {
           body: JSON.stringify({
diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index 3589ec41e4db3..d72d04d2a1843 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -263,3 +263,7 @@ export enum MB_LOOKUP_FUNCTION {
   GET = 'get',
   FEATURE_STATE = 'feature-state',
 }
+
+export type RawValue = string | number | boolean | undefined | null;
+
+export type FieldFormatter = (value: RawValue) => string | number;
diff --git a/x-pack/plugins/maps/public/classes/sources/source.ts b/x-pack/plugins/maps/public/classes/sources/source.ts
index 4a050cc3d7d19..7e7a7bd8f049d 100644
--- a/x-pack/plugins/maps/public/classes/sources/source.ts
+++ b/x-pack/plugins/maps/public/classes/sources/source.ts
@@ -12,7 +12,7 @@ import { Adapters } from 'src/plugins/inspector/public';
 import { copyPersistentState } from '../../reducers/util';
 
 import { IField } from '../fields/field';
-import { MAX_ZOOM, MIN_ZOOM } from '../../../common/constants';
+import { FieldFormatter, MAX_ZOOM, MIN_ZOOM } from '../../../common/constants';
 import { AbstractSourceDescriptor } from '../../../common/descriptor_types';
 import { OnSourceChangeArgs } from '../../connected_components/layer_panel/view';
 
@@ -37,8 +37,6 @@ export type PreIndexedShape = {
   path: string;
 };
 
-export type FieldFormatter = (value: string | number | null | undefined | boolean) => string;
-
 export interface ISource {
   destroy(): void;
   getDisplayName(): Promise<string>;
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx
index de8f3b5c09175..c9188a0a19b0d 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_color_property.test.tsx
@@ -15,7 +15,7 @@ import { shallow } from 'enzyme';
 import { Feature, Point } from 'geojson';
 
 import { DynamicColorProperty } from './dynamic_color_property';
-import { COLOR_MAP_TYPE, VECTOR_STYLES } from '../../../../../common/constants';
+import { COLOR_MAP_TYPE, RawValue, VECTOR_STYLES } from '../../../../../common/constants';
 import { mockField, MockLayer, MockStyle } from './__tests__/test_util';
 import { ColorDynamicOptions } from '../../../../../common/descriptor_types';
 import { IVectorLayer } from '../../../layers/vector_layer/vector_layer';
@@ -28,7 +28,7 @@ const makeProperty = (options: ColorDynamicOptions, style?: MockStyle, field?: I
     field ? field : mockField,
     (new MockLayer(style ? style : new MockStyle()) as unknown) as IVectorLayer,
     () => {
-      return (value: string | number | undefined) => value + '_format';
+      return (value: RawValue) => value + '_format';
     }
   );
 };
@@ -273,7 +273,7 @@ describe('supportsFieldMeta', () => {
       null,
       (new MockLayer(new MockStyle()) as unknown) as IVectorLayer,
       () => {
-        return (value: string | number | undefined) => value + '_format';
+        return (value: RawValue) => value + '_format';
       }
     );
 
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
index 06987ab8bcc48..2f9e4709c1c0b 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_icon_property.test.tsx
@@ -13,7 +13,7 @@ jest.mock('../components/vector_style_editor', () => ({
 }));
 
 import React from 'react';
-import { VECTOR_STYLES } from '../../../../../common/constants';
+import { RawValue, VECTOR_STYLES } from '../../../../../common/constants';
 // @ts-ignore
 import { DynamicIconProperty } from './dynamic_icon_property';
 import { mockField, MockLayer } from './__tests__/test_util';
@@ -33,7 +33,7 @@ const makeProperty = (options: Partial<IconDynamicOptions>, field: IField = mock
     field,
     mockVectorLayer,
     () => {
-      return (value: string | number | undefined) => value + '_format';
+      return (value: RawValue) => value + '_format';
     }
   );
 };
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_orientation_property.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_orientation_property.ts
index dd976027a50f2..192fa1f4db6e0 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_orientation_property.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_orientation_property.ts
@@ -5,25 +5,29 @@
  */
 
 import { Map as MbMap } from 'mapbox-gl';
-import { DynamicStyleProperty } from './dynamic_style_property';
-import { getComputedFieldName } from '../style_util';
-import { VECTOR_STYLES } from '../../../../../common/constants';
+import { DynamicStyleProperty, getNumericalMbFeatureStateValue } from './dynamic_style_property';
 import { OrientationDynamicOptions } from '../../../../../common/descriptor_types';
+import { RawValue } from '../../../../../common/constants';
 
 export class DynamicOrientationProperty extends DynamicStyleProperty<OrientationDynamicOptions> {
   syncIconRotationWithMb(symbolLayerId: string, mbMap: MbMap) {
     if (this._field && this._field.isValid()) {
-      const targetName = this._field.supportsAutoDomain()
-        ? getComputedFieldName(VECTOR_STYLES.ICON_ORIENTATION, this.getFieldName())
-        : this._field.getName();
-      // Using property state instead of feature-state because layout properties do not support feature-state
-      mbMap.setLayoutProperty(symbolLayerId, 'icon-rotate', ['coalesce', ['get', targetName], 0]);
+      const targetName = this.getMbPropertyName();
+      mbMap.setLayoutProperty(symbolLayerId, 'icon-rotate', [
+        'coalesce',
+        [this.getMbLookupFunction(), targetName],
+        0,
+      ]);
     } else {
       mbMap.setLayoutProperty(symbolLayerId, 'icon-rotate', 0);
     }
   }
 
-  supportsMbFeatureState() {
+  supportsMbFeatureState(): boolean {
     return false;
   }
+
+  getMbPropertyValue(rawValue: RawValue): RawValue {
+    return getNumericalMbFeatureStateValue(rawValue);
+  }
 }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx
index c5298067f6cbe..b4244cf7829c4 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.test.tsx
@@ -15,7 +15,7 @@ import { shallow } from 'enzyme';
 
 // @ts-ignore
 import { DynamicSizeProperty } from './dynamic_size_property';
-import { VECTOR_STYLES } from '../../../../../common/constants';
+import { RawValue, VECTOR_STYLES } from '../../../../../common/constants';
 import { IField } from '../../../fields/field';
 import { Map as MbMap } from 'mapbox-gl';
 import { SizeDynamicOptions } from '../../../../../common/descriptor_types';
@@ -48,7 +48,7 @@ const makeProperty = (
     field,
     (new MockLayer(mockStyle) as unknown) as IVectorLayer,
     () => {
-      return (value: string | number | undefined) => value + '_format';
+      return (value: RawValue) => value + '_format';
     },
     false
   );
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.tsx
index 35c830f3cb5e3..4e75a61539ad9 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_size_property.tsx
@@ -7,7 +7,7 @@
 import _ from 'lodash';
 import React from 'react';
 import { Map as MbMap } from 'mapbox-gl';
-import { DynamicStyleProperty, FieldFormatter } from './dynamic_style_property';
+import { DynamicStyleProperty } from './dynamic_style_property';
 import { OrdinalLegend } from '../components/legend/ordinal_legend';
 import { makeMbClampedNumberExpression } from '../style_util';
 import {
@@ -16,7 +16,7 @@ import {
   SMALL_MAKI_ICON_SIZE,
   // @ts-expect-error
 } from '../symbol_utils';
-import { MB_LOOKUP_FUNCTION, VECTOR_STYLES } from '../../../../../common/constants';
+import { FieldFormatter, MB_LOOKUP_FUNCTION, VECTOR_STYLES } from '../../../../../common/constants';
 import { SizeDynamicOptions } from '../../../../../common/descriptor_types';
 import { IField } from '../../../fields/field';
 import { IVectorLayer } from '../../../layers/vector_layer/vector_layer';
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
index f6ab052497723..2bc819daeea90 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
@@ -15,6 +15,8 @@ import {
   SOURCE_META_DATA_REQUEST_ID,
   STYLE_TYPE,
   VECTOR_STYLES,
+  RawValue,
+  FieldFormatter,
 } from '../../../../../common/constants';
 import { OrdinalFieldMetaPopover } from '../components/field_meta/ordinal_field_meta_popover';
 import { CategoricalFieldMetaPopover } from '../components/field_meta/categorical_field_meta_popover';
@@ -28,6 +30,7 @@ import { IField } from '../../../fields/field';
 import { IVectorLayer } from '../../../layers/vector_layer/vector_layer';
 import { IJoin } from '../../../joins/join';
 import { IVectorStyle } from '../vector_style';
+import { getComputedFieldName } from '../style_util';
 
 export interface IDynamicStyleProperty<T> extends IStyleProperty<T> {
   getFieldMetaOptions(): FieldMetaOptions;
@@ -46,9 +49,16 @@ export interface IDynamicStyleProperty<T> extends IStyleProperty<T> {
   pluckOrdinalStyleMetaFromFeatures(features: Feature[]): RangeFieldMeta | null;
   pluckCategoricalStyleMetaFromFeatures(features: Feature[]): CategoryFieldMeta | null;
   getValueSuggestions(query: string): Promise<string[]>;
-}
 
-export type FieldFormatter = (value: string | number | undefined) => string | number;
+  // Returns the name that should be used for accessing the data from the mb-style rule
+  // Depending on
+  // - whether the field is used for labeling, icon-orientation, or other properties (color, size, ...), `feature-state` and or `get` is used
+  // - whether the field was run through a field-formatter, a new dynamic field is created with the formatted-value
+  // The combination of both will inform what field-name (e.g. the "raw" field name from the properties, the "computed field-name" for an on-the-fly created property (e.g. for feature-state or field-formatting).
+  // todo: There is an existing limitation to .mvt backed sources, where the field-formatters are not applied. Here, the raw-data needs to be accessed.
+  getMbPropertyName(): string;
+  getMbPropertyValue(value: RawValue): RawValue;
+}
 
 export class DynamicStyleProperty<T>
   extends AbstractStyleProperty<T>
@@ -313,7 +323,7 @@ export class DynamicStyleProperty<T>
     };
   }
 
-  formatField(value: string | number | undefined): string | number {
+  formatField(value: RawValue): string | number {
     if (this.getField()) {
       const fieldName = this.getFieldName();
       const fieldFormatter = this._getFieldFormatter(fieldName);
@@ -345,4 +355,43 @@ export class DynamicStyleProperty<T>
       />
     );
   }
+
+  getMbPropertyName() {
+    if (!this._field) {
+      return '';
+    }
+
+    let targetName;
+    if (this.supportsMbFeatureState()) {
+      // Base case for any properties that can support feature-state (e.g. color, size, ...)
+      // They just re-use the original property-name
+      targetName = this._field.getName();
+    } else {
+      if (this._field.canReadFromGeoJson() && this._field.supportsAutoDomain()) {
+        // Geojson-sources can support rewrite
+        // e.g. field-formatters will create duplicate field
+        targetName = getComputedFieldName(this.getStyleName(), this._field.getName());
+      } else {
+        // Non-geojson sources (e.g. 3rd party mvt or ES-source as mvt)
+        targetName = this._field.getName();
+      }
+    }
+    return targetName;
+  }
+
+  getMbPropertyValue(rawValue: RawValue): RawValue {
+    // Maps only uses feature-state for numerical values.
+    // `supportsMbFeatureState` will only return true when the mb-style rule does a feature-state lookup on a numerical value
+    // Calling `isOrdinal` would be equivalent.
+    return this.supportsMbFeatureState() ? getNumericalMbFeatureStateValue(rawValue) : rawValue;
+  }
+}
+
+export function getNumericalMbFeatureStateValue(value: RawValue) {
+  if (typeof value !== 'string') {
+    return value;
+  }
+
+  const valueAsFloat = parseFloat(value);
+  return isNaN(valueAsFloat) ? null : valueAsFloat;
 }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts
index d55a6e1cfb444..ec79d71eb7587 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_text_property.ts
@@ -6,18 +6,18 @@
 
 import { Map as MbMap } from 'mapbox-gl';
 import { DynamicStyleProperty } from './dynamic_style_property';
-import { getComputedFieldName } from '../style_util';
 import { LabelDynamicOptions } from '../../../../../common/descriptor_types';
+import { RawValue } from '../../../../../common/constants';
 
 export class DynamicTextProperty extends DynamicStyleProperty<LabelDynamicOptions> {
   syncTextFieldWithMb(mbLayerId: string, mbMap: MbMap) {
     if (this._field && this._field.isValid()) {
-      // Fields that support auto-domain are normalized with a field-formatter and stored into a computed-field
-      // Otherwise, the raw value is just carried over and no computed field is created.
-      const targetName = this._field.supportsAutoDomain()
-        ? getComputedFieldName(this._styleName, this.getFieldName())
-        : this._field.getName();
-      mbMap.setLayoutProperty(mbLayerId, 'text-field', ['coalesce', ['get', targetName], '']);
+      const targetName = this.getMbPropertyName();
+      mbMap.setLayoutProperty(mbLayerId, 'text-field', [
+        'coalesce',
+        [this.getMbLookupFunction(), targetName],
+        '',
+      ]);
     } else {
       mbMap.setLayoutProperty(mbLayerId, 'text-field', null);
     }
@@ -34,4 +34,8 @@ export class DynamicTextProperty extends DynamicStyleProperty<LabelDynamicOption
   supportsMbFeatureState() {
     return false;
   }
+
+  getMbPropertyValue(rawValue: RawValue): RawValue {
+    return this.formatField(rawValue);
+  }
 }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts b/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
index ec52f6a0f7283..20e0bb5465561 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/style_property.ts
@@ -9,7 +9,7 @@ import { ReactElement } from 'react';
 // @ts-ignore
 import { getVectorStyleLabel } from '../components/get_vector_style_label';
 import { FieldMetaOptions } from '../../../../../common/descriptor_types';
-import { VECTOR_STYLES } from '../../../../../common/constants';
+import { RawValue, VECTOR_STYLES } from '../../../../../common/constants';
 
 export type LegendProps = {
   isPointsOnly: boolean;
@@ -20,7 +20,7 @@ export type LegendProps = {
 export interface IStyleProperty<T> {
   isDynamic(): boolean;
   isComplete(): boolean;
-  formatField(value: string | number | undefined): string | number;
+  formatField(value: RawValue): string | number;
   getStyleName(): VECTOR_STYLES;
   getOptions(): T;
   renderLegendDetailRow(legendProps: LegendProps): ReactElement<any> | null;
@@ -53,9 +53,14 @@ export class AbstractStyleProperty<T> implements IStyleProperty<T> {
     return true;
   }
 
-  formatField(value: string | number | undefined): string | number {
-    // eslint-disable-next-line eqeqeq
-    return value == undefined ? '' : value;
+  formatField(value: RawValue): string | number {
+    if (typeof value === 'undefined' || value === null) {
+      return '';
+    } else if (typeof value === 'boolean') {
+      return value.toString();
+    } else {
+      return value;
+    }
   }
 
   getStyleName(): VECTOR_STYLES {
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx
index 956522524a2eb..1244c53afe9a6 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx
@@ -29,7 +29,7 @@ import {
 import { StyleMeta } from './style_meta';
 import { VectorIcon } from './components/legend/vector_icon';
 import { VectorStyleLegend } from './components/legend/vector_style_legend';
-import { getComputedFieldName, isOnlySingleFeatureType } from './style_util';
+import { isOnlySingleFeatureType } from './style_util';
 import { StaticStyleProperty } from './properties/static_style_property';
 import { DynamicStyleProperty } from './properties/dynamic_style_property';
 import { DynamicSizeProperty } from './properties/dynamic_size_property';
@@ -82,11 +82,6 @@ const POINTS = [GEO_JSON_TYPE.POINT, GEO_JSON_TYPE.MULTI_POINT];
 const LINES = [GEO_JSON_TYPE.LINE_STRING, GEO_JSON_TYPE.MULTI_LINE_STRING];
 const POLYGONS = [GEO_JSON_TYPE.POLYGON, GEO_JSON_TYPE.MULTI_POLYGON];
 
-function getNumericalMbFeatureStateValue(value: string) {
-  const valueAsFloat = parseFloat(value);
-  return isNaN(valueAsFloat) ? null : valueAsFloat;
-}
-
 export interface IVectorStyle extends IStyle {
   getAllStyleProperties(): Array<IStyleProperty<StylePropertyOptions>>;
   getDynamicPropertiesArray(): Array<IDynamicStyleProperty<DynamicStylePropertyOptions>>;
@@ -618,21 +613,17 @@ export class VectorStyle implements IVectorStyle {
 
       for (let j = 0; j < dynamicStyleProps.length; j++) {
         const dynamicStyleProp = dynamicStyleProps[j];
-        const name = dynamicStyleProp.getFieldName();
-        const computedName = getComputedFieldName(dynamicStyleProp.getStyleName(), name);
-        const rawValue = feature.properties ? feature.properties[name] : undefined;
+        const targetMbName = dynamicStyleProp.getMbPropertyName();
+        const rawValue = feature.properties
+          ? feature.properties[dynamicStyleProp.getFieldName()]
+          : undefined;
+        const targetMbValue = dynamicStyleProp.getMbPropertyValue(rawValue);
         if (dynamicStyleProp.supportsMbFeatureState()) {
-          tmpFeatureState[name] = getNumericalMbFeatureStateValue(rawValue); // the same value will be potentially overridden multiple times, if the name remains identical
+          tmpFeatureState[targetMbName] = targetMbValue; // the same value will be potentially overridden multiple times, if the name remains identical
         } else {
-          // in practice, a new system property will only be created for:
-          // - label text: this requires the value to be formatted first.
-          // - icon orientation: this is a lay-out property which do not support feature-state (but we're still coercing to a number)
-
-          const formattedValue = dynamicStyleProp.isOrdinal()
-            ? getNumericalMbFeatureStateValue(rawValue)
-            : dynamicStyleProp.formatField(rawValue);
-
-          if (feature.properties) feature.properties[computedName] = formattedValue;
+          if (feature.properties) {
+            feature.properties[targetMbName] = targetMbValue;
+          }
         }
       }
       tmpFeatureIdentifier.source = mbSourceId;
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/field_stats_card.js b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/field_stats_card.js
index 988fb653dd1ad..e68d73fc6acfa 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/field_stats_card.js
+++ b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/field_stats_card.js
@@ -26,7 +26,7 @@ export function FieldStatsCard({ field }) {
 
   return (
     <EuiPanel hasShadow={false} className="mlFieldDataCard">
-      <div className="ml-field-data-card">
+      <div className="ml-field-data-card" data-test-subj="mlPageFileDataVisFieldDataCard">
         <div className={`ml-field-title-bar ${type}`}>
           <FieldTypeIcon type={type} needsAria={false} />
           <div className="field-name" tabIndex="0" aria-label={`${cardTitleAriaLabel.join(', ')}`}>
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/fields_stats.js b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/fields_stats.js
index 9e83f72d7a07b..785dd7db260fc 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/fields_stats.js
+++ b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/fields_stats.js
@@ -50,14 +50,14 @@ function createFields(results) {
     timestamp_field: timestampField,
   } = results;
 
-  if (mappings && fieldStats) {
+  if (mappings && mappings.properties && fieldStats) {
     const fieldNames = getFieldNames(results);
 
     return fieldNames.map((name) => {
       if (fieldStats[name] !== undefined) {
         const field = { name };
         const f = fieldStats[name];
-        const m = mappings[name];
+        const m = mappings.properties[name];
 
         // sometimes the timestamp field is not in the mappings, and so our
         // collection of fields will be missing a time field with a type of date
@@ -93,7 +93,7 @@ function createFields(results) {
         // this could be the message field for a semi-structured log file or a
         // field which the endpoint has not been able to work out any information for
         const type =
-          mappings[name] && mappings[name].type === ML_JOB_FIELD_TYPES.TEXT
+          mappings.properties[name] && mappings.properties[name].type === ML_JOB_FIELD_TYPES.TEXT
             ? ML_JOB_FIELD_TYPES.TEXT
             : ML_JOB_FIELD_TYPES.UNKNOWN;
 
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/get_field_names.js b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/get_field_names.js
index 28764bbbd246d..c423dc3c63e39 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/get_field_names.js
+++ b/x-pack/plugins/ml/public/application/datavisualizer/file_based/components/fields_stats/get_field_names.js
@@ -16,7 +16,7 @@ export function getFieldNames(results) {
   // there may be fields in the mappings which do not exist in the field_stats
   // e.g. the message field for a semi-structured log file, as they have no stats.
   // add any extra fields to the list
-  const differenceFields = difference(Object.keys(mappings), tempFields);
+  const differenceFields = difference(Object.keys(mappings.properties), tempFields);
 
   // except @timestamp
   const timestampIndex = differenceFields.indexOf('@timestamp');
diff --git a/x-pack/plugins/monitoring/server/config.test.ts b/x-pack/plugins/monitoring/server/config.test.ts
index 2efc325a3edec..f4ccb3f830af1 100644
--- a/x-pack/plugins/monitoring/server/config.test.ts
+++ b/x-pack/plugins/monitoring/server/config.test.ts
@@ -3,14 +3,22 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
+import fs from 'fs';
+import { when } from 'jest-when';
+
 import { createConfig, configSchema } from './config';
-jest.mock('fs', () => {
-  const original = jest.requireActual('fs');
 
-  return {
-    ...original,
-    readFileSync: jest.fn().mockImplementation((path: string) => `contents-of-${path}`),
-  };
+const MOCKED_PATHS = [
+  '/proc/self/cgroup',
+  'packages/kbn-dev-utils/certs/ca.crt',
+  'packages/kbn-dev-utils/certs/elasticsearch.crt',
+  'packages/kbn-dev-utils/certs/elasticsearch.key',
+];
+
+beforeEach(() => {
+  const spy = jest.spyOn(fs, 'readFileSync').mockImplementation();
+  MOCKED_PATHS.forEach((file) => when(spy).calledWith(file).mockReturnValue(`contents-of-${file}`));
 });
 
 describe('config schema', () => {
diff --git a/x-pack/plugins/security/server/authentication/providers/base.ts b/x-pack/plugins/security/server/authentication/providers/base.ts
index 631721b032752..7b2ad510db968 100644
--- a/x-pack/plugins/security/server/authentication/providers/base.ts
+++ b/x-pack/plugins/security/server/authentication/providers/base.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { deepFreeze } from '@kbn/std';
 import {
   KibanaRequest,
   Logger,
@@ -11,7 +12,6 @@ import {
   ILegacyClusterClient,
   Headers,
 } from '../../../../../../src/core/server';
-import { deepFreeze } from '../../../../../../src/core/server';
 import { AuthenticatedUser } from '../../../common/model';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
diff --git a/x-pack/plugins/security/server/plugin.ts b/x-pack/plugins/security/server/plugin.ts
index dc9139473004b..69b55fcb3d0a4 100644
--- a/x-pack/plugins/security/server/plugin.ts
+++ b/x-pack/plugins/security/server/plugin.ts
@@ -7,9 +7,9 @@
 import { combineLatest } from 'rxjs';
 import { first, map } from 'rxjs/operators';
 import { TypeOf } from '@kbn/config-schema';
+import { deepFreeze } from '@kbn/std';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import {
-  deepFreeze,
   CoreSetup,
   CoreStart,
   Logger,
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
index 498b561a818f2..f002e13a07cf1 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/common/schemas.ts
@@ -130,7 +130,7 @@ export type Query = t.TypeOf<typeof query>;
 export const queryOrUndefined = t.union([query, t.undefined]);
 export type QueryOrUndefined = t.TypeOf<typeof queryOrUndefined>;
 
-export const language = t.keyof({ kuery: null, lucene: null });
+export const language = t.keyof({ eql: null, kuery: null, lucene: null });
 export type Language = t.TypeOf<typeof language>;
 
 export const languageOrUndefined = t.union([language, t.undefined]);
@@ -294,6 +294,7 @@ export const toOrUndefined = t.union([to, t.undefined]);
 export type ToOrUndefined = t.TypeOf<typeof toOrUndefined>;
 
 export const type = t.keyof({
+  eql: null,
   machine_learning: null,
   query: null,
   saved_query: null,
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts
index 6a51f724fc9e6..c244b9aca9ad0 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/add_prepackaged_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { AddPrepackagedRulesSchema } from './add_prepackaged_rules_schema';
 
 export const validateAnomalyThreshold = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: AddPrepackagedRulesSchema): strin
 };
 
 export const validateQuery = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: AddPrepackagedRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: AddPrepackagedRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -93,7 +95,7 @@ export const validateTimelineTitle = (rule: AddPrepackagedRulesSchema): string[]
 };
 
 export const validateThreshold = (rule: AddPrepackagedRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts
index af665ff8c81d2..91b14fa9b999c 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/create_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { CreateRulesSchema } from './create_rules_schema';
 
 export const validateAnomalyThreshold = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateQuery = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -93,7 +95,7 @@ export const validateTimelineTitle = (rule: CreateRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: CreateRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts
index 269181449e9e9..87264d84fd73a 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/import_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { ImportRulesSchema } from './import_rules_schema';
 
 export const validateAnomalyThreshold = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateQuery = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -93,7 +95,7 @@ export const validateTimelineTitle = (rule: ImportRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: ImportRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts
index a229771a7c05c..c974f73926c21 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/patch_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { PatchRulesSchema } from './patch_rules_schema';
 
 export const validateQuery = (rule: PatchRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -19,7 +21,7 @@ export const validateQuery = (rule: PatchRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: PatchRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -67,7 +69,7 @@ export const validateId = (rule: PatchRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: PatchRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts
index 44182d250c801..5f297fb9688fc 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/request/update_rules_type_dependents.ts
@@ -4,10 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import { UpdateRulesSchema } from './update_rules_schema';
 
 export const validateAnomalyThreshold = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.anomaly_threshold == null) {
       return ['when "type" is "machine_learning" anomaly_threshold is required'];
     } else {
@@ -19,7 +21,7 @@ export const validateAnomalyThreshold = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateQuery = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.query != null) {
       return ['when "type" is "machine_learning", "query" cannot be set'];
     } else {
@@ -31,7 +33,7 @@ export const validateQuery = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateLanguage = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.language != null) {
       return ['when "type" is "machine_learning", "language" cannot be set'];
     } else {
@@ -55,7 +57,7 @@ export const validateSavedId = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateMachineLearningJobId = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'machine_learning') {
+  if (isMlRule(rule.type)) {
     if (rule.machine_learning_job_id == null) {
       return ['when "type" is "machine_learning", "machine_learning_job_id" is required'];
     } else {
@@ -103,7 +105,7 @@ export const validateId = (rule: UpdateRulesSchema): string[] => {
 };
 
 export const validateThreshold = (rule: UpdateRulesSchema): string[] => {
-  if (rule.type === 'threshold') {
+  if (isThresholdRule(rule.type)) {
     if (!rule.threshold) {
       return ['when "type" is "threshold", "threshold" is required'];
     } else if (rule.threshold.value <= 0) {
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts
index b3f9096b51483..36fc063761840 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.test.ts
@@ -633,6 +633,16 @@ describe('rules_schema', () => {
       expect(fields.length).toEqual(2);
     });
 
+    test('should return two fields for a rule of type "eql"', () => {
+      const fields = addQueryFields({ type: 'eql' });
+      expect(fields.length).toEqual(2);
+    });
+
+    test('should return two fields for a rule of type "threshold"', () => {
+      const fields = addQueryFields({ type: 'threshold' });
+      expect(fields.length).toEqual(2);
+    });
+
     test('should return two fields for a rule of type "saved_query"', () => {
       const fields = addQueryFields({ type: 'saved_query' });
       expect(fields.length).toEqual(2);
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts
index 04df25d805f9e..c26a7efb0c288 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/rules_schema.ts
@@ -8,9 +8,9 @@ import * as t from 'io-ts';
 import { isObject } from 'lodash/fp';
 import { Either, left, fold } from 'fp-ts/lib/Either';
 import { pipe } from 'fp-ts/lib/pipeable';
-import { typeAndTimelineOnlySchema, TypeAndTimelineOnly } from './type_timeline_only_schema';
-import { isMlRule } from '../../../machine_learning/helpers';
 
+import { isMlRule } from '../../../machine_learning/helpers';
+import { isThresholdRule } from '../../utils';
 import {
   actions,
   anomaly_threshold,
@@ -66,6 +66,7 @@ import {
   DefaultRiskScoreMappingArray,
   DefaultSeverityMappingArray,
 } from '../types';
+import { typeAndTimelineOnlySchema, TypeAndTimelineOnly } from './type_timeline_only_schema';
 
 /**
  * This is the required fields for the rules schema response. Put all required properties on
@@ -205,7 +206,7 @@ export const addTimelineTitle = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mi
 };
 
 export const addQueryFields = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mixed[] => {
-  if (['query', 'saved_query', 'threshold'].includes(typeAndTimelineOnly.type)) {
+  if (['eql', 'query', 'saved_query', 'threshold'].includes(typeAndTimelineOnly.type)) {
     return [
       t.exact(t.type({ query: dependentRulesSchema.props.query })),
       t.exact(t.type({ language: dependentRulesSchema.props.language })),
@@ -229,7 +230,7 @@ export const addMlFields = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mixed[]
 };
 
 export const addThresholdFields = (typeAndTimelineOnly: TypeAndTimelineOnly): t.Mixed[] => {
-  if (typeAndTimelineOnly.type === 'threshold') {
+  if (isThresholdRule(typeAndTimelineOnly.type)) {
     return [
       t.exact(t.type({ threshold: dependentRulesSchema.props.threshold })),
       t.exact(t.partial({ saved_id: dependentRulesSchema.props.saved_id })),
diff --git a/x-pack/plugins/security_solution/common/detection_engine/utils.ts b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
index a72d641fbaf78..170d28cb5a725 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/utils.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/utils.ts
@@ -17,4 +17,6 @@ export const hasNestedEntry = (entries: EntriesArray): boolean => {
   return found.length > 0;
 };
 
-export const isThresholdRule = (ruleType: Type) => ruleType === 'threshold';
+export const isEqlRule = (ruleType: Type | undefined) => ruleType === 'eql';
+export const isThresholdRule = (ruleType: Type | undefined) => ruleType === 'threshold';
+export const isQueryRule = (ruleType: Type | undefined) => ruleType === 'query';
diff --git a/x-pack/plugins/security_solution/common/machine_learning/helpers.ts b/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
index 73dc30f238c7e..73b14afb5d0c9 100644
--- a/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
+++ b/x-pack/plugins/security_solution/common/machine_learning/helpers.ts
@@ -23,4 +23,4 @@ export const isJobFailed = (jobState: string, datafeedState: string): boolean =>
   return failureStates.includes(jobState) || failureStates.includes(datafeedState);
 };
 
-export const isMlRule = (ruleType: Type) => ruleType === 'machine_learning';
+export const isMlRule = (ruleType: Type | undefined) => ruleType === 'machine_learning';
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
index 35fcc3b07fd05..95f3cd4fd7da7 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
@@ -39,6 +39,17 @@ import {
   NetworkTopNFlowRequestOptions,
   NetworkUsersStrategyResponse,
   NetworkUsersRequestOptions,
+  NetworkKpiQueries,
+  NetworkKpiDnsStrategyResponse,
+  NetworkKpiDnsRequestOptions,
+  NetworkKpiNetworkEventsStrategyResponse,
+  NetworkKpiNetworkEventsRequestOptions,
+  NetworkKpiTlsHandshakesStrategyResponse,
+  NetworkKpiTlsHandshakesRequestOptions,
+  NetworkKpiUniqueFlowsStrategyResponse,
+  NetworkKpiUniqueFlowsRequestOptions,
+  NetworkKpiUniquePrivateIpsStrategyResponse,
+  NetworkKpiUniquePrivateIpsRequestOptions,
 } from './network';
 import {
   MatrixHistogramQuery,
@@ -57,7 +68,11 @@ export * from './hosts';
 export * from './matrix_histogram';
 export * from './network';
 
-export type FactoryQueryTypes = HostsQueries | NetworkQueries | typeof MatrixHistogramQuery;
+export type FactoryQueryTypes =
+  | HostsQueries
+  | NetworkQueries
+  | NetworkKpiQueries
+  | typeof MatrixHistogramQuery;
 
 export interface RequestBasicOptions extends IEsSearchRequest {
   timerange: TimerangeInput;
@@ -107,6 +122,16 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? NetworkTopNFlowStrategyResponse
   : T extends NetworkQueries.users
   ? NetworkUsersStrategyResponse
+  : T extends NetworkKpiQueries.dns
+  ? NetworkKpiDnsStrategyResponse
+  : T extends NetworkKpiQueries.networkEvents
+  ? NetworkKpiNetworkEventsStrategyResponse
+  : T extends NetworkKpiQueries.tlsHandshakes
+  ? NetworkKpiTlsHandshakesStrategyResponse
+  : T extends NetworkKpiQueries.uniqueFlows
+  ? NetworkKpiUniqueFlowsStrategyResponse
+  : T extends NetworkKpiQueries.uniquePrivateIps
+  ? NetworkKpiUniquePrivateIpsStrategyResponse
   : T extends typeof MatrixHistogramQuery
   ? MatrixHistogramStrategyResponse
   : never;
@@ -139,6 +164,16 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? NetworkTopNFlowRequestOptions
   : T extends NetworkQueries.users
   ? NetworkUsersRequestOptions
+  : T extends NetworkKpiQueries.dns
+  ? NetworkKpiDnsRequestOptions
+  : T extends NetworkKpiQueries.networkEvents
+  ? NetworkKpiNetworkEventsRequestOptions
+  : T extends NetworkKpiQueries.tlsHandshakes
+  ? NetworkKpiTlsHandshakesRequestOptions
+  : T extends NetworkKpiQueries.uniqueFlows
+  ? NetworkKpiUniqueFlowsRequestOptions
+  : T extends NetworkKpiQueries.uniquePrivateIps
+  ? NetworkKpiUniquePrivateIpsRequestOptions
   : T extends typeof MatrixHistogramQuery
   ? MatrixHistogramRequestOptions
   : never;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
index 4e73fe11ef430..19f90b2f57e7d 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
@@ -8,6 +8,7 @@ export * from './common';
 export * from './details';
 export * from './dns';
 export * from './http';
+export * from './kpi';
 export * from './overview';
 export * from './tls';
 export * from './top_countries';
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/dns/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/dns/index.ts
new file mode 100644
index 0000000000000..7c192de080e60
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/dns/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiDnsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiDnsStrategyResponse extends IEsSearchResponse {
+  dnsQueries: number;
+  inspect?: Maybe<Inspect>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/index.ts
new file mode 100644
index 0000000000000..e94ab030fbdb9
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/index.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './dns';
+export * from './network_events';
+export * from './tls_handshakes';
+export * from './unique_flows';
+export * from './unique_private_ips';
+
+import { NetworkKpiDnsStrategyResponse } from './dns';
+import { NetworkKpiNetworkEventsStrategyResponse } from './network_events';
+import { NetworkKpiTlsHandshakesStrategyResponse } from './tls_handshakes';
+import { NetworkKpiUniqueFlowsStrategyResponse } from './unique_flows';
+import { NetworkKpiUniquePrivateIpsStrategyResponse } from './unique_private_ips';
+
+export enum NetworkKpiQueries {
+  dns = 'networkKpiDns',
+  networkEvents = 'networkKpiNetworkEvents',
+  tlsHandshakes = 'networkKpiTlsHandshakes',
+  uniqueFlows = 'networkKpiUniqueFlows',
+  uniquePrivateIps = 'networkKpiUniquePrivateIps',
+}
+
+export type NetworkKpiStrategyResponse =
+  | Omit<NetworkKpiDnsStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiNetworkEventsStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiTlsHandshakesStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiUniqueFlowsStrategyResponse, 'rawResponse'>
+  | Omit<NetworkKpiUniquePrivateIpsStrategyResponse, 'rawResponse'>;
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/network_events/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/network_events/index.ts
new file mode 100644
index 0000000000000..dcccf8e7f3ac9
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/network_events/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiNetworkEventsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiNetworkEventsStrategyResponse extends IEsSearchResponse {
+  networkEvents: number;
+  inspect?: Maybe<Inspect>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/tls_handshakes/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/tls_handshakes/index.ts
new file mode 100644
index 0000000000000..216c57fdb6c3c
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/tls_handshakes/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiTlsHandshakesRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiTlsHandshakesStrategyResponse extends IEsSearchResponse {
+  tlsHandshakes: number;
+  inspect?: Maybe<Inspect>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_flows/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_flows/index.ts
new file mode 100644
index 0000000000000..dc7d36b7cd4af
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_flows/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export type NetworkKpiUniqueFlowsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiUniqueFlowsStrategyResponse extends IEsSearchResponse {
+  uniqueFlowId: number;
+  inspect?: Maybe<Inspect>;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_private_ips/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_private_ips/index.ts
new file mode 100644
index 0000000000000..ccf4d397ffd8f
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/kpi/unique_private_ips/index.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import { Inspect, Maybe } from '../../../../common';
+import { RequestBasicOptions } from '../../..';
+
+export interface NetworkKpiHistogramData {
+  x?: Maybe<number>;
+  y?: Maybe<number>;
+}
+
+export type NetworkKpiUniquePrivateIpsRequestOptions = RequestBasicOptions;
+
+export interface NetworkKpiUniquePrivateIpsStrategyResponse extends IEsSearchResponse {
+  uniqueSourcePrivateIps: number;
+  uniqueSourcePrivateIpsHistogram: NetworkKpiHistogramData[] | null;
+  uniqueDestinationPrivateIps: number;
+  uniqueDestinationPrivateIpsHistogram: NetworkKpiHistogramData[] | null;
+  inspect?: Maybe<Inspect>;
+}
+
+export type UniquePrivateAttributeQuery = 'source' | 'destination';
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
index d9d9fde8fc8cc..17ff1dad79960 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { newRule } from '../objects/rule';
+import { newRule, existingRule } from '../objects/rule';
 
 import {
   CUSTOM_RULES_BTN,
@@ -16,26 +16,16 @@ import {
   SHOWING_RULES_TEXT,
 } from '../screens/alerts_detection_rules';
 import {
-  ABOUT_FALSE_POSITIVES,
   ABOUT_INVESTIGATION_NOTES,
-  ABOUT_MITRE,
-  ABOUT_RISK,
   ABOUT_RULE_DESCRIPTION,
-  ABOUT_SEVERITY,
-  ABOUT_STEP,
-  ABOUT_TAGS,
-  ABOUT_URLS,
-  DEFINITION_CUSTOM_QUERY,
-  DEFINITION_INDEX_PATTERNS,
-  DEFINITION_TIMELINE,
-  DEFINITION_STEP,
   INVESTIGATION_NOTES_MARKDOWN,
   INVESTIGATION_NOTES_TOGGLE,
   RULE_ABOUT_DETAILS_HEADER_TOGGLE,
   RULE_NAME_HEADER,
-  SCHEDULE_LOOPBACK,
-  SCHEDULE_RUNS,
-  SCHEDULE_STEP,
+  getDescriptionForTitle,
+  ABOUT_DETAILS,
+  DEFINITION_DETAILS,
+  SCHEDULE_DETAILS,
 } from '../screens/rule_details';
 
 import {
@@ -53,18 +43,38 @@ import {
   selectNumberOfRules,
   waitForLoadElasticPrebuiltDetectionRulesTableToBeLoaded,
   waitForRulesToBeLoaded,
+  editFirstRule,
 } from '../tasks/alerts_detection_rules';
 import {
   createAndActivateRule,
   fillAboutRuleAndContinue,
   fillDefineCustomRuleWithImportedQueryAndContinue,
-  expectDefineFormToRepopulateAndContinue,
-  expectAboutFormToRepopulateAndContinue,
+  goToAboutStepTab,
+  goToScheduleStepTab,
+  goToActionsStepTab,
+  fillAboutRule,
 } from '../tasks/create_new_rule';
 import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
 
 import { DETECTIONS_URL } from '../urls/navigation';
+import {
+  ACTIONS_THROTTLE_INPUT,
+  CUSTOM_QUERY_INPUT,
+  DEFINE_INDEX_INPUT,
+  RULE_NAME_INPUT,
+  RULE_DESCRIPTION_INPUT,
+  TAGS_FIELD,
+  SEVERITY_DROPDOWN,
+  RISK_INPUT,
+  SCHEDULE_INTERVAL_AMOUNT_INPUT,
+  SCHEDULE_INTERVAL_UNITS_INPUT,
+  DEFINE_EDIT_BUTTON,
+  DEFINE_CONTINUE_BUTTON,
+  ABOUT_EDIT_BUTTON,
+  ABOUT_CONTINUE_BTN,
+} from '../screens/create_new_rule';
+import { saveEditedRule } from '../tasks/edit_rule';
 
 describe('Detection rules, custom', () => {
   before(() => {
@@ -84,8 +94,19 @@ describe('Detection rules, custom', () => {
     goToCreateNewRule();
     fillDefineCustomRuleWithImportedQueryAndContinue(newRule);
     fillAboutRuleAndContinue(newRule);
-    expectDefineFormToRepopulateAndContinue(newRule);
-    expectAboutFormToRepopulateAndContinue(newRule);
+
+    // expect define step to repopulate
+    cy.get(DEFINE_EDIT_BUTTON).click();
+    cy.get(CUSTOM_QUERY_INPUT).invoke('text').should('eq', newRule.customQuery);
+    cy.get(DEFINE_CONTINUE_BUTTON).should('exist').click({ force: true });
+    cy.get(DEFINE_CONTINUE_BUTTON).should('not.exist');
+
+    // expect about step to populate
+    cy.get(ABOUT_EDIT_BUTTON).click();
+    cy.get(RULE_NAME_INPUT).invoke('val').should('eq', newRule.name);
+    cy.get(ABOUT_CONTINUE_BTN).should('exist').click({ force: true });
+    cy.get(ABOUT_CONTINUE_BTN).should('not.exist');
+
     createAndActivateRule();
 
     cy.get(CUSTOM_RULES_BTN).invoke('text').should('eql', 'Custom rules (1)');
@@ -142,32 +163,35 @@ describe('Detection rules, custom', () => {
     cy.get(RULE_NAME_HEADER).invoke('text').should('eql', `${newRule.name} Beta`);
 
     cy.get(ABOUT_RULE_DESCRIPTION).invoke('text').should('eql', newRule.description);
-    cy.get(ABOUT_STEP).eq(ABOUT_SEVERITY).invoke('text').should('eql', newRule.severity);
-    cy.get(ABOUT_STEP).eq(ABOUT_RISK).invoke('text').should('eql', newRule.riskScore);
-    cy.get(ABOUT_STEP).eq(ABOUT_URLS).invoke('text').should('eql', expectedUrls);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_FALSE_POSITIVES)
-      .invoke('text')
-      .should('eql', expectedFalsePositives);
-    cy.get(ABOUT_STEP).eq(ABOUT_MITRE).invoke('text').should('eql', expectedMitre);
-    cy.get(ABOUT_STEP).eq(ABOUT_TAGS).invoke('text').should('eql', expectedTags);
+    cy.get(ABOUT_DETAILS).within(() => {
+      getDescriptionForTitle('Severity').invoke('text').should('eql', newRule.severity);
+      getDescriptionForTitle('Risk score').invoke('text').should('eql', newRule.riskScore);
+      getDescriptionForTitle('Reference URLs').invoke('text').should('eql', expectedUrls);
+      getDescriptionForTitle('False positive examples')
+        .invoke('text')
+        .should('eql', expectedFalsePositives);
+      getDescriptionForTitle('MITRE ATT&CK').invoke('text').should('eql', expectedMitre);
+      getDescriptionForTitle('Tags').invoke('text').should('eql', expectedTags);
+    });
 
     cy.get(RULE_ABOUT_DETAILS_HEADER_TOGGLE).eq(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
     cy.get(ABOUT_INVESTIGATION_NOTES).invoke('text').should('eql', INVESTIGATION_NOTES_MARKDOWN);
 
-    cy.get(DEFINITION_INDEX_PATTERNS).then((patterns) => {
-      cy.wrap(patterns).each((pattern, index) => {
-        cy.wrap(pattern).invoke('text').should('eql', expectedIndexPatterns[index]);
-      });
+    cy.get(DEFINITION_DETAILS).within(() => {
+      getDescriptionForTitle('Index patterns')
+        .invoke('text')
+        .should('eql', expectedIndexPatterns.join(''));
+      getDescriptionForTitle('Custom query')
+        .invoke('text')
+        .should('eql', `${newRule.customQuery} `);
+      getDescriptionForTitle('Rule type').invoke('text').should('eql', 'Query');
+      getDescriptionForTitle('Timeline template').invoke('text').should('eql', 'None');
+    });
+
+    cy.get(SCHEDULE_DETAILS).within(() => {
+      getDescriptionForTitle('Runs every').invoke('text').should('eql', '5m');
+      getDescriptionForTitle('Additional look-back time').invoke('text').should('eql', '1m');
     });
-    cy.get(DEFINITION_STEP)
-      .eq(DEFINITION_CUSTOM_QUERY)
-      .invoke('text')
-      .should('eql', `${newRule.customQuery} `);
-    cy.get(DEFINITION_STEP).eq(DEFINITION_TIMELINE).invoke('text').should('eql', 'None');
-
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_RUNS).invoke('text').should('eql', '5m');
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_LOOPBACK).invoke('text').should('eql', '1m');
   });
 });
 
@@ -233,4 +257,94 @@ describe('Deletes custom rules', () => {
           .should('eql', `Custom rules (${expectedNumberOfRulesAfterDeletion})`);
       });
   });
+
+  it('Allows a rule to be edited', () => {
+    editFirstRule();
+
+    // expect define step to populate
+    cy.get(CUSTOM_QUERY_INPUT).invoke('text').should('eq', existingRule.customQuery);
+    if (existingRule.index && existingRule.index.length > 0) {
+      cy.get(DEFINE_INDEX_INPUT).invoke('text').should('eq', existingRule.index.join(''));
+    }
+
+    goToAboutStepTab();
+
+    // expect about step to populate
+    cy.get(RULE_NAME_INPUT).invoke('val').should('eql', existingRule.name);
+    cy.get(RULE_DESCRIPTION_INPUT).invoke('text').should('eql', existingRule.description);
+    cy.get(TAGS_FIELD).invoke('text').should('eql', existingRule.tags.join(''));
+
+    cy.get(SEVERITY_DROPDOWN).invoke('text').should('eql', existingRule.severity);
+    cy.get(RISK_INPUT).invoke('val').should('eql', existingRule.riskScore);
+
+    goToScheduleStepTab();
+
+    // expect schedule step to populate
+    const intervalParts = existingRule.interval && existingRule.interval.match(/[0-9]+|[a-zA-Z]+/g);
+    if (intervalParts) {
+      const [amount, unit] = intervalParts;
+      cy.get(SCHEDULE_INTERVAL_AMOUNT_INPUT).invoke('val').should('eql', amount);
+      cy.get(SCHEDULE_INTERVAL_UNITS_INPUT).invoke('val').should('eql', unit);
+    } else {
+      throw new Error('Cannot assert scheduling info on a rule without an interval');
+    }
+
+    goToActionsStepTab();
+
+    cy.get(ACTIONS_THROTTLE_INPUT).invoke('val').should('eql', 'no_actions');
+
+    goToAboutStepTab();
+
+    const editedRule = {
+      ...existingRule,
+      severity: 'Medium',
+      description: 'Edited Rule description',
+    };
+
+    fillAboutRule(editedRule);
+    saveEditedRule();
+
+    const expectedTags = editedRule.tags.join('');
+    const expectedIndexPatterns =
+      editedRule.index && editedRule.index.length
+        ? editedRule.index
+        : [
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'winlogbeat-*',
+          ];
+
+    cy.get(RULE_NAME_HEADER).invoke('text').should('eql', `${editedRule.name} Beta`);
+
+    cy.get(ABOUT_RULE_DESCRIPTION).invoke('text').should('eql', editedRule.description);
+    cy.get(ABOUT_DETAILS).within(() => {
+      getDescriptionForTitle('Severity').invoke('text').should('eql', editedRule.severity);
+      getDescriptionForTitle('Risk score').invoke('text').should('eql', editedRule.riskScore);
+      getDescriptionForTitle('Tags').invoke('text').should('eql', expectedTags);
+    });
+
+    cy.get(RULE_ABOUT_DETAILS_HEADER_TOGGLE).eq(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
+    cy.get(ABOUT_INVESTIGATION_NOTES).invoke('text').should('eql', editedRule.note);
+
+    cy.get(DEFINITION_DETAILS).within(() => {
+      getDescriptionForTitle('Index patterns')
+        .invoke('text')
+        .should('eql', expectedIndexPatterns.join(''));
+      getDescriptionForTitle('Custom query')
+        .invoke('text')
+        .should('eql', `${editedRule.customQuery} `);
+      getDescriptionForTitle('Rule type').invoke('text').should('eql', 'Query');
+      getDescriptionForTitle('Timeline template').invoke('text').should('eql', 'None');
+    });
+
+    if (editedRule.interval) {
+      cy.get(SCHEDULE_DETAILS).within(() => {
+        getDescriptionForTitle('Runs every').invoke('text').should('eql', editedRule.interval);
+      });
+    }
+  });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_eql.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_eql.spec.ts
new file mode 100644
index 0000000000000..76871929fe050
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_eql.spec.ts
@@ -0,0 +1,159 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { eqlRule } from '../objects/rule';
+
+import {
+  CUSTOM_RULES_BTN,
+  RISK_SCORE,
+  RULE_NAME,
+  RULES_ROW,
+  RULES_TABLE,
+  SEVERITY,
+} from '../screens/alerts_detection_rules';
+import {
+  ABOUT_DETAILS,
+  ABOUT_INVESTIGATION_NOTES,
+  ABOUT_RULE_DESCRIPTION,
+  DEFINITION_DETAILS,
+  getDescriptionForTitle,
+  INVESTIGATION_NOTES_MARKDOWN,
+  INVESTIGATION_NOTES_TOGGLE,
+  RULE_ABOUT_DETAILS_HEADER_TOGGLE,
+  RULE_NAME_HEADER,
+  SCHEDULE_DETAILS,
+} from '../screens/rule_details';
+
+import {
+  goToManageAlertsDetectionRules,
+  waitForAlertsIndexToBeCreated,
+  waitForAlertsPanelToBeLoaded,
+} from '../tasks/alerts';
+import {
+  changeToThreeHundredRowsPerPage,
+  filterByCustomRules,
+  goToCreateNewRule,
+  goToRuleDetails,
+  waitForLoadElasticPrebuiltDetectionRulesTableToBeLoaded,
+  waitForRulesToBeLoaded,
+} from '../tasks/alerts_detection_rules';
+import {
+  createAndActivateRule,
+  fillAboutRuleAndContinue,
+  selectEqlRuleType,
+  fillDefineEqlRuleAndContinue,
+} from '../tasks/create_new_rule';
+import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
+import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
+
+import { DETECTIONS_URL } from '../urls/navigation';
+
+describe('Detection rules, EQL', () => {
+  before(() => {
+    esArchiverLoad('timeline');
+  });
+
+  after(() => {
+    esArchiverUnload('timeline');
+  });
+
+  it('Creates and activates a new EQL rule', () => {
+    loginAndWaitForPageWithoutDateRange(DETECTIONS_URL);
+    waitForAlertsPanelToBeLoaded();
+    waitForAlertsIndexToBeCreated();
+    goToManageAlertsDetectionRules();
+    waitForLoadElasticPrebuiltDetectionRulesTableToBeLoaded();
+    goToCreateNewRule();
+    selectEqlRuleType();
+    fillDefineEqlRuleAndContinue(eqlRule);
+    fillAboutRuleAndContinue(eqlRule);
+    createAndActivateRule();
+
+    cy.get(CUSTOM_RULES_BTN).invoke('text').should('eql', 'Custom rules (1)');
+
+    changeToThreeHundredRowsPerPage();
+    waitForRulesToBeLoaded();
+
+    const expectedNumberOfRules = 1;
+    cy.get(RULES_TABLE).then(($table) => {
+      cy.wrap($table.find(RULES_ROW).length).should('eql', expectedNumberOfRules);
+    });
+
+    filterByCustomRules();
+
+    cy.get(RULES_TABLE).then(($table) => {
+      cy.wrap($table.find(RULES_ROW).length).should('eql', 1);
+    });
+    cy.get(RULE_NAME).invoke('text').should('eql', eqlRule.name);
+    cy.get(RISK_SCORE).invoke('text').should('eql', eqlRule.riskScore);
+    cy.get(SEVERITY).invoke('text').should('eql', eqlRule.severity);
+    cy.get('[data-test-subj="rule-switch"]').should('have.attr', 'aria-checked', 'true');
+
+    goToRuleDetails();
+
+    let expectedUrls = '';
+    eqlRule.referenceUrls.forEach((url) => {
+      expectedUrls = expectedUrls + url;
+    });
+    let expectedFalsePositives = '';
+    eqlRule.falsePositivesExamples.forEach((falsePositive) => {
+      expectedFalsePositives = expectedFalsePositives + falsePositive;
+    });
+    let expectedTags = '';
+    eqlRule.tags.forEach((tag) => {
+      expectedTags = expectedTags + tag;
+    });
+    let expectedMitre = '';
+    eqlRule.mitre.forEach((mitre) => {
+      expectedMitre = expectedMitre + mitre.tactic;
+      mitre.techniques.forEach((technique) => {
+        expectedMitre = expectedMitre + technique;
+      });
+    });
+    const expectedIndexPatterns = [
+      'apm-*-transaction*',
+      'auditbeat-*',
+      'endgame-*',
+      'filebeat-*',
+      'logs-*',
+      'packetbeat-*',
+      'winlogbeat-*',
+    ];
+
+    cy.get(RULE_NAME_HEADER).invoke('text').should('eql', `${eqlRule.name} Beta`);
+
+    cy.get(ABOUT_RULE_DESCRIPTION).invoke('text').should('eql', eqlRule.description);
+    cy.get(ABOUT_DETAILS).within(() => {
+      getDescriptionForTitle('Severity').invoke('text').should('eql', eqlRule.severity);
+      getDescriptionForTitle('Risk score').invoke('text').should('eql', eqlRule.riskScore);
+      getDescriptionForTitle('Reference URLs').invoke('text').should('eql', expectedUrls);
+      getDescriptionForTitle('False positive examples')
+        .invoke('text')
+        .should('eql', expectedFalsePositives);
+      getDescriptionForTitle('MITRE ATT&CK').invoke('text').should('eql', expectedMitre);
+      getDescriptionForTitle('Tags').invoke('text').should('eql', expectedTags);
+    });
+
+    cy.get(RULE_ABOUT_DETAILS_HEADER_TOGGLE).eq(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
+    cy.get(ABOUT_INVESTIGATION_NOTES).invoke('text').should('eql', INVESTIGATION_NOTES_MARKDOWN);
+
+    cy.get(DEFINITION_DETAILS).within(() => {
+      getDescriptionForTitle('Index patterns')
+        .invoke('text')
+        .should('eql', expectedIndexPatterns.join(''));
+      getDescriptionForTitle('Custom query')
+        .invoke('text')
+        .should('eql', `${eqlRule.customQuery} `);
+      getDescriptionForTitle('Rule type').invoke('text').should('eql', 'Event Correlation');
+      getDescriptionForTitle('Timeline template').invoke('text').should('eql', 'None');
+    });
+
+    cy.get(SCHEDULE_DETAILS).within(() => {
+      getDescriptionForTitle('Runs every').invoke('text').should('eql', '5m');
+      getDescriptionForTitle('Additional look-back time').invoke('text').should('eql', '1m');
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_ml.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_ml.spec.ts
index b6b30ef550eb1..47e49d48e2aec 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_ml.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_ml.spec.ts
@@ -16,24 +16,14 @@ import {
   SEVERITY,
 } from '../screens/alerts_detection_rules';
 import {
-  ABOUT_FALSE_POSITIVES,
-  ABOUT_MITRE,
-  ABOUT_RISK,
   ABOUT_RULE_DESCRIPTION,
-  ABOUT_SEVERITY,
-  ABOUT_STEP,
-  ABOUT_TAGS,
-  ABOUT_URLS,
-  ANOMALY_SCORE,
-  DEFINITION_TIMELINE,
-  DEFINITION_STEP,
   MACHINE_LEARNING_JOB_ID,
   MACHINE_LEARNING_JOB_STATUS,
   RULE_NAME_HEADER,
-  SCHEDULE_LOOPBACK,
-  SCHEDULE_RUNS,
-  SCHEDULE_STEP,
-  RULE_TYPE,
+  getDescriptionForTitle,
+  ABOUT_DETAILS,
+  DEFINITION_DETAILS,
+  SCHEDULE_DETAILS,
 } from '../screens/rule_details';
 
 import {
@@ -126,36 +116,37 @@ describe('Detection rules, machine learning', () => {
     cy.get(RULE_NAME_HEADER).invoke('text').should('eql', `${machineLearningRule.name} Beta`);
 
     cy.get(ABOUT_RULE_DESCRIPTION).invoke('text').should('eql', machineLearningRule.description);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_SEVERITY)
-      .invoke('text')
-      .should('eql', machineLearningRule.severity);
-    cy.get(ABOUT_STEP).eq(ABOUT_RISK).invoke('text').should('eql', machineLearningRule.riskScore);
-    cy.get(ABOUT_STEP).eq(ABOUT_URLS).invoke('text').should('eql', expectedUrls);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_FALSE_POSITIVES)
-      .invoke('text')
-      .should('eql', expectedFalsePositives);
-    cy.get(ABOUT_STEP).eq(ABOUT_MITRE).invoke('text').should('eql', expectedMitre);
-    cy.get(ABOUT_STEP).eq(ABOUT_TAGS).invoke('text').should('eql', expectedTags);
-
-    cy.get(DEFINITION_STEP).eq(RULE_TYPE).invoke('text').should('eql', 'Machine Learning');
-    cy.get(DEFINITION_STEP)
-      .eq(ANOMALY_SCORE)
-      .invoke('text')
-      .should('eql', machineLearningRule.anomalyScoreThreshold);
-    cy.get(DEFINITION_STEP)
-      .get(MACHINE_LEARNING_JOB_STATUS)
-      .invoke('text')
-      .should('eql', 'Stopped');
-    cy.get(DEFINITION_STEP)
-      .get(MACHINE_LEARNING_JOB_ID)
-      .invoke('text')
-      .should('eql', machineLearningRule.machineLearningJob);
-
-    cy.get(DEFINITION_STEP).eq(DEFINITION_TIMELINE).invoke('text').should('eql', 'None');
-
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_RUNS).invoke('text').should('eql', '5m');
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_LOOPBACK).invoke('text').should('eql', '1m');
+    cy.get(ABOUT_DETAILS).within(() => {
+      getDescriptionForTitle('Severity').invoke('text').should('eql', machineLearningRule.severity);
+      getDescriptionForTitle('Risk score')
+        .invoke('text')
+        .should('eql', machineLearningRule.riskScore);
+      getDescriptionForTitle('Reference URLs').invoke('text').should('eql', expectedUrls);
+      getDescriptionForTitle('False positive examples')
+        .invoke('text')
+        .should('eql', expectedFalsePositives);
+      getDescriptionForTitle('MITRE ATT&CK').invoke('text').should('eql', expectedMitre);
+      getDescriptionForTitle('Tags').invoke('text').should('eql', expectedTags);
+    });
+
+    cy.get(DEFINITION_DETAILS).within(() => {
+      getDescriptionForTitle('Anomaly score')
+        .invoke('text')
+        .should('eql', machineLearningRule.anomalyScoreThreshold);
+      getDescriptionForTitle('Anomaly score')
+        .invoke('text')
+        .should('eql', machineLearningRule.anomalyScoreThreshold);
+      getDescriptionForTitle('Rule type').invoke('text').should('eql', 'Machine Learning');
+      getDescriptionForTitle('Timeline template').invoke('text').should('eql', 'None');
+      cy.get(MACHINE_LEARNING_JOB_STATUS).invoke('text').should('eql', 'Stopped');
+      cy.get(MACHINE_LEARNING_JOB_ID)
+        .invoke('text')
+        .should('eql', machineLearningRule.machineLearningJob);
+    });
+
+    cy.get(SCHEDULE_DETAILS).within(() => {
+      getDescriptionForTitle('Runs every').invoke('text').should('eql', '5m');
+      getDescriptionForTitle('Additional look-back time').invoke('text').should('eql', '1m');
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_override.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_override.spec.ts
index e3526c63e2310..4edf5e1866087 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_override.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_override.spec.ts
@@ -16,29 +16,17 @@ import {
 } from '../screens/alerts_detection_rules';
 import {
   ABOUT_INVESTIGATION_NOTES,
-  ABOUT_OVERRIDE_FALSE_POSITIVES,
-  ABOUT_OVERRIDE_MITRE,
-  ABOUT_OVERRIDE_NAME_OVERRIDE,
-  ABOUT_OVERRIDE_RISK,
-  ABOUT_OVERRIDE_RISK_OVERRIDE,
-  ABOUT_OVERRIDE_SEVERITY_OVERRIDE,
-  ABOUT_OVERRIDE_TAGS,
-  ABOUT_OVERRIDE_TIMESTAMP_OVERRIDE,
-  ABOUT_OVERRIDE_URLS,
   ABOUT_RULE_DESCRIPTION,
-  ABOUT_SEVERITY,
-  ABOUT_STEP,
-  DEFINITION_CUSTOM_QUERY,
-  DEFINITION_INDEX_PATTERNS,
-  DEFINITION_TIMELINE,
-  DEFINITION_STEP,
   INVESTIGATION_NOTES_MARKDOWN,
   INVESTIGATION_NOTES_TOGGLE,
   RULE_ABOUT_DETAILS_HEADER_TOGGLE,
   RULE_NAME_HEADER,
-  SCHEDULE_LOOPBACK,
-  SCHEDULE_RUNS,
-  SCHEDULE_STEP,
+  ABOUT_DETAILS,
+  getDescriptionForTitle,
+  DEFINITION_DETAILS,
+  SCHEDULE_DETAILS,
+  DETAILS_TITLE,
+  DETAILS_DESCRIPTION,
 } from '../screens/rule_details';
 
 import {
@@ -141,56 +129,56 @@ describe('Detection rules, override', () => {
 
     const expectedOverrideSeverities = ['Low', 'Medium', 'High', 'Critical'];
 
-    cy.get(ABOUT_STEP).eq(ABOUT_SEVERITY).invoke('text').should('eql', newOverrideRule.severity);
-    newOverrideRule.severityOverride.forEach((severity, i) => {
-      cy.get(ABOUT_STEP)
-        .eq(ABOUT_OVERRIDE_SEVERITY_OVERRIDE + i)
+    cy.get(ABOUT_DETAILS).within(() => {
+      getDescriptionForTitle('Severity').invoke('text').should('eql', newOverrideRule.severity);
+      getDescriptionForTitle('Risk score').invoke('text').should('eql', newOverrideRule.riskScore);
+      getDescriptionForTitle('Risk score override')
         .invoke('text')
-        .should(
-          'eql',
-          `${severity.sourceField}:${severity.sourceValue}${expectedOverrideSeverities[i]}`
-        );
+        .should('eql', `${newOverrideRule.riskOverride}signal.rule.risk_score`);
+      getDescriptionForTitle('Rule name override')
+        .invoke('text')
+        .should('eql', newOverrideRule.nameOverride);
+      getDescriptionForTitle('Reference URLs').invoke('text').should('eql', expectedUrls);
+      getDescriptionForTitle('False positive examples')
+        .invoke('text')
+        .should('eql', expectedFalsePositives);
+      getDescriptionForTitle('MITRE ATT&CK').invoke('text').should('eql', expectedMitre);
+      getDescriptionForTitle('Tags').invoke('text').should('eql', expectedTags);
+      getDescriptionForTitle('Timestamp override')
+        .invoke('text')
+        .should('eql', newOverrideRule.timestampOverride);
+      cy.contains(DETAILS_TITLE, 'Severity override')
+        .invoke('index', DETAILS_TITLE) // get index relative to other titles, not all siblings
+        .then((severityOverrideIndex) => {
+          newOverrideRule.severityOverride.forEach((severity, i) => {
+            cy.get(DETAILS_DESCRIPTION)
+              .eq(severityOverrideIndex + i)
+              .invoke('text')
+              .should(
+                'eql',
+                `${severity.sourceField}:${severity.sourceValue}${expectedOverrideSeverities[i]}`
+              );
+          });
+        });
     });
 
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_OVERRIDE_RISK)
-      .invoke('text')
-      .should('eql', newOverrideRule.riskScore);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_OVERRIDE_RISK_OVERRIDE)
-      .invoke('text')
-      .should('eql', `${newOverrideRule.riskOverride}signal.rule.risk_score`);
-    cy.get(ABOUT_STEP).eq(ABOUT_OVERRIDE_URLS).invoke('text').should('eql', expectedUrls);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_OVERRIDE_FALSE_POSITIVES)
-      .invoke('text')
-      .should('eql', expectedFalsePositives);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_OVERRIDE_NAME_OVERRIDE)
-      .invoke('text')
-      .should('eql', newOverrideRule.nameOverride);
-    cy.get(ABOUT_STEP).eq(ABOUT_OVERRIDE_MITRE).invoke('text').should('eql', expectedMitre);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_OVERRIDE_TIMESTAMP_OVERRIDE)
-      .invoke('text')
-      .should('eql', newOverrideRule.timestampOverride);
-    cy.get(ABOUT_STEP).eq(ABOUT_OVERRIDE_TAGS).invoke('text').should('eql', expectedTags);
-
     cy.get(RULE_ABOUT_DETAILS_HEADER_TOGGLE).eq(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
     cy.get(ABOUT_INVESTIGATION_NOTES).invoke('text').should('eql', INVESTIGATION_NOTES_MARKDOWN);
 
-    cy.get(DEFINITION_INDEX_PATTERNS).then((patterns) => {
-      cy.wrap(patterns).each((pattern, index) => {
-        cy.wrap(pattern).invoke('text').should('eql', expectedIndexPatterns[index]);
-      });
+    cy.get(DEFINITION_DETAILS).within(() => {
+      getDescriptionForTitle('Index patterns')
+        .invoke('text')
+        .should('eql', expectedIndexPatterns.join(''));
+      getDescriptionForTitle('Custom query')
+        .invoke('text')
+        .should('eql', `${newOverrideRule.customQuery} `);
+      getDescriptionForTitle('Rule type').invoke('text').should('eql', 'Query');
+      getDescriptionForTitle('Timeline template').invoke('text').should('eql', 'None');
+    });
+
+    cy.get(SCHEDULE_DETAILS).within(() => {
+      getDescriptionForTitle('Runs every').invoke('text').should('eql', '5m');
+      getDescriptionForTitle('Additional look-back time').invoke('text').should('eql', '1m');
     });
-    cy.get(DEFINITION_STEP)
-      .eq(DEFINITION_CUSTOM_QUERY)
-      .invoke('text')
-      .should('eql', `${newOverrideRule.customQuery} `);
-    cy.get(DEFINITION_STEP).eq(DEFINITION_TIMELINE).invoke('text').should('eql', 'None');
-
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_RUNS).invoke('text').should('eql', '5m');
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_LOOPBACK).invoke('text').should('eql', '1m');
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_threshold.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_threshold.spec.ts
index 10f9ebb5623df..00175ed3baeb8 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_threshold.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_threshold.spec.ts
@@ -15,27 +15,16 @@ import {
   SEVERITY,
 } from '../screens/alerts_detection_rules';
 import {
-  ABOUT_FALSE_POSITIVES,
   ABOUT_INVESTIGATION_NOTES,
-  ABOUT_MITRE,
-  ABOUT_RISK,
   ABOUT_RULE_DESCRIPTION,
-  ABOUT_SEVERITY,
-  ABOUT_STEP,
-  ABOUT_TAGS,
-  ABOUT_URLS,
-  DEFINITION_CUSTOM_QUERY,
-  DEFINITION_INDEX_PATTERNS,
-  DEFINITION_THRESHOLD,
-  DEFINITION_TIMELINE,
-  DEFINITION_STEP,
   INVESTIGATION_NOTES_MARKDOWN,
   INVESTIGATION_NOTES_TOGGLE,
   RULE_ABOUT_DETAILS_HEADER_TOGGLE,
   RULE_NAME_HEADER,
-  SCHEDULE_LOOPBACK,
-  SCHEDULE_RUNS,
-  SCHEDULE_STEP,
+  getDescriptionForTitle,
+  ABOUT_DETAILS,
+  DEFINITION_DETAILS,
+  SCHEDULE_DETAILS,
 } from '../screens/rule_details';
 
 import {
@@ -137,38 +126,40 @@ describe('Detection rules, threshold', () => {
     cy.get(RULE_NAME_HEADER).invoke('text').should('eql', `${newThresholdRule.name} Beta`);
 
     cy.get(ABOUT_RULE_DESCRIPTION).invoke('text').should('eql', newThresholdRule.description);
-    cy.get(ABOUT_STEP).eq(ABOUT_SEVERITY).invoke('text').should('eql', newThresholdRule.severity);
-    cy.get(ABOUT_STEP).eq(ABOUT_RISK).invoke('text').should('eql', newThresholdRule.riskScore);
-    cy.get(ABOUT_STEP).eq(ABOUT_URLS).invoke('text').should('eql', expectedUrls);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_FALSE_POSITIVES)
-      .invoke('text')
-      .should('eql', expectedFalsePositives);
-    cy.get(ABOUT_STEP).eq(ABOUT_MITRE).invoke('text').should('eql', expectedMitre);
-    cy.get(ABOUT_STEP).eq(ABOUT_TAGS).invoke('text').should('eql', expectedTags);
+    cy.get(ABOUT_DETAILS).within(() => {
+      getDescriptionForTitle('Severity').invoke('text').should('eql', newThresholdRule.severity);
+      getDescriptionForTitle('Risk score').invoke('text').should('eql', newThresholdRule.riskScore);
+      getDescriptionForTitle('Reference URLs').invoke('text').should('eql', expectedUrls);
+      getDescriptionForTitle('False positive examples')
+        .invoke('text')
+        .should('eql', expectedFalsePositives);
+      getDescriptionForTitle('MITRE ATT&CK').invoke('text').should('eql', expectedMitre);
+      getDescriptionForTitle('Tags').invoke('text').should('eql', expectedTags);
+    });
 
     cy.get(RULE_ABOUT_DETAILS_HEADER_TOGGLE).eq(INVESTIGATION_NOTES_TOGGLE).click({ force: true });
     cy.get(ABOUT_INVESTIGATION_NOTES).invoke('text').should('eql', INVESTIGATION_NOTES_MARKDOWN);
 
-    cy.get(DEFINITION_INDEX_PATTERNS).then((patterns) => {
-      cy.wrap(patterns).each((pattern, index) => {
-        cy.wrap(pattern).invoke('text').should('eql', expectedIndexPatterns[index]);
-      });
+    cy.get(DEFINITION_DETAILS).within(() => {
+      getDescriptionForTitle('Index patterns')
+        .invoke('text')
+        .should('eql', expectedIndexPatterns.join(''));
+      getDescriptionForTitle('Custom query')
+        .invoke('text')
+        .should('eql', `${newThresholdRule.customQuery} `);
+      getDescriptionForTitle('Rule type').invoke('text').should('eql', 'Threshold');
+      getDescriptionForTitle('Timeline template').invoke('text').should('eql', 'None');
+      getDescriptionForTitle('Threshold')
+        .invoke('text')
+        .should(
+          'eql',
+          `Results aggregated by ${newThresholdRule.thresholdField} >= ${newThresholdRule.threshold}`
+        );
+    });
+
+    cy.get(SCHEDULE_DETAILS).within(() => {
+      getDescriptionForTitle('Runs every').invoke('text').should('eql', '5m');
+      getDescriptionForTitle('Additional look-back time').invoke('text').should('eql', '1m');
     });
-    cy.get(DEFINITION_STEP)
-      .eq(DEFINITION_CUSTOM_QUERY)
-      .invoke('text')
-      .should('eql', `${newThresholdRule.customQuery} `);
-    cy.get(DEFINITION_STEP).eq(DEFINITION_TIMELINE).invoke('text').should('eql', 'None');
-    cy.get(DEFINITION_STEP)
-      .eq(DEFINITION_THRESHOLD)
-      .invoke('text')
-      .should(
-        'eql',
-        `Results aggregated by ${newThresholdRule.thresholdField} >= ${newThresholdRule.threshold}`
-      );
-
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_RUNS).invoke('text').should('eql', '5m');
-    cy.get(SCHEDULE_STEP).eq(SCHEDULE_LOOPBACK).invoke('text').should('eql', '1m');
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
index 9438c28f05fef..6194d6892d799 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases.spec.ts
@@ -40,7 +40,7 @@ import { TIMELINE_DESCRIPTION, TIMELINE_QUERY, TIMELINE_TITLE } from '../screens
 
 import { goToCaseDetails, goToCreateNewCase } from '../tasks/all_cases';
 import { openCaseTimeline } from '../tasks/case_details';
-import { backToCases, createNewCase } from '../tasks/create_new_case';
+import { backToCases, createNewCaseWithTimeline } from '../tasks/create_new_case';
 import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
 import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
 
@@ -58,7 +58,7 @@ describe('Cases', () => {
   it('Creates a new case with timeline and opens the timeline', () => {
     loginAndWaitForPageWithoutDateRange(CASES_URL);
     goToCreateNewCase();
-    createNewCase(case1);
+    createNewCaseWithTimeline(case1);
     backToCases();
 
     cy.get(ALL_CASES_PAGE_TITLE).should('have.text', 'Cases Beta');
diff --git a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
index 5f2de69689865..d193330dc54ff 100644
--- a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
@@ -47,7 +47,8 @@ const defaultHeadersInDefaultEcsCategory = [
   { id: 'destination.ip' },
 ];
 
-describe('Events Viewer', () => {
+// https://github.com/elastic/kibana/issues/70757
+describe.skip('Events Viewer', () => {
   context('Fields rendering', () => {
     before(() => {
       loginAndWaitForPage(HOSTS_URL);
diff --git a/x-pack/plugins/security_solution/cypress/integration/timeline_attach_to_case.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timeline_attach_to_case.spec.ts
new file mode 100644
index 0000000000000..6af4d174b9583
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/timeline_attach_to_case.spec.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { loginAndWaitForTimeline } from '../tasks/login';
+import {
+  attachTimelineToNewCase,
+  attachTimelineToExistingCase,
+  addNewCase,
+  selectCase,
+} from '../tasks/timeline';
+import { DESCRIPTION_INPUT } from '../screens/create_new_case';
+import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
+import { caseTimeline, TIMELINE_CASE_ID } from '../objects/case';
+
+describe('attach timeline to case', () => {
+  beforeEach(() => {
+    loginAndWaitForTimeline(caseTimeline.id);
+  });
+  context('without cases created', () => {
+    before(() => {
+      esArchiverLoad('timeline');
+    });
+
+    after(() => {
+      esArchiverUnload('timeline');
+    });
+
+    it('attach timeline to a new case', () => {
+      attachTimelineToNewCase();
+
+      cy.location('origin').then((origin) => {
+        cy.get(DESCRIPTION_INPUT).should(
+          'have.text',
+          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:'${caseTimeline.id}',isOpen:!t))`
+        );
+      });
+    });
+
+    it('attach timeline to an existing case with no case', () => {
+      attachTimelineToExistingCase();
+      addNewCase();
+
+      cy.location('origin').then((origin) => {
+        cy.get(DESCRIPTION_INPUT).should(
+          'have.text',
+          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:'${caseTimeline.id}',isOpen:!t))`
+        );
+      });
+    });
+  });
+
+  context('with cases created', () => {
+    before(() => {
+      esArchiverLoad('case_and_timeline');
+    });
+
+    after(() => {
+      esArchiverUnload('case_and_timeline');
+    });
+
+    it('attach timeline to an existing case', () => {
+      attachTimelineToExistingCase();
+      selectCase(TIMELINE_CASE_ID);
+
+      cy.location('origin').then((origin) => {
+        cy.get(DESCRIPTION_INPUT).should(
+          'have.text',
+          `[${caseTimeline.title}](${origin}/app/security/timelines?timeline=(id:'${caseTimeline.id}',isOpen:!t))`
+        );
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/objects/case.ts b/x-pack/plugins/security_solution/cypress/objects/case.ts
index 12d3f925169af..084df31a604a3 100644
--- a/x-pack/plugins/security_solution/cypress/objects/case.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/case.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Timeline } from './timeline';
+import { Timeline, TimelineWithId } from './timeline';
 
 export interface TestCase {
   name: string;
@@ -21,10 +21,11 @@ export interface Connector {
   password: string;
 }
 
-const caseTimeline: Timeline = {
+export const caseTimeline: TimelineWithId = {
   title: 'SIEM test',
   description: 'description',
   query: 'host.name:*',
+  id: '0162c130-78be-11ea-9718-118a926974a4',
 };
 
 export const case1: TestCase = {
@@ -41,3 +42,5 @@ export const serviceNowConnector: Connector = {
   username: 'Username Name',
   password: 'password',
 };
+
+export const TIMELINE_CASE_ID = '68248e00-f689-11ea-9ab2-59238b522856';
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index df6b792296f9d..2a5c60815f450 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -27,6 +27,8 @@ export interface CustomRule {
   customQuery: string;
   name: string;
   description: string;
+  index?: string[];
+  interval?: string;
   severity: string;
   riskScore: string;
   tags: string[];
@@ -109,6 +111,29 @@ export const newRule: CustomRule = {
   timelineId: '0162c130-78be-11ea-9718-118a926974a4',
 };
 
+export const existingRule: CustomRule = {
+  customQuery: 'host.name:*',
+  name: 'Rule 1',
+  description: 'Description for Rule 1',
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  interval: '4m',
+  severity: 'High',
+  riskScore: '19',
+  tags: ['rule1'],
+  referenceUrls: [],
+  falsePositivesExamples: [],
+  mitre: [],
+  note: 'This is my note',
+  timelineId: '',
+};
+
 export const newOverrideRule: OverrideRule = {
   customQuery: 'host.name:*',
   name: 'New Rule Test',
@@ -156,3 +181,17 @@ export const machineLearningRule: MachineLearningRule = {
   mitre: [mitre1],
   note: '# test markdown',
 };
+
+export const eqlRule: CustomRule = {
+  customQuery: 'process where process_name == "explorer.exe"',
+  name: 'New EQL Rule',
+  description: 'New EQL rule description.',
+  severity: 'High',
+  riskScore: '17',
+  tags: ['test', 'newRule'],
+  referenceUrls: ['https://www.google.com/', 'https://elastic.co/'],
+  falsePositivesExamples: ['False1', 'False2'],
+  mitre: [mitre1, mitre2],
+  note: '# test markdown',
+  timelineId: '0162c130-78be-11ea-9718-118a926974a4',
+};
diff --git a/x-pack/plugins/security_solution/cypress/objects/timeline.ts b/x-pack/plugins/security_solution/cypress/objects/timeline.ts
index 060a1376b46ce..ff7e80e5661ad 100644
--- a/x-pack/plugins/security_solution/cypress/objects/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/timeline.ts
@@ -9,3 +9,7 @@ export interface Timeline {
   description: string;
   query: string;
 }
+
+export interface TimelineWithId extends Timeline {
+  id: string;
+}
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
index a41b8296f83e4..14f5383939a94 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts
@@ -14,6 +14,8 @@ export const CUSTOM_RULES_BTN = '[data-test-subj="show-custom-rules-filter-butto
 
 export const DELETE_RULE_ACTION_BTN = '[data-test-subj="deleteRuleAction"]';
 
+export const EDIT_RULE_ACTION_BTN = '[data-test-subj="editRuleAction"]';
+
 export const DELETE_RULE_BULK_BTN = '[data-test-subj="deleteRuleBulk"]';
 
 export const ELASTIC_RULES_BTN = '[data-test-subj="show-elastic-rules-filter-button"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/all_cases.ts b/x-pack/plugins/security_solution/cypress/screens/all_cases.ts
index 4fa6b69eea7c3..dc0e764744f84 100644
--- a/x-pack/plugins/security_solution/cypress/screens/all_cases.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/all_cases.ts
@@ -4,6 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export const ALL_CASES_CASE = (id: string) => {
+  return `[data-test-subj="cases-table-row-${id}"]`;
+};
+
 export const ALL_CASES_CLOSE_ACTION = '[data-test-subj="action-close"]';
 
 export const ALL_CASES_CLOSED_CASES_COUNT = '[data-test-subj="closed-case-count"]';
@@ -14,6 +18,8 @@ export const ALL_CASES_COMMENTS_COUNT = '[data-test-subj="case-table-column-comm
 
 export const ALL_CASES_CREATE_NEW_CASE_BTN = '[data-test-subj="createNewCaseBtn"]';
 
+export const ALL_CASES_CREATE_NEW_CASE_TABLE_BTN = '[data-test-subj="cases-table-add-case"]';
+
 export const ALL_CASES_DELETE_ACTION = '[data-test-subj="action-delete"]';
 
 export const ALL_CASES_NAME = '[data-test-subj="case-details-link"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts
index 6e2beb78fff19..9431c054d96a4 100644
--- a/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/create_new_case.ts
@@ -6,8 +6,7 @@
 
 export const BACK_TO_CASES_BTN = '[data-test-subj="backToCases"]';
 
-export const DESCRIPTION_INPUT =
-  '[data-test-subj="caseDescription"] [data-test-subj="textAreaInput"]';
+export const DESCRIPTION_INPUT = '[data-test-subj="textAreaInput"]';
 
 export const INSERT_TIMELINE_BTN = '[data-test-subj="insert-timeline-button"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
index 397d0c0142179..dda371126d5aa 100644
--- a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts
@@ -8,6 +8,13 @@ export const ABOUT_CONTINUE_BTN = '[data-test-subj="about-continue"]';
 
 export const ABOUT_EDIT_BUTTON = '[data-test-subj="edit-about-rule"]';
 
+export const ABOUT_EDIT_TAB = '[data-test-subj="edit-rule-about-tab"]';
+
+export const ACTIONS_EDIT_TAB = '[data-test-subj="edit-rule-actions-tab"]';
+
+export const ACTIONS_THROTTLE_INPUT =
+  '[data-test-subj="stepRuleActions"] [data-test-subj="select"]';
+
 export const ADD_FALSE_POSITIVE_BTN =
   '[data-test-subj="detectionEngineStepAboutRuleFalsePositives"] .euiButtonEmpty__text';
 
@@ -30,6 +37,15 @@ export const DEFINE_CONTINUE_BUTTON = '[data-test-subj="define-continue"]';
 
 export const DEFINE_EDIT_BUTTON = '[data-test-subj="edit-define-rule"]';
 
+export const DEFINE_EDIT_TAB = '[data-test-subj="edit-rule-define-tab"]';
+
+export const DEFINE_INDEX_INPUT =
+  '[data-test-subj="detectionEngineStepDefineRuleIndices"] [data-test-subj="input"]';
+
+export const EQL_TYPE = '[data-test-subj="eqlRuleType"]';
+
+export const EQL_QUERY_INPUT = '[data-test-subj="eqlQueryBarTextInput"]';
+
 export const IMPORT_QUERY_FROM_SAVED_TIMELINE_LINK =
   '[data-test-subj="importQueryFromSavedTimeline"]';
 
@@ -77,6 +93,20 @@ export const RULE_TIMESTAMP_OVERRIDE =
 
 export const SCHEDULE_CONTINUE_BUTTON = '[data-test-subj="schedule-continue"]';
 
+export const SCHEDULE_EDIT_TAB = '[data-test-subj="edit-rule-schedule-tab"]';
+
+export const SCHEDULE_INTERVAL_AMOUNT_INPUT =
+  '[data-test-subj="detectionEngineStepScheduleRuleInterval"] [data-test-subj="schedule-amount-input"]';
+
+export const SCHEDULE_INTERVAL_UNITS_INPUT =
+  '[data-test-subj="detectionEngineStepScheduleRuleInterval"] [data-test-subj="schedule-units-input"]';
+
+export const SCHEDULE_LOOKBACK_AMOUNT_INPUT =
+  '[data-test-subj="detectionEngineStepScheduleRuleFrom"] [data-test-subj="schedule-amount-input"]';
+
+export const SCHEDULE_LOOKBACK_UNITS_INPUT =
+  '[data-test-subj="detectionEngineStepScheduleRuleFrom"] [data-test-subj="schedule-units-input"]';
+
 export const SEVERITY_DROPDOWN =
   '[data-test-subj="detectionEngineStepAboutRuleSeverity"] [data-test-subj="select"]';
 
@@ -84,6 +114,9 @@ export const SEVERITY_MAPPING_OVERRIDE_OPTION = '#severity-mapping-override';
 
 export const SEVERITY_OVERRIDE_ROW = '[data-test-subj="severityOverrideRow"]';
 
+export const TAGS_FIELD =
+  '[data-test-subj="detectionEngineStepAboutRuleTags"] [data-test-subj="comboBoxInput"]';
+
 export const TAGS_INPUT =
   '[data-test-subj="detectionEngineStepAboutRuleTags"] [data-test-subj="comboBoxSearchInput"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts b/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
new file mode 100644
index 0000000000000..1bf0ff34ebd94
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/screens/edit_rule.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const EDIT_SUBMIT_BUTTON = '[data-test-subj="ruleEditSubmitButton"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/rule_details.ts b/x-pack/plugins/security_solution/cypress/screens/rule_details.ts
index b221709966943..98fc7b06a9908 100644
--- a/x-pack/plugins/security_solution/cypress/screens/rule_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/rule_details.ts
@@ -4,55 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const ABOUT_FALSE_POSITIVES = 3;
+export const getDescriptionForTitle = (title: string) =>
+  cy.get(DETAILS_TITLE).contains(title).next(DETAILS_DESCRIPTION);
 
-export const ABOUT_INVESTIGATION_NOTES = '[data-test-subj="stepAboutDetailsNoteContent"]';
-
-export const ABOUT_MITRE = 4;
-
-export const ABOUT_OVERRIDE_FALSE_POSITIVES = 8;
-
-export const ABOUT_OVERRIDE_MITRE = 10;
-
-export const ABOUT_OVERRIDE_NAME_OVERRIDE = 9;
-
-export const ABOUT_OVERRIDE_RISK = 5;
+export const DETAILS_DESCRIPTION = '.euiDescriptionList__description';
+export const DETAILS_TITLE = '.euiDescriptionList__title';
 
-export const ABOUT_OVERRIDE_RISK_OVERRIDE = 6;
-
-export const ABOUT_OVERRIDE_SEVERITY_OVERRIDE = 1;
-
-export const ABOUT_OVERRIDE_TAGS = 12;
-
-export const ABOUT_OVERRIDE_TIMESTAMP_OVERRIDE = 11;
-
-export const ABOUT_OVERRIDE_URLS = 7;
+export const ABOUT_INVESTIGATION_NOTES = '[data-test-subj="stepAboutDetailsNoteContent"]';
 
 export const ABOUT_RULE_DESCRIPTION = '[data-test-subj=stepAboutRuleDetailsToggleDescriptionText]';
 
-export const ABOUT_RISK = 1;
+export const ABOUT_DETAILS =
+  '[data-test-subj="aboutRule"] [data-test-subj="listItemColumnStepRuleDescription"]';
 
-export const ABOUT_SEVERITY = 0;
-
-export const ABOUT_STEP = '[data-test-subj="aboutRule"] .euiDescriptionList__description';
-
-export const ABOUT_TAGS = 5;
-
-export const ABOUT_URLS = 2;
-
-export const ANOMALY_SCORE = 1;
-
-export const DEFINITION_CUSTOM_QUERY = 1;
-
-export const DEFINITION_THRESHOLD = 4;
-
-export const DEFINITION_TIMELINE = 3;
-
-export const DEFINITION_INDEX_PATTERNS =
-  '[data-test-subj=definitionRule] [data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description .euiBadge__text';
-
-export const DEFINITION_STEP =
-  '[data-test-subj=definitionRule] [data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description';
+export const DEFINITION_DETAILS =
+  '[data-test-subj=definitionRule] [data-test-subj="listItemColumnStepRuleDescription"]';
 
 export const INVESTIGATION_NOTES_MARKDOWN = 'test markdown';
 
@@ -60,16 +26,13 @@ export const INVESTIGATION_NOTES_TOGGLE = 1;
 
 export const MACHINE_LEARNING_JOB_ID = '[data-test-subj="machineLearningJobId"]';
 
-export const MACHINE_LEARNING_JOB_STATUS = '[data-test-subj="machineLearningJobStatus"  ]';
+export const MACHINE_LEARNING_JOB_STATUS = '[data-test-subj="machineLearningJobStatus"]';
 
 export const RULE_ABOUT_DETAILS_HEADER_TOGGLE = '[data-test-subj="stepAboutDetailsToggle"]';
 
 export const RULE_NAME_HEADER = '[data-test-subj="header-page-title"]';
 
-export const RULE_TYPE = 0;
+export const SCHEDULE_DETAILS =
+  '[data-test-subj=schedule] [data-test-subj="listItemColumnStepRuleDescription"]';
 
 export const SCHEDULE_STEP = '[data-test-subj="schedule"]  .euiDescriptionList__description';
-
-export const SCHEDULE_RUNS = 0;
-
-export const SCHEDULE_LOOPBACK = 1;
diff --git a/x-pack/plugins/security_solution/cypress/screens/timeline.ts b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
index fd41cd63fc090..bcb64fc947feb 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
@@ -4,8 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export const ATTACH_TIMELINE_TO_NEW_CASE_ICON = '[data-test-subj="attach-timeline-case"]';
+
+export const ATTACH_TIMELINE_TO_EXISTING_CASE_ICON =
+  '[data-test-subj="attach-timeline-existing-case"]';
+
 export const BULK_ACTIONS = '[data-test-subj="utility-bar-action-button"]';
 
+export const CASE = (id: string) => {
+  return `[data-test-subj="cases-table-row-${id}"]`;
+};
+
 export const CLOSE_TIMELINE_BTN = '[data-test-subj="close-timeline"]';
 
 export const CREATE_NEW_TIMELINE = '[data-test-subj="timeline-new"]';
@@ -25,6 +34,8 @@ export const ID_FIELD = '[data-test-subj="timeline"] [data-test-subj="field-name
 
 export const ID_TOGGLE_FIELD = '[data-test-subj="toggle-field-_id"]';
 
+export const OPEN_TIMELINE_ICON = '[data-test-subj="open-timeline-button"]';
+
 export const PIN_EVENT = '[data-test-subj="pin"]';
 
 export const PROVIDER_BADGE = '[data-test-subj="providerBadge"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
index 5ec5bb97250db..c530594508f95 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts
@@ -24,6 +24,7 @@ import {
   SORT_RULES_BTN,
   THREE_HUNDRED_ROWS,
   EXPORT_ACTION_BTN,
+  EDIT_RULE_ACTION_BTN,
 } from '../screens/alerts_detection_rules';
 
 export const activateRule = (rulePosition: number) => {
@@ -35,6 +36,11 @@ export const changeToThreeHundredRowsPerPage = () => {
   cy.get(THREE_HUNDRED_ROWS).click();
 };
 
+export const editFirstRule = () => {
+  cy.get(COLLAPSED_ACTION_BTN).first().click({ force: true });
+  cy.get(EDIT_RULE_ACTION_BTN).click();
+};
+
 export const deleteFirstRule = () => {
   cy.get(COLLAPSED_ACTION_BTN).first().click({ force: true });
   cy.get(DELETE_RULE_ACTION_BTN).click();
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
index b2cde23a8dce2..1d5d240c5c53d 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_case.ts
@@ -29,6 +29,18 @@ export const createNewCase = (newCase: TestCase) => {
   });
   cy.get(DESCRIPTION_INPUT).type(`${newCase.description} `, { force: true });
 
+  cy.get(SUBMIT_BTN).click({ force: true });
+  cy.get(LOADING_SPINNER).should('exist');
+  cy.get(LOADING_SPINNER).should('not.exist');
+};
+
+export const createNewCaseWithTimeline = (newCase: TestCase) => {
+  cy.get(TITLE_INPUT).type(newCase.name, { force: true });
+  newCase.tags.forEach((tag) => {
+    cy.get(TAGS_INPUT).type(`${tag}{enter}`, { force: true });
+  });
+  cy.get(DESCRIPTION_INPUT).type(`${newCase.description} `, { force: true });
+
   cy.get(INSERT_TIMELINE_BTN).click({ force: true });
   cy.get(TIMELINE_SEARCHBOX).type(`${newCase.timeline.title}{enter}`);
   cy.get(TIMELINE).should('be.visible');
diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
index 3fa300ce9d8d0..0daff52de7063 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts
@@ -13,14 +13,17 @@ import {
 } from '../objects/rule';
 import {
   ABOUT_CONTINUE_BTN,
-  ANOMALY_THRESHOLD_INPUT,
+  ABOUT_EDIT_TAB,
+  ACTIONS_EDIT_TAB,
   ADD_FALSE_POSITIVE_BTN,
   ADD_REFERENCE_URL_BTN,
   ADVANCED_SETTINGS_BTN,
+  ANOMALY_THRESHOLD_INPUT,
   COMBO_BOX_INPUT,
   CREATE_AND_ACTIVATE_BTN,
   CUSTOM_QUERY_INPUT,
   DEFINE_CONTINUE_BUTTON,
+  DEFINE_EDIT_TAB,
   FALSE_POSITIVES_INPUT,
   IMPORT_QUERY_FROM_SAVED_TIMELINE_LINK,
   INPUT,
@@ -32,8 +35,8 @@ import {
   MITRE_TACTIC,
   MITRE_TACTIC_DROPDOWN,
   MITRE_TECHNIQUES_INPUT,
-  RISK_INPUT,
   REFERENCE_URLS_INPUT,
+  RISK_INPUT,
   RISK_MAPPING_OVERRIDE_OPTION,
   RISK_OVERRIDE,
   RULE_DESCRIPTION_INPUT,
@@ -41,6 +44,7 @@ import {
   RULE_NAME_OVERRIDE,
   RULE_TIMESTAMP_OVERRIDE,
   SCHEDULE_CONTINUE_BUTTON,
+  SCHEDULE_EDIT_TAB,
   SEVERITY_DROPDOWN,
   SEVERITY_MAPPING_OVERRIDE_OPTION,
   SEVERITY_OVERRIDE_ROW,
@@ -48,8 +52,8 @@ import {
   THRESHOLD_FIELD_SELECTION,
   THRESHOLD_INPUT_AREA,
   THRESHOLD_TYPE,
-  DEFINE_EDIT_BUTTON,
-  ABOUT_EDIT_BUTTON,
+  EQL_TYPE,
+  EQL_QUERY_INPUT,
 } from '../screens/create_new_rule';
 import { TIMELINE } from '../screens/timeline';
 
@@ -59,11 +63,9 @@ export const createAndActivateRule = () => {
   cy.get(CREATE_AND_ACTIVATE_BTN).should('not.exist');
 };
 
-export const fillAboutRuleAndContinue = (
-  rule: CustomRule | MachineLearningRule | ThresholdRule
-) => {
-  cy.get(RULE_NAME_INPUT).type(rule.name, { force: true });
-  cy.get(RULE_DESCRIPTION_INPUT).type(rule.description, { force: true });
+export const fillAboutRule = (rule: CustomRule | MachineLearningRule | ThresholdRule) => {
+  cy.get(RULE_NAME_INPUT).clear({ force: true }).type(rule.name, { force: true });
+  cy.get(RULE_DESCRIPTION_INPUT).clear({ force: true }).type(rule.description, { force: true });
 
   cy.get(SEVERITY_DROPDOWN).click({ force: true });
   cy.get(`#${rule.severity.toLowerCase()}`).click();
@@ -77,12 +79,15 @@ export const fillAboutRuleAndContinue = (
   cy.get(ADVANCED_SETTINGS_BTN).click({ force: true });
 
   rule.referenceUrls.forEach((url, index) => {
-    cy.get(REFERENCE_URLS_INPUT).eq(index).type(url, { force: true });
+    cy.get(REFERENCE_URLS_INPUT).eq(index).clear({ force: true }).type(url, { force: true });
     cy.get(ADD_REFERENCE_URL_BTN).click({ force: true });
   });
 
   rule.falsePositivesExamples.forEach((falsePositive, index) => {
-    cy.get(FALSE_POSITIVES_INPUT).eq(index).type(falsePositive, { force: true });
+    cy.get(FALSE_POSITIVES_INPUT)
+      .eq(index)
+      .clear({ force: true })
+      .type(falsePositive, { force: true });
     cy.get(ADD_FALSE_POSITIVE_BTN).click({ force: true });
   });
 
@@ -91,14 +96,22 @@ export const fillAboutRuleAndContinue = (
     cy.contains(MITRE_TACTIC, mitre.tactic).click();
 
     mitre.techniques.forEach((technique) => {
-      cy.get(MITRE_TECHNIQUES_INPUT).eq(index).type(`${technique}{enter}`, { force: true });
+      cy.get(MITRE_TECHNIQUES_INPUT)
+        .eq(index)
+        .clear({ force: true })
+        .type(`${technique}{enter}`, { force: true });
     });
 
     cy.get(MITRE_BTN).click({ force: true });
   });
 
-  cy.get(INVESTIGATION_NOTES_TEXTAREA).type(rule.note, { force: true });
+  cy.get(INVESTIGATION_NOTES_TEXTAREA).clear({ force: true }).type(rule.note, { force: true });
+};
 
+export const fillAboutRuleAndContinue = (
+  rule: CustomRule | MachineLearningRule | ThresholdRule
+) => {
+  fillAboutRule(rule);
   cy.get(ABOUT_CONTINUE_BTN).should('exist').click({ force: true });
 };
 
@@ -177,20 +190,6 @@ export const fillDefineCustomRuleWithImportedQueryAndContinue = (
   cy.get(CUSTOM_QUERY_INPUT).should('not.exist');
 };
 
-export const expectDefineFormToRepopulateAndContinue = (rule: CustomRule) => {
-  cy.get(DEFINE_EDIT_BUTTON).click();
-  cy.get(CUSTOM_QUERY_INPUT).invoke('text').should('eq', rule.customQuery);
-  cy.get(DEFINE_CONTINUE_BUTTON).should('exist').click({ force: true });
-  cy.get(DEFINE_CONTINUE_BUTTON).should('not.exist');
-};
-
-export const expectAboutFormToRepopulateAndContinue = (rule: CustomRule) => {
-  cy.get(ABOUT_EDIT_BUTTON).click();
-  cy.get(RULE_NAME_INPUT).invoke('val').should('eq', rule.name);
-  cy.get(ABOUT_CONTINUE_BTN).should('exist').click({ force: true });
-  cy.get(ABOUT_CONTINUE_BTN).should('not.exist');
-};
-
 export const fillDefineThresholdRuleAndContinue = (rule: ThresholdRule) => {
   const thresholdField = 0;
   const threshold = 1;
@@ -209,6 +208,14 @@ export const fillDefineThresholdRuleAndContinue = (rule: ThresholdRule) => {
   cy.get(CUSTOM_QUERY_INPUT).should('not.exist');
 };
 
+export const fillDefineEqlRuleAndContinue = (rule: CustomRule) => {
+  cy.get(EQL_QUERY_INPUT).type(rule.customQuery);
+  cy.get(EQL_QUERY_INPUT).invoke('text').should('eq', rule.customQuery);
+  cy.get(DEFINE_CONTINUE_BUTTON).should('exist').click({ force: true });
+
+  cy.get(EQL_QUERY_INPUT).should('not.exist');
+};
+
 export const fillDefineMachineLearningRuleAndContinue = (rule: MachineLearningRule) => {
   cy.get(MACHINE_LEARNING_DROPDOWN).click({ force: true });
   cy.contains(MACHINE_LEARNING_LIST, rule.machineLearningJob).click();
@@ -220,6 +227,22 @@ export const fillDefineMachineLearningRuleAndContinue = (rule: MachineLearningRu
   cy.get(MACHINE_LEARNING_DROPDOWN).should('not.exist');
 };
 
+export const goToDefineStepTab = () => {
+  cy.get(DEFINE_EDIT_TAB).click({ force: true });
+};
+
+export const goToAboutStepTab = () => {
+  cy.get(ABOUT_EDIT_TAB).click({ force: true });
+};
+
+export const goToScheduleStepTab = () => {
+  cy.get(SCHEDULE_EDIT_TAB).click({ force: true });
+};
+
+export const goToActionsStepTab = () => {
+  cy.get(ACTIONS_EDIT_TAB).click({ force: true });
+};
+
 export const selectMachineLearningRuleType = () => {
   cy.get(MACHINE_LEARNING_TYPE).click({ force: true });
 };
@@ -227,3 +250,7 @@ export const selectMachineLearningRuleType = () => {
 export const selectThresholdRuleType = () => {
   cy.get(THRESHOLD_TYPE).click({ force: true });
 };
+
+export const selectEqlRuleType = () => {
+  cy.get(EQL_TYPE).click({ force: true });
+};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/edit_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/edit_rule.ts
new file mode 100644
index 0000000000000..690a36058ec33
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/tasks/edit_rule.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EDIT_SUBMIT_BUTTON } from '../screens/edit_rule';
+
+export const saveEditedRule = () => {
+  cy.get(EDIT_SUBMIT_BUTTON).should('exist').click({ force: true });
+  cy.get(EDIT_SUBMIT_BUTTON).should('not.exist');
+};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/login.ts b/x-pack/plugins/security_solution/cypress/tasks/login.ts
index ca23a1defd4f5..65f821ec5bfb7 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/login.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/login.ts
@@ -5,6 +5,7 @@
  */
 
 import * as yaml from 'js-yaml';
+import { TIMELINE_FLYOUT_BODY } from '../screens/timeline';
 
 /**
  * Credentials in the `kibana.dev.yml` config file will be used to authenticate
@@ -143,3 +144,11 @@ export const loginAndWaitForPageWithoutDateRange = (url: string) => {
   cy.visit(url);
   cy.get('[data-test-subj="headerGlobalNav"]', { timeout: 120000 });
 };
+
+export const loginAndWaitForTimeline = (timelineId: string) => {
+  login();
+  cy.viewport('macbook-15');
+  cy.visit(`/app/security/timelines?timeline=(id:'${timelineId}',isOpen:!t)`);
+  cy.get('[data-test-subj="headerGlobalNav"]');
+  cy.get(TIMELINE_FLYOUT_BODY).should('be.visible');
+};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
index 6fb8bb5e29ae5..cd8b197fc4dec 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { ALL_CASES_CREATE_NEW_CASE_TABLE_BTN } from '../screens/all_cases';
 import {
   BULK_ACTIONS,
   CLOSE_TIMELINE_BTN,
@@ -28,6 +29,10 @@ import {
   TOGGLE_TIMELINE_EXPAND_EVENT,
   REMOVE_COLUMN,
   RESET_FIELDS,
+  ATTACH_TIMELINE_TO_NEW_CASE_ICON,
+  OPEN_TIMELINE_ICON,
+  ATTACH_TIMELINE_TO_EXISTING_CASE_ICON,
+  CASE,
 } from '../screens/timeline';
 
 import { drag, drop } from '../tasks/common';
@@ -44,6 +49,20 @@ export const addNameToTimeline = (name: string) => {
   cy.get(TIMELINE_TITLE).should('have.attr', 'value', name);
 };
 
+export const addNewCase = () => {
+  cy.get(ALL_CASES_CREATE_NEW_CASE_TABLE_BTN).click();
+};
+
+export const attachTimelineToNewCase = () => {
+  cy.get(TIMELINE_SETTINGS_ICON).click({ force: true });
+  cy.get(ATTACH_TIMELINE_TO_NEW_CASE_ICON).click({ force: true });
+};
+
+export const attachTimelineToExistingCase = () => {
+  cy.get(TIMELINE_SETTINGS_ICON).click({ force: true });
+  cy.get(ATTACH_TIMELINE_TO_EXISTING_CASE_ICON).click({ force: true });
+};
+
 export const checkIdToggleField = () => {
   cy.get(ID_HEADER_FIELD).should('not.exist');
 
@@ -85,6 +104,11 @@ export const openTimelineInspectButton = () => {
   cy.get(TIMELINE_INSPECT_BUTTON).trigger('click', { force: true });
 };
 
+export const openTimelineFromSettings = () => {
+  cy.get(TIMELINE_SETTINGS_ICON).click({ force: true });
+  cy.get(OPEN_TIMELINE_ICON).click({ force: true });
+};
+
 export const openTimelineSettings = () => {
   cy.get(TIMELINE_SETTINGS_ICON).trigger('click', { force: true });
 };
@@ -132,6 +156,10 @@ export const resetFields = () => {
   cy.get(RESET_FIELDS).click({ force: true });
 };
 
+export const selectCase = (caseId: string) => {
+  cy.get(CASE(caseId)).click();
+};
+
 export const waitForTimelinesPanelToBeLoaded = () => {
   cy.get(TIMELINES_TABLE).should('exist');
 };
diff --git a/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts b/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts
index 96c1217577ff2..87f8f46affb52 100644
--- a/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts
+++ b/x-pack/plugins/security_solution/public/cases/components/__mock__/form.ts
@@ -4,9 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { useForm } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form';
+import { useFormData } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data';
+
 jest.mock(
   '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form'
 );
+jest.mock(
+  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data'
+);
+
 export const mockFormHook = {
   isSubmitted: false,
   isSubmitting: false,
@@ -41,3 +47,4 @@ export const getFormMock = (sampleData: any) => ({
 });
 
 export const useFormMock = useForm as jest.Mock;
+export const useFormDataMock = useFormData as jest.Mock;
diff --git a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx
index f697ce443f2c5..a800bd690f710 100644
--- a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.test.tsx
@@ -15,6 +15,7 @@ import { Router, routeData, mockHistory, mockLocation } from '../__mock__/router
 import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
 import { usePostComment } from '../../containers/use_post_comment';
 import { useForm } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form';
+import { useFormData } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data';
 
 // we don't have the types for waitFor just yet, so using "as waitFor" until when we do
 import { wait as waitFor } from '@testing-library/react';
@@ -23,10 +24,15 @@ jest.mock(
   '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form'
 );
 
+jest.mock(
+  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data'
+);
+
 jest.mock('../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline');
 jest.mock('../../containers/use_post_comment');
 
-export const useFormMock = useForm as jest.Mock;
+const useFormMock = useForm as jest.Mock;
+const useFormDataMock = useFormData as jest.Mock;
 
 const useInsertTimelineMock = useInsertTimeline as jest.Mock;
 const usePostCommentMock = usePostComment as jest.Mock;
@@ -73,6 +79,7 @@ describe('AddComment ', () => {
     useInsertTimelineMock.mockImplementation(() => defaultInsertTimeline);
     usePostCommentMock.mockImplementation(() => defaultPostCommment);
     useFormMock.mockImplementation(() => ({ form: formHookMock }));
+    useFormDataMock.mockImplementation(() => [{ comment: sampleData.comment }]);
     jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
   });
 
diff --git a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
index 87bd7bb247056..ef13c87a92dbb 100644
--- a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
@@ -14,7 +14,7 @@ import { Case } from '../../containers/types';
 import { MarkdownEditorForm } from '../../../common/components/markdown_editor/form';
 import { InsertTimelinePopover } from '../../../timelines/components/timeline/insert_timeline_popover';
 import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
-import { Form, useForm, UseField } from '../../../shared_imports';
+import { Form, useForm, UseField, useFormData } from '../../../shared_imports';
 
 import * as i18n from './translations';
 import { schema } from './schema';
@@ -46,23 +46,31 @@ export const AddComment = React.memo(
   forwardRef<AddCommentRefObject, AddCommentProps>(
     ({ caseId, disabled, showLoading = true, onCommentPosted, onCommentSaving }, ref) => {
       const { isLoading, postComment } = usePostComment(caseId);
+
       const { form } = useForm<CommentRequest>({
         defaultValue: initialCommentValue,
         options: { stripEmptyFields: false },
         schema,
       });
-      const { getFormData, setFieldValue, reset, submit } = form;
-      const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<CommentRequest>(
-        form,
-        'comment'
+
+      const fieldName = 'comment';
+      const { setFieldValue, reset, submit } = form;
+      const [{ comment }] = useFormData({ form, watch: [fieldName] });
+
+      const onCommentChange = useCallback((newValue) => setFieldValue(fieldName, newValue), [
+        setFieldValue,
+      ]);
+
+      const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline(
+        comment,
+        onCommentChange
       );
 
       const addQuote = useCallback(
         (quote) => {
-          const { comment } = getFormData();
-          setFieldValue('comment', `${comment}${comment.length > 0 ? '\n\n' : ''}${quote}`);
+          setFieldValue(fieldName, `${comment}${comment.length > 0 ? '\n\n' : ''}${quote}`);
         },
-        [getFormData, setFieldValue]
+        [comment, setFieldValue]
       );
 
       useImperativeHandle(ref, () => ({
@@ -87,7 +95,7 @@ export const AddComment = React.memo(
           {isLoading && showLoading && <MySpinner data-test-subj="loading-spinner" size="xl" />}
           <Form form={form}>
             <UseField
-              path="comment"
+              path={fieldName}
               component={MarkdownEditorForm}
               componentProps={{
                 idAria: 'caseComment',
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx
index aefb196e0678d..4f1e45ae7c115 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.test.tsx
@@ -16,16 +16,23 @@ import { useInsertTimeline } from '../../../timelines/components/timeline/insert
 import { usePostCase } from '../../containers/use_post_case';
 import { useGetTags } from '../../containers/use_get_tags';
 
-jest.mock('../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline');
-jest.mock('../../containers/use_post_case');
 import { useForm } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form';
+import { useFormData } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data';
 
 // we don't have the types for waitFor just yet, so using "as waitFor" until when we do
 import { wait as waitFor } from '@testing-library/react';
 
+jest.mock('../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline');
+jest.mock('../../containers/use_post_case');
+
 jest.mock(
   '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form'
 );
+
+jest.mock(
+  '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form_data'
+);
+
 jest.mock('../../containers/use_get_tags');
 jest.mock(
   '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider',
@@ -35,7 +42,8 @@ jest.mock(
   })
 );
 
-export const useFormMock = useForm as jest.Mock;
+const useFormMock = useForm as jest.Mock;
+const useFormDataMock = useFormData as jest.Mock;
 
 const useInsertTimelineMock = useInsertTimeline as jest.Mock;
 const usePostCaseMock = usePostCase as jest.Mock;
@@ -83,6 +91,7 @@ describe('Create case', () => {
     useInsertTimelineMock.mockImplementation(() => defaultInsertTimeline);
     usePostCaseMock.mockImplementation(() => defaultPostCase);
     useFormMock.mockImplementation(() => ({ form: formHookMock }));
+    useFormDataMock.mockImplementation(() => [{ description: sampleData.description }]);
     jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
     (useGetTags as jest.Mock).mockImplementation(() => ({
       tags: sampleTags,
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
index 31e6da4269ead..3c3cc95218b03 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
@@ -24,6 +24,7 @@ import {
   useForm,
   UseField,
   FormDataProvider,
+  useFormData,
 } from '../../../shared_imports';
 import { usePostCase } from '../../containers/use_post_case';
 import { schema } from './schema';
@@ -69,13 +70,18 @@ export const Create = React.memo(() => {
     options: { stripEmptyFields: false },
     schema,
   });
-  const { submit } = form;
+
+  const fieldName = 'description';
+  const { submit, setFieldValue } = form;
+  const [{ description }] = useFormData({ form, watch: [fieldName] });
+
   const { tags: tagOptions } = useGetTags();
   const [options, setOptions] = useState(
     tagOptions.map((label) => ({
       label,
     }))
   );
+
   useEffect(
     () =>
       setOptions(
@@ -85,10 +91,16 @@ export const Create = React.memo(() => {
       ),
     [tagOptions]
   );
-  const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<CasePostRequest>(
-    form,
-    'description'
+
+  const onDescriptionChange = useCallback((newValue) => setFieldValue(fieldName, newValue), [
+    setFieldValue,
+  ]);
+
+  const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline(
+    description,
+    onDescriptionChange
   );
+
   const handleTimelineClick = useTimelineClick();
 
   const onSubmit = useCallback(async () => {
@@ -141,7 +153,7 @@ export const Create = React.memo(() => {
         </Container>
         <ContainerBig>
           <UseField
-            path="description"
+            path={fieldName}
             component={MarkdownEditorForm}
             componentProps={{
               dataTestSubj: 'caseDescription',
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
index 9cf13b6f9930a..d67c364bbda10 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.test.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { mount } from 'enzyme';
 
 import { Router, routeData, mockHistory, mockLocation } from '../__mock__/router';
-import { getFormMock, useFormMock } from '../__mock__/form';
+import { getFormMock, useFormMock, useFormDataMock } from '../__mock__/form';
 import { useUpdateComment } from '../../containers/use_update_comment';
 import { basicCase, basicPush, getUserAction } from '../../containers/mock';
 import { UserActionTree } from '.';
@@ -49,6 +49,7 @@ describe('UserActionTree ', () => {
     }));
     const formHookMock = getFormMock(sampleData);
     useFormMock.mockImplementation(() => ({ form: formHookMock }));
+    useFormDataMock.mockImplementation(() => [{ content: sampleData.content, comment: '' }]);
     jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
   });
 
@@ -69,7 +70,8 @@ describe('UserActionTree ', () => {
       defaultProps.data.createdBy.username
     );
   });
-  it('Renders service now update line with top and bottom when push is required', () => {
+
+  it('Renders service now update line with top and bottom when push is required', async () => {
     const ourActions = [
       getUserAction(['pushed'], 'push-to-service'),
       getUserAction(['comment'], 'update'),
@@ -87,6 +89,7 @@ describe('UserActionTree ', () => {
       },
       caseUserActions: ourActions,
     };
+
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -94,10 +97,16 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
+
+    await act(async () => {
+      wrapper.update();
+    });
+
     expect(wrapper.find(`[data-test-subj="show-top-footer"]`).exists()).toBeTruthy();
     expect(wrapper.find(`[data-test-subj="show-bottom-footer"]`).exists()).toBeTruthy();
   });
-  it('Renders service now update line with top only when push is up to date', () => {
+
+  it('Renders service now update line with top only when push is up to date', async () => {
     const ourActions = [getUserAction(['pushed'], 'push-to-service')];
     const props = {
       ...defaultProps,
@@ -112,6 +121,7 @@ describe('UserActionTree ', () => {
         },
       },
     };
+
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -119,16 +129,22 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
+
+    await act(async () => {
+      wrapper.update();
+    });
+
     expect(wrapper.find(`[data-test-subj="show-top-footer"]`).exists()).toBeTruthy();
     expect(wrapper.find(`[data-test-subj="show-bottom-footer"]`).exists()).toBeFalsy();
   });
 
-  it('Outlines comment when update move to link is clicked', () => {
+  it('Outlines comment when update move to link is clicked', async () => {
     const ourActions = [getUserAction(['comment'], 'create'), getUserAction(['comment'], 'update')];
     const props = {
       ...defaultProps,
       caseUserActions: ourActions,
     };
+
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -136,6 +152,11 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
+
+    await act(async () => {
+      wrapper.update();
+    });
+
     expect(
       wrapper.find(`[data-test-subj="comment-create-action"]`).first().prop('idToOutline')
     ).toEqual('');
@@ -148,12 +169,13 @@ describe('UserActionTree ', () => {
     ).toEqual(ourActions[0].commentId);
   });
 
-  it('Switches to markdown when edit is clicked and back to panel when canceled', () => {
+  it('Switches to markdown when edit is clicked and back to panel when canceled', async () => {
     const ourActions = [getUserAction(['comment'], 'create')];
     const props = {
       ...defaultProps,
       caseUserActions: ourActions,
     };
+
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -161,6 +183,11 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
+
+    await act(async () => {
+      wrapper.update();
+    });
+
     expect(
       wrapper
         .find(
@@ -168,14 +195,17 @@ describe('UserActionTree ', () => {
         )
         .exists()
     ).toEqual(false);
+
     wrapper
       .find(`[data-test-subj="comment-create-action"] [data-test-subj="property-actions-ellipses"]`)
       .first()
       .simulate('click');
+
     wrapper
       .find(`[data-test-subj="comment-create-action"] [data-test-subj="property-actions-pencil"]`)
       .first()
       .simulate('click');
+
     expect(
       wrapper
         .find(
@@ -183,12 +213,14 @@ describe('UserActionTree ', () => {
         )
         .exists()
     ).toEqual(true);
+
     wrapper
       .find(
         `[data-test-subj="user-action-${props.data.comments[0].id}"] [data-test-subj="user-action-cancel-markdown"]`
       )
       .first()
       .simulate('click');
+
     expect(
       wrapper
         .find(
@@ -299,23 +331,35 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
-    wrapper
-      .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`)
-      .first()
-      .simulate('click');
+
+    await act(async () => {
+      await waitFor(() => {
+        wrapper
+          .find(
+            `[data-test-subj="description-action"] [data-test-subj="property-actions-ellipses"]`
+          )
+          .first()
+          .simulate('click');
+        wrapper.update();
+      });
+    });
+
     wrapper
       .find(`[data-test-subj="description-action"] [data-test-subj="property-actions-quote"]`)
       .first()
       .simulate('click');
+
     expect(setFieldValue).toBeCalledWith('comment', `> ${props.data.description} \n`);
   });
-  it('Outlines comment when url param is provided', () => {
+
+  it('Outlines comment when url param is provided', async () => {
     const commentId = 'neat-comment-id';
     const ourActions = [getUserAction(['comment'], 'create')];
     const props = {
       ...defaultProps,
       caseUserActions: ourActions,
     };
+
     jest.spyOn(routeData, 'useParams').mockReturnValue({ commentId });
     const wrapper = mount(
       <TestProviders>
@@ -324,6 +368,11 @@ describe('UserActionTree ', () => {
         </Router>
       </TestProviders>
     );
+
+    await act(async () => {
+      wrapper.update();
+    });
+
     expect(
       wrapper.find(`[data-test-subj="comment-create-action"]`).first().prop('idToOutline')
     ).toEqual(commentId);
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
index da081fea5eac0..ac2ad179ec60c 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
@@ -10,7 +10,7 @@ import styled from 'styled-components';
 
 import * as i18n from '../case_view/translations';
 import { Markdown } from '../../../common/components/markdown';
-import { Form, useForm, UseField } from '../../../shared_imports';
+import { Form, useForm, UseField, useFormData } from '../../../shared_imports';
 import { schema, Content } from './schema';
 import { InsertTimelinePopover } from '../../../timelines/components/timeline/insert_timeline_popover';
 import { useInsertTimeline } from '../../../timelines/components/timeline/insert_timeline_popover/use_insert_timeline';
@@ -41,11 +41,20 @@ export const UserActionMarkdown = ({
     options: { stripEmptyFields: false },
     schema,
   });
-  const { submit } = form;
-  const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<Content>(
-    form,
-    'content'
+
+  const fieldName = 'content';
+  const { submit, setFieldValue } = form;
+  const [{ content: contentFormValue }] = useFormData({ form, watch: [fieldName] });
+
+  const onContentChange = useCallback((newValue) => setFieldValue(fieldName, newValue), [
+    setFieldValue,
+  ]);
+
+  const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline(
+    contentFormValue,
+    onContentChange
   );
+
   const handleCancelAction = useCallback(() => {
     onChangeEditable(id);
   }, [id, onChangeEditable]);
@@ -93,7 +102,7 @@ export const UserActionMarkdown = ({
   return isEditable ? (
     <Form form={form} data-test-subj="user-action-markdown-form">
       <UseField
-        path="content"
+        path={fieldName}
         component={MarkdownEditorForm}
         componentProps={{
           bottomRightContent: renderButtons({
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
index c1befabdd7809..bcbad2dfee9f0 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
@@ -308,10 +308,11 @@ export const AddExceptionModal = memo(function AddExceptionModal({
       const alertIdToClose = shouldCloseAlert && alertData ? alertData.ecsData._id : undefined;
       const bulkCloseIndex =
         shouldBulkCloseAlert && signalIndexName !== null ? [signalIndexName] : undefined;
-      addOrUpdateExceptionItems(enrichExceptionItems(), alertIdToClose, bulkCloseIndex);
+      addOrUpdateExceptionItems(ruleId, enrichExceptionItems(), alertIdToClose, bulkCloseIndex);
     }
   }, [
     addOrUpdateExceptionItems,
+    ruleId,
     enrichExceptionItems,
     shouldCloseAlert,
     shouldBulkCloseAlert,
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/translations.ts b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/translations.ts
index 2e9bced21fe71..2fe73982e0faf 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/translations.ts
@@ -63,8 +63,7 @@ export const ENDPOINT_QUARANTINE_TEXT = i18n.translate(
 export const BULK_CLOSE_LABEL = i18n.translate(
   'xpack.securitySolution.exceptions.addException.bulkCloseLabel',
   {
-    defaultMessage:
-      'Close all alerts that match this exception, including alerts generated by other rules',
+    defaultMessage: 'Close all alerts that match this exception and were generated by this rule',
   }
 );
 
@@ -72,7 +71,7 @@ export const BULK_CLOSE_LABEL_DISABLED = i18n.translate(
   'xpack.securitySolution.exceptions.addException.bulkCloseLabel.disabled',
   {
     defaultMessage:
-      'Close all alerts that match attributes in this exception (Lists and non-ECS fields are not supported)',
+      'Close all alerts that match this exception and were generated by this rule (Lists and non-ECS fields are not supported)',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
index 41fc6ba57d715..5dbf319c3299d 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
@@ -240,9 +240,15 @@ export const EditExceptionModal = memo(function EditExceptionModal({
     if (addOrUpdateExceptionItems !== null) {
       const bulkCloseIndex =
         shouldBulkCloseAlert && signalIndexName !== null ? [signalIndexName] : undefined;
-      addOrUpdateExceptionItems(enrichExceptionItems(), undefined, bulkCloseIndex);
+      addOrUpdateExceptionItems(ruleId, enrichExceptionItems(), undefined, bulkCloseIndex);
     }
-  }, [addOrUpdateExceptionItems, enrichExceptionItems, shouldBulkCloseAlert, signalIndexName]);
+  }, [
+    addOrUpdateExceptionItems,
+    ruleId,
+    enrichExceptionItems,
+    shouldBulkCloseAlert,
+    signalIndexName,
+  ]);
 
   return (
     <EuiOverlayMask onClick={onCancel}>
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/translations.ts b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/translations.ts
index 1452003d8f8b8..7c6750f81f84b 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/translations.ts
@@ -48,8 +48,7 @@ export const EDIT_EXCEPTION_SUCCESS = i18n.translate(
 export const BULK_CLOSE_LABEL = i18n.translate(
   'xpack.securitySolution.exceptions.editException.bulkCloseLabel',
   {
-    defaultMessage:
-      'Close all alerts that match this exception, including alerts generated by other rules',
+    defaultMessage: 'Close all alerts that match this exception and were generated by this rule',
   }
 );
 
@@ -57,7 +56,7 @@ export const BULK_CLOSE_LABEL_DISABLED = i18n.translate(
   'xpack.securitySolution.exceptions.editException.bulkCloseLabel.disabled',
   {
     defaultMessage:
-      'Close all alerts that match attributes in this exception (Lists and non-ECS fields are not supported)',
+      'Close all alerts that match this exception and were generated by this rule (Lists and non-ECS fields are not supported)',
   }
 );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
index 2398f8d799c2c..3de949a05c881 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
@@ -11,7 +11,7 @@ import { KibanaServices } from '../../../common/lib/kibana';
 import * as alertsApi from '../../../detections/containers/detection_engine/alerts/api';
 import * as listsApi from '../../../../../lists/public/exceptions/api';
 import * as getQueryFilterHelper from '../../../../common/detection_engine/get_query_filter';
-import * as buildAlertStatusFilterHelper from '../../../detections/components/alerts_table/default_config';
+import * as buildFilterHelpers from '../../../detections/components/alerts_table/default_config';
 import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
 import { getCreateExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/request/create_exception_list_item_schema.mock';
 import { getUpdateExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/request/update_exception_list_item_schema.mock';
@@ -42,12 +42,16 @@ describe('useAddOrUpdateException', () => {
   >>;
   let getQueryFilter: jest.SpyInstance<ReturnType<typeof getQueryFilterHelper.getQueryFilter>>;
   let buildAlertStatusFilter: jest.SpyInstance<ReturnType<
-    typeof buildAlertStatusFilterHelper.buildAlertStatusFilter
+    typeof buildFilterHelpers.buildAlertStatusFilter
+  >>;
+  let buildAlertsRuleIdFilter: jest.SpyInstance<ReturnType<
+    typeof buildFilterHelpers.buildAlertsRuleIdFilter
   >>;
   let addOrUpdateItemsArgs: Parameters<AddOrUpdateExceptionItemsFunc>;
   let render: () => RenderHookResult<UseAddOrUpdateExceptionProps, ReturnUseAddOrUpdateException>;
   const onError = jest.fn();
   const onSuccess = jest.fn();
+  const ruleId = 'rule-id';
   const alertIdToClose = 'idToClose';
   const bulkCloseIndex = ['.custom'];
   const itemsToAdd: CreateExceptionListItemSchema[] = [
@@ -122,9 +126,11 @@ describe('useAddOrUpdateException', () => {
 
     getQueryFilter = jest.spyOn(getQueryFilterHelper, 'getQueryFilter');
 
-    buildAlertStatusFilter = jest.spyOn(buildAlertStatusFilterHelper, 'buildAlertStatusFilter');
+    buildAlertStatusFilter = jest.spyOn(buildFilterHelpers, 'buildAlertStatusFilter');
+
+    buildAlertsRuleIdFilter = jest.spyOn(buildFilterHelpers, 'buildAlertsRuleIdFilter');
 
-    addOrUpdateItemsArgs = [itemsToAddOrUpdate];
+    addOrUpdateItemsArgs = [ruleId, itemsToAddOrUpdate];
     render = () =>
       renderHook<UseAddOrUpdateExceptionProps, ReturnUseAddOrUpdateException>(() =>
         useAddOrUpdateException({
@@ -247,7 +253,7 @@ describe('useAddOrUpdateException', () => {
 
   describe('when alertIdToClose is passed in', () => {
     beforeEach(() => {
-      addOrUpdateItemsArgs = [itemsToAddOrUpdate, alertIdToClose];
+      addOrUpdateItemsArgs = [ruleId, itemsToAddOrUpdate, alertIdToClose];
     });
     it('should update the alert status', async () => {
       await act(async () => {
@@ -302,7 +308,7 @@ describe('useAddOrUpdateException', () => {
 
   describe('when bulkCloseIndex is passed in', () => {
     beforeEach(() => {
-      addOrUpdateItemsArgs = [itemsToAddOrUpdate, undefined, bulkCloseIndex];
+      addOrUpdateItemsArgs = [ruleId, itemsToAddOrUpdate, undefined, bulkCloseIndex];
     });
     it('should update the status of only alerts that are open', async () => {
       await act(async () => {
@@ -320,6 +326,22 @@ describe('useAddOrUpdateException', () => {
         expect(buildAlertStatusFilter.mock.calls[0][0]).toEqual('open');
       });
     });
+    it('should update the status of only alerts generated by the provided rule', async () => {
+      await act(async () => {
+        const { rerender, result, waitForNextUpdate } = render();
+        const addOrUpdateItems = await waitForAddOrUpdateFunc({
+          rerender,
+          result,
+          waitForNextUpdate,
+        });
+        if (addOrUpdateItems) {
+          addOrUpdateItems(...addOrUpdateItemsArgs);
+        }
+        await waitForNextUpdate();
+        expect(buildAlertsRuleIdFilter).toHaveBeenCalledTimes(1);
+        expect(buildAlertsRuleIdFilter.mock.calls[0][0]).toEqual(ruleId);
+      });
+    });
     it('should generate the query filter using exceptions', async () => {
       await act(async () => {
         const { rerender, result, waitForNextUpdate } = render();
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
index dbd634e97a328..71cdebf21d801 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
@@ -17,7 +17,10 @@ import {
 } from '../../../lists_plugin_deps';
 import { updateAlertStatus } from '../../../detections/containers/detection_engine/alerts/api';
 import { getUpdateAlertsQuery } from '../../../detections/components/alerts_table/actions';
-import { buildAlertStatusFilter } from '../../../detections/components/alerts_table/default_config';
+import {
+  buildAlertStatusFilter,
+  buildAlertsRuleIdFilter,
+} from '../../../detections/components/alerts_table/default_config';
 import { getQueryFilter } from '../../../../common/detection_engine/get_query_filter';
 import { Index } from '../../../../common/detection_engine/schemas/common/schemas';
 import { formatExceptionItemForUpdate, prepareExceptionItemsForBulkClose } from './helpers';
@@ -25,12 +28,14 @@ import { formatExceptionItemForUpdate, prepareExceptionItemsForBulkClose } from
 /**
  * Adds exception items to the list. Also optionally closes alerts.
  *
+ * @param ruleId id of the rule where the exception updates will be applied
  * @param exceptionItemsToAddOrUpdate array of ExceptionListItemSchema to add or update
  * @param alertIdToClose - optional string representing alert to close
  * @param bulkCloseIndex - optional index used to create bulk close query
  *
  */
 export type AddOrUpdateExceptionItemsFunc = (
+  ruleId: string,
   exceptionItemsToAddOrUpdate: Array<ExceptionListItemSchema | CreateExceptionListItemSchema>,
   alertIdToClose?: string,
   bulkCloseIndex?: Index
@@ -63,9 +68,10 @@ export const useAddOrUpdateException = ({
   const [isLoading, setIsLoading] = useState(false);
   const addOrUpdateExceptionRef = useRef<AddOrUpdateExceptionItemsFunc | null>(null);
   const addOrUpdateException = useCallback<AddOrUpdateExceptionItemsFunc>(
-    async (exceptionItemsToAddOrUpdate, alertIdToClose, bulkCloseIndex) => {
+    async (ruleId, exceptionItemsToAddOrUpdate, alertIdToClose, bulkCloseIndex) => {
       if (addOrUpdateExceptionRef.current !== null) {
         addOrUpdateExceptionRef.current(
+          ruleId,
           exceptionItemsToAddOrUpdate,
           alertIdToClose,
           bulkCloseIndex
@@ -117,6 +123,7 @@ export const useAddOrUpdateException = ({
     };
 
     const addOrUpdateExceptionItems: AddOrUpdateExceptionItemsFunc = async (
+      ruleId,
       exceptionItemsToAddOrUpdate,
       alertIdToClose,
       bulkCloseIndex
@@ -137,7 +144,7 @@ export const useAddOrUpdateException = ({
           const filter = getQueryFilter(
             '',
             'kuery',
-            buildAlertStatusFilter('open'),
+            [...buildAlertsRuleIdFilter(ruleId), ...buildAlertStatusFilter('open')],
             bulkCloseIndex,
             prepareExceptionItemsForBulkClose(exceptionItemsToAddOrUpdate),
             false
diff --git a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
index 8a78706e17a4c..664d8b2ff5598 100644
--- a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
@@ -23,7 +23,7 @@ import {
 import { BarChart } from '../charts/barchart';
 import { AreaChart } from '../charts/areachart';
 import { EuiHorizontalRule } from '@elastic/eui';
-import { fieldTitleChartMapping } from '../../../network/components/kpi_network';
+import { fieldsMapping as fieldTitleChartMapping } from '../../../network/components/kpi_network/unique_private_ips';
 import {
   mockData,
   mockEnableChartsData,
@@ -39,7 +39,8 @@ import {
 } from '../../mock';
 import { State, createStore } from '../../store';
 import { Provider as ReduxStoreProvider } from 'react-redux';
-import { KpiNetworkData, KpiHostsData } from '../../../graphql/types';
+import { KpiHostsData } from '../../../graphql/types';
+import { NetworkKpiStrategyResponse } from '../../../../common/search_strategy';
 
 const from = '2019-06-15T06:00:00.000Z';
 const to = '2019-06-18T06:00:00.000Z';
@@ -74,7 +75,6 @@ describe('Stat Items Component', () => {
               fields={[{ key: 'hosts', value: null, color: '#6092C0', icon: 'cross' }]}
               from={from}
               id="statItems"
-              index={0}
               key="mock-keys"
               to={to}
               narrowDateRange={mockNarrowDateRange}
@@ -94,7 +94,6 @@ describe('Stat Items Component', () => {
               fields={[{ key: 'hosts', value: null, color: '#6092C0', icon: 'cross' }]}
               from={from}
               id="statItems"
-              index={0}
               key="mock-keys"
               to={to}
               narrowDateRange={mockNarrowDateRange}
@@ -176,7 +175,6 @@ describe('Stat Items Component', () => {
       ],
       from,
       id: 'statItems',
-      index: 0,
       key: 'mock-keys',
       to,
       narrowDateRange: mockNarrowDateRange,
@@ -214,41 +212,37 @@ describe('Stat Items Component', () => {
 
 describe('addValueToFields', () => {
   const mockNetworkMappings = fieldTitleChartMapping[0];
-  const mockKpiNetworkData = mockData.KpiNetwork;
   test('should update value from data', () => {
-    const result = addValueToFields(mockNetworkMappings.fields, mockKpiNetworkData);
+    const result = addValueToFields(mockNetworkMappings.fields, mockData);
     expect(result).toEqual(mockEnableChartsData.fields);
   });
 });
 
 describe('addValueToAreaChart', () => {
   const mockNetworkMappings = fieldTitleChartMapping[0];
-  const mockKpiNetworkData = mockData.KpiNetwork;
   test('should add areaChart from data', () => {
-    const result = addValueToAreaChart(mockNetworkMappings.fields, mockKpiNetworkData);
+    const result = addValueToAreaChart(mockNetworkMappings.fields, mockData);
     expect(result).toEqual(mockEnableChartsData.areaChart);
   });
 });
 
 describe('addValueToBarChart', () => {
   const mockNetworkMappings = fieldTitleChartMapping[0];
-  const mockKpiNetworkData = mockData.KpiNetwork;
   test('should add areaChart from data', () => {
-    const result = addValueToBarChart(mockNetworkMappings.fields, mockKpiNetworkData);
+    const result = addValueToBarChart(mockNetworkMappings.fields, mockData);
     expect(result).toEqual(mockEnableChartsData.barChart);
   });
 });
 
 describe('useKpiMatrixStatus', () => {
   const mockNetworkMappings = fieldTitleChartMapping;
-  const mockKpiNetworkData = mockData.KpiNetwork;
   const MockChildComponent = (mappedStatItemProps: StatItemsProps) => <span />;
   const MockHookWrapperComponent = ({
     fieldsMapping,
     data,
   }: {
     fieldsMapping: Readonly<StatItems[]>;
-    data: KpiNetworkData | KpiHostsData;
+    data: NetworkKpiStrategyResponse | KpiHostsData;
   }) => {
     const statItemsProps: StatItemsProps[] = useKpiMatrixStatus(
       fieldsMapping,
@@ -271,7 +265,7 @@ describe('useKpiMatrixStatus', () => {
   test('it updates status correctly', () => {
     const wrapper = mount(
       <>
-        <MockHookWrapperComponent fieldsMapping={mockNetworkMappings} data={mockKpiNetworkData} />
+        <MockHookWrapperComponent fieldsMapping={mockNetworkMappings} data={mockData} />
       </>
     );
 
@@ -281,7 +275,7 @@ describe('useKpiMatrixStatus', () => {
   test('it should not append areaChart if enableAreaChart is off', () => {
     const wrapper = mount(
       <>
-        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockKpiNetworkData} />
+        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockData} />
       </>
     );
 
@@ -291,7 +285,7 @@ describe('useKpiMatrixStatus', () => {
   test('it should not append barChart if enableBarChart is off', () => {
     const wrapper = mount(
       <>
-        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockKpiNetworkData} />
+        <MockHookWrapperComponent fieldsMapping={mockNoChartMappings} data={mockData} />
       </>
     );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx b/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx
index 183f89d9320f3..13a93a784a2c9 100644
--- a/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx
@@ -18,7 +18,8 @@ import { get, getOr } from 'lodash/fp';
 import React, { useState, useEffect } from 'react';
 import styled from 'styled-components';
 
-import { KpiHostsData, KpiNetworkData } from '../../../graphql/types';
+import { NetworkKpiStrategyResponse } from '../../../../common/search_strategy';
+import { KpiHostsData } from '../../../graphql/types';
 import { AreaChart } from '../charts/areachart';
 import { BarChart } from '../charts/barchart';
 import { ChartSeriesData, ChartData, ChartSeriesConfigs, UpdateDateRange } from '../charts/common';
@@ -58,7 +59,7 @@ export interface StatItems {
   enableBarChart?: boolean;
   fields: StatItem[];
   grow?: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | true | false | null;
-  index: number;
+  index?: number;
   key: string;
   statKey?: string;
 }
@@ -112,12 +113,12 @@ export const barchartConfigs = (config?: { onElementClick?: ElementClickListener
 
 export const addValueToFields = (
   fields: StatItem[],
-  data: KpiHostsData | KpiNetworkData
+  data: KpiHostsData | NetworkKpiStrategyResponse
 ): StatItem[] => fields.map((field) => ({ ...field, value: get(field.key, data) }));
 
 export const addValueToAreaChart = (
   fields: StatItem[],
-  data: KpiHostsData | KpiNetworkData
+  data: KpiHostsData | NetworkKpiStrategyResponse
 ): ChartSeriesData[] =>
   fields
     .filter((field) => get(`${field.key}Histogram`, data) != null)
@@ -129,7 +130,7 @@ export const addValueToAreaChart = (
 
 export const addValueToBarChart = (
   fields: StatItem[],
-  data: KpiHostsData | KpiNetworkData
+  data: KpiHostsData | NetworkKpiStrategyResponse
 ): ChartSeriesData[] => {
   if (fields.length === 0) return [];
   return fields.reduce((acc: ChartSeriesData[], field: StatItem, idx: number) => {
@@ -158,7 +159,7 @@ export const addValueToBarChart = (
 
 export const useKpiMatrixStatus = (
   mappings: Readonly<StatItems[]>,
-  data: KpiHostsData | KpiNetworkData,
+  data: KpiHostsData | NetworkKpiStrategyResponse,
   id: string,
   from: string,
   to: string,
diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index 5a4eaad72ac32..8c186addf783d 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -77,11 +77,11 @@ const TestProvidersComponent: React.FC<Props> = ({
 
 export const TestProviders = React.memo(TestProvidersComponent);
 
-export const useFormFieldMock = (options?: Partial<FieldHook>): FieldHook => {
+export const useFormFieldMock = <T,>(options?: Partial<FieldHook<T>>): FieldHook<T> => {
   return {
     path: 'path',
     type: 'type',
-    value: [],
+    value: ('mockedValue' as unknown) as T,
     isPristine: false,
     isValidating: false,
     isValidated: false,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx
index 890e66c8767c4..362dfed4b8e72 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/add_item_form/index.test.tsx
@@ -13,7 +13,7 @@ import { useFormFieldMock } from '../../../../common/mock/test_providers';
 describe('AddItem', () => {
   it('renders correctly', () => {
     const Component = () => {
-      const field = useFormFieldMock();
+      const field = useFormFieldMock<unknown>({ value: [] });
 
       return (
         <AddItem
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
index 680ca78fc222e..0c866ae0bd926 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx
@@ -383,6 +383,14 @@ export const buildRuleTypeDescription = (label: string, ruleType: Type): ListIte
         },
       ];
     }
+    case 'eql': {
+      return [
+        {
+          title: label,
+          description: i18n.EQL_TYPE_DESCRIPTION,
+        },
+      ];
+    }
     default:
       return assertUnreachable(ruleType);
   }
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx
index 76217964a87cb..124ef9e648403 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/translations.tsx
@@ -34,6 +34,13 @@ export const ML_TYPE_DESCRIPTION = i18n.translate(
   }
 );
 
+export const EQL_TYPE_DESCRIPTION = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.eqlRuleTypeDescription',
+  {
+    defaultMessage: 'Event Correlation',
+  }
+);
+
 export const QUERY_TYPE_DESCRIPTION = i18n.translate(
   'xpack.securitySolution.detectionEngine.createRule.queryRuleTypeDescription',
   {
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx
new file mode 100644
index 0000000000000..331c0ba4c4491
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.test.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow, mount } from 'enzyme';
+
+import { useFormFieldMock } from '../../../../common/mock';
+import { mockQueryBar } from '../../../pages/detection_engine/rules/all/__mocks__/mock';
+import { EqlQueryBar, EqlQueryBarProps } from './eql_query_bar';
+
+describe('EqlQueryBar', () => {
+  let mockField: EqlQueryBarProps['field'];
+
+  beforeEach(() => {
+    mockField = useFormFieldMock({
+      value: mockQueryBar,
+    });
+  });
+
+  it('renders correctly', () => {
+    const wrapper = shallow(<EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />);
+
+    expect(wrapper.find('[data-test-subj="myQueryBar"]')).toHaveLength(1);
+  });
+
+  it('sets the field value on input change', () => {
+    const wrapper = mount(<EqlQueryBar dataTestSubj="myQueryBar" field={mockField} />);
+
+    wrapper
+      .find('[data-test-subj="eqlQueryBarTextInput"]')
+      .first()
+      .simulate('change', { target: { value: 'newQuery' } });
+
+    const expected = {
+      filters: [],
+      query: {
+        query: 'newQuery',
+        language: 'eql',
+      },
+    };
+
+    expect(mockField.setValue).toHaveBeenCalledWith(expected);
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.tsx
new file mode 100644
index 0000000000000..e3f33ea9b9b87
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/eql_query_bar.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC, useCallback, ChangeEvent } from 'react';
+import { EuiFormRow, EuiTextArea } from '@elastic/eui';
+
+import { FieldHook, getFieldValidityAndErrorMessage } from '../../../../shared_imports';
+import { DefineStepRule } from '../../../pages/detection_engine/rules/types';
+
+export interface EqlQueryBarProps {
+  dataTestSubj: string;
+  field: FieldHook<DefineStepRule['queryBar']>;
+  idAria?: string;
+}
+
+export const EqlQueryBar: FC<EqlQueryBarProps> = ({ dataTestSubj, field, idAria }) => {
+  const { setValue } = field;
+  const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+  const fieldValue = field.value.query.query as string;
+
+  const handleChange = useCallback(
+    (e: ChangeEvent<HTMLTextAreaElement>) => {
+      const newQuery = e.target.value;
+
+      setValue({
+        filters: [],
+        query: {
+          query: newQuery,
+          language: 'eql',
+        },
+      });
+    },
+    [setValue]
+  );
+
+  return (
+    <EuiFormRow
+      label={field.label}
+      labelAppend={field.labelAppend}
+      helpText={field.helpText}
+      error={errorMessage}
+      isInvalid={isInvalid}
+      fullWidth
+      data-test-subj={dataTestSubj}
+      describedByIds={idAria ? [idAria] : undefined}
+    >
+      <EuiTextArea
+        data-test-subj="eqlQueryBarTextInput"
+        fullWidth
+        isInvalid={isInvalid}
+        value={fieldValue}
+        onChange={handleChange}
+      />
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/index.ts b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/index.ts
new file mode 100644
index 0000000000000..fcbe069c1f57f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { EqlQueryBar } from './eql_query_bar';
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx
index ecf1bda807b68..23b3519cee582 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/mitre/index.test.tsx
@@ -13,7 +13,7 @@ import { useFormFieldMock } from '../../../../common/mock';
 describe('AddMitreThreat', () => {
   it('renders correctly', () => {
     const Component = () => {
-      const field = useFormFieldMock();
+      const field = useFormFieldMock<unknown>({ value: [] });
 
       return (
         <AddMitreThreat
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/schedule_item_form/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/schedule_item_form/index.tsx
index bb33767f4f5d5..867be1c1270e8 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/schedule_item_form/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/schedule_item_form/index.tsx
@@ -145,6 +145,7 @@ export const ScheduleItem = ({
       <EuiFormControlLayout
         append={
           <MyEuiSelect
+            data-test-subj="schedule-units-input"
             fullWidth={false}
             options={timeTypeOptions}
             onChange={onChangeTimeType}
@@ -154,6 +155,7 @@ export const ScheduleItem = ({
         }
       >
         <EuiFieldNumber
+          data-test-subj="schedule-amount-input"
           fullWidth
           min={minimumValue}
           onChange={onChangeTimeVal}
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
index 6f5f3361d2b3e..169e4f81d3498 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/index.tsx
@@ -8,7 +8,11 @@ import React, { useCallback, useMemo } from 'react';
 import { EuiCard, EuiFlexGrid, EuiFlexItem, EuiFormRow, EuiIcon } from '@elastic/eui';
 
 import { isMlRule } from '../../../../../common/machine_learning/helpers';
-import { isThresholdRule } from '../../../../../common/detection_engine/utils';
+import {
+  isThresholdRule,
+  isEqlRule,
+  isQueryRule,
+} from '../../../../../common/detection_engine/utils';
 import { FieldHook } from '../../../../shared_imports';
 import { useKibana } from '../../../../common/lib/kibana';
 import * as i18n from './translations';
@@ -37,6 +41,7 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
     },
     [field]
   );
+  const setEql = useCallback(() => setType('eql'), [setType]);
   const setMl = useCallback(() => setType('machine_learning'), [setType]);
   const setQuery = useCallback(() => setType('query'), [setType]);
   const setThreshold = useCallback(() => setType('threshold'), [setType]);
@@ -45,11 +50,20 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
     path: '#/management/stack/license_management',
   });
 
+  const eqlSelectableConfig = useMemo(
+    () => ({
+      isDisabled: isReadOnly,
+      onClick: setEql,
+      isSelected: isEqlRule(ruleType),
+    }),
+    [isReadOnly, ruleType, setEql]
+  );
+
   const querySelectableConfig = useMemo(
     () => ({
       isDisabled: isReadOnly,
       onClick: setQuery,
-      isSelected: !isMlRule(ruleType) && !isThresholdRule(ruleType),
+      isSelected: isQueryRule(ruleType),
     }),
     [isReadOnly, ruleType, setQuery]
   );
@@ -114,6 +128,16 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
             selectable={thresholdSelectableConfig}
           />
         </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiCard
+            data-test-subj="eqlRuleType"
+            title={i18n.EQL_TYPE_TITLE}
+            description={i18n.EQL_TYPE_DESCRIPTION}
+            icon={<EuiIcon size="l" type="bullseye" />}
+            isDisabled={eqlSelectableConfig.isDisabled && !eqlSelectableConfig.isSelected}
+            selectable={eqlSelectableConfig}
+          />
+        </EuiFlexItem>
       </EuiFlexGrid>
     </EuiFormRow>
   );
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
index 3b85a7dfc765c..e7b231ca74958 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/select_rule_type/translations.ts
@@ -6,6 +6,21 @@
 
 import { i18n } from '@kbn/i18n';
 
+export const EQL_TYPE_TITLE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.eqlTypeTitle',
+  {
+    defaultMessage: 'Event Correlation',
+  }
+);
+
+export const EQL_TYPE_DESCRIPTION = i18n.translate(
+  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.eqlTypeDescription',
+  {
+    defaultMessage:
+      'Use Event Query Language (EQL) to match events, generate sequences, and stack data',
+  }
+);
+
 export const QUERY_TYPE_TITLE = i18n.translate(
   'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.queryTypeTitle',
   {
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
index 158f323b739e6..7846f0c406668 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
@@ -46,6 +46,8 @@ import {
 } from '../../../../shared_imports';
 import { schema } from './schema';
 import * as i18n from './translations';
+import { isEqlRule, isThresholdRule } from '../../../../../common/detection_engine/utils';
+import { EqlQueryBar } from '../eql_query_bar';
 
 const CommonUseField = getUseField({ component: Field });
 
@@ -123,9 +125,10 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   }) as unknown) as [Partial<DefineStepRule>];
   const index = formIndex || initialState.index;
   const ruleType = formRuleType || initialState.ruleType;
-  const [
-    { browserFields, indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
-  ] = useFetchIndexPatterns(index, RuleStep.defineRule);
+  const [{ browserFields, indexPatterns, isLoading: indexPatternsLoading }] = useFetchIndexPatterns(
+    index,
+    RuleStep.defineRule
+  );
 
   // reset form when rule type changes
   useEffect(() => {
@@ -186,7 +189,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     <StepContentWrapper data-test-subj="definitionRule" addPadding={addPadding}>
       <StepRuleDescription
         columns={descriptionColumns}
-        indexPatterns={indexPatternQueryBar}
+        indexPatterns={indexPatterns}
         schema={filterRuleFieldsForType(schema as typeof schema & RuleFields, ruleType)}
         data={filterRuleFieldsForType(initialState, ruleType)}
       />
@@ -227,31 +230,46 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
                   },
                 }}
               />
-              <UseField
-                path="queryBar"
-                config={{
-                  ...schema.queryBar,
-                  labelAppend: (
-                    <MyLabelButton
-                      data-test-subj="importQueryFromSavedTimeline"
-                      onClick={handleOpenTimelineSearch}
-                    >
-                      {i18n.IMPORT_TIMELINE_QUERY}
-                    </MyLabelButton>
-                  ),
-                }}
-                component={QueryBarDefineRule}
-                componentProps={{
-                  browserFields,
-                  idAria: 'detectionEngineStepDefineRuleQueryBar',
-                  indexPattern: indexPatternQueryBar,
-                  isDisabled: isLoading,
-                  isLoading: indexPatternLoadingQueryBar,
-                  dataTestSubj: 'detectionEngineStepDefineRuleQueryBar',
-                  openTimelineSearch,
-                  onCloseTimelineSearch: handleCloseTimelineSearch,
-                }}
-              />
+              {isEqlRule(ruleType) ? (
+                <UseField
+                  key="EqlQueryBar"
+                  path="queryBar"
+                  component={EqlQueryBar}
+                  componentProps={{
+                    idAria: 'detectionEngineStepDefineRuleEqlQueryBar',
+                    isDisabled: isLoading,
+                    isLoading: indexPatternsLoading,
+                    dataTestSubj: 'detectionEngineStepDefineRuleEqlQueryBar',
+                  }}
+                />
+              ) : (
+                <UseField
+                  key="QueryBarDefineRule"
+                  path="queryBar"
+                  config={{
+                    ...schema.queryBar,
+                    labelAppend: (
+                      <MyLabelButton
+                        data-test-subj="importQueryFromSavedTimeline"
+                        onClick={handleOpenTimelineSearch}
+                      >
+                        {i18n.IMPORT_TIMELINE_QUERY}
+                      </MyLabelButton>
+                    ),
+                  }}
+                  component={QueryBarDefineRule}
+                  componentProps={{
+                    browserFields,
+                    idAria: 'detectionEngineStepDefineRuleQueryBar',
+                    indexPattern: indexPatterns,
+                    isDisabled: isLoading,
+                    isLoading: indexPatternsLoading,
+                    dataTestSubj: 'detectionEngineStepDefineRuleQueryBar',
+                    openTimelineSearch,
+                    onCloseTimelineSearch: handleCloseTimelineSearch,
+                  }}
+                />
+              )}
             </>
           </RuleTypeEuiFormRow>
           <RuleTypeEuiFormRow $isVisible={isMlRule(ruleType)} fullWidth>
@@ -273,7 +291,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
             </>
           </RuleTypeEuiFormRow>
           <RuleTypeEuiFormRow
-            $isVisible={ruleType === 'threshold'}
+            $isVisible={isThresholdRule(ruleType)}
             data-test-subj="thresholdInput"
             fullWidth
           >
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
index 71cfbbf552d84..740cd63496682 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/batch_actions.tsx
@@ -17,6 +17,7 @@ import {
 import { ActionToaster, displayWarningToast } from '../../../../../common/components/toasters';
 import { Rule } from '../../../../containers/detection_engine/rules';
 import * as detectionI18n from '../../translations';
+import { isMlRule } from '../../../../../../common/machine_learning/helpers';
 
 interface GetBatchItems {
   closePopover: () => void;
@@ -62,7 +63,7 @@ export const getBatchItems = ({
         );
 
         const deactivatedIdsNoML = deactivatedIds.filter(
-          (id) => rules.find((r) => r.id === id)?.type !== 'machine_learning' ?? false
+          (id) => !isMlRule(rules.find((r) => r.id === id)?.type)
         );
 
         const mlRuleCount = deactivatedIds.length - deactivatedIdsNoML.length;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
index 866d3e896a71d..3666e16dcbaf8 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/columns.tsx
@@ -47,6 +47,7 @@ export const getActions = (
   reFetchRules: (refreshPrePackagedRule?: boolean) => void
 ) => [
   {
+    'data-test-subj': 'editRuleAction',
     description: i18n.EDIT_RULE_SETTINGS,
     icon: 'controlsHorizontal',
     name: i18n.EDIT_RULE_SETTINGS,
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
index 79488231b29ee..11222a0a95a80 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.test.ts
@@ -241,6 +241,32 @@ describe('helpers', () => {
 
       expect(result).toEqual(expected);
     });
+
+    test('returns query fields if type is eql', () => {
+      const mockStepData: DefineStepRule = {
+        ...mockData,
+        ruleType: 'eql',
+        queryBar: {
+          ...mockData.queryBar,
+          query: {
+            ...mockData.queryBar.query,
+            language: 'eql',
+            query: 'process where process_name == "explorer.exe"',
+          },
+        },
+      };
+      const result: DefineStepRuleJson = formatDefineStepData(mockStepData);
+
+      const expected = {
+        filters: mockStepData.queryBar.filters,
+        index: mockStepData.index,
+        language: 'eql',
+        query: 'process where process_name == "explorer.exe"',
+        type: 'eql',
+      };
+
+      expect(result).toEqual(expect.objectContaining(expected));
+    });
   });
 
   describe('formatScheduleStepData', () => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
index 0137777f8f8f2..2acb3e57c5a3b 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/helpers.ts
@@ -9,9 +9,8 @@ import moment from 'moment';
 import deepmerge from 'deepmerge';
 
 import { NOTIFICATION_THROTTLE_NO_ACTIONS } from '../../../../../../common/constants';
+import { assertUnreachable } from '../../../../../../common/utility_types';
 import { transformAlertToRuleAction } from '../../../../../../common/detection_engine/transform_actions';
-import { isMlRule } from '../../../../../../common/machine_learning/helpers';
-import { isThresholdRule } from '../../../../../../common/detection_engine/utils';
 import { List } from '../../../../../../common/detection_engine/schemas/types';
 import { ENDPOINT_LIST_ID, ExceptionListType, NamespaceType } from '../../../../../shared_imports';
 import { Rule } from '../../../../containers/detection_engine/rules';
@@ -88,16 +87,25 @@ const isThresholdFields = <T>(
 ): fields is ThresholdRuleFields<T> => has('threshold', fields);
 
 export const filterRuleFieldsForType = <T extends RuleFields>(fields: T, type: Type) => {
-  if (isMlRule(type)) {
-    const { index, queryBar, threshold, ...mlRuleFields } = fields;
-    return mlRuleFields;
-  } else if (isThresholdRule(type)) {
-    const { anomalyThreshold, machineLearningJobId, ...thresholdRuleFields } = fields;
-    return thresholdRuleFields;
-  } else {
-    const { anomalyThreshold, machineLearningJobId, threshold, ...queryRuleFields } = fields;
-    return queryRuleFields;
+  switch (type) {
+    case 'machine_learning':
+      const { index, queryBar, threshold, ...mlRuleFields } = fields;
+      return mlRuleFields;
+    case 'threshold':
+      const { anomalyThreshold, machineLearningJobId, ...thresholdRuleFields } = fields;
+      return thresholdRuleFields;
+    case 'query':
+    case 'saved_query':
+    case 'eql':
+      const {
+        anomalyThreshold: _a,
+        machineLearningJobId: _m,
+        threshold: _t,
+        ...queryRuleFields
+      } = fields;
+      return queryRuleFields;
   }
+  assertUnreachable(type);
 };
 
 export const formatDefineStepData = (defineStepData: DefineStepRule): DefineStepRuleJson => {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index 2988e031c4dd6..68799f46eee57 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -390,7 +390,7 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
                     <EuiToolTip
                       position="top"
                       content={
-                        rule?.type === 'machine_learning' && !hasMlPermissions
+                        isMlRule(rule?.type) && !hasMlPermissions
                           ? detectionI18n.ML_RULES_DISABLED_MESSAGE
                           : undefined
                       }
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
index 5f4fd59669103..e2772af72da06 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
@@ -118,6 +118,7 @@ const EditRulePageComponent: FC = () => {
   const tabs = useMemo(
     () => [
       {
+        'data-test-subj': 'edit-rule-define-tab',
         id: RuleStep.defineRule,
         name: ruleI18n.DEFINITION,
         disabled: rule?.immutable,
@@ -140,6 +141,7 @@ const EditRulePageComponent: FC = () => {
         ),
       },
       {
+        'data-test-subj': 'edit-rule-about-tab',
         id: RuleStep.aboutRule,
         name: ruleI18n.ABOUT,
         disabled: rule?.immutable,
@@ -163,6 +165,7 @@ const EditRulePageComponent: FC = () => {
         ),
       },
       {
+        'data-test-subj': 'edit-rule-schedule-tab',
         id: RuleStep.scheduleRule,
         name: ruleI18n.SCHEDULE,
         disabled: rule?.immutable,
@@ -185,6 +188,7 @@ const EditRulePageComponent: FC = () => {
         ),
       },
       {
+        'data-test-subj': 'edit-rule-actions-tab',
         id: RuleStep.ruleActions,
         name: ruleI18n.ACTIONS,
         content: (
@@ -387,6 +391,7 @@ const EditRulePageComponent: FC = () => {
 
           <EuiFlexItem grow={false}>
             <EuiButton
+              data-test-subj="ruleEditSubmitButton"
               fill
               onClick={onSubmit}
               iconType="save"
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
index aab73c5d5a1e5..dbfb0333e48ee 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
@@ -11,7 +11,7 @@ import { useLocation } from 'react-router-dom';
 
 import { ActionVariable } from '../../../../../../triggers_actions_ui/public';
 import { RuleAlertAction } from '../../../../../common/detection_engine/types';
-import { isMlRule } from '../../../../../common/machine_learning/helpers';
+import { assertUnreachable } from '../../../../../common/utility_types';
 import { transformRuleToAlertAction } from '../../../../../common/detection_engine/transform_actions';
 import { Filter } from '../../../../../../../../src/plugins/data/public';
 import { ENDPOINT_LIST_ID } from '../../../../shared_imports';
@@ -310,15 +310,17 @@ export const redirectToDetections = (
 const getRuleSpecificRuleParamKeys = (ruleType: Type) => {
   const queryRuleParams = ['index', 'filters', 'language', 'query', 'saved_id'];
 
-  if (isMlRule(ruleType)) {
-    return ['anomaly_threshold', 'machine_learning_job_id'];
+  switch (ruleType) {
+    case 'machine_learning':
+      return ['anomaly_threshold', 'machine_learning_job_id'];
+    case 'threshold':
+      return ['threshold', ...queryRuleParams];
+    case 'query':
+    case 'saved_query':
+    case 'eql':
+      return queryRuleParams;
   }
-
-  if (ruleType === 'threshold') {
-    return ['threshold', ...queryRuleParams];
-  }
-
-  return queryRuleParams;
+  assertUnreachable(ruleType);
 };
 
 export const getActionMessageRuleParams = (ruleType: Type): string[] => {
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/network/components/kpi_network/__snapshots__/index.test.tsx.snap
index 2f97e45b217f3..49562162e94a8 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/__snapshots__/index.test.tsx.snap
@@ -1,81 +1,12 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`KpiNetwork Component rendering it renders loading icons 1`] = `
-<KpiNetworkComponent
-  data={
-    Object {
-      "dnsQueries": 278,
-      "networkEvents": 16,
-      "tlsHandshakes": 10000,
-      "uniqueDestinationPrivateIps": 18,
-      "uniqueDestinationPrivateIpsHistogram": Array [
-        Object {
-          "x": 1549728000000,
-          "y": 8,
-        },
-        Object {
-          "x": 1549738800000,
-          "y": 0,
-        },
-      ],
-      "uniqueFlowId": 10277307,
-      "uniqueSourcePrivateIps": 383,
-      "uniqueSourcePrivateIpsHistogram": Array [
-        Object {
-          "x": 1549728000000,
-          "y": 8,
-        },
-        Object {
-          "x": 1549738800000,
-          "y": 0,
-        },
-      ],
-    }
-  }
-  from="2019-06-15T06:00:00.000Z"
-  id="kpiNetwork"
-  loading={true}
-  narrowDateRange={[MockFunction]}
-  to="2019-06-18T06:00:00.000Z"
-/>
-`;
-
 exports[`KpiNetwork Component rendering it renders the default widget 1`] = `
 <KpiNetworkComponent
-  data={
-    Object {
-      "dnsQueries": 278,
-      "networkEvents": 16,
-      "tlsHandshakes": 10000,
-      "uniqueDestinationPrivateIps": 18,
-      "uniqueDestinationPrivateIpsHistogram": Array [
-        Object {
-          "x": 1549728000000,
-          "y": 8,
-        },
-        Object {
-          "x": 1549738800000,
-          "y": 0,
-        },
-      ],
-      "uniqueFlowId": 10277307,
-      "uniqueSourcePrivateIps": 383,
-      "uniqueSourcePrivateIpsHistogram": Array [
-        Object {
-          "x": 1549728000000,
-          "y": 8,
-        },
-        Object {
-          "x": 1549738800000,
-          "y": 0,
-        },
-      ],
-    }
-  }
+  filterQuery=""
   from="2019-06-15T06:00:00.000Z"
-  id="kpiNetwork"
-  loading={false}
   narrowDateRange={[MockFunction]}
+  setQuery={[MockFunction]}
+  skip={true}
   to="2019-06-18T06:00:00.000Z"
 />
 `;
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/common/index.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/common/index.tsx
new file mode 100644
index 0000000000000..c4881b0f29a68
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/common/index.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiFlexItem, EuiLoadingSpinner, EuiFlexGroup } from '@elastic/eui';
+import styled from 'styled-components';
+
+import { manageQuery } from '../../../../common/components/page/manage_query';
+import { NetworkKpiStrategyResponse } from '../../../../../common/search_strategy';
+import {
+  StatItemsComponent,
+  StatItemsProps,
+  useKpiMatrixStatus,
+  StatItems,
+} from '../../../../common/components/stat_items';
+import { UpdateDateRange } from '../../../../common/components/charts/common';
+
+const kpiWidgetHeight = 228;
+
+export const FlexGroup = styled(EuiFlexGroup)`
+  min-height: ${kpiWidgetHeight}px;
+`;
+
+FlexGroup.displayName = 'FlexGroup';
+
+export const KpiNetworkBaseComponent = React.memo<{
+  fieldsMapping: Readonly<StatItems[]>;
+  data: NetworkKpiStrategyResponse;
+  loading?: boolean;
+  id: string;
+  from: string;
+  to: string;
+  narrowDateRange: UpdateDateRange;
+}>(({ fieldsMapping, data, id, loading = false, from, to, narrowDateRange }) => {
+  const statItemsProps: StatItemsProps[] = useKpiMatrixStatus(
+    fieldsMapping,
+    data,
+    id,
+    from,
+    to,
+    narrowDateRange
+  );
+
+  if (loading) {
+    return (
+      <FlexGroup justifyContent="center" alignItems="center">
+        <EuiFlexItem grow={false}>
+          <EuiLoadingSpinner size="xl" />
+        </EuiFlexItem>
+      </FlexGroup>
+    );
+  }
+
+  return (
+    <EuiFlexGroup wrap>
+      {statItemsProps.map((mappedStatItemProps) => (
+        <StatItemsComponent {...mappedStatItemProps} />
+      ))}
+    </EuiFlexGroup>
+  );
+});
+
+KpiNetworkBaseComponent.displayName = 'KpiNetworkBaseComponent';
+
+export const KpiNetworkBaseComponentManage = manageQuery(KpiNetworkBaseComponent);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/dns/index.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/dns/index.tsx
new file mode 100644
index 0000000000000..889f3dacc2d98
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/dns/index.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { StatItems } from '../../../../common/components/stat_items';
+import { useNetworkKpiDns } from '../../../containers/kpi_network/dns';
+import { KpiNetworkBaseComponentManage } from '../common';
+import { NetworkKpiProps } from '../types';
+import * as i18n from './translations';
+
+export const fieldsMapping: Readonly<StatItems[]> = [
+  {
+    key: 'dnsQueries',
+    fields: [
+      {
+        key: 'dnsQueries',
+        value: null,
+      },
+    ],
+    description: i18n.DNS_QUERIES,
+  },
+];
+
+const NetworkKpiDnsComponent: React.FC<NetworkKpiProps> = ({
+  filterQuery,
+  from,
+  to,
+  narrowDateRange,
+  setQuery,
+  skip,
+}) => {
+  const [loading, { refetch, id, inspect, ...data }] = useNetworkKpiDns({
+    filterQuery,
+    endDate: to,
+    startDate: from,
+    skip,
+  });
+
+  return (
+    <KpiNetworkBaseComponentManage
+      data={data}
+      id={id}
+      inspect={inspect}
+      loading={loading}
+      fieldsMapping={fieldsMapping}
+      from={from}
+      to={to}
+      narrowDateRange={narrowDateRange}
+      refetch={refetch}
+      setQuery={setQuery}
+    />
+  );
+};
+
+export const NetworkKpiDns = React.memo(NetworkKpiDnsComponent);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/dns/translations.ts b/x-pack/plugins/security_solution/public/network/components/kpi_network/dns/translations.ts
new file mode 100644
index 0000000000000..0a3986fea3d24
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/dns/translations.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const DNS_QUERIES = i18n.translate('xpack.securitySolution.kpiNetwork.dnsQueries.title', {
+  defaultMessage: 'DNS queries',
+});
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
index 18f766f37ade2..2432d32b7b5d5 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
@@ -18,13 +18,17 @@ import {
 import '../../../common/mock/match_media';
 import { createStore, State } from '../../../common/store';
 import { KpiNetworkComponent } from '.';
-import { mockData } from './mock';
 
 describe('KpiNetwork Component', () => {
   const state: State = mockGlobalState;
-  const from = '2019-06-15T06:00:00.000Z';
-  const to = '2019-06-18T06:00:00.000Z';
-  const narrowDateRange = jest.fn();
+  const props = {
+    from: '2019-06-15T06:00:00.000Z',
+    to: '2019-06-18T06:00:00.000Z',
+    narrowDateRange: jest.fn(),
+    filterQuery: '',
+    setQuery: jest.fn(),
+    skip: true,
+  };
 
   const { storage } = createSecuritySolutionStorageMock();
   let store = createStore(
@@ -46,34 +50,10 @@ describe('KpiNetwork Component', () => {
   });
 
   describe('rendering', () => {
-    test('it renders loading icons', () => {
-      const wrapper = shallow(
-        <ReduxStoreProvider store={store}>
-          <KpiNetworkComponent
-            data={mockData.KpiNetwork}
-            from={from}
-            id="kpiNetwork"
-            loading={true}
-            to={to}
-            narrowDateRange={narrowDateRange}
-          />
-        </ReduxStoreProvider>
-      );
-
-      expect(wrapper.find('KpiNetworkComponent')).toMatchSnapshot();
-    });
-
     test('it renders the default widget', () => {
       const wrapper = shallow(
         <ReduxStoreProvider store={store}>
-          <KpiNetworkComponent
-            data={mockData.KpiNetwork}
-            from={from}
-            id="kpiNetwork"
-            loading={false}
-            to={to}
-            narrowDateRange={narrowDateRange}
-          />
+          <KpiNetworkComponent {...props} />
         </ReduxStoreProvider>
       );
 
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.tsx
index dd8979bc02a61..674e592940fa6 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.tsx
@@ -5,195 +5,77 @@
  */
 
 import React from 'react';
+import { EuiFlexItem, EuiFlexGroup, EuiSpacer } from '@elastic/eui';
 
-import {
-  EuiFlexItem,
-  EuiLoadingSpinner,
-  EuiFlexGroup,
-  EuiSpacer,
-  euiPaletteColorBlind,
-} from '@elastic/eui';
-import styled from 'styled-components';
-import { chunk as _chunk } from 'lodash/fp';
+import { NetworkKpiDns } from './dns';
+import { NetworkKpiNetworkEvents } from './network_events';
+import { NetworkKpiTlsHandshakes } from './tls_handshakes';
+import { NetworkKpiUniqueFlows } from './unique_flows';
+import { NetworkKpiUniquePrivateIps } from './unique_private_ips';
+import { NetworkKpiProps } from './types';
 
-import {
-  StatItemsComponent,
-  StatItemsProps,
-  useKpiMatrixStatus,
-  StatItems,
-} from '../../../common/components/stat_items';
-import { KpiNetworkData } from '../../../graphql/types';
-
-import * as i18n from './translations';
-import { UpdateDateRange } from '../../../common/components/charts/common';
-
-const kipsPerRow = 2;
-const kpiWidgetHeight = 228;
-
-const euiVisColorPalette = euiPaletteColorBlind();
-const euiColorVis1 = euiVisColorPalette[1];
-const euiColorVis2 = euiVisColorPalette[2];
-const euiColorVis3 = euiVisColorPalette[3];
-
-interface KpiNetworkProps {
-  data: KpiNetworkData;
-  from: string;
-  id: string;
-  loading: boolean;
-  to: string;
-  narrowDateRange: UpdateDateRange;
-}
-
-export const fieldTitleChartMapping: Readonly<StatItems[]> = [
-  {
-    key: 'UniqueIps',
-    index: 2,
-    fields: [
-      {
-        key: 'uniqueSourcePrivateIps',
-        value: null,
-        name: i18n.SOURCE_CHART_LABEL,
-        description: i18n.SOURCE_UNIT_LABEL,
-        color: euiColorVis2,
-        icon: 'visMapCoordinate',
-      },
-      {
-        key: 'uniqueDestinationPrivateIps',
-        value: null,
-        name: i18n.DESTINATION_CHART_LABEL,
-        description: i18n.DESTINATION_UNIT_LABEL,
-        color: euiColorVis3,
-        icon: 'visMapCoordinate',
-      },
-    ],
-    description: i18n.UNIQUE_PRIVATE_IPS,
-    enableAreaChart: true,
-    enableBarChart: true,
-    grow: 2,
-  },
-];
-
-const fieldTitleMatrixMapping: Readonly<StatItems[]> = [
-  {
-    key: 'networkEvents',
-    index: 0,
-    fields: [
-      {
-        key: 'networkEvents',
-        value: null,
-        color: euiColorVis1,
-      },
-    ],
-    description: i18n.NETWORK_EVENTS,
-    grow: 1,
-  },
-  {
-    key: 'dnsQueries',
-    index: 1,
-    fields: [
-      {
-        key: 'dnsQueries',
-        value: null,
-      },
-    ],
-    description: i18n.DNS_QUERIES,
-  },
-  {
-    key: 'uniqueFlowId',
-    index: 3,
-    fields: [
-      {
-        key: 'uniqueFlowId',
-        value: null,
-      },
-    ],
-    description: i18n.UNIQUE_FLOW_IDS,
-  },
-  {
-    key: 'tlsHandshakes',
-    index: 4,
-    fields: [
-      {
-        key: 'tlsHandshakes',
-        value: null,
-      },
-    ],
-    description: i18n.TLS_HANDSHAKES,
-  },
-];
-
-const FlexGroup = styled(EuiFlexGroup)`
-  min-height: ${kpiWidgetHeight}px;
-`;
-
-FlexGroup.displayName = 'FlexGroup';
-
-export const KpiNetworkBaseComponent = React.memo<{
-  fieldsMapping: Readonly<StatItems[]>;
-  data: KpiNetworkData;
-  id: string;
-  from: string;
-  to: string;
-  narrowDateRange: UpdateDateRange;
-}>(({ fieldsMapping, data, id, from, to, narrowDateRange }) => {
-  const statItemsProps: StatItemsProps[] = useKpiMatrixStatus(
-    fieldsMapping,
-    data,
-    id,
-    from,
-    to,
-    narrowDateRange
-  );
-
-  return (
+export const KpiNetworkComponent = React.memo<NetworkKpiProps>(
+  ({ filterQuery, from, to, setQuery, skip, narrowDateRange }) => (
     <EuiFlexGroup wrap>
-      {statItemsProps.map((mappedStatItemProps, idx) => {
-        return <StatItemsComponent {...mappedStatItemProps} />;
-      })}
+      <EuiFlexItem grow={1}>
+        <EuiFlexGroup wrap>
+          <EuiFlexItem>
+            <NetworkKpiNetworkEvents
+              filterQuery={filterQuery}
+              from={from}
+              to={to}
+              narrowDateRange={narrowDateRange}
+              setQuery={setQuery}
+              skip={skip}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <NetworkKpiDns
+              filterQuery={filterQuery}
+              from={from}
+              to={to}
+              narrowDateRange={narrowDateRange}
+              setQuery={setQuery}
+              skip={skip}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        <EuiSpacer size="l" />
+        <EuiFlexGroup wrap>
+          <EuiFlexItem>
+            <NetworkKpiUniqueFlows
+              filterQuery={filterQuery}
+              from={from}
+              to={to}
+              narrowDateRange={narrowDateRange}
+              setQuery={setQuery}
+              skip={skip}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <NetworkKpiTlsHandshakes
+              filterQuery={filterQuery}
+              from={from}
+              to={to}
+              narrowDateRange={narrowDateRange}
+              setQuery={setQuery}
+              skip={skip}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlexItem>
+      <EuiFlexItem grow={1}>
+        <NetworkKpiUniquePrivateIps
+          filterQuery={filterQuery}
+          from={from}
+          to={to}
+          narrowDateRange={narrowDateRange}
+          setQuery={setQuery}
+          skip={skip}
+        />
+      </EuiFlexItem>
     </EuiFlexGroup>
-  );
-});
-
-KpiNetworkBaseComponent.displayName = 'KpiNetworkBaseComponent';
-
-export const KpiNetworkComponent = React.memo<KpiNetworkProps>(
-  ({ data, from, id, loading, to, narrowDateRange }) => {
-    return loading ? (
-      <FlexGroup justifyContent="center" alignItems="center">
-        <EuiFlexItem grow={false}>
-          <EuiLoadingSpinner size="xl" />
-        </EuiFlexItem>
-      </FlexGroup>
-    ) : (
-      <EuiFlexGroup wrap>
-        <EuiFlexItem grow={1}>
-          {_chunk(kipsPerRow, fieldTitleMatrixMapping).map((mappingsPerLine, idx) => (
-            <React.Fragment key={`kpi-network-row-${idx}`}>
-              {idx % kipsPerRow === 1 && <EuiSpacer size="l" />}
-              <KpiNetworkBaseComponent
-                data={data}
-                id={id}
-                fieldsMapping={mappingsPerLine}
-                from={from}
-                to={to}
-                narrowDateRange={narrowDateRange}
-              />
-            </React.Fragment>
-          ))}
-        </EuiFlexItem>
-        <EuiFlexItem grow={1}>
-          <KpiNetworkBaseComponent
-            data={data}
-            id={id}
-            fieldsMapping={fieldTitleChartMapping}
-            from={from}
-            to={to}
-            narrowDateRange={narrowDateRange}
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    );
-  }
+  )
 );
 
 KpiNetworkComponent.displayName = 'KpiNetworkComponent';
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/mock.ts b/x-pack/plugins/security_solution/public/network/components/kpi_network/mock.ts
index bd820d4ed367d..431d09418e9ed 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/mock.ts
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/mock.ts
@@ -4,45 +4,42 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { KpiNetworkData } from '../../../graphql/types';
+import { NetworkKpiStrategyResponse } from '../../../../common/search_strategy';
 import { StatItems } from '../../../common/components/stat_items';
 
 export const mockNarrowDateRange = jest.fn();
 
-export const mockData: { KpiNetwork: KpiNetworkData } = {
-  KpiNetwork: {
-    networkEvents: 16,
-    uniqueFlowId: 10277307,
-    uniqueSourcePrivateIps: 383,
-    uniqueSourcePrivateIpsHistogram: [
-      {
-        x: new Date('2019-02-09T16:00:00.000Z').valueOf(),
-        y: 8,
-      },
-      {
-        x: new Date('2019-02-09T19:00:00.000Z').valueOf(),
-        y: 0,
-      },
-    ],
-    uniqueDestinationPrivateIps: 18,
-    uniqueDestinationPrivateIpsHistogram: [
-      {
-        x: new Date('2019-02-09T16:00:00.000Z').valueOf(),
-        y: 8,
-      },
-      {
-        x: new Date('2019-02-09T19:00:00.000Z').valueOf(),
-        y: 0,
-      },
-    ],
-    dnsQueries: 278,
-    tlsHandshakes: 10000,
-  },
+export const mockData: NetworkKpiStrategyResponse = {
+  networkEvents: 16,
+  uniqueFlowId: 10277307,
+  uniqueSourcePrivateIps: 383,
+  uniqueSourcePrivateIpsHistogram: [
+    {
+      x: new Date('2019-02-09T16:00:00.000Z').valueOf(),
+      y: 8,
+    },
+    {
+      x: new Date('2019-02-09T19:00:00.000Z').valueOf(),
+      y: 0,
+    },
+  ],
+  uniqueDestinationPrivateIps: 18,
+  uniqueDestinationPrivateIpsHistogram: [
+    {
+      x: new Date('2019-02-09T16:00:00.000Z').valueOf(),
+      y: 8,
+    },
+    {
+      x: new Date('2019-02-09T19:00:00.000Z').valueOf(),
+      y: 0,
+    },
+  ],
+  dnsQueries: 278,
+  tlsHandshakes: 10000,
 };
 
 const mockMappingItems: StatItems = {
   key: 'UniqueIps',
-  index: 0,
   fields: [
     {
       key: 'uniqueSourcePrivateIps',
@@ -64,7 +61,6 @@ const mockMappingItems: StatItems = {
   description: 'Unique private IPs',
   enableAreaChart: true,
   enableBarChart: true,
-  grow: 2,
 };
 
 export const mockNoChartMappings: Readonly<StatItems[]> = [
@@ -97,7 +93,6 @@ export const mockDisableChartsInitialData = {
   description: 'Unique private IPs',
   enableAreaChart: false,
   enableBarChart: false,
-  grow: 2,
   areaChart: undefined,
   barChart: undefined,
 };
@@ -124,7 +119,6 @@ export const mockEnableChartsInitialData = {
   description: 'Unique private IPs',
   enableAreaChart: true,
   enableBarChart: true,
-  grow: 2,
   areaChart: [],
   barChart: [
     {
@@ -221,9 +215,7 @@ export const mockEnableChartsData = {
     },
   ],
   from: '2019-06-15T06:00:00.000Z',
-  grow: 2,
   id: 'statItem',
-  index: 2,
   statKey: 'UniqueIps',
   to: '2019-06-18T06:00:00.000Z',
   narrowDateRange: mockNarrowDateRange,
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/network_events/index.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/network_events/index.tsx
new file mode 100644
index 0000000000000..3ee2acf1a115c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/network_events/index.tsx
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { euiPaletteColorBlind } from '@elastic/eui';
+
+import { StatItems } from '../../../../common/components/stat_items';
+import { useNetworkKpiNetworkEvents } from '../../../containers/kpi_network/network_events';
+import { KpiNetworkBaseComponentManage } from '../common';
+import { NetworkKpiProps } from '../types';
+import * as i18n from './translations';
+
+const euiVisColorPalette = euiPaletteColorBlind();
+const euiColorVis1 = euiVisColorPalette[1];
+
+export const fieldsMapping: Readonly<StatItems[]> = [
+  {
+    key: 'networkEvents',
+    fields: [
+      {
+        key: 'networkEvents',
+        value: null,
+        color: euiColorVis1,
+      },
+    ],
+    description: i18n.NETWORK_EVENTS,
+  },
+];
+
+const NetworkKpiNetworkEventsComponent: React.FC<NetworkKpiProps> = ({
+  filterQuery,
+  from,
+  to,
+  narrowDateRange,
+  setQuery,
+  skip,
+}) => {
+  const [loading, { refetch, id, inspect, ...data }] = useNetworkKpiNetworkEvents({
+    filterQuery,
+    endDate: to,
+    startDate: from,
+    skip,
+  });
+
+  return (
+    <KpiNetworkBaseComponentManage
+      data={data}
+      id={id}
+      inspect={inspect}
+      loading={loading}
+      fieldsMapping={fieldsMapping}
+      from={from}
+      to={to}
+      narrowDateRange={narrowDateRange}
+      refetch={refetch}
+      setQuery={setQuery}
+    />
+  );
+};
+
+export const NetworkKpiNetworkEvents = React.memo(NetworkKpiNetworkEventsComponent);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/network_events/translations.ts b/x-pack/plugins/security_solution/public/network/components/kpi_network/network_events/translations.ts
new file mode 100644
index 0000000000000..dc54f96a123ea
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/network_events/translations.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const NETWORK_EVENTS = i18n.translate(
+  'xpack.securitySolution.kpiNetwork.networkEvents.title',
+  {
+    defaultMessage: 'Network events',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/tls_handshakes/index.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/tls_handshakes/index.tsx
new file mode 100644
index 0000000000000..1a29465e2ad80
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/tls_handshakes/index.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { StatItems } from '../../../../common/components/stat_items';
+import { useNetworkKpiTlsHandshakes } from '../../../containers/kpi_network/tls_handshakes';
+import { KpiNetworkBaseComponentManage } from '../common';
+import { NetworkKpiProps } from '../types';
+import * as i18n from './translations';
+
+export const fieldsMapping: Readonly<StatItems[]> = [
+  {
+    key: 'tlsHandshakes',
+    fields: [
+      {
+        key: 'tlsHandshakes',
+        value: null,
+      },
+    ],
+    description: i18n.TLS_HANDSHAKES,
+  },
+];
+
+const NetworkKpiTlsHandshakesComponent: React.FC<NetworkKpiProps> = ({
+  filterQuery,
+  from,
+  to,
+  narrowDateRange,
+  setQuery,
+  skip,
+}) => {
+  const [loading, { refetch, id, inspect, ...data }] = useNetworkKpiTlsHandshakes({
+    filterQuery,
+    endDate: to,
+    startDate: from,
+    skip,
+  });
+
+  return (
+    <KpiNetworkBaseComponentManage
+      data={data}
+      id={id}
+      inspect={inspect}
+      loading={loading}
+      fieldsMapping={fieldsMapping}
+      from={from}
+      to={to}
+      narrowDateRange={narrowDateRange}
+      refetch={refetch}
+      setQuery={setQuery}
+    />
+  );
+};
+
+export const NetworkKpiTlsHandshakes = React.memo(NetworkKpiTlsHandshakesComponent);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/tls_handshakes/translations.ts b/x-pack/plugins/security_solution/public/network/components/kpi_network/tls_handshakes/translations.ts
new file mode 100644
index 0000000000000..f392687cf86a7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/tls_handshakes/translations.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const TLS_HANDSHAKES = i18n.translate(
+  'xpack.securitySolution.kpiNetwork.tlsHandshakes.title',
+  {
+    defaultMessage: 'TLS handshakes',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/types.ts b/x-pack/plugins/security_solution/public/network/components/kpi_network/types.ts
new file mode 100644
index 0000000000000..d3a0ac5a6c5dd
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/types.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UpdateDateRange } from '../../../common/components/charts/common';
+import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
+
+export interface NetworkKpiProps {
+  filterQuery: string;
+  from: string;
+  to: string;
+  narrowDateRange: UpdateDateRange;
+  setQuery: GlobalTimeArgs['setQuery'];
+  skip: boolean;
+}
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_flows/index.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_flows/index.tsx
new file mode 100644
index 0000000000000..489062851becc
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_flows/index.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { StatItems } from '../../../../common/components/stat_items';
+import { useNetworkKpiUniqueFlows } from '../../../containers/kpi_network/unique_flows';
+import { KpiNetworkBaseComponentManage } from '../common';
+import { NetworkKpiProps } from '../types';
+import * as i18n from './translations';
+
+export const fieldsMapping: Readonly<StatItems[]> = [
+  {
+    key: 'uniqueFlowId',
+    fields: [
+      {
+        key: 'uniqueFlowId',
+        value: null,
+      },
+    ],
+    description: i18n.UNIQUE_FLOW_IDS,
+  },
+];
+
+const NetworkKpiUniqueFlowsComponent: React.FC<NetworkKpiProps> = ({
+  filterQuery,
+  from,
+  to,
+  narrowDateRange,
+  setQuery,
+  skip,
+}) => {
+  const [loading, { refetch, id, inspect, ...data }] = useNetworkKpiUniqueFlows({
+    filterQuery,
+    endDate: to,
+    startDate: from,
+    skip,
+  });
+
+  return (
+    <KpiNetworkBaseComponentManage
+      data={data}
+      id={id}
+      inspect={inspect}
+      loading={loading}
+      fieldsMapping={fieldsMapping}
+      from={from}
+      to={to}
+      narrowDateRange={narrowDateRange}
+      refetch={refetch}
+      setQuery={setQuery}
+    />
+  );
+};
+
+export const NetworkKpiUniqueFlows = React.memo(NetworkKpiUniqueFlowsComponent);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_flows/translations.ts b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_flows/translations.ts
new file mode 100644
index 0000000000000..a0bbb07b9856f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_flows/translations.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const UNIQUE_FLOW_IDS = i18n.translate(
+  'xpack.securitySolution.kpiNetwork.uniqueFlowIds.title',
+  {
+    defaultMessage: 'Unique flow IDs',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_private_ips/index.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_private_ips/index.tsx
new file mode 100644
index 0000000000000..db57e96331650
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_private_ips/index.tsx
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { euiPaletteColorBlind } from '@elastic/eui';
+
+import { StatItems } from '../../../../common/components/stat_items';
+import { useNetworkKpiUniquePrivateIps } from '../../../containers/kpi_network/unique_private_ips';
+import { KpiNetworkBaseComponentManage } from '../common';
+import { NetworkKpiProps } from '../types';
+import * as i18n from './translations';
+
+const euiVisColorPalette = euiPaletteColorBlind();
+const euiColorVis2 = euiVisColorPalette[2];
+const euiColorVis3 = euiVisColorPalette[3];
+
+export const fieldsMapping: Readonly<StatItems[]> = [
+  {
+    key: 'UniqueIps',
+    fields: [
+      {
+        key: 'uniqueSourcePrivateIps',
+        value: null,
+        name: i18n.SOURCE_CHART_LABEL,
+        description: i18n.SOURCE_UNIT_LABEL,
+        color: euiColorVis2,
+        icon: 'visMapCoordinate',
+      },
+      {
+        key: 'uniqueDestinationPrivateIps',
+        value: null,
+        name: i18n.DESTINATION_CHART_LABEL,
+        description: i18n.DESTINATION_UNIT_LABEL,
+        color: euiColorVis3,
+        icon: 'visMapCoordinate',
+      },
+    ],
+    description: i18n.UNIQUE_PRIVATE_IPS,
+    enableAreaChart: true,
+    enableBarChart: true,
+  },
+];
+
+const NetworkKpiUniquePrivateIpsComponent: React.FC<NetworkKpiProps> = ({
+  filterQuery,
+  from,
+  to,
+  narrowDateRange,
+  setQuery,
+  skip,
+}) => {
+  const [loading, { refetch, id, inspect, ...data }] = useNetworkKpiUniquePrivateIps({
+    filterQuery,
+    endDate: to,
+    startDate: from,
+    skip,
+  });
+
+  return (
+    <KpiNetworkBaseComponentManage
+      data={data}
+      id={id}
+      inspect={inspect}
+      loading={loading}
+      fieldsMapping={fieldsMapping}
+      from={from}
+      to={to}
+      narrowDateRange={narrowDateRange}
+      refetch={refetch}
+      setQuery={setQuery}
+    />
+  );
+};
+
+export const NetworkKpiUniquePrivateIps = React.memo(NetworkKpiUniquePrivateIpsComponent);
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/translations.ts b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_private_ips/translations.ts
similarity index 65%
rename from x-pack/plugins/security_solution/public/network/components/kpi_network/translations.ts
rename to x-pack/plugins/security_solution/public/network/components/kpi_network/unique_private_ips/translations.ts
index 292077c1578d3..6b1fb94972bff 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/translations.ts
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/unique_private_ips/translations.ts
@@ -6,31 +6,6 @@
 
 import { i18n } from '@kbn/i18n';
 
-export const NETWORK_EVENTS = i18n.translate(
-  'xpack.securitySolution.kpiNetwork.networkEvents.title',
-  {
-    defaultMessage: 'Network events',
-  }
-);
-
-export const UNIQUE_FLOW_IDS = i18n.translate(
-  'xpack.securitySolution.kpiNetwork.uniqueFlowIds.title',
-  {
-    defaultMessage: 'Unique flow IDs',
-  }
-);
-
-export const DNS_QUERIES = i18n.translate('xpack.securitySolution.kpiNetwork.dnsQueries.title', {
-  defaultMessage: 'DNS queries',
-});
-
-export const TLS_HANDSHAKES = i18n.translate(
-  'xpack.securitySolution.kpiNetwork.tlsHandshakes.title',
-  {
-    defaultMessage: 'TLS handshakes',
-  }
-);
-
 export const UNIQUE_PRIVATE_IPS = i18n.translate(
   'xpack.securitySolution.kpiNetwork.uniquePrivateIps.title',
   {
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/dns/index.tsx b/x-pack/plugins/security_solution/public/network/containers/kpi_network/dns/index.tsx
new file mode 100644
index 0000000000000..295cbff76f6aa
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/dns/index.tsx
@@ -0,0 +1,157 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { inputsModel } from '../../../../common/store';
+import { createFilter } from '../../../../common/containers/helpers';
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  NetworkKpiQueries,
+  NetworkKpiDnsRequestOptions,
+  NetworkKpiDnsStrategyResponse,
+} from '../../../../../common/search_strategy';
+import { ESTermQuery } from '../../../../../common/typed_json';
+
+import * as i18n from './translations';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../../helpers';
+import { InspectResponse } from '../../../../types';
+
+const ID = 'networkKpiDnsQuery';
+
+export interface NetworkKpiDnsArgs {
+  dnsQueries: number;
+  id: string;
+  inspect: InspectResponse;
+  isInspected: boolean;
+  refetch: inputsModel.Refetch;
+}
+
+interface UseNetworkKpiDns {
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
+}
+
+export const useNetworkKpiDns = ({
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+}: UseNetworkKpiDns): [boolean, NetworkKpiDnsArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [networkKpiDnsRequest, setNetworkKpiDnsRequest] = useState<NetworkKpiDnsRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkKpiQueries.dns,
+    filterQuery: createFilter(filterQuery),
+    id: ID,
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
+
+  const [networkKpiDnsResponse, setNetworkKpiDnsResponse] = useState<NetworkKpiDnsArgs>({
+    dnsQueries: 0,
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    refetch: refetch.current,
+  });
+
+  const networkKpiDnsSearch = useCallback(
+    (request: NetworkKpiDnsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkKpiDnsRequestOptions, NetworkKpiDnsStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkKpiDnsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    dnsQueries: response.dnsQueries,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_KPI_DNS);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_KPI_DNS,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setNetworkKpiDnsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, filterQuery, skip, startDate]);
+
+  useEffect(() => {
+    networkKpiDnsSearch(networkKpiDnsRequest);
+  }, [networkKpiDnsRequest, networkKpiDnsSearch]);
+
+  return [loading, networkKpiDnsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/dns/translations.ts b/x-pack/plugins/security_solution/public/network/containers/kpi_network/dns/translations.ts
new file mode 100644
index 0000000000000..c55fca673c6bf
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/dns/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_KPI_DNS = i18n.translate(
+  'xpack.securitySolution.networkKpiDns.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network kpi dns search`,
+  }
+);
+
+export const FAIL_NETWORK_KPI_DNS = i18n.translate(
+  'xpack.securitySolution.networkKpiDns.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network kpi dns`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/index.tsx b/x-pack/plugins/security_solution/public/network/containers/kpi_network/index.tsx
index edba8b4c2e65c..490b866012a48 100644
--- a/x-pack/plugins/security_solution/public/network/containers/kpi_network/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/index.tsx
@@ -4,82 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect, ConnectedProps } from 'react-redux';
-
-import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import { GetKpiNetworkQuery, KpiNetworkData } from '../../../graphql/types';
-import { inputsModel, inputsSelectors, State } from '../../../common/store';
-import { useUiSetting } from '../../../common/lib/kibana';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import { QueryTemplateProps } from '../../../common/containers/query_template';
-
-import { kpiNetworkQuery } from './index.gql_query';
-
-const ID = 'kpiNetworkQuery';
-
-export interface KpiNetworkArgs {
-  id: string;
-  inspect: inputsModel.InspectQuery;
-  kpiNetwork: KpiNetworkData;
-  loading: boolean;
-  refetch: inputsModel.Refetch;
-}
-
-export interface KpiNetworkProps extends QueryTemplateProps {
-  children: (args: KpiNetworkArgs) => React.ReactNode;
-}
-
-const KpiNetworkComponentQuery = React.memo<KpiNetworkProps & PropsFromRedux>(
-  ({ id = ID, children, filterQuery, isInspected, skip, sourceId, startDate, endDate }) => (
-    <Query<GetKpiNetworkQuery.Query, GetKpiNetworkQuery.Variables>
-      query={kpiNetworkQuery}
-      fetchPolicy={getDefaultFetchPolicy()}
-      notifyOnNetworkStatusChange
-      skip={skip}
-      variables={{
-        sourceId,
-        timerange: {
-          interval: '12h',
-          from: startDate!,
-          to: endDate!,
-        },
-        filterQuery: createFilter(filterQuery),
-        defaultIndex: useUiSetting<string[]>(DEFAULT_INDEX_KEY),
-        inspect: isInspected,
-      }}
-    >
-      {({ data, loading, refetch }) => {
-        const kpiNetwork = getOr({}, `source.KpiNetwork`, data);
-        return children({
-          id,
-          inspect: getOr(null, 'source.KpiNetwork.inspect', data),
-          kpiNetwork,
-          loading,
-          refetch,
-        });
-      }}
-    </Query>
-  )
-);
-
-KpiNetworkComponentQuery.displayName = 'KpiNetworkComponentQuery';
-
-const makeMapStateToProps = () => {
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  const mapStateToProps = (state: State, { id = ID }: KpiNetworkProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      isInspected,
-    };
-  };
-  return mapStateToProps;
-};
-
-const connector = connect(makeMapStateToProps);
-
-type PropsFromRedux = ConnectedProps<typeof connector>;
-
-export const KpiNetworkQuery = connector(KpiNetworkComponentQuery);
+export * from './dns';
+export * from './network_events';
+export * from './tls_handshakes';
+export * from './unique_flows';
+export * from './unique_private_ips';
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/network_events/index.tsx b/x-pack/plugins/security_solution/public/network/containers/kpi_network/network_events/index.tsx
new file mode 100644
index 0000000000000..8ab94432746f4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/network_events/index.tsx
@@ -0,0 +1,164 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { inputsModel } from '../../../../common/store';
+import { createFilter } from '../../../../common/containers/helpers';
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  NetworkKpiQueries,
+  NetworkKpiNetworkEventsRequestOptions,
+  NetworkKpiNetworkEventsStrategyResponse,
+} from '../../../../../common/search_strategy';
+import { ESTermQuery } from '../../../../../common/typed_json';
+
+import * as i18n from './translations';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../../helpers';
+import { InspectResponse } from '../../../../types';
+
+const ID = 'networkKpiNetworkEventsQuery';
+
+export interface NetworkKpiNetworkEventsArgs {
+  networkEvents: number;
+  id: string;
+  inspect: InspectResponse;
+  isInspected: boolean;
+  refetch: inputsModel.Refetch;
+}
+
+interface UseNetworkKpiNetworkEvents {
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
+}
+
+export const useNetworkKpiNetworkEvents = ({
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+}: UseNetworkKpiNetworkEvents): [boolean, NetworkKpiNetworkEventsArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [networkKpiNetworkEventsRequest, setNetworkKpiNetworkEventsRequest] = useState<
+    NetworkKpiNetworkEventsRequestOptions
+  >({
+    defaultIndex,
+    factoryQueryType: NetworkKpiQueries.networkEvents,
+    filterQuery: createFilter(filterQuery),
+    id: ID,
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
+
+  const [networkKpiNetworkEventsResponse, setNetworkKpiNetworkEventsResponse] = useState<
+    NetworkKpiNetworkEventsArgs
+  >({
+    networkEvents: 0,
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    refetch: refetch.current,
+  });
+
+  const networkKpiNetworkEventsSearch = useCallback(
+    (request: NetworkKpiNetworkEventsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkKpiNetworkEventsRequestOptions, NetworkKpiNetworkEventsStrategyResponse>(
+            request,
+            {
+              strategy: 'securitySolutionSearchStrategy',
+              abortSignal: abortCtrl.current.signal,
+            }
+          )
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkKpiNetworkEventsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    networkEvents: response.networkEvents,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_KPI_NETWORK_EVENTS);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_KPI_NETWORK_EVENTS,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setNetworkKpiNetworkEventsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, filterQuery, skip, startDate]);
+
+  useEffect(() => {
+    networkKpiNetworkEventsSearch(networkKpiNetworkEventsRequest);
+  }, [networkKpiNetworkEventsRequest, networkKpiNetworkEventsSearch]);
+
+  return [loading, networkKpiNetworkEventsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/network_events/translations.ts b/x-pack/plugins/security_solution/public/network/containers/kpi_network/network_events/translations.ts
new file mode 100644
index 0000000000000..9951eb23ff4f7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/network_events/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_KPI_NETWORK_EVENTS = i18n.translate(
+  'xpack.securitySolution.networkKpiNetworkEvents.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network kpi network events search`,
+  }
+);
+
+export const FAIL_NETWORK_KPI_NETWORK_EVENTS = i18n.translate(
+  'xpack.securitySolution.networkKpiNetworkEvents.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network kpi network events`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/tls_handshakes/index.tsx b/x-pack/plugins/security_solution/public/network/containers/kpi_network/tls_handshakes/index.tsx
new file mode 100644
index 0000000000000..f7630352fc3c4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/tls_handshakes/index.tsx
@@ -0,0 +1,164 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { inputsModel } from '../../../../common/store';
+import { createFilter } from '../../../../common/containers/helpers';
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  NetworkKpiQueries,
+  NetworkKpiTlsHandshakesRequestOptions,
+  NetworkKpiTlsHandshakesStrategyResponse,
+} from '../../../../../common/search_strategy';
+import { ESTermQuery } from '../../../../../common/typed_json';
+
+import * as i18n from './translations';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../../helpers';
+import { InspectResponse } from '../../../../types';
+
+const ID = 'networkKpiTlsHandshakesQuery';
+
+export interface NetworkKpiTlsHandshakesArgs {
+  tlsHandshakes: number;
+  id: string;
+  inspect: InspectResponse;
+  isInspected: boolean;
+  refetch: inputsModel.Refetch;
+}
+
+interface UseNetworkKpiTlsHandshakes {
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
+}
+
+export const useNetworkKpiTlsHandshakes = ({
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+}: UseNetworkKpiTlsHandshakes): [boolean, NetworkKpiTlsHandshakesArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [networkKpiTlsHandshakesRequest, setNetworkKpiTlsHandshakesRequest] = useState<
+    NetworkKpiTlsHandshakesRequestOptions
+  >({
+    defaultIndex,
+    factoryQueryType: NetworkKpiQueries.tlsHandshakes,
+    filterQuery: createFilter(filterQuery),
+    id: ID,
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
+
+  const [networkKpiTlsHandshakesResponse, setNetworkKpiTlsHandshakesResponse] = useState<
+    NetworkKpiTlsHandshakesArgs
+  >({
+    tlsHandshakes: 0,
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    refetch: refetch.current,
+  });
+
+  const networkKpiTlsHandshakesSearch = useCallback(
+    (request: NetworkKpiTlsHandshakesRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkKpiTlsHandshakesRequestOptions, NetworkKpiTlsHandshakesStrategyResponse>(
+            request,
+            {
+              strategy: 'securitySolutionSearchStrategy',
+              abortSignal: abortCtrl.current.signal,
+            }
+          )
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkKpiTlsHandshakesResponse((prevResponse) => ({
+                    ...prevResponse,
+                    tlsHandshakes: response.tlsHandshakes,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_KPI_TLS_HANDSHAKES);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_KPI_TLS_HANDSHAKES,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setNetworkKpiTlsHandshakesRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, filterQuery, skip, startDate]);
+
+  useEffect(() => {
+    networkKpiTlsHandshakesSearch(networkKpiTlsHandshakesRequest);
+  }, [networkKpiTlsHandshakesRequest, networkKpiTlsHandshakesSearch]);
+
+  return [loading, networkKpiTlsHandshakesResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/tls_handshakes/translations.ts b/x-pack/plugins/security_solution/public/network/containers/kpi_network/tls_handshakes/translations.ts
new file mode 100644
index 0000000000000..bca2b6610b533
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/tls_handshakes/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_KPI_TLS_HANDSHAKES = i18n.translate(
+  'xpack.securitySolution.networkKpiTlsHandshakes.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network kpi tls handshakes search`,
+  }
+);
+
+export const FAIL_NETWORK_KPI_TLS_HANDSHAKES = i18n.translate(
+  'xpack.securitySolution.networkKpiTlsHandshakes.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network kpi tls handshakes`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_flows/index.tsx b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_flows/index.tsx
new file mode 100644
index 0000000000000..5f1bd782b9abd
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_flows/index.tsx
@@ -0,0 +1,164 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { inputsModel } from '../../../../common/store';
+import { createFilter } from '../../../../common/containers/helpers';
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  NetworkKpiQueries,
+  NetworkKpiUniqueFlowsRequestOptions,
+  NetworkKpiUniqueFlowsStrategyResponse,
+} from '../../../../../common/search_strategy';
+import { ESTermQuery } from '../../../../../common/typed_json';
+
+import * as i18n from './translations';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../../helpers';
+import { InspectResponse } from '../../../../types';
+
+const ID = 'networkKpiUniqueFlowsQuery';
+
+export interface NetworkKpiUniqueFlowsArgs {
+  uniqueFlowId: number;
+  id: string;
+  inspect: InspectResponse;
+  isInspected: boolean;
+  refetch: inputsModel.Refetch;
+}
+
+interface UseNetworkKpiUniqueFlows {
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
+}
+
+export const useNetworkKpiUniqueFlows = ({
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+}: UseNetworkKpiUniqueFlows): [boolean, NetworkKpiUniqueFlowsArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [networkKpiUniqueFlowsRequest, setNetworkKpiUniqueFlowsRequest] = useState<
+    NetworkKpiUniqueFlowsRequestOptions
+  >({
+    defaultIndex,
+    factoryQueryType: NetworkKpiQueries.uniqueFlows,
+    filterQuery: createFilter(filterQuery),
+    id: ID,
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
+
+  const [networkKpiUniqueFlowsResponse, setNetworkKpiUniqueFlowsResponse] = useState<
+    NetworkKpiUniqueFlowsArgs
+  >({
+    uniqueFlowId: 0,
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    refetch: refetch.current,
+  });
+
+  const networkKpiUniqueFlowsSearch = useCallback(
+    (request: NetworkKpiUniqueFlowsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkKpiUniqueFlowsRequestOptions, NetworkKpiUniqueFlowsStrategyResponse>(
+            request,
+            {
+              strategy: 'securitySolutionSearchStrategy',
+              abortSignal: abortCtrl.current.signal,
+            }
+          )
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkKpiUniqueFlowsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    uniqueFlowId: response.uniqueFlowId,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_KPI_UNIQUE_FLOWS);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_KPI_UNIQUE_FLOWS,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setNetworkKpiUniqueFlowsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, filterQuery, skip, startDate]);
+
+  useEffect(() => {
+    networkKpiUniqueFlowsSearch(networkKpiUniqueFlowsRequest);
+  }, [networkKpiUniqueFlowsRequest, networkKpiUniqueFlowsSearch]);
+
+  return [loading, networkKpiUniqueFlowsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_flows/translations.ts b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_flows/translations.ts
new file mode 100644
index 0000000000000..7760a629208e3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_flows/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_KPI_UNIQUE_FLOWS = i18n.translate(
+  'xpack.securitySolution.networkKpiUniqueFlows.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network kpi unique flows search`,
+  }
+);
+
+export const FAIL_NETWORK_KPI_UNIQUE_FLOWS = i18n.translate(
+  'xpack.securitySolution.networkKpiUniqueFlows.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network kpi unique flows`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_private_ips/index.tsx b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_private_ips/index.tsx
new file mode 100644
index 0000000000000..f32f43d811137
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_private_ips/index.tsx
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import deepEqual from 'fast-deep-equal';
+import { noop } from 'lodash/fp';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+import { DEFAULT_INDEX_KEY } from '../../../../../common/constants';
+import { inputsModel } from '../../../../common/store';
+import { createFilter } from '../../../../common/containers/helpers';
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  NetworkKpiHistogramData,
+  NetworkKpiQueries,
+  NetworkKpiUniquePrivateIpsRequestOptions,
+  NetworkKpiUniquePrivateIpsStrategyResponse,
+} from '../../../../../common/search_strategy';
+import { ESTermQuery } from '../../../../../common/typed_json';
+
+import * as i18n from './translations';
+import { AbortError } from '../../../../../../../../src/plugins/data/common';
+import { getInspectResponse } from '../../../../helpers';
+import { InspectResponse } from '../../../../types';
+
+const ID = 'networkKpiUniquePrivateIpsQuery';
+
+export interface NetworkKpiUniquePrivateIpsArgs {
+  uniqueDestinationPrivateIps: number;
+  uniqueDestinationPrivateIpsHistogram: NetworkKpiHistogramData[] | null;
+  uniqueSourcePrivateIps: number;
+  uniqueSourcePrivateIpsHistogram: NetworkKpiHistogramData[] | null;
+  id: string;
+  inspect: InspectResponse;
+  isInspected: boolean;
+  refetch: inputsModel.Refetch;
+}
+
+interface UseNetworkKpiUniquePrivateIps {
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  skip?: boolean;
+  startDate: string;
+}
+
+export const useNetworkKpiUniquePrivateIps = ({
+  filterQuery,
+  endDate,
+  skip = false,
+  startDate,
+}: UseNetworkKpiUniquePrivateIps): [boolean, NetworkKpiUniquePrivateIpsArgs] => {
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+  const [networkKpiUniquePrivateIpsRequest, setNetworkKpiUniquePrivateIpsRequest] = useState<
+    NetworkKpiUniquePrivateIpsRequestOptions
+  >({
+    defaultIndex,
+    factoryQueryType: NetworkKpiQueries.uniquePrivateIps,
+    filterQuery: createFilter(filterQuery),
+    id: ID,
+    timerange: {
+      interval: '12h',
+      from: startDate,
+      to: endDate,
+    },
+  });
+
+  const [networkKpiUniquePrivateIpsResponse, setNetworkKpiUniquePrivateIpsResponse] = useState<
+    NetworkKpiUniquePrivateIpsArgs
+  >({
+    uniqueDestinationPrivateIps: 0,
+    uniqueDestinationPrivateIpsHistogram: null,
+    uniqueSourcePrivateIps: 0,
+    uniqueSourcePrivateIpsHistogram: null,
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    refetch: refetch.current,
+  });
+
+  const networkKpiUniquePrivateIpsSearch = useCallback(
+    (request: NetworkKpiUniquePrivateIpsRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<
+            NetworkKpiUniquePrivateIpsRequestOptions,
+            NetworkKpiUniquePrivateIpsStrategyResponse
+          >(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            abortSignal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkKpiUniquePrivateIpsResponse((prevResponse) => ({
+                    ...prevResponse,
+                    uniqueDestinationPrivateIps: response.uniqueDestinationPrivateIps,
+                    uniqueDestinationPrivateIpsHistogram:
+                      response.uniqueDestinationPrivateIpsHistogram,
+                    uniqueSourcePrivateIps: response.uniqueSourcePrivateIps,
+                    uniqueSourcePrivateIpsHistogram: response.uniqueSourcePrivateIpsHistogram,
+                    inspect: getInspectResponse(response, prevResponse.inspect),
+                    refetch: refetch.current,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_KPI_UNIQUE_PRIVATE_IPS);
+                searchSubscription$.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_KPI_UNIQUE_PRIVATE_IPS,
+                  text: msg.message,
+                });
+              }
+            },
+          });
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
+
+  useEffect(() => {
+    setNetworkKpiUniquePrivateIpsRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [defaultIndex, endDate, filterQuery, skip, startDate]);
+
+  useEffect(() => {
+    networkKpiUniquePrivateIpsSearch(networkKpiUniquePrivateIpsRequest);
+  }, [networkKpiUniquePrivateIpsRequest, networkKpiUniquePrivateIpsSearch]);
+
+  return [loading, networkKpiUniquePrivateIpsResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_private_ips/translations.ts b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_private_ips/translations.ts
new file mode 100644
index 0000000000000..f37fd5c02e5a9
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/kpi_network/unique_private_ips/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_KPI_UNIQUE_PRIVATE_IPS = i18n.translate(
+  'xpack.securitySolution.networkKpiUniquePrivateIps.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network kpi unique private ips search`,
+  }
+);
+
+export const FAIL_NETWORK_KPI_UNIQUE_PRIVATE_IPS = i18n.translate(
+  'xpack.securitySolution.networkKpiUniquePrivateIps.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network kpi unique private ips`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.tsx b/x-pack/plugins/security_solution/public/network/pages/network.tsx
index 848dc94acff61..e04350fd38df5 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.tsx
@@ -18,11 +18,10 @@ import { FiltersGlobal } from '../../common/components/filters_global';
 import { HeaderPage } from '../../common/components/header_page';
 import { LastEventTime } from '../../common/components/last_event_time';
 import { SiemNavigation } from '../../common/components/navigation';
-import { manageQuery } from '../../common/components/page/manage_query';
-import { KpiNetworkComponent } from '..//components/kpi_network';
+
+import { KpiNetworkComponent } from '../components/kpi_network';
 import { SiemSearchBar } from '../../common/components/search_bar';
 import { WrapperPage } from '../../common/components/wrapper_page';
-import { KpiNetworkQuery } from '../../network/containers/kpi_network';
 import { useFullScreen } from '../../common/containers/use_full_screen';
 import { useGlobalTime } from '../../common/containers/use_global_time';
 import { useWithSource } from '../../common/containers/source';
@@ -46,7 +45,6 @@ import { TimelineId } from '../../../common/types/timeline';
 import { timelineDefaults } from '../../timelines/store/timeline/defaults';
 import { TimelineModel } from '../../timelines/store/timeline/model';
 
-const KpiNetworkComponentManage = manageQuery(KpiNetworkComponent);
 const sourceId = 'default';
 
 const NetworkComponent = React.memo<NetworkComponentProps & PropsFromRedux>(
@@ -127,27 +125,14 @@ const NetworkComponent = React.memo<NetworkComponentProps & PropsFromRedux>(
 
                 <EuiSpacer />
 
-                <KpiNetworkQuery
-                  endDate={to}
+                <KpiNetworkComponent
                   filterQuery={filterQuery}
+                  setQuery={setQuery}
                   skip={isInitializing}
-                  sourceId={sourceId}
-                  startDate={from}
-                >
-                  {({ kpiNetwork, loading, id, inspect, refetch }) => (
-                    <KpiNetworkComponentManage
-                      id={id}
-                      inspect={inspect}
-                      setQuery={setQuery}
-                      refetch={refetch}
-                      data={kpiNetwork}
-                      loading={loading}
-                      from={from}
-                      to={to}
-                      narrowDateRange={narrowDateRange}
-                    />
-                  )}
-                </KpiNetworkQuery>
+                  from={from}
+                  to={to}
+                  narrowDateRange={narrowDateRange}
+                />
               </Display>
 
               {capabilitiesFetched && !isInitializing ? (
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx
index 5e6f35e8397e4..bfd76f0a98d46 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.test.tsx
@@ -6,64 +6,17 @@
 
 import React from 'react';
 import { mount } from 'enzyme';
-/* eslint-disable @kbn/eslint/module_migration */
-import routeData from 'react-router';
-/* eslint-enable @kbn/eslint/module_migration */
 import { InsertTimelinePopoverComponent } from '.';
 
-const mockDispatch = jest.fn();
-jest.mock('react-redux', () => {
-  const reactRedux = jest.requireActual('react-redux');
-  return {
-    ...reactRedux,
-    useDispatch: () => mockDispatch,
-    useSelector: jest
-      .fn()
-      .mockReturnValueOnce({
-        timelineId: 'timeline-id',
-        timelineSavedObjectId: '34578-3497-5893-47589-34759',
-        timelineTitle: 'Timeline title',
-      })
-      .mockReturnValue(null),
-  };
-});
-const mockLocation = {
-  pathname: '/apath',
-  hash: '',
-  search: '',
-  state: '',
-};
 const onTimelineChange = jest.fn();
-const defaultProps = {
+const props = {
   isDisabled: false,
   onTimelineChange,
 };
 
 describe('Insert timeline popover ', () => {
-  afterEach(() => {
-    jest.clearAllMocks();
-  });
-
-  it('should insert a timeline when passed in the router state', () => {
-    mount(<InsertTimelinePopoverComponent {...defaultProps} />);
-    expect(mockDispatch.mock.calls[0][0]).toEqual({
-      payload: { id: 'timeline-id', show: false },
-      type: 'x-pack/security_solution/local/timeline/SHOW_TIMELINE',
-    });
-    expect(onTimelineChange).toBeCalledWith(
-      'Timeline title',
-      '34578-3497-5893-47589-34759',
-      undefined
-    );
-    expect(mockDispatch.mock.calls[1][0]).toEqual({
-      payload: null,
-      type: 'x-pack/security_solution/local/timeline/SET_INSERT_TIMELINE',
-    });
-  });
-  it('should do nothing when router state', () => {
-    jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
-    mount(<InsertTimelinePopoverComponent {...defaultProps} />);
-    expect(mockDispatch).toHaveBeenCalledTimes(0);
-    expect(onTimelineChange).toHaveBeenCalledTimes(0);
+  it('it renders', () => {
+    const wrapper = mount(<InsertTimelinePopoverComponent {...props} />);
+    expect(wrapper.find('[data-test-subj="insert-timeline-popover"]').exists()).toBeTruthy();
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx
index 0adf767308269..11ad54321da88 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/index.tsx
@@ -5,16 +5,12 @@
  */
 
 import { EuiButtonIcon, EuiPopover, EuiSelectableOption, EuiToolTip } from '@elastic/eui';
-import React, { memo, useCallback, useEffect, useMemo, useState } from 'react';
-import { useDispatch, useSelector } from 'react-redux';
+import React, { memo, useCallback, useMemo, useState } from 'react';
 
 import { OpenTimelineResult } from '../../open_timeline/types';
 import { SelectableTimeline } from '../selectable_timeline';
 import * as i18n from '../translations';
-import { timelineActions, timelineSelectors } from '../../../../timelines/store/timeline';
 import { TimelineType } from '../../../../../common/types/timeline';
-import { State } from '../../../../common/store';
-import { setInsertTimeline } from '../../../store/timeline/actions';
 
 interface InsertTimelinePopoverProps {
   isDisabled: boolean;
@@ -33,25 +29,8 @@ export const InsertTimelinePopoverComponent: React.FC<Props> = ({
   hideUntitled = false,
   onTimelineChange,
 }) => {
-  const dispatch = useDispatch();
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
 
-  const insertTimeline = useSelector((state: State) => {
-    return timelineSelectors.selectInsertTimeline(state);
-  });
-  useEffect(() => {
-    if (insertTimeline != null) {
-      dispatch(timelineActions.showTimeline({ id: insertTimeline.timelineId, show: false }));
-      onTimelineChange(
-        insertTimeline.timelineTitle,
-        insertTimeline.timelineSavedObjectId,
-        insertTimeline.graphEventId
-      );
-      dispatch(setInsertTimeline(null));
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [insertTimeline, dispatch]);
-
   const handleClosePopover = useCallback(() => {
     setIsPopoverOpen(false);
   }, []);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
index c3bcd1c0ebe51..55c0709bd5543 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/insert_timeline_popover/use_insert_timeline.tsx
@@ -5,38 +5,60 @@
  */
 
 import { isEmpty } from 'lodash/fp';
-import { useCallback, useState } from 'react';
+import { useCallback, useState, useEffect } from 'react';
+import { useDispatch, useSelector, shallowEqual } from 'react-redux';
 import { useBasePath } from '../../../../common/lib/kibana';
 import { CursorPosition } from '../../../../common/components/markdown_editor';
-import { FormData, FormHook } from '../../../../shared_imports';
+import { timelineActions, timelineSelectors } from '../../../../timelines/store/timeline';
+import { setInsertTimeline } from '../../../store/timeline/actions';
 
-export const useInsertTimeline = <T extends FormData>(form: FormHook<T>, fieldName: string) => {
+export const useInsertTimeline = (value: string, onChange: (newValue: string) => void) => {
   const basePath = window.location.origin + useBasePath();
+  const dispatch = useDispatch();
   const [cursorPosition, setCursorPosition] = useState<CursorPosition>({
     start: 0,
     end: 0,
   });
+
+  const insertTimeline = useSelector(timelineSelectors.selectInsertTimeline, shallowEqual);
+
   const handleOnTimelineChange = useCallback(
     (title: string, id: string | null, graphEventId?: string) => {
       const builtLink = `${basePath}/app/security/timelines?timeline=(id:'${id}'${
         !isEmpty(graphEventId) ? `,graphEventId:'${graphEventId}'` : ''
       },isOpen:!t)`;
-      const currentValue = form.getFormData()[fieldName];
+
       const newValue: string = [
-        currentValue.slice(0, cursorPosition.start),
+        value.slice(0, cursorPosition.start),
         cursorPosition.start === cursorPosition.end
           ? `[${title}](${builtLink})`
-          : `[${currentValue.slice(cursorPosition.start, cursorPosition.end)}](${builtLink})`,
-        currentValue.slice(cursorPosition.end),
+          : `[${value.slice(cursorPosition.start, cursorPosition.end)}](${builtLink})`,
+        value.slice(cursorPosition.end),
       ].join('');
-      form.setFieldValue(fieldName, newValue);
+
+      onChange(newValue);
     },
-    [basePath, cursorPosition, fieldName, form]
+    [value, onChange, basePath, cursorPosition]
   );
+
   const handleCursorChange = useCallback((cp: CursorPosition) => {
     setCursorPosition(cp);
   }, []);
 
+  // insertTimeline selector is defined to attached a timeline to a case outside of the case page.
+  // FYI, if you are in the case page we only use handleOnTimelineChange to attach a timeline to a case.
+  useEffect(() => {
+    if (insertTimeline != null && value != null) {
+      dispatch(timelineActions.showTimeline({ id: insertTimeline.timelineId, show: false }));
+      handleOnTimelineChange(
+        insertTimeline.timelineTitle,
+        insertTimeline.timelineSavedObjectId,
+        insertTimeline.graphEventId
+      );
+      dispatch(setInsertTimeline(null));
+    }
+  }, [insertTimeline, dispatch, handleOnTimelineChange, value]);
+
   return {
     cursorPosition,
     handleCursorChange,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
index acd800e54040c..959bf3186f136 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_bulk_route.ts
@@ -27,6 +27,7 @@ import { buildRouteValidation } from '../../../../utils/build_validation/route_v
 import { transformBulkError, createBulkErrorObject, buildSiemResponse } from '../utils';
 import { updateRulesNotifications } from '../../rules/update_rules_notifications';
 import { PartialFilter } from '../../types';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 
 export const createRulesBulkRoute = (router: IRouter, ml: SetupPlugins['ml']) => {
   router.post(
@@ -112,13 +113,10 @@ export const createRulesBulkRoute = (router: IRouter, ml: SetupPlugins['ml']) =>
                 });
               }
 
-              const query =
-                type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+              const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
               const language =
-                type !== 'machine_learning' && languageOrUndefined == null
-                  ? 'kuery'
-                  : languageOrUndefined;
+                !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
               // TODO: Fix these either with an is conversion or by better typing them within io-ts
               const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
index 482edb9925557..701e5b5e706ed 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -24,6 +24,7 @@ import { transformError, buildSiemResponse } from '../utils';
 import { updateRulesNotifications } from '../../rules/update_rules_notifications';
 import { ruleStatusSavedObjectsClientFactory } from '../../signals/rule_status_saved_objects_client';
 import { PartialFilter } from '../../types';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 
 export const createRulesRoute = (router: IRouter, ml: SetupPlugins['ml']): void => {
   router.post(
@@ -86,13 +87,10 @@ export const createRulesRoute = (router: IRouter, ml: SetupPlugins['ml']): void
         exceptions_list: exceptionsList,
       } = request.body;
       try {
-        const query =
-          type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+        const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
         const language =
-          type !== 'machine_learning' && languageOrUndefined == null
-            ? 'kuery'
-            : languageOrUndefined;
+          !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
         // TODO: Fix these either with an is conversion or by better typing them within io-ts
         const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
index 8a7215e5a5bad..60bb8c79243d7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/import_rules_route.ts
@@ -19,6 +19,7 @@ import {
   ImportRulesSchema as ImportRulesResponseSchema,
   importRulesSchema as importRulesResponseSchema,
 } from '../../../../../common/detection_engine/schemas/response/import_rules_schema';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { IRouter } from '../../../../../../../../src/core/server';
 import { createPromiseFromStreams } from '../../../../../../../../src/core/server/utils/';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
@@ -174,13 +175,10 @@ export const importRulesRoute = (router: IRouter, config: ConfigType, ml: SetupP
                 } = parsedRule;
 
                 try {
-                  const query =
-                    type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+                  const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
                   const language =
-                    type !== 'machine_learning' && languageOrUndefined == null
-                      ? 'kuery'
-                      : languageOrUndefined;
+                    !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
                   // TODO: Fix these either with an is conversion or by better typing them within io-ts
                   const filters: PartialFilter[] | undefined = filtersRest as PartialFilter[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
index 518024387fed3..0e414e130849a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_bulk_route.ts
@@ -13,6 +13,7 @@ import {
   UpdateRulesBulkSchemaDecoded,
 } from '../../../../../common/detection_engine/schemas/request/update_rules_bulk_schema';
 import { rulesBulkSchema } from '../../../../../common/detection_engine/schemas/response/rules_bulk_schema';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { IRouter } from '../../../../../../../../src/core/server';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 import { SetupPlugins } from '../../../../plugin';
@@ -108,13 +109,10 @@ export const updateRulesBulkRoute = (router: IRouter, ml: SetupPlugins['ml']) =>
               });
             }
 
-            const query =
-              type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+            const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
             const language =
-              type !== 'machine_learning' && languageOrUndefined == null
-                ? 'kuery'
-                : languageOrUndefined;
+              !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
             // TODO: Fix these either with an is conversion or by better typing them within io-ts
             const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
index 299b99c4d37b0..553d084b62633 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -10,6 +10,7 @@ import {
   updateRulesSchema,
   UpdateRulesSchemaDecoded,
 } from '../../../../../common/detection_engine/schemas/request/update_rules_schema';
+import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { IRouter } from '../../../../../../../../src/core/server';
 import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 import { SetupPlugins } from '../../../../plugin';
@@ -87,13 +88,10 @@ export const updateRulesRoute = (router: IRouter, ml: SetupPlugins['ml']) => {
         exceptions_list: exceptionsList,
       } = request.body;
       try {
-        const query =
-          type !== 'machine_learning' && queryOrUndefined == null ? '' : queryOrUndefined;
+        const query = !isMlRule(type) && queryOrUndefined == null ? '' : queryOrUndefined;
 
         const language =
-          type !== 'machine_learning' && languageOrUndefined == null
-            ? 'kuery'
-            : languageOrUndefined;
+          !isMlRule(type) && languageOrUndefined == null ? 'kuery' : languageOrUndefined;
 
         // TODO: Fix these either with an is conversion or by better typing them within io-ts
         const actions: RuleAlertAction[] = actionsRest as RuleAlertAction[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
index f77485f39a98d..6323938d6903b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_filter.ts
@@ -89,6 +89,7 @@ export const getFilter = async ({
   };
 
   switch (type) {
+    case 'eql':
     case 'threshold': {
       return savedId != null ? savedQueryFilter() : queryFilter();
     }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 7ee157beec789..2b6587300a581 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -14,6 +14,7 @@ import {
   SERVER_APP_ID,
 } from '../../../../common/constants';
 import { isJobStarted, isMlRule } from '../../../../common/machine_learning/helpers';
+import { isThresholdRule, isEqlRule } from '../../../../common/detection_engine/utils';
 import { parseScheduleDates } from '../../../../common/detection_engine/parse_schedule_dates';
 import { SetupPlugins } from '../../../plugin';
 import { getInputIndex } from './get_input_output_index';
@@ -244,7 +245,9 @@ export const signalRulesAlertType = ({
           if (bulkCreateDuration) {
             result.bulkCreateTimes.push(bulkCreateDuration);
           }
-        } else if (type === 'threshold' && threshold) {
+        } else if (isEqlRule(type)) {
+          throw new Error('EQL Rules are under development, execution is not yet implemented');
+        } else if (isThresholdRule(type) && threshold) {
           const inputIndex = await getInputIndex(services, version, index);
           const esFilter = await getFilter({
             type,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.test.ts
index f901d9f3dab5d..aca76b8529d58 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.test.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.test.ts
@@ -3,7 +3,10 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { NetworkQueries } from '../../../../../common/search_strategy/security_solution';
+import {
+  NetworkQueries,
+  NetworkKpiQueries,
+} from '../../../../../common/search_strategy/security_solution';
 
 import { networkFactory } from '.';
 import { networkDetails } from './details';
@@ -14,6 +17,11 @@ import { networkTls } from './tls';
 import { networkTopCountries } from './top_countries';
 import { networkTopNFlow } from './top_n_flow';
 import { networkUsers } from './users';
+import { networkKpiDns } from './kpi/dns';
+import { networkKpiNetworkEvents } from './kpi/network_events';
+import { networkKpiTlsHandshakes } from './kpi/tls_handshakes';
+import { networkKpiUniqueFlows } from './kpi/unique_flows';
+import { networkKpiUniquePrivateIps } from './kpi/unique_private_ips';
 
 jest.mock('./details');
 jest.mock('./dns');
@@ -23,6 +31,11 @@ jest.mock('./tls');
 jest.mock('./top_countries');
 jest.mock('./top_n_flow');
 jest.mock('./users');
+jest.mock('./kpi/dns');
+jest.mock('./kpi/network_events');
+jest.mock('./kpi/tls_handshakes');
+jest.mock('./kpi/unique_flows');
+jest.mock('./kpi/unique_private_ips');
 
 describe('networkFactory', () => {
   test('should include correct apis', () => {
@@ -35,6 +48,11 @@ describe('networkFactory', () => {
       [NetworkQueries.topCountries]: networkTopCountries,
       [NetworkQueries.topNFlow]: networkTopNFlow,
       [NetworkQueries.users]: networkUsers,
+      [NetworkKpiQueries.dns]: networkKpiDns,
+      [NetworkKpiQueries.networkEvents]: networkKpiNetworkEvents,
+      [NetworkKpiQueries.tlsHandshakes]: networkKpiTlsHandshakes,
+      [NetworkKpiQueries.uniqueFlows]: networkKpiUniqueFlows,
+      [NetworkKpiQueries.uniquePrivateIps]: networkKpiUniquePrivateIps,
     };
     expect(networkFactory).toEqual(expectedNetworkFactory);
   });
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
index bf5321d32b58f..1eaa59846aebf 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
@@ -7,8 +7,14 @@
 import {
   FactoryQueryTypes,
   NetworkQueries,
+  NetworkKpiQueries,
 } from '../../../../../common/search_strategy/security_solution';
 
+import { networkKpiDns } from './kpi/dns';
+import { networkKpiNetworkEvents } from './kpi/network_events';
+import { networkKpiTlsHandshakes } from './kpi/tls_handshakes';
+import { networkKpiUniqueFlows } from './kpi/unique_flows';
+import { networkKpiUniquePrivateIps } from './kpi/unique_private_ips';
 import { SecuritySolutionFactory } from '../types';
 import { networkDetails } from './details';
 import { networkDns } from './dns';
@@ -19,7 +25,10 @@ import { networkTopCountries } from './top_countries';
 import { networkTopNFlow } from './top_n_flow';
 import { networkUsers } from './users';
 
-export const networkFactory: Record<NetworkQueries, SecuritySolutionFactory<FactoryQueryTypes>> = {
+export const networkFactory: Record<
+  NetworkQueries | NetworkKpiQueries,
+  SecuritySolutionFactory<FactoryQueryTypes>
+> = {
   [NetworkQueries.details]: networkDetails,
   [NetworkQueries.dns]: networkDns,
   [NetworkQueries.http]: networkHttp,
@@ -28,4 +37,9 @@ export const networkFactory: Record<NetworkQueries, SecuritySolutionFactory<Fact
   [NetworkQueries.topCountries]: networkTopCountries,
   [NetworkQueries.topNFlow]: networkTopNFlow,
   [NetworkQueries.users]: networkUsers,
+  [NetworkKpiQueries.dns]: networkKpiDns,
+  [NetworkKpiQueries.networkEvents]: networkKpiNetworkEvents,
+  [NetworkKpiQueries.tlsHandshakes]: networkKpiTlsHandshakes,
+  [NetworkKpiQueries.uniqueFlows]: networkKpiUniqueFlows,
+  [NetworkKpiQueries.uniquePrivateIps]: networkKpiUniquePrivateIps,
 };
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/common/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/common/index.ts
new file mode 100644
index 0000000000000..c7711ac78ec73
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/common/index.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+import { NetworkKpiHistogramData } from '../../../../../../../common/search_strategy/security_solution/network';
+
+export const getIpFilter = () => [
+  {
+    bool: {
+      should: [
+        {
+          exists: {
+            field: 'source.ip',
+          },
+        },
+        {
+          exists: {
+            field: 'destination.ip',
+          },
+        },
+      ],
+      minimum_should_match: 1,
+    },
+  },
+];
+
+export const formatHistogramData = (
+  data: Array<{ key: number; count: { value: number } }>
+): NetworkKpiHistogramData[] | null =>
+  data && data.length > 0
+    ? data.map<NetworkKpiHistogramData>(({ key, count }) => ({
+        x: key,
+        y: getOr(null, 'value', count),
+      }))
+    : null;
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/index.ts
new file mode 100644
index 0000000000000..42713fb063188
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/index.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkKpiQueries,
+  NetworkKpiDnsStrategyResponse,
+  NetworkKpiDnsRequestOptions,
+} from '../../../../../../../common/search_strategy/security_solution/network';
+import { inspectStringifyObject } from '../../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../../types';
+import { buildDnsQuery } from './query.network_kpi_dns.dsl';
+
+export const networkKpiDns: SecuritySolutionFactory<NetworkKpiQueries.dns> = {
+  buildDsl: (options: NetworkKpiDnsRequestOptions) => buildDnsQuery(options),
+  parse: async (
+    options: NetworkKpiDnsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkKpiDnsStrategyResponse> => {
+    const inspect = {
+      dsl: [inspectStringifyObject(buildDnsQuery(options))],
+    };
+
+    return {
+      ...response,
+      inspect,
+      dnsQueries: getOr(null, 'hits.total.value', response.rawResponse),
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kpi_dns.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kpi_dns.dsl.ts
new file mode 100644
index 0000000000000..bb8443bf39178
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/dns/query.network_kpi_dns.dsl.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { NetworkKpiDnsRequestOptions } from '../../../../../../../common/search_strategy/security_solution/network';
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+
+const getDnsQueryFilter = () => [
+  {
+    bool: {
+      should: [
+        {
+          exists: {
+            field: 'dns.question.name',
+          },
+        },
+        {
+          term: {
+            'suricata.eve.dns.type': {
+              value: 'query',
+            },
+          },
+        },
+        {
+          exists: {
+            field: 'zeek.dns.query',
+          },
+        },
+      ],
+      minimum_should_match: 1,
+    },
+  },
+];
+
+export const buildDnsQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+}: NetworkKpiDnsRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    ...getDnsQueryFilter(),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/index.ts
new file mode 100644
index 0000000000000..9cc58271ac18a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/index.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  FactoryQueryTypes,
+  NetworkKpiQueries,
+} from '../../../../../../common/search_strategy/security_solution';
+
+import { SecuritySolutionFactory } from '../../types';
+import { networkKpiDns } from './dns';
+import { networkKpiNetworkEvents } from './network_events';
+import { networkKpiTlsHandshakes } from './tls_handshakes';
+import { networkKpiUniqueFlows } from './unique_flows';
+import { networkKpiUniquePrivateIps } from './unique_private_ips';
+
+export const networkKpiFactory: Record<
+  NetworkKpiQueries,
+  SecuritySolutionFactory<FactoryQueryTypes>
+> = {
+  [NetworkKpiQueries.dns]: networkKpiDns,
+  [NetworkKpiQueries.networkEvents]: networkKpiNetworkEvents,
+  [NetworkKpiQueries.tlsHandshakes]: networkKpiTlsHandshakes,
+  [NetworkKpiQueries.uniqueFlows]: networkKpiUniqueFlows,
+  [NetworkKpiQueries.uniquePrivateIps]: networkKpiUniquePrivateIps,
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/index.ts
new file mode 100644
index 0000000000000..913b1d566a4ea
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/index.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkKpiQueries,
+  NetworkKpiNetworkEventsStrategyResponse,
+  NetworkKpiNetworkEventsRequestOptions,
+} from '../../../../../../../common/search_strategy/security_solution/network';
+import { inspectStringifyObject } from '../../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../../types';
+import { buildNetworkEventsQuery } from './query.network_kpi_network_events.dsl';
+
+export const networkKpiNetworkEvents: SecuritySolutionFactory<NetworkKpiQueries.networkEvents> = {
+  buildDsl: (options: NetworkKpiNetworkEventsRequestOptions) => buildNetworkEventsQuery(options),
+  parse: async (
+    options: NetworkKpiNetworkEventsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkKpiNetworkEventsStrategyResponse> => {
+    const inspect = {
+      dsl: [inspectStringifyObject(buildNetworkEventsQuery(options))],
+    };
+
+    return {
+      ...response,
+      inspect,
+      networkEvents: getOr(null, 'hits.total.value', response.rawResponse),
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events.dsl.ts
new file mode 100644
index 0000000000000..2749e3fa64518
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/network_events/query.network_kpi_network_events.dsl.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { NetworkKpiNetworkEventsRequestOptions } from '../../../../../../../common/search_strategy/security_solution/network';
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+import { getIpFilter } from '../common';
+
+export const buildNetworkEventsQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+}: NetworkKpiNetworkEventsRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    ...getIpFilter(),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/index.ts
new file mode 100644
index 0000000000000..41df66cf28b40
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/index.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkKpiQueries,
+  NetworkKpiTlsHandshakesStrategyResponse,
+  NetworkKpiTlsHandshakesRequestOptions,
+} from '../../../../../../../common/search_strategy/security_solution/network';
+import { inspectStringifyObject } from '../../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../../types';
+import { buildTlsHandshakeQuery } from './query.network_kpi_tls_handshakes.dsl';
+
+export const networkKpiTlsHandshakes: SecuritySolutionFactory<NetworkKpiQueries.tlsHandshakes> = {
+  buildDsl: (options: NetworkKpiTlsHandshakesRequestOptions) => buildTlsHandshakeQuery(options),
+  parse: async (
+    options: NetworkKpiTlsHandshakesRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkKpiTlsHandshakesStrategyResponse> => {
+    const inspect = {
+      dsl: [inspectStringifyObject(buildTlsHandshakeQuery(options))],
+    };
+
+    return {
+      ...response,
+      inspect,
+      tlsHandshakes: getOr(null, 'hits.total.value', response.rawResponse),
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes.dsl.ts
new file mode 100644
index 0000000000000..2b48061c64122
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/tls_handshakes/query.network_kpi_tls_handshakes.dsl.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { NetworkKpiTlsHandshakesRequestOptions } from '../../../../../../../common/search_strategy/security_solution/network';
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+import { getIpFilter } from '../common';
+
+const getTlsHandshakesQueryFilter = () => [
+  {
+    bool: {
+      should: [
+        {
+          exists: {
+            field: 'tls.version',
+          },
+        },
+        {
+          exists: {
+            field: 'suricata.eve.tls.version',
+          },
+        },
+        {
+          exists: {
+            field: 'zeek.ssl.version',
+          },
+        },
+      ],
+      minimum_should_match: 1,
+    },
+  },
+];
+
+export const buildTlsHandshakeQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+}: NetworkKpiTlsHandshakesRequestOptions) => {
+  const filter = [
+    ...getIpFilter(),
+    ...createQueryFilterClauses(filterQuery),
+    ...getTlsHandshakesQueryFilter(),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: true,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/index.ts
new file mode 100644
index 0000000000000..3f2ace27b8bdb
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/index.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkKpiQueries,
+  NetworkKpiUniqueFlowsStrategyResponse,
+  NetworkKpiUniqueFlowsRequestOptions,
+} from '../../../../../../../common/search_strategy/security_solution/network';
+import { inspectStringifyObject } from '../../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../../types';
+import { buildUniqueFlowsQuery } from './query.network_kpi_unique_flows.dsl';
+
+export const networkKpiUniqueFlows: SecuritySolutionFactory<NetworkKpiQueries.uniqueFlows> = {
+  buildDsl: (options: NetworkKpiUniqueFlowsRequestOptions) => buildUniqueFlowsQuery(options),
+  parse: async (
+    options: NetworkKpiUniqueFlowsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkKpiUniqueFlowsStrategyResponse> => {
+    const inspect = {
+      dsl: [inspectStringifyObject(buildUniqueFlowsQuery(options))],
+    };
+
+    return {
+      ...response,
+      inspect,
+      uniqueFlowId: getOr(null, 'aggregations.unique_flow_id.value', response.rawResponse),
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/query.network_kpi_unique_flows.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/query.network_kpi_unique_flows.dsl.ts
new file mode 100644
index 0000000000000..e6340db661e8f
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_flows/query.network_kpi_unique_flows.dsl.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { NetworkKpiUniqueFlowsRequestOptions } from '../../../../../../../common/search_strategy/security_solution/network';
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+import { getIpFilter } from '../common';
+
+export const buildUniqueFlowsQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+}: NetworkKpiUniqueFlowsRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    ...getIpFilter(),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    index: defaultIndex,
+    allowNoIndices: true,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        unique_flow_id: {
+          cardinality: {
+            field: 'network.community_id',
+          },
+        },
+      },
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: false,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/index.ts
new file mode 100644
index 0000000000000..dbb2dd539641a
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/index.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkKpiQueries,
+  NetworkKpiUniquePrivateIpsStrategyResponse,
+  NetworkKpiUniquePrivateIpsRequestOptions,
+} from '../../../../../../../common/search_strategy/security_solution/network';
+import { inspectStringifyObject } from '../../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../../types';
+import { formatHistogramData } from '../common';
+import { buildUniquePrivateIpsQuery } from './query.network_kpi_unique_private_ips.dsl';
+
+export const networkKpiUniquePrivateIps: SecuritySolutionFactory<NetworkKpiQueries.uniquePrivateIps> = {
+  buildDsl: (options: NetworkKpiUniquePrivateIpsRequestOptions) =>
+    buildUniquePrivateIpsQuery(options),
+  parse: async (
+    options: NetworkKpiUniquePrivateIpsRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkKpiUniquePrivateIpsStrategyResponse> => {
+    const inspect = {
+      dsl: [inspectStringifyObject(buildUniquePrivateIpsQuery(options))],
+    };
+
+    const uniqueSourcePrivateIpsHistogram = getOr(
+      null,
+      'aggregations.source.histogram.buckets',
+      response.rawResponse
+    );
+    const uniqueDestinationPrivateIpsHistogram = getOr(
+      null,
+      'aggregations.destination.histogram.buckets',
+      response.rawResponse
+    );
+
+    return {
+      ...response,
+      inspect,
+      uniqueSourcePrivateIps: getOr(
+        null,
+        'aggregations.source.unique_private_ips.value',
+        response.rawResponse
+      ),
+      uniqueDestinationPrivateIps: getOr(
+        null,
+        'aggregations.destination.unique_private_ips.value',
+        response.rawResponse
+      ),
+      uniqueSourcePrivateIpsHistogram: formatHistogramData(uniqueSourcePrivateIpsHistogram),
+      uniqueDestinationPrivateIpsHistogram: formatHistogramData(
+        uniqueDestinationPrivateIpsHistogram
+      ),
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips.dsl.ts
new file mode 100644
index 0000000000000..f1b2b06203cad
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/kpi/unique_private_ips/query.network_kpi_unique_private_ips.dsl.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  NetworkKpiUniquePrivateIpsRequestOptions,
+  UniquePrivateAttributeQuery,
+} from '../../../../../../../common/search_strategy/security_solution/network';
+import { createQueryFilterClauses } from '../../../../../../utils/build_query';
+
+const getUniquePrivateIpsFilter = (attrQuery: UniquePrivateAttributeQuery) => ({
+  bool: {
+    should: [
+      {
+        term: {
+          [`${attrQuery}.ip`]: '10.0.0.0/8',
+        },
+      },
+      {
+        term: {
+          [`${attrQuery}.ip`]: '192.168.0.0/16',
+        },
+      },
+      {
+        term: {
+          [`${attrQuery}.ip`]: '172.16.0.0/12',
+        },
+      },
+      {
+        term: {
+          [`${attrQuery}.ip`]: 'fd00::/8',
+        },
+      },
+    ],
+    minimum_should_match: 1,
+  },
+});
+
+const getAggs = (attrQuery: 'source' | 'destination') => ({
+  [attrQuery]: {
+    filter: getUniquePrivateIpsFilter(attrQuery),
+    aggs: {
+      unique_private_ips: {
+        cardinality: {
+          field: `${attrQuery}.ip`,
+        },
+      },
+      histogram: {
+        auto_date_histogram: {
+          field: '@timestamp',
+          buckets: '6',
+        },
+        aggs: {
+          count: {
+            cardinality: {
+              field: `${attrQuery}.ip`,
+            },
+          },
+        },
+      },
+    },
+  },
+});
+
+export const buildUniquePrivateIpsQuery = ({
+  filterQuery,
+  timerange: { from, to },
+  defaultIndex,
+}: NetworkKpiUniquePrivateIpsRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': {
+          gte: from,
+          lte: to,
+          format: 'strict_date_optional_time',
+        },
+      },
+    },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...getAggs('source'),
+        ...getAggs('destination'),
+      },
+      query: {
+        bool: {
+          filter,
+        },
+      },
+      size: 0,
+      track_total_hits: false,
+    },
+  };
+
+  return dslQuery;
+};
diff --git a/x-pack/plugins/spaces/server/saved_objects/mappings.ts b/x-pack/plugins/spaces/server/saved_objects/mappings.ts
index 3afa7c389927c..875a164e25217 100644
--- a/x-pack/plugins/spaces/server/saved_objects/mappings.ts
+++ b/x-pack/plugins/spaces/server/saved_objects/mappings.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { deepFreeze } from '../../../../../src/core/server';
+import { deepFreeze } from '@kbn/std';
 
 export const SpacesSavedObjectMappings = deepFreeze({
   properties: {
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 0977e99fa0c3c..68f6bc166cd1d 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -9497,9 +9497,6 @@
     "xpack.ingestPipelines.requestFlyout.descriptionText": "このElasticsearchリクエストは、このパイプラインを作成または更新します。",
     "xpack.ingestPipelines.requestFlyout.namedTitle": "「{name}」のリクエスト",
     "xpack.ingestPipelines.requestFlyout.unnamedTitle": "リクエスト",
-    "xpack.ingestPipelines.settingsFormOnFailureFlyout.addButtonLabel": "追加",
-    "xpack.ingestPipelines.settingsFormOnFailureFlyout.cancelButtonLabel": "キャンセル",
-    "xpack.ingestPipelines.settingsFormOnFailureFlyout.updateButtonLabel": "更新",
     "xpack.ingestPipelines.tabs.outputTabTitle": "アウトプット",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsFieldLabel": "ドキュメント",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsJsonError": "ドキュメントJSONが無効です。",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 7f8f2a98abae3..cb43cefdc3655 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -9503,9 +9503,6 @@
     "xpack.ingestPipelines.requestFlyout.descriptionText": "此 Elasticsearch 请求将创建或更新管道。",
     "xpack.ingestPipelines.requestFlyout.namedTitle": "对“{name}”的请求",
     "xpack.ingestPipelines.requestFlyout.unnamedTitle": "请求",
-    "xpack.ingestPipelines.settingsFormOnFailureFlyout.addButtonLabel": "添加",
-    "xpack.ingestPipelines.settingsFormOnFailureFlyout.cancelButtonLabel": "取消",
-    "xpack.ingestPipelines.settingsFormOnFailureFlyout.updateButtonLabel": "更新",
     "xpack.ingestPipelines.tabs.outputTabTitle": "输出",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsFieldLabel": "文档",
     "xpack.ingestPipelines.testPipelineFlyout.documentsForm.documentsJsonError": "文档 JSON 无效。",
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
index d499812a9d5ae..2c9237fac593f 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/url_drilldown_scope.ts
@@ -5,8 +5,8 @@
  */
 
 import partition from 'lodash/partition';
+import { getFlattenedObject } from '@kbn/std';
 import { UrlDrilldownGlobalScope, UrlDrilldownScope } from './types';
-import { getFlattenedObject } from '../../../../../../src/core/public';
 
 export function buildScope<
   ContextScope extends object = object,
diff --git a/x-pack/tasks/build.ts b/x-pack/tasks/build.ts
index 085f63206507f..41bf9587cad1e 100644
--- a/x-pack/tasks/build.ts
+++ b/x-pack/tasks/build.ts
@@ -10,7 +10,8 @@ import { writeFileSync } from 'fs';
 import { promisify } from 'util';
 import { pipeline } from 'stream';
 
-import { ToolingLog, REPO_ROOT, transformFileStream, transformFileWithBabel } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+import { ToolingLog, transformFileStream, transformFileWithBabel } from '@kbn/dev-utils';
 import gulp from 'gulp';
 import del from 'del';
 import fancyLog from 'fancy-log';
diff --git a/x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts b/x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts
index 127721e8e2112..6d0d2d3042625 100644
--- a/x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts
@@ -10,6 +10,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+
   describe('Has data', () => {
     describe('when data is not loaded', () => {
       it('returns false when there is no data', async () => {
@@ -28,8 +30,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       });
     });
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       it('returns true when there is at least one document on transaction, error or metrics indices', async () => {
         const response = await supertest.get('/api/apm/observability_overview/has_data');
diff --git a/x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts b/x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts
index 96ac3c3a5e494..5b04213401660 100644
--- a/x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
+import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
@@ -11,9 +12,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
   // url parameters
-  const start = encodeURIComponent('2020-06-29T06:00:00.000Z');
-  const end = encodeURIComponent('2020-06-29T10:00:00.000Z');
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
   const bucketSize = '60s';
 
   describe('Observability overview', () => {
@@ -23,37 +27,58 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           `/api/apm/observability_overview?start=${start}&end=${end}&bucketSize=${bucketSize}`
         );
         expect(response.status).to.be(200);
-        expectSnapshot(response.body).toMatchInline(`
-          Object {
-            "serviceCount": 0,
-            "transactionCoordinates": Array [],
-          }
-        `);
+
+        expect(response.body.serviceCount).to.be(0);
+        expect(response.body.transactionCoordinates.length).to.be(0);
       });
     });
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       it('returns the service count and transaction coordinates', async () => {
         const response = await supertest.get(
           `/api/apm/observability_overview?start=${start}&end=${end}&bucketSize=${bucketSize}`
         );
         expect(response.status).to.be(200);
-        expectSnapshot(response.body).toMatchInline(`
-          Object {
-            "serviceCount": 3,
-            "transactionCoordinates": Array [
-              Object {
-                "x": 1593413220000,
-                "y": 0.016666666666666666,
-              },
-              Object {
-                "x": 1593413280000,
-                "y": 1.0458333333333334,
-              },
-            ],
-          }
+
+        expect(response.body.serviceCount).to.be.greaterThan(0);
+        expect(response.body.transactionCoordinates.length).to.be.greaterThan(0);
+
+        expectSnapshot(response.body.serviceCount).toMatchInline(`7`);
+
+        expectSnapshot(response.body.transactionCoordinates.length).toMatchInline(`31`);
+
+        expectSnapshot(
+          response.body.transactionCoordinates
+            .slice(0, 5)
+            .map(({ x, y }: { x: number; y: number }) => ({
+              x: new Date(x).toISOString(),
+              y,
+            }))
+        ).toMatchInline(`
+          Array [
+            Object {
+              "x": "2020-09-15T08:53:00.000Z",
+              "y": 1,
+            },
+            Object {
+              "x": "2020-09-15T08:54:00.000Z",
+              "y": 1.8666666666666667,
+            },
+            Object {
+              "x": "2020-09-15T08:55:00.000Z",
+              "y": 0.9666666666666667,
+            },
+            Object {
+              "x": "2020-09-15T08:56:00.000Z",
+              "y": 1.9333333333333333,
+            },
+            Object {
+              "x": "2020-09-15T08:57:00.000Z",
+              "y": 1.1,
+            },
+          ]
         `);
       });
     });
diff --git a/x-pack/test/apm_api_integration/basic/tests/service_maps/service_maps.ts b/x-pack/test/apm_api_integration/basic/tests/service_maps/service_maps.ts
index b0e503eb7d1eb..d729680154c1d 100644
--- a/x-pack/test/apm_api_integration/basic/tests/service_maps/service_maps.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/service_maps/service_maps.ts
@@ -5,22 +5,28 @@
  */
 
 import expect from '@kbn/expect';
+import { expectSnapshot } from '../../../common/match_snapshot';
+import archives_metadata from '../../../common/archives_metadata';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 export default function serviceMapsApiTests({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
   // url parameters
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
 
   describe('Service Maps', () => {
     it('is only be available to users with Platinum license (or higher)', async () => {
       const response = await supertest.get(`/api/apm/service-map?start=${start}&end=${end}`);
 
       expect(response.status).to.be(403);
-      expect(response.body.message).to.be(
-        "In order to access Service Maps, you must be subscribed to an Elastic Platinum license. With it, you'll have the ability to visualize your entire application stack along with your APM data."
+
+      expectSnapshot(response.body.message).toMatchInline(
+        `"In order to access Service Maps, you must be subscribed to an Elastic Platinum license. With it, you'll have the ability to visualize your entire application stack along with your APM data."`
       );
     });
   });
diff --git a/x-pack/test/apm_api_integration/basic/tests/services/agent_name.ts b/x-pack/test/apm_api_integration/basic/tests/services/agent_name.ts
index a87d080e564a2..ee835fde680e0 100644
--- a/x-pack/test/apm_api_integration/basic/tests/services/agent_name.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/services/agent_name.ts
@@ -39,6 +39,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
+
         expect(response.body).to.eql({ agentName: 'nodejs' });
       });
     });
diff --git a/x-pack/test/apm_api_integration/basic/tests/services/top_services.ts b/x-pack/test/apm_api_integration/basic/tests/services/top_services.ts
index 116b2987db32a..9eb9d80e26b6c 100644
--- a/x-pack/test/apm_api_integration/basic/tests/services/top_services.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/services/top_services.ts
@@ -33,7 +33,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
-        expect(response.body).to.eql({ hasHistoricalData: false, hasLegacyData: false, items: [] });
+        expect(response.body.hasHistoricalData).to.be(false);
+        expect(response.body.hasLegacyData).to.be(false);
+        expect(response.body.items.length).to.be(0);
       });
     });
 
@@ -66,8 +68,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             Array [
               "opbeans-python",
               "opbeans-node",
-              "opbeans-ruby",
               "opbeans-go",
+              "opbeans-ruby",
               "opbeans-dotnet",
               "opbeans-java",
               "opbeans-rum",
@@ -89,76 +91,76 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             Array [
               Object {
                 "avgResponseTime": Object {
-                  "value": 208079.9121184089,
+                  "value": 213583.7652495379,
                 },
                 "transactionErrorRate": Object {
-                  "value": 0.041666666666666664,
+                  "value": 0,
                 },
                 "transactionsPerMinute": Object {
-                  "value": 18.016666666666666,
+                  "value": 18.033333333333335,
                 },
               },
               Object {
                 "avgResponseTime": Object {
-                  "value": 578297.1431623931,
+                  "value": 600255.7079646018,
                 },
                 "transactionErrorRate": Object {
-                  "value": 0.03317535545023697,
+                  "value": 0,
                 },
                 "transactionsPerMinute": Object {
-                  "value": 7.8,
+                  "value": 7.533333333333333,
                 },
               },
               Object {
                 "avgResponseTime": Object {
-                  "value": 60518.587926509186,
+                  "value": 1818501.060810811,
                 },
                 "transactionErrorRate": Object {
-                  "value": 0.013123359580052493,
+                  "value": 0.02027027027027027,
                 },
                 "transactionsPerMinute": Object {
-                  "value": 6.35,
+                  "value": 4.933333333333334,
                 },
               },
               Object {
                 "avgResponseTime": Object {
-                  "value": 25259.78717201166,
+                  "value": 290900.5714285714,
                 },
                 "transactionErrorRate": Object {
-                  "value": 0.014577259475218658,
+                  "value": 0.013605442176870748,
                 },
                 "transactionsPerMinute": Object {
-                  "value": 5.716666666666667,
+                  "value": 4.9,
                 },
               },
               Object {
                 "avgResponseTime": Object {
-                  "value": 527290.3218390804,
+                  "value": 1123903.7027027027,
                 },
                 "transactionErrorRate": Object {
-                  "value": 0.01532567049808429,
+                  "value": 0.009009009009009009,
                 },
                 "transactionsPerMinute": Object {
-                  "value": 4.35,
+                  "value": 3.7,
                 },
               },
               Object {
                 "avgResponseTime": Object {
-                  "value": 530245.8571428572,
+                  "value": 80364.62962962964,
                 },
                 "transactionErrorRate": Object {
-                  "value": 0.15384615384615385,
+                  "value": 0.18518518518518517,
                 },
                 "transactionsPerMinute": Object {
-                  "value": 3.033333333333333,
+                  "value": 3.6,
                 },
               },
               Object {
                 "avgResponseTime": Object {
-                  "value": 896134.328358209,
+                  "value": 1365102.9411764706,
                 },
                 "transactionsPerMinute": Object {
-                  "value": 2.2333333333333334,
+                  "value": 2.2666666666666666,
                 },
               },
             ]
@@ -176,10 +178,10 @@ export default function ApiTest({ getService }: FtrProviderContext) {
                 "testing",
               ],
               Array [
-                "production",
+                "testing",
               ],
               Array [
-                "testing",
+                "production",
               ],
               Array [
                 "production",
diff --git a/x-pack/test/apm_api_integration/basic/tests/services/transaction_types.ts b/x-pack/test/apm_api_integration/basic/tests/services/transaction_types.ts
index a6c6bad21a8b7..1221ce0198d82 100644
--- a/x-pack/test/apm_api_integration/basic/tests/services/transaction_types.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/services/transaction_types.ts
@@ -5,6 +5,7 @@
  */
 
 import expect from '@kbn/expect';
+import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 
@@ -12,9 +13,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
   // url parameters
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
 
   describe('Transaction types', () => {
     describe('when data is not loaded ', () => {
@@ -30,8 +34,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     });
 
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       it('handles empty state', async () => {
         const response = await supertest.get(
@@ -39,11 +43,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
+        expect(response.body.transactionTypes.length).to.be.greaterThan(0);
+
         expectSnapshot(response.body).toMatchInline(`
           Object {
             "transactionTypes": Array [
-              "request",
               "Worker",
+              "request",
             ],
           }
         `);
diff --git a/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts b/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts
index 27023d16f57ca..70ddf276ab35c 100644
--- a/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/settings/agent_configuration.ts
@@ -6,6 +6,7 @@
 
 import expect from '@kbn/expect';
 import { omit, orderBy } from 'lodash';
+import { expectSnapshot } from '../../../common/match_snapshot';
 import { AgentConfigurationIntake } from '../../../../../plugins/apm/common/agent_configuration/configuration_types';
 import { AgentConfigSearchParams } from '../../../../../plugins/apm/server/routes/settings/agent_configuration';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
@@ -16,6 +17,8 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
   const log = getService('log');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+
   function getServices() {
     return supertestRead
       .get(`/api/apm/settings/agent-configuration/services`)
@@ -125,31 +128,46 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
     });
 
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       it('returns all services', async () => {
         const { body } = await getServices();
-        expect(body).to.eql([
-          'ALL_OPTION_VALUE',
-          'client',
-          'opbeans-dotnet',
-          'opbeans-go',
-          'opbeans-java',
-          'opbeans-node',
-          'opbeans-python',
-          'opbeans-ruby',
-          'opbeans-rum',
-        ]);
+        expectSnapshot(body).toMatchInline(`
+          Array [
+            "ALL_OPTION_VALUE",
+            "opbeans-dotnet",
+            "opbeans-go",
+            "opbeans-java",
+            "opbeans-node",
+            "opbeans-python",
+            "opbeans-ruby",
+            "opbeans-rum",
+          ]
+        `);
       });
 
-      it('returns the environments', async () => {
+      it('returns the environments, all unconfigured', async () => {
         const { body } = await getEnvironments('opbeans-node');
-        expect(body).to.eql([
-          { name: 'ALL_OPTION_VALUE', alreadyConfigured: false },
-          { name: 'testing', alreadyConfigured: false },
-          { name: 'production', alreadyConfigured: false },
-        ]);
+
+        expect(body.map((item: { name: string }) => item.name)).to.contain('ALL_OPTION_VALUE');
+
+        expect(
+          body.every((item: { alreadyConfigured: boolean }) => item.alreadyConfigured === false)
+        ).to.be(true);
+
+        expectSnapshot(body).toMatchInline(`
+          Array [
+            Object {
+              "alreadyConfigured": false,
+              "name": "ALL_OPTION_VALUE",
+            },
+            Object {
+              "alreadyConfigured": false,
+              "name": "testing",
+            },
+          ]
+        `);
       });
 
       it('returns the agent names', async () => {
diff --git a/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts b/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts
index 2acc6522bf479..a1c647a854bf6 100644
--- a/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/settings/custom_link.ts
@@ -14,6 +14,8 @@ export default function customLinksTests({ getService }: FtrProviderContext) {
   const log = getService('log');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+
   function searchCustomLinks(filters?: any) {
     const path = URL.format({
       pathname: `/api/apm/settings/custom_links`,
@@ -142,8 +144,8 @@ export default function customLinksTests({ getService }: FtrProviderContext) {
     });
 
     describe('transaction', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       it('fetches a transaction sample', async () => {
         const response = await supertestRead.get(
diff --git a/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap b/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap
index 5557e0828a338..c5ee0b524f0d4 100644
--- a/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap
+++ b/x-pack/test/apm_api_integration/basic/tests/traces/__snapshots__/top_traces.snap
@@ -3,301 +3,535 @@
 exports[`Top traces when data is loaded returns the correct buckets 1`] = `
 Array [
   Object {
-    "averageResponseTime": 2577,
+    "averageResponseTime": 1137,
     "impact": 0,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /throw-error",
+      "transaction.name": "POST /api/orders",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 3147,
-    "impact": 0.06552270160444405,
+    "averageResponseTime": 3347,
+    "impact": 0.003559081182448518,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#orders",
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.stats",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.03333333333333333,
+  },
+  Object {
+    "averageResponseTime": 4479,
+    "impact": 0.00538210376096966,
+    "key": Object {
+      "service.name": "opbeans-node",
+      "transaction.name": "GET /api/customers/:id",
+    },
+    "transactionsPerMinute": 0.03333333333333333,
+  },
+  Object {
+    "averageResponseTime": 7287,
+    "impact": 0.009904230439845424,
+    "key": Object {
+      "service.name": "opbeans-node",
+      "transaction.name": "GET /api/products/top",
+    },
+    "transactionsPerMinute": 0.03333333333333333,
+  },
+  Object {
+    "averageResponseTime": 8023,
+    "impact": 0.011089517204678958,
+    "key": Object {
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::OrdersController#show",
+    },
+    "transactionsPerMinute": 0.03333333333333333,
+  },
+  Object {
+    "averageResponseTime": 8282,
+    "impact": 0.011506622193934236,
+    "key": Object {
+      "service.name": "opbeans-node",
+      "transaction.name": "GET /api/orders/:id",
+    },
+    "transactionsPerMinute": 0.03333333333333333,
+  },
+  Object {
+    "averageResponseTime": 12116,
+    "impact": 0.017681064390091532,
+    "key": Object {
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::ProductsController#top",
+    },
+    "transactionsPerMinute": 0.03333333333333333,
+  },
+  Object {
+    "averageResponseTime": 6451,
+    "impact": 0.018946873353622995,
+    "key": Object {
+      "service.name": "opbeans-node",
+      "transaction.name": "GET /api/products",
+    },
+    "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
-    "averageResponseTime": 3392.5,
-    "impact": 0.09374344413758617,
+    "averageResponseTime": 13360,
+    "impact": 0.019684456693696034,
     "key": Object {
       "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#order",
+      "transaction.name": "APIRestController#customers",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 4713.5,
-    "impact": 0.24559517890858723,
+    "averageResponseTime": 7903,
+    "impact": 0.023623602653998786,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#product",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
-    "averageResponseTime": 4757,
-    "impact": 0.25059559560997896,
+    "averageResponseTime": 17913,
+    "impact": 0.027016808107129565,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/products/:id/customers",
+      "transaction.name": "GET /api/stats",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 6787,
-    "impact": 0.4839483750082622,
+    "averageResponseTime": 6065.666666666667,
+    "impact": 0.02747417419573381,
     "key": Object {
       "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#products",
+      "transaction.name": "APIRestController#topProducts",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 4749.666666666667,
-    "impact": 0.5227447114845778,
+    "averageResponseTime": 2340.875,
+    "impact": 0.02832770950193187,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET /api/orders/:id",
+      "service.name": "opbeans-java",
+      "transaction.name": "ResourceHttpRequestHandler",
     },
-    "transactionsPerMinute": 0.75,
+    "transactionsPerMinute": 0.26666666666666666,
   },
   Object {
-    "averageResponseTime": 7624.5,
-    "impact": 0.5802207655235637,
+    "averageResponseTime": 7340.666666666667,
+    "impact": 0.03363412239612548,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET /api/orders",
+      "service.name": "opbeans-java",
+      "transaction.name": "APIRestController#customerWhoBought",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 5098,
-    "impact": 0.582807187955318,
+    "averageResponseTime": 7689,
+    "impact": 0.03531703634891222,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/stats",
+      "transaction.name": "GET /api/types",
     },
-    "transactionsPerMinute": 0.75,
+    "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 8181,
-    "impact": 0.6441916136689552,
+    "averageResponseTime": 11598,
+    "impact": 0.035524783621552876,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/types/:id",
+      "transaction.name": "GET /api/products/:id/customers",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
-    "averageResponseTime": 20011,
-    "impact": 0.853921734857215,
+    "averageResponseTime": 12077.5,
+    "impact": 0.03706919939257919,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "POST /api",
+      "service.name": "opbeans-java",
+      "transaction.name": "APIRestController#order",
+    },
+    "transactionsPerMinute": 0.06666666666666667,
+  },
+  Object {
+    "averageResponseTime": 6296.5,
+    "impact": 0.03872956712973051,
+    "key": Object {
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::TypesController#index",
+    },
+    "transactionsPerMinute": 0.13333333333333333,
+  },
+  Object {
+    "averageResponseTime": 28181,
+    "impact": 0.04355284683173653,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.customer",
     },
-    "transactionsPerMinute": 0.25,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 6583,
-    "impact": 1.2172278724376455,
+    "averageResponseTime": 7439,
+    "impact": 0.046089296090721335,
+    "key": Object {
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/customers/:id",
+    },
+    "transactionsPerMinute": 0.13333333333333333,
+  },
+  Object {
+    "averageResponseTime": 10471.333333333334,
+    "impact": 0.0487594121995447,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/products",
+      "transaction.name": "GET /api/types/:id",
     },
-    "transactionsPerMinute": 1,
+    "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 33097,
-    "impact": 1.6060533780113861,
+    "averageResponseTime": 20810.5,
+    "impact": 0.0651972138417402,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/products/top",
+      "transaction.name": "GET /api/customers",
     },
-    "transactionsPerMinute": 0.25,
+    "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
-    "averageResponseTime": 4825,
-    "impact": 1.6450221426498186,
+    "averageResponseTime": 11732.25,
+    "impact": 0.07374545045551247,
     "key": Object {
       "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#topProducts",
+      "transaction.name": "APIRestController#customer",
     },
-    "transactionsPerMinute": 1.75,
+    "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
-    "averageResponseTime": 35846,
-    "impact": 1.7640550505645587,
+    "averageResponseTime": 47646,
+    "impact": 0.0749001387848408,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET /log-error",
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.customers",
     },
-    "transactionsPerMinute": 0.25,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 3742.153846153846,
-    "impact": 2.4998634943716573,
+    "averageResponseTime": 13160.75,
+    "impact": 0.08294752732271193,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#customerWhoBought",
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.products",
     },
-    "transactionsPerMinute": 3.25,
+    "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
-    "averageResponseTime": 3492.9285714285716,
-    "impact": 2.5144049360435208,
+    "averageResponseTime": 4131.461538461538,
+    "impact": 0.08466426059895181,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET static file",
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/types/:id",
     },
-    "transactionsPerMinute": 3.5,
+    "transactionsPerMinute": 0.43333333333333335,
   },
   Object {
-    "averageResponseTime": 26992.5,
-    "impact": 2.8066131947777255,
+    "averageResponseTime": 13869.25,
+    "impact": 0.08751152554491062,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET /api/types",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::StatsController#index",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
-    "averageResponseTime": 13516.5,
-    "impact": 2.8112687551548836,
+    "averageResponseTime": 20643.333333333332,
+    "impact": 0.09790372050886552,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET /api/products/:id",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::ProductsController#show",
     },
-    "transactionsPerMinute": 1,
+    "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 20092,
-    "impact": 3.168195050736987,
+    "averageResponseTime": 15596.5,
+    "impact": 0.09863808296099064,
     "key": Object {
-      "service.name": "opbeans-node",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::TypesController#show",
+    },
+    "transactionsPerMinute": 0.13333333333333333,
+  },
+  Object {
+    "averageResponseTime": 20989,
+    "impact": 0.09957375090986059,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.orders",
+    },
+    "transactionsPerMinute": 0.1,
+  },
+  Object {
+    "averageResponseTime": 74419,
+    "impact": 0.11801655529963453,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.product_type",
+    },
+    "transactionsPerMinute": 0.03333333333333333,
+  },
+  Object {
+    "averageResponseTime": 10678.42857142857,
+    "impact": 0.11854800181104089,
+    "key": Object {
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/orders/:id",
+    },
+    "transactionsPerMinute": 0.23333333333333334,
+  },
+  Object {
+    "averageResponseTime": 27078.666666666668,
+    "impact": 0.12899495187011034,
+    "key": Object {
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::OrdersController#index",
+    },
+    "transactionsPerMinute": 0.1,
+  },
+  Object {
+    "averageResponseTime": 11827.42857142857,
+    "impact": 0.13150080269358994,
+    "key": Object {
+      "service.name": "opbeans-go",
       "transaction.name": "GET /api/customers",
     },
-    "transactionsPerMinute": 0.75,
+    "transactionsPerMinute": 0.23333333333333334,
   },
   Object {
-    "averageResponseTime": 15535,
-    "impact": 3.275330415465657,
+    "averageResponseTime": 21770.75,
+    "impact": 0.13841121778584634,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#stats",
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.product",
     },
-    "transactionsPerMinute": 1,
+    "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
-    "averageResponseTime": 32667.5,
-    "impact": 3.458966408120217,
+    "averageResponseTime": 10252,
+    "impact": 0.1467613697908217,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET /log-message",
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/types",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.3,
   },
   Object {
-    "averageResponseTime": 16690.75,
-    "impact": 3.541042213287889,
+    "averageResponseTime": 100570,
+    "impact": 0.16013127566262603,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#customers",
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.top_products",
     },
-    "transactionsPerMinute": 1,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 33500,
-    "impact": 3.5546640380951287,
+    "averageResponseTime": 15505,
+    "impact": 0.1979283957314345,
     "key": Object {
-      "service.name": "client",
-      "transaction.name": "/customers",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::CustomersController#index",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.26666666666666666,
   },
   Object {
-    "averageResponseTime": 77000,
-    "impact": 4.129424578484989,
+    "averageResponseTime": 22856.5,
+    "impact": 0.21902360134631826,
     "key": Object {
-      "service.name": "client",
-      "transaction.name": "/products",
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/products",
     },
-    "transactionsPerMinute": 0.25,
+    "transactionsPerMinute": 0.2,
   },
   Object {
-    "averageResponseTime": 19370.6,
-    "impact": 5.270496679320978,
+    "averageResponseTime": 17250.125,
+    "impact": 0.2204118040518706,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#customer",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::ProductsController#index",
     },
-    "transactionsPerMinute": 1.25,
+    "transactionsPerMinute": 0.26666666666666666,
   },
   Object {
-    "averageResponseTime": 81500,
-    "impact": 9.072365225837785,
+    "averageResponseTime": 20089.555555555555,
+    "impact": 0.2893468583571687,
     "key": Object {
-      "service.name": "client",
-      "transaction.name": "/orders",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::CustomersController#show",
     },
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.3,
   },
   Object {
-    "averageResponseTime": 14419.42857142857,
-    "impact": 11.30657439844125,
+    "averageResponseTime": 26487.85714285714,
+    "impact": 0.29676939463314395,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "ResourceHttpRequestHandler",
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/stats",
     },
-    "transactionsPerMinute": 3.5,
+    "transactionsPerMinute": 0.23333333333333334,
   },
   Object {
-    "averageResponseTime": 270684,
-    "impact": 15.261616628971955,
+    "averageResponseTime": 14957.538461538461,
+    "impact": 0.31131653504991197,
+    "key": Object {
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/products/:id/customers",
+    },
+    "transactionsPerMinute": 0.43333333333333335,
+  },
+  Object {
+    "averageResponseTime": 30178.5,
+    "impact": 0.678579893755146,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "POST /api/orders",
+      "transaction.name": "GET /api",
+    },
+    "transactionsPerMinute": 0.4666666666666667,
+  },
+  Object {
+    "averageResponseTime": 32625.875,
+    "impact": 0.8388432258236366,
+    "key": Object {
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/products/:id",
+    },
+    "transactionsPerMinute": 0.5333333333333333,
+  },
+  Object {
+    "averageResponseTime": 121200.83333333333,
+    "impact": 1.1692918352841768,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.product_customers",
+    },
+    "transactionsPerMinute": 0.2,
+  },
+  Object {
+    "averageResponseTime": 38025.86666666667,
+    "impact": 3.6724805948748136,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "opbeans.tasks.sync_orders",
     },
-    "transactionsPerMinute": 0.25,
+    "transactionsPerMinute": 2,
   },
   Object {
-    "averageResponseTime": 36010.53846153846,
-    "impact": 26.61043592713186,
+    "averageResponseTime": 815238,
+    "impact": 11.8142250451802,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "DispatcherServlet#doGet",
     },
-    "transactionsPerMinute": 3.25,
+    "transactionsPerMinute": 0.3,
+  },
+  Object {
+    "averageResponseTime": 691636.3636363636,
+    "impact": 12.25042667907868,
+    "key": Object {
+      "service.name": "opbeans-rum",
+      "transaction.name": "/customers",
+    },
+    "transactionsPerMinute": 0.36666666666666664,
+  },
+  Object {
+    "averageResponseTime": 1590910.5,
+    "impact": 20.494746747861388,
+    "key": Object {
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/orders",
+    },
+    "transactionsPerMinute": 0.26666666666666666,
+  },
+  Object {
+    "averageResponseTime": 303589.16279069765,
+    "impact": 21.02144244954455,
+    "key": Object {
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Rack",
+    },
+    "transactionsPerMinute": 1.4333333333333333,
   },
   Object {
-    "averageResponseTime": 208000,
-    "impact": 35.56882613781033,
+    "averageResponseTime": 1180200,
+    "impact": 28.507858596190804,
     "key": Object {
-      "service.name": "client",
+      "service.name": "opbeans-rum",
+      "transaction.name": "/products",
+    },
+    "transactionsPerMinute": 0.5,
+  },
+  Object {
+    "averageResponseTime": 1073178.5714285714,
+    "impact": 48.390399898683754,
+    "key": Object {
+      "service.name": "opbeans-rum",
       "transaction.name": "/dashboard",
     },
-    "transactionsPerMinute": 0.75,
+    "transactionsPerMinute": 0.9333333333333333,
+  },
+  Object {
+    "averageResponseTime": 2676214.285714286,
+    "impact": 60.33667329750868,
+    "key": Object {
+      "service.name": "opbeans-rum",
+      "transaction.name": "/orders",
+    },
+    "transactionsPerMinute": 0.4666666666666667,
   },
   Object {
-    "averageResponseTime": 49816.15625,
-    "impact": 91.32732325394932,
+    "averageResponseTime": 928922.4347826086,
+    "impact": 68.81313564424958,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api",
+      "transaction.name": "Process completed order",
     },
-    "transactionsPerMinute": 8,
+    "transactionsPerMinute": 1.5333333333333334,
   },
   Object {
-    "averageResponseTime": 1745009,
-    "impact": 100,
+    "averageResponseTime": 1012219.0930232558,
+    "impact": 70.09342088866295,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "Process payment",
     },
-    "transactionsPerMinute": 0.25,
+    "transactionsPerMinute": 1.4333333333333333,
+  },
+  Object {
+    "averageResponseTime": 126010.60833333334,
+    "impact": 73.05405786950051,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "opbeans.tasks.update_stats",
+    },
+    "transactionsPerMinute": 12,
+  },
+  Object {
+    "averageResponseTime": 1041680.2444444444,
+    "impact": 75.48871418577934,
+    "key": Object {
+      "service.name": "opbeans-node",
+      "transaction.name": "Update shipping status",
+    },
+    "transactionsPerMinute": 1.5,
+  },
+  Object {
+    "averageResponseTime": 1724883.75,
+    "impact": 100,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "opbeans.tasks.sync_customers",
+    },
+    "transactionsPerMinute": 1.2,
   },
 ]
 `;
diff --git a/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts b/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts
index 2935fb8e2839a..a63c007f96032 100644
--- a/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/traces/top_traces.ts
@@ -5,6 +5,7 @@
  */
 import expect from '@kbn/expect';
 import { sortBy, omit } from 'lodash';
+import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 
@@ -12,9 +13,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
   // url parameters
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
   const uiFilters = encodeURIComponent(JSON.stringify({}));
 
   describe('Top traces', () => {
@@ -25,32 +29,27 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
-        expectSnapshot(response.body).toMatchInline(`
-          Object {
-            "bucketSize": 1000,
-            "isAggregationAccurate": true,
-            "items": Array [],
-          }
-        `);
+        expect(response.body.items.length).to.be(0);
+        expect(response.body.isAggregationAccurate).to.be(true);
       });
     });
 
     describe('when data is loaded', () => {
       let response: any;
       before(async () => {
-        await esArchiver.load('8.0.0');
+        await esArchiver.load(archiveName);
         response = await supertest.get(
           `/api/apm/traces?start=${start}&end=${end}&uiFilters=${uiFilters}`
         );
       });
-      after(() => esArchiver.unload('8.0.0'));
+      after(() => esArchiver.unload(archiveName));
 
       it('returns the correct status code', async () => {
         expect(response.status).to.be(200);
       });
 
       it('returns the correct number of buckets', async () => {
-        expectSnapshot(response.body.items.length).toMatchInline(`33`);
+        expectSnapshot(response.body.items.length).toMatchInline(`59`);
       });
 
       it('returns the correct buckets', async () => {
@@ -68,25 +67,25 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expectSnapshot(firstItem).toMatchInline(`
           Object {
-            "averageResponseTime": 2577,
+            "averageResponseTime": 1137,
             "impact": 0,
             "key": Object {
               "service.name": "opbeans-node",
-              "transaction.name": "GET /throw-error",
+              "transaction.name": "POST /api/orders",
             },
-            "transactionsPerMinute": 0.5,
+            "transactionsPerMinute": 0.03333333333333333,
           }
         `);
 
         expectSnapshot(lastItem).toMatchInline(`
           Object {
-            "averageResponseTime": 1745009,
+            "averageResponseTime": 1724883.75,
             "impact": 100,
             "key": Object {
-              "service.name": "opbeans-node",
-              "transaction.name": "Process payment",
+              "service.name": "opbeans-python",
+              "transaction.name": "opbeans.tasks.sync_customers",
             },
-            "transactionsPerMinute": 0.25,
+            "transactionsPerMinute": 1.2,
           }
         `);
 
@@ -94,23 +93,23 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           Array [
             Object {
               "service.name": "opbeans-node",
-              "transaction.name": "GET /throw-error",
+              "transaction.name": "POST /api/orders",
             },
             Object {
-              "service.name": "opbeans-java",
-              "transaction.name": "APIRestController#orders",
+              "service.name": "opbeans-python",
+              "transaction.name": "GET opbeans.views.stats",
             },
             Object {
-              "service.name": "opbeans-java",
-              "transaction.name": "APIRestController#order",
+              "service.name": "opbeans-node",
+              "transaction.name": "GET /api/customers/:id",
             },
             Object {
-              "service.name": "opbeans-java",
-              "transaction.name": "APIRestController#product",
+              "service.name": "opbeans-node",
+              "transaction.name": "GET /api/products/top",
             },
             Object {
-              "service.name": "opbeans-node",
-              "transaction.name": "GET /api/products/:id/customers",
+              "service.name": "opbeans-ruby",
+              "transaction.name": "Api::OrdersController#show",
             },
           ]
         `);
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/avg_duration_by_browser.snap b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/avg_duration_by_browser.snap
index 326797919a095..ab7b71cdf9e53 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/avg_duration_by_browser.snap
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/avg_duration_by_browser.snap
@@ -5,1469 +5,434 @@ Array [
   Object {
     "data": Array [
       Object {
-        "x": 1593413100000,
+        "x": 1600159980000,
+        "y": 1131000,
       },
       Object {
-        "x": 1593413101000,
+        "x": 1600160010000,
+        "y": 617000,
       },
       Object {
-        "x": 1593413102000,
+        "x": 1600160040000,
       },
       Object {
-        "x": 1593413103000,
+        "x": 1600160070000,
+        "y": 1963000,
       },
       Object {
-        "x": 1593413104000,
+        "x": 1600160100000,
+        "y": 1190000,
       },
       Object {
-        "x": 1593413105000,
+        "x": 1600160130000,
+        "y": 1697000,
       },
       Object {
-        "x": 1593413106000,
+        "x": 1600160160000,
       },
       Object {
-        "x": 1593413107000,
+        "x": 1600160190000,
+        "y": 710000,
       },
       Object {
-        "x": 1593413108000,
+        "x": 1600160220000,
+        "y": 675250,
       },
       Object {
-        "x": 1593413109000,
+        "x": 1600160250000,
       },
       Object {
-        "x": 1593413110000,
+        "x": 1600160280000,
       },
       Object {
-        "x": 1593413111000,
+        "x": 1600160310000,
+        "y": 1763500,
       },
       Object {
-        "x": 1593413112000,
+        "x": 1600160340000,
+        "y": 539333.3333333334,
       },
       Object {
-        "x": 1593413113000,
+        "x": 1600160370000,
       },
       Object {
-        "x": 1593413114000,
+        "x": 1600160400000,
       },
       Object {
-        "x": 1593413115000,
+        "x": 1600160430000,
+        "y": 1650000,
       },
       Object {
-        "x": 1593413116000,
+        "x": 1600160460000,
+        "y": 781000,
       },
       Object {
-        "x": 1593413117000,
+        "x": 1600160490000,
       },
       Object {
-        "x": 1593413118000,
+        "x": 1600160520000,
       },
       Object {
-        "x": 1593413119000,
+        "x": 1600160550000,
+        "y": 1710000,
       },
       Object {
-        "x": 1593413120000,
+        "x": 1600160580000,
+        "y": 718000,
       },
       Object {
-        "x": 1593413121000,
+        "x": 1600160610000,
+        "y": 11912000,
       },
       Object {
-        "x": 1593413122000,
+        "x": 1600160640000,
       },
       Object {
-        "x": 1593413123000,
+        "x": 1600160670000,
+        "y": 885000,
       },
       Object {
-        "x": 1593413124000,
+        "x": 1600160700000,
+        "y": 1043000,
       },
       Object {
-        "x": 1593413125000,
+        "x": 1600160730000,
+        "y": 406000,
       },
       Object {
-        "x": 1593413126000,
+        "x": 1600160760000,
       },
       Object {
-        "x": 1593413127000,
+        "x": 1600160790000,
+        "y": 1296000,
       },
       Object {
-        "x": 1593413128000,
+        "x": 1600160820000,
+        "y": 570500,
       },
       Object {
-        "x": 1593413129000,
+        "x": 1600160850000,
       },
       Object {
-        "x": 1593413130000,
+        "x": 1600160880000,
       },
       Object {
-        "x": 1593413131000,
+        "x": 1600160910000,
+        "y": 1110000,
       },
       Object {
-        "x": 1593413132000,
+        "x": 1600160940000,
+        "y": 533500,
       },
       Object {
-        "x": 1593413133000,
+        "x": 1600160970000,
+        "y": 782500,
       },
       Object {
-        "x": 1593413134000,
+        "x": 1600161000000,
       },
       Object {
-        "x": 1593413135000,
+        "x": 1600161030000,
+        "y": 1200000,
       },
       Object {
-        "x": 1593413136000,
+        "x": 1600161060000,
+        "y": 522000,
       },
       Object {
-        "x": 1593413137000,
+        "x": 1600161090000,
       },
       Object {
-        "x": 1593413138000,
+        "x": 1600161120000,
       },
       Object {
-        "x": 1593413139000,
+        "x": 1600161150000,
+        "y": 1006000,
       },
       Object {
-        "x": 1593413140000,
+        "x": 1600161180000,
+        "y": 1203000,
       },
       Object {
-        "x": 1593413141000,
+        "x": 1600161210000,
       },
       Object {
-        "x": 1593413142000,
+        "x": 1600161240000,
       },
       Object {
-        "x": 1593413143000,
+        "x": 1600161270000,
+        "y": 1908000,
       },
       Object {
-        "x": 1593413144000,
+        "x": 1600161300000,
+        "y": 549000,
       },
       Object {
-        "x": 1593413145000,
+        "x": 1600161330000,
+        "y": 685000,
       },
       Object {
-        "x": 1593413146000,
+        "x": 1600161360000,
       },
       Object {
-        "x": 1593413147000,
+        "x": 1600161390000,
+        "y": 2055000,
       },
       Object {
-        "x": 1593413148000,
+        "x": 1600161420000,
+        "y": 699750,
       },
       Object {
-        "x": 1593413149000,
+        "x": 1600161450000,
       },
       Object {
-        "x": 1593413150000,
+        "x": 1600161480000,
       },
       Object {
-        "x": 1593413151000,
+        "x": 1600161510000,
+        "y": 1557000,
       },
       Object {
-        "x": 1593413152000,
+        "x": 1600161540000,
+        "y": 4993000,
       },
       Object {
-        "x": 1593413153000,
+        "x": 1600161570000,
       },
       Object {
-        "x": 1593413154000,
+        "x": 1600161600000,
       },
       Object {
-        "x": 1593413155000,
+        "x": 1600161630000,
+        "y": 898000,
       },
       Object {
-        "x": 1593413156000,
+        "x": 1600161660000,
+        "y": 4100500,
       },
       Object {
-        "x": 1593413157000,
+        "x": 1600161690000,
       },
       Object {
-        "x": 1593413158000,
+        "x": 1600161720000,
       },
       Object {
-        "x": 1593413159000,
+        "x": 1600161750000,
+        "y": 1305000,
       },
       Object {
-        "x": 1593413160000,
-      },
-      Object {
-        "x": 1593413161000,
-      },
-      Object {
-        "x": 1593413162000,
-      },
-      Object {
-        "x": 1593413163000,
-      },
-      Object {
-        "x": 1593413164000,
-      },
-      Object {
-        "x": 1593413165000,
-      },
-      Object {
-        "x": 1593413166000,
-      },
-      Object {
-        "x": 1593413167000,
-      },
-      Object {
-        "x": 1593413168000,
-      },
-      Object {
-        "x": 1593413169000,
-      },
-      Object {
-        "x": 1593413170000,
-      },
-      Object {
-        "x": 1593413171000,
-      },
-      Object {
-        "x": 1593413172000,
-      },
-      Object {
-        "x": 1593413173000,
-      },
-      Object {
-        "x": 1593413174000,
-      },
-      Object {
-        "x": 1593413175000,
-      },
-      Object {
-        "x": 1593413176000,
-      },
-      Object {
-        "x": 1593413177000,
-      },
-      Object {
-        "x": 1593413178000,
-      },
-      Object {
-        "x": 1593413179000,
-      },
-      Object {
-        "x": 1593413180000,
-      },
-      Object {
-        "x": 1593413181000,
-      },
-      Object {
-        "x": 1593413182000,
-      },
-      Object {
-        "x": 1593413183000,
-      },
-      Object {
-        "x": 1593413184000,
-      },
-      Object {
-        "x": 1593413185000,
-      },
-      Object {
-        "x": 1593413186000,
-      },
-      Object {
-        "x": 1593413187000,
-      },
-      Object {
-        "x": 1593413188000,
-      },
-      Object {
-        "x": 1593413189000,
-      },
-      Object {
-        "x": 1593413190000,
-      },
-      Object {
-        "x": 1593413191000,
-      },
-      Object {
-        "x": 1593413192000,
-      },
-      Object {
-        "x": 1593413193000,
-      },
-      Object {
-        "x": 1593413194000,
-      },
-      Object {
-        "x": 1593413195000,
-      },
-      Object {
-        "x": 1593413196000,
-      },
-      Object {
-        "x": 1593413197000,
-      },
-      Object {
-        "x": 1593413198000,
-      },
-      Object {
-        "x": 1593413199000,
-      },
-      Object {
-        "x": 1593413200000,
-      },
-      Object {
-        "x": 1593413201000,
-      },
-      Object {
-        "x": 1593413202000,
-      },
-      Object {
-        "x": 1593413203000,
-      },
-      Object {
-        "x": 1593413204000,
-      },
-      Object {
-        "x": 1593413205000,
-      },
-      Object {
-        "x": 1593413206000,
-      },
-      Object {
-        "x": 1593413207000,
-      },
-      Object {
-        "x": 1593413208000,
-      },
-      Object {
-        "x": 1593413209000,
-      },
-      Object {
-        "x": 1593413210000,
-      },
-      Object {
-        "x": 1593413211000,
-      },
-      Object {
-        "x": 1593413212000,
-      },
-      Object {
-        "x": 1593413213000,
-      },
-      Object {
-        "x": 1593413214000,
-      },
-      Object {
-        "x": 1593413215000,
-      },
-      Object {
-        "x": 1593413216000,
-      },
-      Object {
-        "x": 1593413217000,
-      },
-      Object {
-        "x": 1593413218000,
-      },
-      Object {
-        "x": 1593413219000,
-      },
-      Object {
-        "x": 1593413220000,
-      },
-      Object {
-        "x": 1593413221000,
-      },
-      Object {
-        "x": 1593413222000,
-      },
-      Object {
-        "x": 1593413223000,
-      },
-      Object {
-        "x": 1593413224000,
-      },
-      Object {
-        "x": 1593413225000,
-      },
-      Object {
-        "x": 1593413226000,
-      },
-      Object {
-        "x": 1593413227000,
-      },
-      Object {
-        "x": 1593413228000,
-      },
-      Object {
-        "x": 1593413229000,
-      },
-      Object {
-        "x": 1593413230000,
-      },
-      Object {
-        "x": 1593413231000,
-      },
-      Object {
-        "x": 1593413232000,
-      },
-      Object {
-        "x": 1593413233000,
-      },
-      Object {
-        "x": 1593413234000,
-      },
-      Object {
-        "x": 1593413235000,
-      },
-      Object {
-        "x": 1593413236000,
-      },
-      Object {
-        "x": 1593413237000,
-      },
-      Object {
-        "x": 1593413238000,
-      },
-      Object {
-        "x": 1593413239000,
-      },
-      Object {
-        "x": 1593413240000,
-      },
-      Object {
-        "x": 1593413241000,
-      },
-      Object {
-        "x": 1593413242000,
-      },
-      Object {
-        "x": 1593413243000,
-      },
-      Object {
-        "x": 1593413244000,
-      },
-      Object {
-        "x": 1593413245000,
-      },
-      Object {
-        "x": 1593413246000,
-      },
-      Object {
-        "x": 1593413247000,
-      },
-      Object {
-        "x": 1593413248000,
-      },
-      Object {
-        "x": 1593413249000,
-      },
-      Object {
-        "x": 1593413250000,
-      },
-      Object {
-        "x": 1593413251000,
-      },
-      Object {
-        "x": 1593413252000,
-      },
-      Object {
-        "x": 1593413253000,
-      },
-      Object {
-        "x": 1593413254000,
-      },
-      Object {
-        "x": 1593413255000,
-      },
-      Object {
-        "x": 1593413256000,
-      },
-      Object {
-        "x": 1593413257000,
-      },
-      Object {
-        "x": 1593413258000,
-      },
-      Object {
-        "x": 1593413259000,
-      },
-      Object {
-        "x": 1593413260000,
-      },
-      Object {
-        "x": 1593413261000,
-      },
-      Object {
-        "x": 1593413262000,
-      },
-      Object {
-        "x": 1593413263000,
-      },
-      Object {
-        "x": 1593413264000,
-      },
-      Object {
-        "x": 1593413265000,
-      },
-      Object {
-        "x": 1593413266000,
-      },
-      Object {
-        "x": 1593413267000,
-      },
-      Object {
-        "x": 1593413268000,
-      },
-      Object {
-        "x": 1593413269000,
-      },
-      Object {
-        "x": 1593413270000,
-      },
-      Object {
-        "x": 1593413271000,
-      },
-      Object {
-        "x": 1593413272000,
-      },
-      Object {
-        "x": 1593413273000,
-      },
-      Object {
-        "x": 1593413274000,
-      },
-      Object {
-        "x": 1593413275000,
-      },
-      Object {
-        "x": 1593413276000,
-      },
-      Object {
-        "x": 1593413277000,
-      },
-      Object {
-        "x": 1593413278000,
-      },
-      Object {
-        "x": 1593413279000,
-      },
-      Object {
-        "x": 1593413280000,
-      },
-      Object {
-        "x": 1593413281000,
-      },
-      Object {
-        "x": 1593413282000,
-      },
-      Object {
-        "x": 1593413283000,
-      },
-      Object {
-        "x": 1593413284000,
-      },
-      Object {
-        "x": 1593413285000,
-      },
-      Object {
-        "x": 1593413286000,
-      },
-      Object {
-        "x": 1593413287000,
-        "y": 342000,
-      },
-      Object {
-        "x": 1593413288000,
-      },
-      Object {
-        "x": 1593413289000,
-      },
-      Object {
-        "x": 1593413290000,
-      },
-      Object {
-        "x": 1593413291000,
-      },
-      Object {
-        "x": 1593413292000,
-      },
-      Object {
-        "x": 1593413293000,
-      },
-      Object {
-        "x": 1593413294000,
-      },
-      Object {
-        "x": 1593413295000,
-      },
-      Object {
-        "x": 1593413296000,
-      },
-      Object {
-        "x": 1593413297000,
-      },
-      Object {
-        "x": 1593413298000,
-        "y": 173000,
-      },
-      Object {
-        "x": 1593413299000,
-      },
-      Object {
-        "x": 1593413300000,
-      },
-      Object {
-        "x": 1593413301000,
-        "y": 109000,
-      },
-      Object {
-        "x": 1593413302000,
-      },
-      Object {
-        "x": 1593413303000,
-      },
-      Object {
-        "x": 1593413304000,
-      },
-      Object {
-        "x": 1593413305000,
-      },
-      Object {
-        "x": 1593413306000,
-      },
-      Object {
-        "x": 1593413307000,
-      },
-      Object {
-        "x": 1593413308000,
-      },
-      Object {
-        "x": 1593413309000,
-      },
-      Object {
-        "x": 1593413310000,
-      },
-      Object {
-        "x": 1593413311000,
-      },
-      Object {
-        "x": 1593413312000,
-      },
-      Object {
-        "x": 1593413313000,
-      },
-      Object {
-        "x": 1593413314000,
-      },
-      Object {
-        "x": 1593413315000,
-      },
-      Object {
-        "x": 1593413316000,
-      },
-      Object {
-        "x": 1593413317000,
-      },
-      Object {
-        "x": 1593413318000,
-        "y": 140000,
-      },
-      Object {
-        "x": 1593413319000,
-      },
-      Object {
-        "x": 1593413320000,
-      },
-      Object {
-        "x": 1593413321000,
-      },
-      Object {
-        "x": 1593413322000,
-      },
-      Object {
-        "x": 1593413323000,
-      },
-      Object {
-        "x": 1593413324000,
-      },
-      Object {
-        "x": 1593413325000,
-      },
-      Object {
-        "x": 1593413326000,
-      },
-      Object {
-        "x": 1593413327000,
-      },
-      Object {
-        "x": 1593413328000,
-        "y": 77000,
-      },
-      Object {
-        "x": 1593413329000,
-      },
-      Object {
-        "x": 1593413330000,
-      },
-      Object {
-        "x": 1593413331000,
-      },
-      Object {
-        "x": 1593413332000,
-      },
-      Object {
-        "x": 1593413333000,
-      },
-      Object {
-        "x": 1593413334000,
-      },
-      Object {
-        "x": 1593413335000,
-      },
-      Object {
-        "x": 1593413336000,
-      },
-      Object {
-        "x": 1593413337000,
-      },
-      Object {
-        "x": 1593413338000,
-      },
-      Object {
-        "x": 1593413339000,
-      },
-      Object {
-        "x": 1593413340000,
-      },
-    ],
-    "title": "HeadlessChrome",
-  },
-]
-`;
-
-exports[`Average duration by browser when data is loaded returns the average duration by browser filtering by transaction name 1`] = `
-Array [
-  Object {
-    "data": Array [
-      Object {
-        "x": 1593413100000,
-      },
-      Object {
-        "x": 1593413101000,
-      },
-      Object {
-        "x": 1593413102000,
-      },
-      Object {
-        "x": 1593413103000,
-      },
-      Object {
-        "x": 1593413104000,
-      },
-      Object {
-        "x": 1593413105000,
-      },
-      Object {
-        "x": 1593413106000,
-      },
-      Object {
-        "x": 1593413107000,
-      },
-      Object {
-        "x": 1593413108000,
-      },
-      Object {
-        "x": 1593413109000,
-      },
-      Object {
-        "x": 1593413110000,
-      },
-      Object {
-        "x": 1593413111000,
-      },
-      Object {
-        "x": 1593413112000,
-      },
-      Object {
-        "x": 1593413113000,
-      },
-      Object {
-        "x": 1593413114000,
-      },
-      Object {
-        "x": 1593413115000,
-      },
-      Object {
-        "x": 1593413116000,
-      },
-      Object {
-        "x": 1593413117000,
-      },
-      Object {
-        "x": 1593413118000,
-      },
-      Object {
-        "x": 1593413119000,
-      },
-      Object {
-        "x": 1593413120000,
-      },
-      Object {
-        "x": 1593413121000,
-      },
-      Object {
-        "x": 1593413122000,
-      },
-      Object {
-        "x": 1593413123000,
-      },
-      Object {
-        "x": 1593413124000,
-      },
-      Object {
-        "x": 1593413125000,
-      },
-      Object {
-        "x": 1593413126000,
-      },
-      Object {
-        "x": 1593413127000,
-      },
-      Object {
-        "x": 1593413128000,
-      },
-      Object {
-        "x": 1593413129000,
-      },
-      Object {
-        "x": 1593413130000,
-      },
-      Object {
-        "x": 1593413131000,
-      },
-      Object {
-        "x": 1593413132000,
-      },
-      Object {
-        "x": 1593413133000,
-      },
-      Object {
-        "x": 1593413134000,
-      },
-      Object {
-        "x": 1593413135000,
-      },
-      Object {
-        "x": 1593413136000,
-      },
-      Object {
-        "x": 1593413137000,
-      },
-      Object {
-        "x": 1593413138000,
-      },
-      Object {
-        "x": 1593413139000,
-      },
-      Object {
-        "x": 1593413140000,
-      },
-      Object {
-        "x": 1593413141000,
-      },
-      Object {
-        "x": 1593413142000,
-      },
-      Object {
-        "x": 1593413143000,
-      },
-      Object {
-        "x": 1593413144000,
-      },
-      Object {
-        "x": 1593413145000,
-      },
-      Object {
-        "x": 1593413146000,
-      },
-      Object {
-        "x": 1593413147000,
-      },
-      Object {
-        "x": 1593413148000,
-      },
-      Object {
-        "x": 1593413149000,
-      },
-      Object {
-        "x": 1593413150000,
-      },
-      Object {
-        "x": 1593413151000,
-      },
-      Object {
-        "x": 1593413152000,
-      },
-      Object {
-        "x": 1593413153000,
-      },
-      Object {
-        "x": 1593413154000,
-      },
-      Object {
-        "x": 1593413155000,
-      },
-      Object {
-        "x": 1593413156000,
-      },
-      Object {
-        "x": 1593413157000,
-      },
-      Object {
-        "x": 1593413158000,
-      },
-      Object {
-        "x": 1593413159000,
-      },
-      Object {
-        "x": 1593413160000,
-      },
-      Object {
-        "x": 1593413161000,
-      },
-      Object {
-        "x": 1593413162000,
-      },
-      Object {
-        "x": 1593413163000,
-      },
-      Object {
-        "x": 1593413164000,
-      },
-      Object {
-        "x": 1593413165000,
-      },
-      Object {
-        "x": 1593413166000,
-      },
-      Object {
-        "x": 1593413167000,
-      },
-      Object {
-        "x": 1593413168000,
-      },
-      Object {
-        "x": 1593413169000,
-      },
-      Object {
-        "x": 1593413170000,
-      },
-      Object {
-        "x": 1593413171000,
-      },
-      Object {
-        "x": 1593413172000,
-      },
-      Object {
-        "x": 1593413173000,
-      },
-      Object {
-        "x": 1593413174000,
-      },
-      Object {
-        "x": 1593413175000,
-      },
-      Object {
-        "x": 1593413176000,
-      },
-      Object {
-        "x": 1593413177000,
-      },
-      Object {
-        "x": 1593413178000,
-      },
-      Object {
-        "x": 1593413179000,
-      },
-      Object {
-        "x": 1593413180000,
-      },
-      Object {
-        "x": 1593413181000,
-      },
-      Object {
-        "x": 1593413182000,
-      },
-      Object {
-        "x": 1593413183000,
-      },
-      Object {
-        "x": 1593413184000,
-      },
-      Object {
-        "x": 1593413185000,
-      },
-      Object {
-        "x": 1593413186000,
-      },
-      Object {
-        "x": 1593413187000,
-      },
-      Object {
-        "x": 1593413188000,
-      },
-      Object {
-        "x": 1593413189000,
-      },
-      Object {
-        "x": 1593413190000,
-      },
-      Object {
-        "x": 1593413191000,
-      },
-      Object {
-        "x": 1593413192000,
-      },
-      Object {
-        "x": 1593413193000,
-      },
-      Object {
-        "x": 1593413194000,
-      },
-      Object {
-        "x": 1593413195000,
-      },
-      Object {
-        "x": 1593413196000,
-      },
-      Object {
-        "x": 1593413197000,
-      },
-      Object {
-        "x": 1593413198000,
-      },
-      Object {
-        "x": 1593413199000,
-      },
-      Object {
-        "x": 1593413200000,
-      },
-      Object {
-        "x": 1593413201000,
-      },
-      Object {
-        "x": 1593413202000,
-      },
-      Object {
-        "x": 1593413203000,
-      },
-      Object {
-        "x": 1593413204000,
-      },
-      Object {
-        "x": 1593413205000,
-      },
-      Object {
-        "x": 1593413206000,
-      },
-      Object {
-        "x": 1593413207000,
-      },
-      Object {
-        "x": 1593413208000,
-      },
-      Object {
-        "x": 1593413209000,
-      },
-      Object {
-        "x": 1593413210000,
-      },
-      Object {
-        "x": 1593413211000,
-      },
-      Object {
-        "x": 1593413212000,
-      },
-      Object {
-        "x": 1593413213000,
-      },
-      Object {
-        "x": 1593413214000,
-      },
-      Object {
-        "x": 1593413215000,
-      },
-      Object {
-        "x": 1593413216000,
-      },
-      Object {
-        "x": 1593413217000,
-      },
-      Object {
-        "x": 1593413218000,
-      },
-      Object {
-        "x": 1593413219000,
-      },
-      Object {
-        "x": 1593413220000,
-      },
-      Object {
-        "x": 1593413221000,
-      },
-      Object {
-        "x": 1593413222000,
-      },
-      Object {
-        "x": 1593413223000,
-      },
-      Object {
-        "x": 1593413224000,
-      },
-      Object {
-        "x": 1593413225000,
-      },
-      Object {
-        "x": 1593413226000,
-      },
-      Object {
-        "x": 1593413227000,
-      },
-      Object {
-        "x": 1593413228000,
-      },
-      Object {
-        "x": 1593413229000,
-      },
-      Object {
-        "x": 1593413230000,
-      },
-      Object {
-        "x": 1593413231000,
-      },
-      Object {
-        "x": 1593413232000,
-      },
-      Object {
-        "x": 1593413233000,
-      },
-      Object {
-        "x": 1593413234000,
-      },
-      Object {
-        "x": 1593413235000,
-      },
-      Object {
-        "x": 1593413236000,
-      },
-      Object {
-        "x": 1593413237000,
-      },
-      Object {
-        "x": 1593413238000,
-      },
-      Object {
-        "x": 1593413239000,
-      },
-      Object {
-        "x": 1593413240000,
-      },
-      Object {
-        "x": 1593413241000,
-      },
-      Object {
-        "x": 1593413242000,
-      },
-      Object {
-        "x": 1593413243000,
-      },
-      Object {
-        "x": 1593413244000,
-      },
-      Object {
-        "x": 1593413245000,
-      },
-      Object {
-        "x": 1593413246000,
-      },
-      Object {
-        "x": 1593413247000,
-      },
-      Object {
-        "x": 1593413248000,
-      },
-      Object {
-        "x": 1593413249000,
-      },
-      Object {
-        "x": 1593413250000,
-      },
-      Object {
-        "x": 1593413251000,
-      },
-      Object {
-        "x": 1593413252000,
-      },
-      Object {
-        "x": 1593413253000,
-      },
-      Object {
-        "x": 1593413254000,
-      },
-      Object {
-        "x": 1593413255000,
-      },
-      Object {
-        "x": 1593413256000,
-      },
-      Object {
-        "x": 1593413257000,
-      },
-      Object {
-        "x": 1593413258000,
-      },
-      Object {
-        "x": 1593413259000,
-      },
-      Object {
-        "x": 1593413260000,
-      },
-      Object {
-        "x": 1593413261000,
-      },
-      Object {
-        "x": 1593413262000,
-      },
-      Object {
-        "x": 1593413263000,
-      },
-      Object {
-        "x": 1593413264000,
-      },
-      Object {
-        "x": 1593413265000,
-      },
-      Object {
-        "x": 1593413266000,
-      },
-      Object {
-        "x": 1593413267000,
-      },
-      Object {
-        "x": 1593413268000,
-      },
-      Object {
-        "x": 1593413269000,
-      },
-      Object {
-        "x": 1593413270000,
-      },
-      Object {
-        "x": 1593413271000,
-      },
-      Object {
-        "x": 1593413272000,
-      },
-      Object {
-        "x": 1593413273000,
-      },
-      Object {
-        "x": 1593413274000,
-      },
-      Object {
-        "x": 1593413275000,
-      },
-      Object {
-        "x": 1593413276000,
-      },
-      Object {
-        "x": 1593413277000,
-      },
-      Object {
-        "x": 1593413278000,
-      },
-      Object {
-        "x": 1593413279000,
+        "x": 1600161780000,
       },
+    ],
+    "title": "Electron",
+  },
+]
+`;
+
+exports[`Average duration by browser when data is loaded returns the average duration by browser filtering by transaction name 2`] = `
+Array [
+  Object {
+    "data": Array [
       Object {
-        "x": 1593413280000,
+        "x": 1600159980000,
       },
       Object {
-        "x": 1593413281000,
+        "x": 1600160010000,
       },
       Object {
-        "x": 1593413282000,
+        "x": 1600160040000,
       },
       Object {
-        "x": 1593413283000,
+        "x": 1600160070000,
+        "y": 1096000,
       },
       Object {
-        "x": 1593413284000,
+        "x": 1600160100000,
       },
       Object {
-        "x": 1593413285000,
+        "x": 1600160130000,
       },
       Object {
-        "x": 1593413286000,
+        "x": 1600160160000,
       },
       Object {
-        "x": 1593413287000,
+        "x": 1600160190000,
+        "y": 710000,
       },
       Object {
-        "x": 1593413288000,
+        "x": 1600160220000,
       },
       Object {
-        "x": 1593413289000,
+        "x": 1600160250000,
       },
       Object {
-        "x": 1593413290000,
+        "x": 1600160280000,
       },
       Object {
-        "x": 1593413291000,
+        "x": 1600160310000,
+        "y": 1108000,
       },
       Object {
-        "x": 1593413292000,
+        "x": 1600160340000,
       },
       Object {
-        "x": 1593413293000,
+        "x": 1600160370000,
       },
       Object {
-        "x": 1593413294000,
+        "x": 1600160400000,
       },
       Object {
-        "x": 1593413295000,
+        "x": 1600160430000,
+        "y": 1221000,
       },
       Object {
-        "x": 1593413296000,
+        "x": 1600160460000,
       },
       Object {
-        "x": 1593413297000,
+        "x": 1600160490000,
       },
       Object {
-        "x": 1593413298000,
+        "x": 1600160520000,
       },
       Object {
-        "x": 1593413299000,
+        "x": 1600160550000,
+        "y": 1325000,
       },
       Object {
-        "x": 1593413300000,
+        "x": 1600160580000,
       },
       Object {
-        "x": 1593413301000,
+        "x": 1600160610000,
       },
       Object {
-        "x": 1593413302000,
+        "x": 1600160640000,
       },
       Object {
-        "x": 1593413303000,
+        "x": 1600160670000,
+        "y": 885000,
       },
       Object {
-        "x": 1593413304000,
+        "x": 1600160700000,
       },
       Object {
-        "x": 1593413305000,
+        "x": 1600160730000,
       },
       Object {
-        "x": 1593413306000,
+        "x": 1600160760000,
       },
       Object {
-        "x": 1593413307000,
+        "x": 1600160790000,
+        "y": 1296000,
       },
       Object {
-        "x": 1593413308000,
+        "x": 1600160820000,
       },
       Object {
-        "x": 1593413309000,
+        "x": 1600160850000,
       },
       Object {
-        "x": 1593413310000,
+        "x": 1600160880000,
       },
       Object {
-        "x": 1593413311000,
+        "x": 1600160910000,
+        "y": 1110000,
       },
       Object {
-        "x": 1593413312000,
+        "x": 1600160940000,
       },
       Object {
-        "x": 1593413313000,
+        "x": 1600160970000,
       },
       Object {
-        "x": 1593413314000,
+        "x": 1600161000000,
       },
       Object {
-        "x": 1593413315000,
+        "x": 1600161030000,
+        "y": 1200000,
       },
       Object {
-        "x": 1593413316000,
+        "x": 1600161060000,
       },
       Object {
-        "x": 1593413317000,
+        "x": 1600161090000,
       },
       Object {
-        "x": 1593413318000,
+        "x": 1600161120000,
       },
       Object {
-        "x": 1593413319000,
+        "x": 1600161150000,
+        "y": 1006000,
       },
       Object {
-        "x": 1593413320000,
+        "x": 1600161180000,
       },
       Object {
-        "x": 1593413321000,
+        "x": 1600161210000,
       },
       Object {
-        "x": 1593413322000,
+        "x": 1600161240000,
       },
       Object {
-        "x": 1593413323000,
+        "x": 1600161270000,
+        "y": 1908000,
       },
       Object {
-        "x": 1593413324000,
+        "x": 1600161300000,
       },
       Object {
-        "x": 1593413325000,
+        "x": 1600161330000,
       },
       Object {
-        "x": 1593413326000,
+        "x": 1600161360000,
       },
       Object {
-        "x": 1593413327000,
+        "x": 1600161390000,
+        "y": 1420000,
       },
       Object {
-        "x": 1593413328000,
-        "y": 77000,
+        "x": 1600161420000,
       },
       Object {
-        "x": 1593413329000,
+        "x": 1600161450000,
       },
       Object {
-        "x": 1593413330000,
+        "x": 1600161480000,
       },
       Object {
-        "x": 1593413331000,
+        "x": 1600161510000,
+        "y": 1215000,
       },
       Object {
-        "x": 1593413332000,
+        "x": 1600161540000,
       },
       Object {
-        "x": 1593413333000,
+        "x": 1600161570000,
       },
       Object {
-        "x": 1593413334000,
+        "x": 1600161600000,
       },
       Object {
-        "x": 1593413335000,
+        "x": 1600161630000,
+        "y": 898000,
       },
       Object {
-        "x": 1593413336000,
+        "x": 1600161660000,
       },
       Object {
-        "x": 1593413337000,
+        "x": 1600161690000,
       },
       Object {
-        "x": 1593413338000,
+        "x": 1600161720000,
       },
       Object {
-        "x": 1593413339000,
+        "x": 1600161750000,
+        "y": 1305000,
       },
       Object {
-        "x": 1593413340000,
+        "x": 1600161780000,
       },
     ],
-    "title": "HeadlessChrome",
+    "title": "Electron",
   },
 ]
 `;
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/breakdown.snap b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/breakdown.snap
index e204ff41dfa43..563bad8779e96 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/breakdown.snap
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/breakdown.snap
@@ -7,44 +7,252 @@ Object {
       "color": "#54b399",
       "data": Array [
         Object {
-          "x": 1593413100000,
+          "x": 1600159980000,
           "y": null,
         },
         Object {
-          "x": 1593413130000,
+          "x": 1600160010000,
           "y": null,
         },
         Object {
-          "x": 1593413160000,
+          "x": 1600160040000,
           "y": null,
         },
         Object {
-          "x": 1593413190000,
+          "x": 1600160070000,
+          "y": 1,
+        },
+        Object {
+          "x": 1600160100000,
+          "y": 0.1875,
+        },
+        Object {
+          "x": 1600160130000,
+          "y": 0.2625,
+        },
+        Object {
+          "x": 1600160160000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160190000,
+          "y": 0.4827586206896552,
+        },
+        Object {
+          "x": 1600160220000,
+          "y": 0.44,
+        },
+        Object {
+          "x": 1600160250000,
+          "y": 1,
+        },
+        Object {
+          "x": 1600160280000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160310000,
+          "y": 0.17142857142857143,
+        },
+        Object {
+          "x": 1600160340000,
+          "y": 0.55,
+        },
+        Object {
+          "x": 1600160370000,
+          "y": 0.5,
+        },
+        Object {
+          "x": 1600160400000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160430000,
+          "y": 0.41964285714285715,
+        },
+        Object {
+          "x": 1600160460000,
+          "y": 0.7222222222222222,
+        },
+        Object {
+          "x": 1600160490000,
+          "y": 0.8333333333333334,
+        },
+        Object {
+          "x": 1600160520000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160550000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160580000,
+          "y": 0.11044776119402985,
+        },
+        Object {
+          "x": 1600160610000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160640000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160670000,
+          "y": 0.15028901734104047,
+        },
+        Object {
+          "x": 1600160700000,
+          "y": 0.38095238095238093,
+        },
+        Object {
+          "x": 1600160730000,
+          "y": 0.06761565836298933,
+        },
+        Object {
+          "x": 1600160760000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160790000,
+          "y": 0.26373626373626374,
+        },
+        Object {
+          "x": 1600160820000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160850000,
+          "y": 0.5294117647058824,
+        },
+        Object {
+          "x": 1600160880000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160910000,
+          "y": 0.012096774193548387,
+        },
+        Object {
+          "x": 1600160940000,
+          "y": 0.26126126126126126,
+        },
+        Object {
+          "x": 1600160970000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161000000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161030000,
+          "y": 0.16071428571428573,
+        },
+        Object {
+          "x": 1600161060000,
+          "y": 0.040268456375838924,
+        },
+        Object {
+          "x": 1600161090000,
+          "y": 1,
+        },
+        Object {
+          "x": 1600161120000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161150000,
+          "y": 0.07894736842105263,
+        },
+        Object {
+          "x": 1600161180000,
+          "y": 0.4074074074074074,
+        },
+        Object {
+          "x": 1600161210000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161240000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161270000,
+          "y": 0.6666666666666666,
+        },
+        Object {
+          "x": 1600161300000,
+          "y": 0.8214285714285714,
+        },
+        Object {
+          "x": 1600161330000,
+          "y": 1,
+        },
+        Object {
+          "x": 1600161360000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161390000,
+          "y": 0.17333333333333334,
+        },
+        Object {
+          "x": 1600161420000,
+          "y": 0.14285714285714285,
+        },
+        Object {
+          "x": 1600161450000,
+          "y": 0.85,
+        },
+        Object {
+          "x": 1600161480000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161510000,
+          "y": 0.42105263157894735,
+        },
+        Object {
+          "x": 1600161540000,
           "y": null,
         },
         Object {
-          "x": 1593413220000,
+          "x": 1600161570000,
           "y": null,
         },
         Object {
-          "x": 1593413250000,
+          "x": 1600161600000,
           "y": null,
         },
         Object {
-          "x": 1593413280000,
+          "x": 1600161630000,
           "y": null,
         },
         Object {
-          "x": 1593413310000,
-          "y": 0.16700861715223636,
+          "x": 1600161660000,
+          "y": 0.018518518518518517,
         },
         Object {
-          "x": 1593413340000,
+          "x": 1600161690000,
+          "y": 0.0625,
+        },
+        Object {
+          "x": 1600161720000,
           "y": null,
         },
+        Object {
+          "x": 1600161750000,
+          "y": 0.36764705882352944,
+        },
+        Object {
+          "x": 1600161780000,
+          "y": 0.10526315789473684,
+        },
       ],
       "hideLegend": false,
-      "legendValue": "17%",
+      "legendValue": "23%",
       "title": "app",
       "type": "areaStacked",
     },
@@ -52,44 +260,252 @@ Object {
       "color": "#6092c0",
       "data": Array [
         Object {
-          "x": 1593413100000,
+          "x": 1600159980000,
           "y": null,
         },
         Object {
-          "x": 1593413130000,
+          "x": 1600160010000,
           "y": null,
         },
         Object {
-          "x": 1593413160000,
+          "x": 1600160040000,
           "y": null,
         },
         Object {
-          "x": 1593413190000,
+          "x": 1600160070000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160100000,
+          "y": 0.71875,
+        },
+        Object {
+          "x": 1600160130000,
+          "y": 0.4875,
+        },
+        Object {
+          "x": 1600160160000,
           "y": null,
         },
         Object {
-          "x": 1593413220000,
+          "x": 1600160190000,
+          "y": 0.41379310344827586,
+        },
+        Object {
+          "x": 1600160220000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160250000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160280000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160310000,
+          "y": 0.6285714285714286,
+        },
+        Object {
+          "x": 1600160340000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160370000,
+          "y": 0.5,
+        },
+        Object {
+          "x": 1600160400000,
           "y": null,
         },
         Object {
-          "x": 1593413250000,
+          "x": 1600160430000,
+          "y": 0.4375,
+        },
+        Object {
+          "x": 1600160460000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160490000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160520000,
           "y": null,
         },
         Object {
-          "x": 1593413280000,
+          "x": 1600160550000,
           "y": null,
         },
         Object {
-          "x": 1593413310000,
-          "y": 0.7702092736971686,
+          "x": 1600160580000,
+          "y": 0.8895522388059701,
         },
         Object {
-          "x": 1593413340000,
+          "x": 1600160610000,
           "y": null,
         },
+        Object {
+          "x": 1600160640000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160670000,
+          "y": 0.7052023121387283,
+        },
+        Object {
+          "x": 1600160700000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160730000,
+          "y": 0.8718861209964412,
+        },
+        Object {
+          "x": 1600160760000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160790000,
+          "y": 0.6703296703296703,
+        },
+        Object {
+          "x": 1600160820000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160850000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160880000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160910000,
+          "y": 0.9879032258064516,
+        },
+        Object {
+          "x": 1600160940000,
+          "y": 0.7387387387387387,
+        },
+        Object {
+          "x": 1600160970000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161000000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161030000,
+          "y": 0.7946428571428571,
+        },
+        Object {
+          "x": 1600161060000,
+          "y": 0.959731543624161,
+        },
+        Object {
+          "x": 1600161090000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161120000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161150000,
+          "y": 0.9210526315789473,
+        },
+        Object {
+          "x": 1600161180000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161210000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161240000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161270000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161300000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161330000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161360000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161390000,
+          "y": 0.7466666666666667,
+        },
+        Object {
+          "x": 1600161420000,
+          "y": 0.8571428571428571,
+        },
+        Object {
+          "x": 1600161450000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161480000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161510000,
+          "y": 0.5789473684210527,
+        },
+        Object {
+          "x": 1600161540000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161570000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161600000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161630000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161660000,
+          "y": 0.9814814814814815,
+        },
+        Object {
+          "x": 1600161690000,
+          "y": 0.9375,
+        },
+        Object {
+          "x": 1600161720000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161750000,
+          "y": 0.5588235294117647,
+        },
+        Object {
+          "x": 1600161780000,
+          "y": 0.8947368421052632,
+        },
       ],
       "hideLegend": false,
-      "legendValue": "77%",
+      "legendValue": "68%",
       "title": "http",
       "type": "areaStacked",
     },
@@ -97,92 +513,504 @@ Object {
       "color": "#d36086",
       "data": Array [
         Object {
-          "x": 1593413100000,
+          "x": 1600159980000,
           "y": null,
         },
         Object {
-          "x": 1593413130000,
+          "x": 1600160010000,
           "y": null,
         },
         Object {
-          "x": 1593413160000,
+          "x": 1600160040000,
           "y": null,
         },
         Object {
-          "x": 1593413190000,
+          "x": 1600160070000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160100000,
+          "y": 0.09375,
+        },
+        Object {
+          "x": 1600160130000,
+          "y": 0.25,
+        },
+        Object {
+          "x": 1600160160000,
           "y": null,
         },
         Object {
-          "x": 1593413220000,
+          "x": 1600160190000,
+          "y": 0.10344827586206896,
+        },
+        Object {
+          "x": 1600160220000,
+          "y": 0.56,
+        },
+        Object {
+          "x": 1600160250000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160280000,
           "y": null,
         },
         Object {
-          "x": 1593413250000,
+          "x": 1600160310000,
+          "y": 0.2,
+        },
+        Object {
+          "x": 1600160340000,
+          "y": 0.45,
+        },
+        Object {
+          "x": 1600160370000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160400000,
           "y": null,
         },
         Object {
-          "x": 1593413280000,
+          "x": 1600160430000,
+          "y": 0.14285714285714285,
+        },
+        Object {
+          "x": 1600160460000,
+          "y": 0.2777777777777778,
+        },
+        Object {
+          "x": 1600160490000,
+          "y": 0.16666666666666666,
+        },
+        Object {
+          "x": 1600160520000,
           "y": null,
         },
         Object {
-          "x": 1593413310000,
-          "y": 0.0508822322527698,
+          "x": 1600160550000,
+          "y": null,
         },
         Object {
-          "x": 1593413340000,
+          "x": 1600160580000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160610000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160640000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160670000,
+          "y": 0.14450867052023122,
+        },
+        Object {
+          "x": 1600160700000,
+          "y": 0.6190476190476191,
+        },
+        Object {
+          "x": 1600160730000,
+          "y": 0.060498220640569395,
+        },
+        Object {
+          "x": 1600160760000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160790000,
+          "y": 0.06593406593406594,
+        },
+        Object {
+          "x": 1600160820000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160850000,
+          "y": 0.47058823529411764,
+        },
+        Object {
+          "x": 1600160880000,
+          "y": null,
+        },
+        Object {
+          "x": 1600160910000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160940000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600160970000,
           "y": null,
         },
-      ],
-      "hideLegend": false,
-      "legendValue": "5.1%",
-      "title": "postgresql",
-      "type": "areaStacked",
-    },
-    Object {
-      "color": "#9170b8",
-      "data": Array [
         Object {
-          "x": 1593413100000,
+          "x": 1600161000000,
           "y": null,
         },
         Object {
-          "x": 1593413130000,
+          "x": 1600161030000,
+          "y": 0.044642857142857144,
+        },
+        Object {
+          "x": 1600161060000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161090000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161120000,
           "y": null,
         },
         Object {
-          "x": 1593413160000,
+          "x": 1600161150000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161180000,
+          "y": 0.5925925925925926,
+        },
+        Object {
+          "x": 1600161210000,
           "y": null,
         },
         Object {
-          "x": 1593413190000,
+          "x": 1600161240000,
           "y": null,
         },
         Object {
-          "x": 1593413220000,
+          "x": 1600161270000,
+          "y": 0.3333333333333333,
+        },
+        Object {
+          "x": 1600161300000,
+          "y": 0.17857142857142858,
+        },
+        Object {
+          "x": 1600161330000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161360000,
           "y": null,
         },
         Object {
-          "x": 1593413250000,
+          "x": 1600161390000,
+          "y": 0.08,
+        },
+        Object {
+          "x": 1600161420000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161450000,
+          "y": 0.15,
+        },
+        Object {
+          "x": 1600161480000,
           "y": null,
         },
         Object {
-          "x": 1593413280000,
+          "x": 1600161510000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161540000,
           "y": null,
         },
         Object {
-          "x": 1593413310000,
-          "y": 0.011899876897825195,
+          "x": 1600161570000,
+          "y": null,
         },
         Object {
-          "x": 1593413340000,
+          "x": 1600161600000,
           "y": null,
         },
+        Object {
+          "x": 1600161630000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161660000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161690000,
+          "y": 0,
+        },
+        Object {
+          "x": 1600161720000,
+          "y": null,
+        },
+        Object {
+          "x": 1600161750000,
+          "y": 0.07352941176470588,
+        },
+        Object {
+          "x": 1600161780000,
+          "y": 0,
+        },
       ],
       "hideLegend": false,
-      "legendValue": "1.2%",
-      "title": "redis",
+      "legendValue": "9.3%",
+      "title": "postgresql",
       "type": "areaStacked",
     },
   ],
 }
 `;
+
+exports[`Breakdown when data is loaded returns the transaction breakdown for a transaction group 9`] = `
+Array [
+  Object {
+    "x": 1600159980000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160010000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160040000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160070000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160100000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160130000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160160000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160190000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160220000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160250000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160280000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160310000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160340000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160370000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160400000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160430000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160460000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160490000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160520000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160550000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160580000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160610000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160640000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160670000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160700000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160730000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160760000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160790000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160820000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160850000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160880000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160910000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160940000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160970000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161000000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161030000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161060000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161090000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161120000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161150000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161180000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161210000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161240000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161270000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161300000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161330000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161360000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161390000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161420000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161450000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161480000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161510000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161540000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161570000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161600000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161630000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161660000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161690000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161720000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161750000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600161780000,
+    "y": 1,
+  },
+]
+`;
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/error_rate.snap b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/error_rate.snap
new file mode 100644
index 0000000000000..f9ab0ed8ff8cf
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/error_rate.snap
@@ -0,0 +1,250 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Error rate when data is loaded returns the transaction error rate has the correct error rate 1`] = `
+Array [
+  Object {
+    "x": 1600159980000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160010000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160040000,
+    "y": 0.14285714285714285,
+  },
+  Object {
+    "x": 1600160070000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160100000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160130000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160160000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160190000,
+    "y": 0.5,
+  },
+  Object {
+    "x": 1600160220000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160250000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160280000,
+    "y": 0.16666666666666666,
+  },
+  Object {
+    "x": 1600160310000,
+    "y": 0.3333333333333333,
+  },
+  Object {
+    "x": 1600160340000,
+    "y": 1,
+  },
+  Object {
+    "x": 1600160370000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160400000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160430000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160460000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160490000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160520000,
+    "y": 0.16666666666666666,
+  },
+  Object {
+    "x": 1600160550000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160580000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160610000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160640000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160670000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160700000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160730000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160760000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160790000,
+    "y": 0.2,
+  },
+  Object {
+    "x": 1600160820000,
+    "y": 0.5,
+  },
+  Object {
+    "x": 1600160850000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160880000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160910000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600160940000,
+    "y": null,
+  },
+  Object {
+    "x": 1600160970000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161000000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161030000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161060000,
+    "y": 0.5,
+  },
+  Object {
+    "x": 1600161090000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161120000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161150000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161180000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161210000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161240000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161270000,
+    "y": 0.4,
+  },
+  Object {
+    "x": 1600161300000,
+    "y": 0.5,
+  },
+  Object {
+    "x": 1600161330000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161360000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161390000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161420000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161450000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161480000,
+    "y": 0.1,
+  },
+  Object {
+    "x": 1600161510000,
+    "y": 0.5,
+  },
+  Object {
+    "x": 1600161540000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161570000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161600000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161630000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161660000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161690000,
+    "y": null,
+  },
+  Object {
+    "x": 1600161720000,
+    "y": 0.625,
+  },
+  Object {
+    "x": 1600161750000,
+    "y": 0,
+  },
+  Object {
+    "x": 1600161780000,
+    "y": null,
+  },
+]
+`;
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap
index 16a5640c5305b..a80f392a32aa3 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/top_transaction_groups.snap
@@ -3,130 +3,102 @@
 exports[`Top transaction groups when data is loaded returns the correct buckets (when ignoring samples) 1`] = `
 Array [
   Object {
-    "averageResponseTime": 2577,
+    "averageResponseTime": 1137,
     "impact": 0,
-    "key": "GET /throw-error",
-    "p95": 3224,
-    "transactionsPerMinute": 0.5,
-  },
-  Object {
-    "averageResponseTime": 4757,
-    "impact": 0.20830834986820673,
-    "key": "GET /api/products/:id/customers",
-    "p95": 5616,
-    "transactionsPerMinute": 0.5,
-  },
-  Object {
-    "averageResponseTime": 4749.666666666667,
-    "impact": 0.43453312891085794,
-    "key": "GET /api/orders/:id",
-    "p95": 7184,
-    "transactionsPerMinute": 0.75,
-  },
-  Object {
-    "averageResponseTime": 8181,
-    "impact": 0.5354862351657939,
-    "key": "GET /api/types/:id",
-    "p95": 10080,
-    "transactionsPerMinute": 0.5,
+    "key": "POST /api/orders",
+    "p95": 1136,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 20011,
-    "impact": 0.7098250353192541,
-    "key": "POST /api",
-    "p95": 19968,
-    "transactionsPerMinute": 0.25,
+    "averageResponseTime": 4479,
+    "impact": 0.1825278966745733,
+    "key": "GET /api/customers/:id",
+    "p95": 4448,
+    "transactionsPerMinute": 0.03333333333333333,
   },
   Object {
-    "averageResponseTime": 35846,
-    "impact": 1.466376117925459,
-    "key": "GET /log-error",
-    "p95": 35840,
-    "transactionsPerMinute": 0.25,
+    "averageResponseTime": 2754.5,
+    "impact": 0.23878275411766442,
+    "key": "GET /*",
+    "p95": 2832,
+    "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
-    "averageResponseTime": 7105.333333333333,
-    "impact": 1.7905918202662048,
-    "key": "GET /api/stats",
-    "p95": 15136,
-    "transactionsPerMinute": 1.5,
+    "averageResponseTime": 10841,
+    "impact": 1.122093248707094,
+    "key": "GET /api/orders/:id",
+    "p95": 13376,
+    "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
-    "averageResponseTime": 22958.5,
-    "impact": 1.9475397398343375,
+    "averageResponseTime": 10551.333333333334,
+    "impact": 1.6667276549425354,
     "key": "GET /api/products/top",
-    "p95": 33216,
-    "transactionsPerMinute": 0.5,
+    "p95": 19552,
+    "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 3492.9285714285716,
-    "impact": 2.0901067389184496,
-    "key": "GET static file",
-    "p95": 11900,
-    "transactionsPerMinute": 3.5,
+    "averageResponseTime": 15988,
+    "impact": 1.6843141249393074,
+    "key": "GET /api/products/:id",
+    "p95": 16000,
+    "transactionsPerMinute": 0.06666666666666667,
   },
   Object {
-    "averageResponseTime": 26992.5,
-    "impact": 2.3330057413794503,
+    "averageResponseTime": 9499,
+    "impact": 2.013104650965918,
     "key": "GET /api/types",
-    "p95": 45248,
-    "transactionsPerMinute": 0.5,
+    "p95": 14944,
+    "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
-    "averageResponseTime": 13516.5,
-    "impact": 2.3368756900811305,
-    "key": "GET /api/products/:id",
-    "p95": 37856,
-    "transactionsPerMinute": 1,
-  },
-  Object {
-    "averageResponseTime": 8585,
-    "impact": 2.624924094061731,
-    "key": "GET /api/products",
-    "p95": 22112,
-    "transactionsPerMinute": 1.75,
+    "averageResponseTime": 12228,
+    "impact": 2.6092969071297842,
+    "key": "GET /api/products/:id/customers",
+    "p95": 17760,
+    "transactionsPerMinute": 0.13333333333333333,
   },
   Object {
-    "averageResponseTime": 7615.625,
-    "impact": 2.6645791239678345,
-    "key": "GET /api/orders",
-    "p95": 11616,
-    "transactionsPerMinute": 2,
+    "averageResponseTime": 22555.666666666668,
+    "impact": 3.633626859892089,
+    "key": "GET /api/customers",
+    "p95": 25984,
+    "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 3262.95,
-    "impact": 2.8716452680799467,
-    "key": "GET /*",
-    "p95": 4472,
-    "transactionsPerMinute": 5,
+    "averageResponseTime": 13852.6,
+    "impact": 3.7207945807456553,
+    "key": "GET /api/types/:id",
+    "p95": 21984,
+    "transactionsPerMinute": 0.16666666666666666,
   },
   Object {
-    "averageResponseTime": 32667.5,
-    "impact": 2.875276331059301,
-    "key": "GET /log-message",
-    "p95": 38528,
-    "transactionsPerMinute": 0.5,
+    "averageResponseTime": 12228.5,
+    "impact": 3.9451586141206243,
+    "key": "GET /api/orders",
+    "p95": 16736,
+    "transactionsPerMinute": 0.2,
   },
   Object {
-    "averageResponseTime": 16896.8,
-    "impact": 3.790160870423129,
-    "key": "GET /api/customers",
-    "p95": 26432,
-    "transactionsPerMinute": 1.25,
+    "averageResponseTime": 12491.42857142857,
+    "impact": 4.71355627370009,
+    "key": "GET /api/products",
+    "p95": 30448,
+    "transactionsPerMinute": 0.23333333333333334,
   },
   Object {
-    "averageResponseTime": 270684,
-    "impact": 12.686265169840583,
-    "key": "POST /api/orders",
-    "p95": 270336,
-    "transactionsPerMinute": 0.25,
+    "averageResponseTime": 23683.333333333332,
+    "impact": 11.579379700079686,
+    "key": "GET /api/stats",
+    "p95": 36288,
+    "transactionsPerMinute": 0.3,
   },
   Object {
-    "averageResponseTime": 51175.73170731707,
+    "averageResponseTime": 42606.74418604651,
     "impact": 100,
     "key": "GET /api",
-    "p95": 259040,
-    "transactionsPerMinute": 10.25,
+    "p95": 131008,
+    "transactionsPerMinute": 1.4333333333333333,
   },
 ]
 `;
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/transaction_charts.snap b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/transaction_charts.snap
index 0ac7741396fd4..aaeac9edf01b8 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/transaction_charts.snap
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/__snapshots__/transaction_charts.snap
@@ -1,7756 +1,1496 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`Transaction charts when data is loaded returns the transaction charts 1`] = `
+exports[`Transaction charts when data is loaded returns the correct data 4`] = `
 Object {
   "apmTimeseries": Object {
-    "overallAvgDuration": 38682.52419354839,
+    "overallAvgDuration": 600255.7079646018,
     "responseTimes": Object {
       "avg": Array [
         Object {
-          "x": 1593413100000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413101000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413102000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413103000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413104000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413105000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413106000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413107000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413108000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413109000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413110000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413111000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413112000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413113000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413114000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413115000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413116000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413117000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413118000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413119000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413120000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413121000,
-          "y": null,
+          "x": 1600159980000,
+          "y": 961397,
         },
         Object {
-          "x": 1593413122000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413123000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413124000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413125000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413126000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413127000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413128000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413129000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413130000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413131000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413132000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413133000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413134000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413135000,
-          "y": null,
+          "x": 1600160010000,
+          "y": 605527.5,
         },
         Object {
-          "x": 1593413136000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413137000,
-          "y": null,
+          "x": 1600160040000,
+          "y": 390910,
         },
         Object {
-          "x": 1593413138000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413139000,
-          "y": null,
+          "x": 1600160070000,
+          "y": 556820.6,
         },
         Object {
-          "x": 1593413140000,
-          "y": null,
+          "x": 1600160100000,
+          "y": 496316.4,
         },
         Object {
-          "x": 1593413141000,
+          "x": 1600160130000,
           "y": null,
         },
         Object {
-          "x": 1593413142000,
-          "y": null,
+          "x": 1600160160000,
+          "y": 467003.6666666667,
         },
         Object {
-          "x": 1593413143000,
-          "y": null,
+          "x": 1600160190000,
+          "y": 863809.6666666666,
         },
         Object {
-          "x": 1593413144000,
-          "y": null,
+          "x": 1600160220000,
+          "y": 812744,
         },
         Object {
-          "x": 1593413145000,
-          "y": null,
+          "x": 1600160250000,
+          "y": 1536887,
         },
         Object {
-          "x": 1593413146000,
-          "y": null,
+          "x": 1600160280000,
+          "y": 506194.8,
         },
         Object {
-          "x": 1593413147000,
-          "y": null,
+          "x": 1600160310000,
+          "y": 459425.5,
         },
         Object {
-          "x": 1593413148000,
-          "y": null,
+          "x": 1600160340000,
+          "y": 553661,
         },
         Object {
-          "x": 1593413149000,
-          "y": null,
+          "x": 1600160370000,
+          "y": 658207.5,
         },
         Object {
-          "x": 1593413150000,
-          "y": null,
+          "x": 1600160400000,
+          "y": 368087.9090909091,
         },
         Object {
-          "x": 1593413151000,
-          "y": null,
+          "x": 1600160430000,
+          "y": 115251.8,
         },
         Object {
-          "x": 1593413152000,
-          "y": null,
+          "x": 1600160460000,
+          "y": 635499.25,
         },
         Object {
-          "x": 1593413153000,
-          "y": null,
+          "x": 1600160490000,
+          "y": 1224766,
         },
         Object {
-          "x": 1593413154000,
-          "y": null,
+          "x": 1600160520000,
+          "y": 826125.5,
         },
         Object {
-          "x": 1593413155000,
-          "y": null,
+          "x": 1600160550000,
+          "y": 389583.75,
         },
         Object {
-          "x": 1593413156000,
-          "y": null,
+          "x": 1600160580000,
+          "y": 477951,
         },
         Object {
-          "x": 1593413157000,
-          "y": null,
+          "x": 1600160610000,
+          "y": 882789.6666666666,
         },
         Object {
-          "x": 1593413158000,
-          "y": null,
+          "x": 1600160640000,
+          "y": 238075.9090909091,
         },
         Object {
-          "x": 1593413159000,
-          "y": null,
+          "x": 1600160670000,
+          "y": 608137,
         },
         Object {
-          "x": 1593413160000,
-          "y": null,
+          "x": 1600160700000,
+          "y": 356875.5,
         },
         Object {
-          "x": 1593413161000,
-          "y": null,
+          "x": 1600160730000,
+          "y": 1207555.5,
         },
         Object {
-          "x": 1593413162000,
-          "y": null,
+          "x": 1600160760000,
+          "y": 282337.1666666667,
         },
         Object {
-          "x": 1593413163000,
-          "y": null,
+          "x": 1600160790000,
+          "y": 987012.3333333334,
         },
         Object {
-          "x": 1593413164000,
-          "y": null,
+          "x": 1600160820000,
+          "y": 268791.5,
         },
         Object {
-          "x": 1593413165000,
-          "y": null,
+          "x": 1600160850000,
+          "y": 1268295.5,
         },
         Object {
-          "x": 1593413166000,
-          "y": null,
+          "x": 1600160880000,
+          "y": 442801.5,
         },
         Object {
-          "x": 1593413167000,
-          "y": null,
+          "x": 1600160910000,
+          "y": 314103.5,
         },
         Object {
-          "x": 1593413168000,
-          "y": null,
+          "x": 1600160940000,
+          "y": 1313632.6666666667,
         },
         Object {
-          "x": 1593413169000,
-          "y": null,
+          "x": 1600160970000,
+          "y": 888299,
         },
         Object {
-          "x": 1593413170000,
-          "y": null,
+          "x": 1600161000000,
+          "y": 611899.1428571428,
         },
         Object {
-          "x": 1593413171000,
-          "y": null,
+          "x": 1600161030000,
+          "y": 273321.85714285716,
         },
         Object {
-          "x": 1593413172000,
-          "y": null,
+          "x": 1600161060000,
+          "y": 407488.75,
         },
         Object {
-          "x": 1593413173000,
-          "y": null,
+          "x": 1600161090000,
+          "y": 1446104.6666666667,
         },
         Object {
-          "x": 1593413174000,
-          "y": null,
+          "x": 1600161120000,
+          "y": 650821,
         },
         Object {
-          "x": 1593413175000,
-          "y": null,
+          "x": 1600161150000,
+          "y": 818027.6,
         },
         Object {
-          "x": 1593413176000,
-          "y": null,
+          "x": 1600161180000,
+          "y": 1606260.5,
         },
         Object {
-          "x": 1593413177000,
-          "y": null,
+          "x": 1600161210000,
+          "y": 1054428.6666666667,
         },
         Object {
-          "x": 1593413178000,
-          "y": null,
+          "x": 1600161240000,
+          "y": 816781.3333333334,
         },
         Object {
-          "x": 1593413179000,
-          "y": null,
+          "x": 1600161270000,
+          "y": 319174,
         },
         Object {
-          "x": 1593413180000,
-          "y": null,
+          "x": 1600161300000,
+          "y": 683605.5,
         },
         Object {
-          "x": 1593413181000,
-          "y": null,
+          "x": 1600161330000,
+          "y": 884499.5,
         },
         Object {
-          "x": 1593413182000,
-          "y": null,
+          "x": 1600161360000,
+          "y": 714202.3333333334,
         },
         Object {
-          "x": 1593413183000,
-          "y": null,
+          "x": 1600161390000,
+          "y": 439751.6,
         },
         Object {
-          "x": 1593413184000,
-          "y": null,
+          "x": 1600161420000,
+          "y": 576370.2,
         },
         Object {
-          "x": 1593413185000,
-          "y": null,
+          "x": 1600161450000,
+          "y": 836182.3333333334,
         },
         Object {
-          "x": 1593413186000,
-          "y": null,
+          "x": 1600161480000,
+          "y": 19902,
         },
         Object {
-          "x": 1593413187000,
-          "y": null,
+          "x": 1600161510000,
+          "y": 615193.3333333334,
         },
         Object {
-          "x": 1593413188000,
-          "y": null,
+          "x": 1600161540000,
+          "y": 946298.6666666666,
         },
         Object {
-          "x": 1593413189000,
-          "y": null,
+          "x": 1600161570000,
+          "y": 1146024,
         },
         Object {
-          "x": 1593413190000,
-          "y": null,
+          "x": 1600161600000,
+          "y": 823085,
         },
         Object {
-          "x": 1593413191000,
-          "y": null,
+          "x": 1600161630000,
+          "y": 460616,
         },
         Object {
-          "x": 1593413192000,
-          "y": null,
+          "x": 1600161660000,
+          "y": 955115.5,
         },
         Object {
-          "x": 1593413193000,
-          "y": null,
+          "x": 1600161690000,
+          "y": 1684473,
         },
         Object {
-          "x": 1593413194000,
-          "y": null,
+          "x": 1600161720000,
+          "y": 450557.77777777775,
         },
         Object {
-          "x": 1593413195000,
-          "y": null,
+          "x": 1600161750000,
+          "y": 19350,
         },
         Object {
-          "x": 1593413196000,
-          "y": null,
+          "x": 1600161780000,
+          "y": 960447,
         },
+      ],
+      "p95": Array [
         Object {
-          "x": 1593413197000,
-          "y": null,
+          "x": 1600159980000,
+          "y": 1711104,
         },
         Object {
-          "x": 1593413198000,
-          "y": null,
+          "x": 1600160010000,
+          "y": 784384,
         },
         Object {
-          "x": 1593413199000,
-          "y": null,
+          "x": 1600160040000,
+          "y": 389120,
         },
         Object {
-          "x": 1593413200000,
-          "y": null,
+          "x": 1600160070000,
+          "y": 1581024,
         },
         Object {
-          "x": 1593413201000,
-          "y": null,
+          "x": 1600160100000,
+          "y": 1277824,
         },
         Object {
-          "x": 1593413202000,
+          "x": 1600160130000,
           "y": null,
         },
         Object {
-          "x": 1593413203000,
-          "y": null,
+          "x": 1600160160000,
+          "y": 1753072,
         },
         Object {
-          "x": 1593413204000,
-          "y": null,
+          "x": 1600160190000,
+          "y": 1916800,
         },
         Object {
-          "x": 1593413205000,
-          "y": null,
+          "x": 1600160220000,
+          "y": 1228736,
         },
         Object {
-          "x": 1593413206000,
-          "y": null,
+          "x": 1600160250000,
+          "y": 1671168,
         },
         Object {
-          "x": 1593413207000,
-          "y": null,
+          "x": 1600160280000,
+          "y": 1679328,
         },
         Object {
-          "x": 1593413208000,
-          "y": null,
+          "x": 1600160310000,
+          "y": 1028064,
         },
         Object {
-          "x": 1593413209000,
-          "y": null,
+          "x": 1600160340000,
+          "y": 1630144,
         },
         Object {
-          "x": 1593413210000,
-          "y": null,
+          "x": 1600160370000,
+          "y": 972800,
         },
         Object {
-          "x": 1593413211000,
-          "y": null,
+          "x": 1600160400000,
+          "y": 1359856,
         },
         Object {
-          "x": 1593413212000,
-          "y": null,
+          "x": 1600160430000,
+          "y": 536568,
         },
         Object {
-          "x": 1593413213000,
-          "y": null,
+          "x": 1600160460000,
+          "y": 1130368,
         },
         Object {
-          "x": 1593413214000,
-          "y": null,
+          "x": 1600160490000,
+          "y": 1245184,
         },
         Object {
-          "x": 1593413215000,
-          "y": null,
+          "x": 1600160520000,
+          "y": 1028096,
         },
         Object {
-          "x": 1593413216000,
-          "y": null,
+          "x": 1600160550000,
+          "y": 1228768,
         },
         Object {
-          "x": 1593413217000,
-          "y": null,
+          "x": 1600160580000,
+          "y": 790016,
         },
         Object {
-          "x": 1593413218000,
-          "y": null,
+          "x": 1600160610000,
+          "y": 1416192,
         },
         Object {
-          "x": 1593413219000,
-          "y": null,
+          "x": 1600160640000,
+          "y": 905184,
         },
         Object {
-          "x": 1593413220000,
-          "y": null,
+          "x": 1600160670000,
+          "y": 1154816,
         },
         Object {
-          "x": 1593413221000,
-          "y": null,
+          "x": 1600160700000,
+          "y": 1154944,
         },
         Object {
-          "x": 1593413222000,
-          "y": null,
+          "x": 1600160730000,
+          "y": 1544192,
         },
         Object {
-          "x": 1593413223000,
-          "y": null,
+          "x": 1600160760000,
+          "y": 888768,
         },
         Object {
-          "x": 1593413224000,
-          "y": null,
+          "x": 1600160790000,
+          "y": 1783808,
         },
         Object {
-          "x": 1593413225000,
-          "y": null,
+          "x": 1600160820000,
+          "y": 737248,
         },
         Object {
-          "x": 1593413226000,
-          "y": null,
+          "x": 1600160850000,
+          "y": 1409024,
         },
         Object {
-          "x": 1593413227000,
-          "y": null,
+          "x": 1600160880000,
+          "y": 843520,
         },
         Object {
-          "x": 1593413228000,
-          "y": null,
+          "x": 1600160910000,
+          "y": 987072,
         },
         Object {
-          "x": 1593413229000,
-          "y": null,
+          "x": 1600160940000,
+          "y": 1646592,
         },
         Object {
-          "x": 1593413230000,
-          "y": null,
+          "x": 1600160970000,
+          "y": 884736,
         },
         Object {
-          "x": 1593413231000,
-          "y": null,
+          "x": 1600161000000,
+          "y": 1163200,
         },
         Object {
-          "x": 1593413232000,
-          "y": null,
+          "x": 1600161030000,
+          "y": 991168,
         },
         Object {
-          "x": 1593413233000,
-          "y": null,
+          "x": 1600161060000,
+          "y": 806784,
         },
         Object {
-          "x": 1593413234000,
-          "y": null,
+          "x": 1600161090000,
+          "y": 1732608,
         },
         Object {
-          "x": 1593413235000,
-          "y": null,
+          "x": 1600161120000,
+          "y": 1916864,
         },
         Object {
-          "x": 1593413236000,
-          "y": null,
+          "x": 1600161150000,
+          "y": 1335168,
         },
         Object {
-          "x": 1593413237000,
-          "y": null,
+          "x": 1600161180000,
+          "y": 1703936,
         },
         Object {
-          "x": 1593413238000,
-          "y": null,
+          "x": 1600161210000,
+          "y": 1306624,
         },
         Object {
-          "x": 1593413239000,
-          "y": null,
+          "x": 1600161240000,
+          "y": 1343424,
         },
         Object {
-          "x": 1593413240000,
-          "y": null,
+          "x": 1600161270000,
+          "y": 794560,
         },
         Object {
-          "x": 1593413241000,
-          "y": null,
+          "x": 1600161300000,
+          "y": 1351552,
         },
         Object {
-          "x": 1593413242000,
-          "y": null,
+          "x": 1600161330000,
+          "y": 1275904,
         },
         Object {
-          "x": 1593413243000,
-          "y": null,
+          "x": 1600161360000,
+          "y": 1515264,
         },
         Object {
-          "x": 1593413244000,
-          "y": null,
+          "x": 1600161390000,
+          "y": 1359808,
         },
         Object {
-          "x": 1593413245000,
-          "y": null,
+          "x": 1600161420000,
+          "y": 1187808,
         },
         Object {
-          "x": 1593413246000,
-          "y": null,
+          "x": 1600161450000,
+          "y": 1069056,
         },
         Object {
-          "x": 1593413247000,
-          "y": null,
+          "x": 1600161480000,
+          "y": 24896,
         },
         Object {
-          "x": 1593413248000,
-          "y": null,
+          "x": 1600161510000,
+          "y": 804864,
         },
         Object {
-          "x": 1593413249000,
-          "y": null,
+          "x": 1600161540000,
+          "y": 1347584,
         },
         Object {
-          "x": 1593413250000,
-          "y": null,
+          "x": 1600161570000,
+          "y": 1138688,
         },
         Object {
-          "x": 1593413251000,
-          "y": null,
+          "x": 1600161600000,
+          "y": 1588224,
         },
         Object {
-          "x": 1593413252000,
-          "y": null,
+          "x": 1600161630000,
+          "y": 1089280,
         },
         Object {
-          "x": 1593413253000,
-          "y": null,
+          "x": 1600161660000,
+          "y": 1793920,
         },
         Object {
-          "x": 1593413254000,
-          "y": null,
+          "x": 1600161690000,
+          "y": 1679360,
         },
         Object {
-          "x": 1593413255000,
-          "y": null,
+          "x": 1600161720000,
+          "y": 1384416,
         },
         Object {
-          "x": 1593413256000,
-          "y": null,
+          "x": 1600161750000,
+          "y": 19328,
         },
         Object {
-          "x": 1593413257000,
-          "y": null,
+          "x": 1600161780000,
+          "y": 1554432,
         },
+      ],
+      "p99": Array [
         Object {
-          "x": 1593413258000,
-          "y": null,
+          "x": 1600159980000,
+          "y": 1711104,
         },
         Object {
-          "x": 1593413259000,
-          "y": null,
+          "x": 1600160010000,
+          "y": 784384,
         },
         Object {
-          "x": 1593413260000,
-          "y": null,
+          "x": 1600160040000,
+          "y": 389120,
         },
         Object {
-          "x": 1593413261000,
-          "y": null,
+          "x": 1600160070000,
+          "y": 1581024,
         },
         Object {
-          "x": 1593413262000,
-          "y": null,
+          "x": 1600160100000,
+          "y": 1277824,
         },
         Object {
-          "x": 1593413263000,
+          "x": 1600160130000,
           "y": null,
         },
         Object {
-          "x": 1593413264000,
-          "y": null,
+          "x": 1600160160000,
+          "y": 1753072,
         },
         Object {
-          "x": 1593413265000,
-          "y": null,
+          "x": 1600160190000,
+          "y": 1916800,
         },
         Object {
-          "x": 1593413266000,
-          "y": null,
+          "x": 1600160220000,
+          "y": 1228736,
         },
         Object {
-          "x": 1593413267000,
-          "y": null,
+          "x": 1600160250000,
+          "y": 1671168,
         },
         Object {
-          "x": 1593413268000,
-          "y": null,
+          "x": 1600160280000,
+          "y": 1679328,
         },
         Object {
-          "x": 1593413269000,
-          "y": null,
+          "x": 1600160310000,
+          "y": 1028064,
         },
         Object {
-          "x": 1593413270000,
-          "y": null,
+          "x": 1600160340000,
+          "y": 1630144,
         },
         Object {
-          "x": 1593413271000,
-          "y": null,
+          "x": 1600160370000,
+          "y": 972800,
         },
         Object {
-          "x": 1593413272000,
-          "y": 45093,
+          "x": 1600160400000,
+          "y": 1400816,
         },
         Object {
-          "x": 1593413273000,
-          "y": 7498,
+          "x": 1600160430000,
+          "y": 536568,
         },
         Object {
-          "x": 1593413274000,
-          "y": null,
+          "x": 1600160460000,
+          "y": 1130368,
         },
         Object {
-          "x": 1593413275000,
-          "y": null,
+          "x": 1600160490000,
+          "y": 1245184,
         },
         Object {
-          "x": 1593413276000,
-          "y": null,
+          "x": 1600160520000,
+          "y": 1028096,
         },
         Object {
-          "x": 1593413277000,
-          "y": 37709,
+          "x": 1600160550000,
+          "y": 1228768,
         },
         Object {
-          "x": 1593413278000,
-          "y": null,
+          "x": 1600160580000,
+          "y": 790016,
         },
         Object {
-          "x": 1593413279000,
-          "y": null,
+          "x": 1600160610000,
+          "y": 1416192,
         },
         Object {
-          "x": 1593413280000,
-          "y": null,
+          "x": 1600160640000,
+          "y": 1556448,
         },
         Object {
-          "x": 1593413281000,
-          "y": 33097,
+          "x": 1600160670000,
+          "y": 1154816,
         },
         Object {
-          "x": 1593413282000,
-          "y": null,
+          "x": 1600160700000,
+          "y": 1154944,
         },
         Object {
-          "x": 1593413283000,
-          "y": null,
+          "x": 1600160730000,
+          "y": 1544192,
         },
         Object {
-          "x": 1593413284000,
-          "y": 388507,
+          "x": 1600160760000,
+          "y": 888768,
         },
         Object {
-          "x": 1593413285000,
-          "y": 42331.5,
+          "x": 1600160790000,
+          "y": 1783808,
         },
         Object {
-          "x": 1593413286000,
-          "y": 99104.25,
+          "x": 1600160820000,
+          "y": 737248,
         },
         Object {
-          "x": 1593413287000,
-          "y": 18939.5,
+          "x": 1600160850000,
+          "y": 1409024,
         },
         Object {
-          "x": 1593413288000,
-          "y": 23229.5,
+          "x": 1600160880000,
+          "y": 843520,
         },
         Object {
-          "x": 1593413289000,
-          "y": 11318,
+          "x": 1600160910000,
+          "y": 987072,
         },
         Object {
-          "x": 1593413290000,
-          "y": 15651.25,
+          "x": 1600160940000,
+          "y": 1646592,
         },
         Object {
-          "x": 1593413291000,
-          "y": 2376,
+          "x": 1600160970000,
+          "y": 884736,
         },
         Object {
-          "x": 1593413292000,
-          "y": 7796,
+          "x": 1600161000000,
+          "y": 1163200,
         },
         Object {
-          "x": 1593413293000,
-          "y": 7571,
+          "x": 1600161030000,
+          "y": 991168,
         },
         Object {
-          "x": 1593413294000,
-          "y": 4219.333333333333,
+          "x": 1600161060000,
+          "y": 806784,
         },
-        Object {
-          "x": 1593413295000,
-          "y": 6827.5,
-        },
-        Object {
-          "x": 1593413296000,
-          "y": 10415.5,
-        },
-        Object {
-          "x": 1593413297000,
-          "y": 10082,
-        },
-        Object {
-          "x": 1593413298000,
-          "y": 6459.375,
-        },
-        Object {
-          "x": 1593413299000,
-          "y": 3131.5,
-        },
-        Object {
-          "x": 1593413300000,
-          "y": 6713.333333333333,
-        },
-        Object {
-          "x": 1593413301000,
-          "y": 8800,
-        },
-        Object {
-          "x": 1593413302000,
-          "y": 3743.5,
-        },
-        Object {
-          "x": 1593413303000,
-          "y": 9239.5,
-        },
-        Object {
-          "x": 1593413304000,
-          "y": 8402,
-        },
-        Object {
-          "x": 1593413305000,
-          "y": 20520.666666666668,
-        },
-        Object {
-          "x": 1593413306000,
-          "y": 9319.5,
-        },
-        Object {
-          "x": 1593413307000,
-          "y": 7694.333333333333,
-        },
-        Object {
-          "x": 1593413308000,
-          "y": 20131,
-        },
-        Object {
-          "x": 1593413309000,
-          "y": 439937.75,
-        },
-        Object {
-          "x": 1593413310000,
-          "y": 11933,
-        },
-        Object {
-          "x": 1593413311000,
-          "y": 18670.5,
-        },
-        Object {
-          "x": 1593413312000,
-          "y": 9232,
-        },
-        Object {
-          "x": 1593413313000,
-          "y": 7602,
-        },
-        Object {
-          "x": 1593413314000,
-          "y": 10428.8,
-        },
-        Object {
-          "x": 1593413315000,
-          "y": 8405.25,
-        },
-        Object {
-          "x": 1593413316000,
-          "y": 10654.5,
-        },
-        Object {
-          "x": 1593413317000,
-          "y": 10250,
-        },
-        Object {
-          "x": 1593413318000,
-          "y": 5775,
-        },
-        Object {
-          "x": 1593413319000,
-          "y": 137867,
-        },
-        Object {
-          "x": 1593413320000,
-          "y": 5694.333333333333,
-        },
-        Object {
-          "x": 1593413321000,
-          "y": 6115,
-        },
-        Object {
-          "x": 1593413322000,
-          "y": 1832.5,
-        },
-        Object {
-          "x": 1593413323000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413324000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413325000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413326000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413327000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413328000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413329000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413330000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413331000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413332000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413333000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413334000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413335000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413336000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413337000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413338000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413339000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413340000,
-          "y": null,
-        },
-      ],
-      "p95": Array [
-        Object {
-          "x": 1593413100000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413101000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413102000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413103000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413104000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413105000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413106000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413107000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413108000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413109000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413110000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413111000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413112000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413113000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413114000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413115000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413116000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413117000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413118000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413119000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413120000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413121000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413122000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413123000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413124000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413125000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413126000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413127000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413128000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413129000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413130000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413131000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413132000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413133000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413134000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413135000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413136000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413137000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413138000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413139000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413140000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413141000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413142000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413143000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413144000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413145000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413146000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413147000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413148000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413149000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413150000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413151000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413152000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413153000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413154000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413155000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413156000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413157000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413158000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413159000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413160000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413161000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413162000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413163000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413164000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413165000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413166000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413167000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413168000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413169000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413170000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413171000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413172000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413173000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413174000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413175000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413176000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413177000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413178000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413179000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413180000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413181000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413182000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413183000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413184000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413185000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413186000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413187000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413188000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413189000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413190000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413191000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413192000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413193000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413194000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413195000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413196000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413197000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413198000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413199000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413200000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413201000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413202000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413203000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413204000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413205000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413206000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413207000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413208000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413209000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413210000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413211000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413212000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413213000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413214000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413215000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413216000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413217000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413218000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413219000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413220000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413221000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413222000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413223000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413224000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413225000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413226000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413227000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413228000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413229000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413230000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413231000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413232000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413233000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413234000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413235000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413236000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413237000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413238000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413239000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413240000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413241000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413242000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413243000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413244000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413245000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413246000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413247000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413248000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413249000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413250000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413251000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413252000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413253000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413254000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413255000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413256000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413257000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413258000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413259000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413260000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413261000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413262000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413263000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413264000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413265000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413266000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413267000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413268000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413269000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413270000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413271000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413272000,
-          "y": 45056,
-        },
-        Object {
-          "x": 1593413273000,
-          "y": 10080,
-        },
-        Object {
-          "x": 1593413274000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413275000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413276000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413277000,
-          "y": 37632,
-        },
-        Object {
-          "x": 1593413278000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413279000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413280000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413281000,
-          "y": 33024,
-        },
-        Object {
-          "x": 1593413282000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413283000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413284000,
-          "y": 761728,
-        },
-        Object {
-          "x": 1593413285000,
-          "y": 81904,
-        },
-        Object {
-          "x": 1593413286000,
-          "y": 358384,
-        },
-        Object {
-          "x": 1593413287000,
-          "y": 36088,
-        },
-        Object {
-          "x": 1593413288000,
-          "y": 44536,
-        },
-        Object {
-          "x": 1593413289000,
-          "y": 11648,
-        },
-        Object {
-          "x": 1593413290000,
-          "y": 31984,
-        },
-        Object {
-          "x": 1593413291000,
-          "y": 2920,
-        },
-        Object {
-          "x": 1593413292000,
-          "y": 9312,
-        },
-        Object {
-          "x": 1593413293000,
-          "y": 10912,
-        },
-        Object {
-          "x": 1593413294000,
-          "y": 6392,
-        },
-        Object {
-          "x": 1593413295000,
-          "y": 11704,
-        },
-        Object {
-          "x": 1593413296000,
-          "y": 10816,
-        },
-        Object {
-          "x": 1593413297000,
-          "y": 12000,
-        },
-        Object {
-          "x": 1593413298000,
-          "y": 15164,
-        },
-        Object {
-          "x": 1593413299000,
-          "y": 3216,
-        },
-        Object {
-          "x": 1593413300000,
-          "y": 9584,
-        },
-        Object {
-          "x": 1593413301000,
-          "y": 21240,
-        },
-        Object {
-          "x": 1593413302000,
-          "y": 5624,
-        },
-        Object {
-          "x": 1593413303000,
-          "y": 11360,
-        },
-        Object {
-          "x": 1593413304000,
-          "y": 12320,
-        },
-        Object {
-          "x": 1593413305000,
-          "y": 38640,
-        },
-        Object {
-          "x": 1593413306000,
-          "y": 9728,
-        },
-        Object {
-          "x": 1593413307000,
-          "y": 17016,
-        },
-        Object {
-          "x": 1593413308000,
-          "y": 26848,
-        },
-        Object {
-          "x": 1593413309000,
-          "y": 1753072,
-        },
-        Object {
-          "x": 1593413310000,
-          "y": 16992,
-        },
-        Object {
-          "x": 1593413311000,
-          "y": 26560,
-        },
-        Object {
-          "x": 1593413312000,
-          "y": 11232,
-        },
-        Object {
-          "x": 1593413313000,
-          "y": 11424,
-        },
-        Object {
-          "x": 1593413314000,
-          "y": 16096,
-        },
-        Object {
-          "x": 1593413315000,
-          "y": 18800,
-        },
-        Object {
-          "x": 1593413316000,
-          "y": 12672,
-        },
-        Object {
-          "x": 1593413317000,
-          "y": 24316,
-        },
-        Object {
-          "x": 1593413318000,
-          "y": 8944,
-        },
-        Object {
-          "x": 1593413319000,
-          "y": 272352,
-        },
-        Object {
-          "x": 1593413320000,
-          "y": 7992,
-        },
-        Object {
-          "x": 1593413321000,
-          "y": 8368,
-        },
-        Object {
-          "x": 1593413322000,
-          "y": 1928,
-        },
-        Object {
-          "x": 1593413323000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413324000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413325000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413326000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413327000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413328000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413329000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413330000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413331000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413332000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413333000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413334000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413335000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413336000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413337000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413338000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413339000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413340000,
-          "y": null,
-        },
-      ],
-      "p99": Array [
-        Object {
-          "x": 1593413100000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413101000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413102000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413103000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413104000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413105000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413106000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413107000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413108000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413109000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413110000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413111000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413112000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413113000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413114000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413115000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413116000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413117000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413118000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413119000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413120000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413121000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413122000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413123000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413124000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413125000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413126000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413127000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413128000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413129000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413130000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413131000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413132000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413133000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413134000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413135000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413136000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413137000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413138000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413139000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413140000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413141000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413142000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413143000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413144000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413145000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413146000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413147000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413148000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413149000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413150000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413151000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413152000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413153000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413154000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413155000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413156000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413157000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413158000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413159000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413160000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413161000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413162000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413163000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413164000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413165000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413166000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413167000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413168000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413169000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413170000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413171000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413172000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413173000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413174000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413175000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413176000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413177000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413178000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413179000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413180000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413181000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413182000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413183000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413184000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413185000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413186000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413187000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413188000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413189000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413190000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413191000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413192000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413193000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413194000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413195000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413196000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413197000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413198000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413199000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413200000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413201000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413202000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413203000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413204000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413205000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413206000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413207000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413208000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413209000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413210000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413211000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413212000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413213000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413214000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413215000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413216000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413217000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413218000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413219000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413220000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413221000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413222000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413223000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413224000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413225000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413226000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413227000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413228000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413229000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413230000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413231000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413232000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413233000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413234000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413235000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413236000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413237000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413238000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413239000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413240000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413241000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413242000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413243000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413244000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413245000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413246000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413247000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413248000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413249000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413250000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413251000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413252000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413253000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413254000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413255000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413256000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413257000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413258000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413259000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413260000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413261000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413262000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413263000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413264000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413265000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413266000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413267000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413268000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413269000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413270000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413271000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413272000,
-          "y": 45056,
-        },
-        Object {
-          "x": 1593413273000,
-          "y": 10080,
-        },
-        Object {
-          "x": 1593413274000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413275000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413276000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413277000,
-          "y": 37632,
-        },
-        Object {
-          "x": 1593413278000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413279000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413280000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413281000,
-          "y": 33024,
-        },
-        Object {
-          "x": 1593413282000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413283000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413284000,
-          "y": 761728,
-        },
-        Object {
-          "x": 1593413285000,
-          "y": 81904,
-        },
-        Object {
-          "x": 1593413286000,
-          "y": 358384,
-        },
-        Object {
-          "x": 1593413287000,
-          "y": 36088,
-        },
-        Object {
-          "x": 1593413288000,
-          "y": 44536,
-        },
-        Object {
-          "x": 1593413289000,
-          "y": 11648,
-        },
-        Object {
-          "x": 1593413290000,
-          "y": 31984,
-        },
-        Object {
-          "x": 1593413291000,
-          "y": 2920,
-        },
-        Object {
-          "x": 1593413292000,
-          "y": 9312,
-        },
-        Object {
-          "x": 1593413293000,
-          "y": 10912,
-        },
-        Object {
-          "x": 1593413294000,
-          "y": 6392,
-        },
-        Object {
-          "x": 1593413295000,
-          "y": 11704,
-        },
-        Object {
-          "x": 1593413296000,
-          "y": 10816,
-        },
-        Object {
-          "x": 1593413297000,
-          "y": 12000,
-        },
-        Object {
-          "x": 1593413298000,
-          "y": 15164,
-        },
-        Object {
-          "x": 1593413299000,
-          "y": 3216,
-        },
-        Object {
-          "x": 1593413300000,
-          "y": 9584,
-        },
-        Object {
-          "x": 1593413301000,
-          "y": 21240,
-        },
-        Object {
-          "x": 1593413302000,
-          "y": 5624,
-        },
-        Object {
-          "x": 1593413303000,
-          "y": 11360,
-        },
-        Object {
-          "x": 1593413304000,
-          "y": 12320,
-        },
-        Object {
-          "x": 1593413305000,
-          "y": 38640,
-        },
-        Object {
-          "x": 1593413306000,
-          "y": 9728,
-        },
-        Object {
-          "x": 1593413307000,
-          "y": 17016,
-        },
-        Object {
-          "x": 1593413308000,
-          "y": 26848,
-        },
-        Object {
-          "x": 1593413309000,
-          "y": 1753072,
-        },
-        Object {
-          "x": 1593413310000,
-          "y": 16992,
-        },
-        Object {
-          "x": 1593413311000,
-          "y": 26560,
-        },
-        Object {
-          "x": 1593413312000,
-          "y": 11232,
-        },
-        Object {
-          "x": 1593413313000,
-          "y": 11424,
-        },
-        Object {
-          "x": 1593413314000,
-          "y": 16096,
-        },
-        Object {
-          "x": 1593413315000,
-          "y": 18800,
-        },
-        Object {
-          "x": 1593413316000,
-          "y": 12672,
-        },
-        Object {
-          "x": 1593413317000,
-          "y": 24316,
-        },
-        Object {
-          "x": 1593413318000,
-          "y": 8944,
-        },
-        Object {
-          "x": 1593413319000,
-          "y": 272352,
-        },
-        Object {
-          "x": 1593413320000,
-          "y": 7992,
-        },
-        Object {
-          "x": 1593413321000,
-          "y": 8368,
-        },
-        Object {
-          "x": 1593413322000,
-          "y": 1928,
-        },
-        Object {
-          "x": 1593413323000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413324000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413325000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413326000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413327000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413328000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413329000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413330000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413331000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413332000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413333000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413334000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413335000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413336000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413337000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413338000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413339000,
-          "y": null,
-        },
-        Object {
-          "x": 1593413340000,
-          "y": null,
-        },
-      ],
-    },
-    "tpmBuckets": Array [
-      Object {
-        "avg": 24.75,
-        "dataPoints": Array [
-          Object {
-            "x": 1593413100000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413101000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413102000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413103000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413104000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413105000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413106000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413107000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413108000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413109000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413110000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413111000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413112000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413113000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413114000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413115000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413116000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413117000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413118000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413119000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413120000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413121000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413122000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413123000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413124000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413125000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413126000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413127000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413128000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413129000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413130000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413131000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413132000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413133000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413134000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413135000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413136000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413137000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413138000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413139000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413140000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413141000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413142000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413143000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413144000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413145000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413146000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413147000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413148000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413149000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413150000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413151000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413152000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413153000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413154000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413155000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413156000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413157000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413158000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413159000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413160000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413161000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413162000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413163000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413164000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413165000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413166000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413167000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413168000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413169000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413170000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413171000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413172000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413173000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413174000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413175000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413176000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413177000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413178000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413179000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413180000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413181000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413182000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413183000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413184000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413185000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413186000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413187000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413188000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413189000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413190000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413191000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413192000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413193000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413194000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413195000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413196000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413197000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413198000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413199000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413200000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413201000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413202000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413203000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413204000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413205000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413206000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413207000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413208000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413209000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413210000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413211000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413212000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413213000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413214000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413215000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413216000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413217000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413218000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413219000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413220000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413221000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413222000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413223000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413224000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413225000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413226000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413227000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413228000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413229000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413230000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413231000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413232000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413233000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413234000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413235000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413236000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413237000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413238000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413239000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413240000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413241000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413242000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413243000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413244000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413245000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413246000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413247000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413248000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413249000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413250000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413251000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413252000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413253000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413254000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413255000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413256000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413257000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413258000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413259000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413260000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413261000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413262000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413263000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413264000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413265000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413266000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413267000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413268000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413269000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413270000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413271000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413272000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413273000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413274000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413275000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413276000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413277000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413278000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413279000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413280000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413281000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413282000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413283000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413284000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413285000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413286000,
-            "y": 7,
-          },
-          Object {
-            "x": 1593413287000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413288000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413289000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413290000,
-            "y": 4,
-          },
-          Object {
-            "x": 1593413291000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413292000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413293000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413294000,
-            "y": 3,
-          },
-          Object {
-            "x": 1593413295000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413296000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413297000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413298000,
-            "y": 6,
-          },
-          Object {
-            "x": 1593413299000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413300000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413301000,
-            "y": 3,
-          },
-          Object {
-            "x": 1593413302000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413303000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413304000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413305000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413306000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413307000,
-            "y": 3,
-          },
-          Object {
-            "x": 1593413308000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413309000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413310000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413311000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413312000,
-            "y": 3,
-          },
-          Object {
-            "x": 1593413313000,
-            "y": 3,
-          },
-          Object {
-            "x": 1593413314000,
-            "y": 5,
-          },
-          Object {
-            "x": 1593413315000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413316000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413317000,
-            "y": 6,
-          },
-          Object {
-            "x": 1593413318000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413319000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413320000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413321000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413322000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413323000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413324000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413325000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413326000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413327000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413328000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413329000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413330000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413331000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413332000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413333000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413334000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413335000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413336000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413337000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413338000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413339000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413340000,
-            "y": 0,
-          },
-        ],
-        "key": "HTTP 2xx",
-      },
-      Object {
-        "avg": 1.75,
-        "dataPoints": Array [
-          Object {
-            "x": 1593413100000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413101000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413102000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413103000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413104000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413105000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413106000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413107000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413108000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413109000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413110000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413111000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413112000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413113000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413114000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413115000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413116000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413117000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413118000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413119000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413120000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413121000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413122000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413123000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413124000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413125000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413126000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413127000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413128000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413129000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413130000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413131000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413132000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413133000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413134000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413135000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413136000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413137000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413138000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413139000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413140000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413141000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413142000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413143000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413144000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413145000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413146000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413147000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413148000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413149000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413150000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413151000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413152000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413153000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413154000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413155000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413156000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413157000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413158000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413159000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413160000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413161000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413162000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413163000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413164000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413165000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413166000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413167000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413168000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413169000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413170000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413171000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413172000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413173000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413174000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413175000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413176000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413177000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413178000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413179000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413180000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413181000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413182000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413183000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413184000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413185000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413186000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413187000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413188000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413189000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413190000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413191000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413192000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413193000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413194000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413195000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413196000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413197000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413198000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413199000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413200000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413201000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413202000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413203000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413204000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413205000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413206000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413207000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413208000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413209000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413210000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413211000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413212000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413213000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413214000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413215000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413216000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413217000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413218000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413219000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413220000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413221000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413222000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413223000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413224000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413225000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413226000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413227000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413228000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413229000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413230000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413231000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413232000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413233000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413234000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413235000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413236000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413237000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413238000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413239000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413240000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413241000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413242000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413243000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413244000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413245000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413246000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413247000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413248000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413249000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413250000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413251000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413252000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413253000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413254000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413255000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413256000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413257000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413258000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413259000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413260000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413261000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413262000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413263000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413264000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413265000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413266000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413267000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413268000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413269000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413270000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413271000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413272000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413273000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413274000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413275000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413276000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413277000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413278000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413279000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413280000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413281000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413282000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413283000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413284000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413285000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413286000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413287000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413288000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413289000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413290000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413291000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413292000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413293000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413294000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413295000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413296000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413297000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413298000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413299000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413300000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413301000,
-            "y": 3,
-          },
-          Object {
-            "x": 1593413302000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413303000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413304000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413305000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413306000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413307000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413308000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413309000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413310000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413311000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413312000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413313000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413314000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413315000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413316000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413317000,
-            "y": 2,
-          },
-          Object {
-            "x": 1593413318000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413319000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413320000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413321000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413322000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413323000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413324000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413325000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413326000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413327000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413328000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413329000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413330000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413331000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413332000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413333000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413334000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413335000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413336000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413337000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413338000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413339000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413340000,
-            "y": 0,
-          },
-        ],
-        "key": "HTTP 3xx",
-      },
-      Object {
-        "avg": 2,
-        "dataPoints": Array [
-          Object {
-            "x": 1593413100000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413101000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413102000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413103000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413104000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413105000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413106000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413107000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413108000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413109000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413110000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413111000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413112000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413113000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413114000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413115000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413116000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413117000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413118000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413119000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413120000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413121000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413122000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413123000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413124000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413125000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413126000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413127000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413128000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413129000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413130000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413131000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413132000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413133000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413134000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413135000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413136000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413137000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413138000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413139000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413140000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413141000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413142000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413143000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413144000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413145000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413146000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413147000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413148000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413149000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413150000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413151000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413152000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413153000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413154000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413155000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413156000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413157000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413158000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413159000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413160000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413161000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413162000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413163000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413164000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413165000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413166000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413167000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413168000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413169000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413170000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413171000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413172000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413173000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413174000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413175000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413176000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413177000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413178000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413179000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413180000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413181000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413182000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413183000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413184000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413185000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413186000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413187000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413188000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413189000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413190000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413191000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413192000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413193000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413194000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413195000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413196000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413197000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413198000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413199000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413200000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413201000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413202000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413203000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413204000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413205000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413206000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413207000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413208000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413209000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413210000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413211000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413212000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413213000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413214000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413215000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413216000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413217000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413218000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413219000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413220000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413221000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413222000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413223000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413224000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413225000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413226000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413227000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413228000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413229000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413230000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413231000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413232000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413233000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413234000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413235000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413236000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413237000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413238000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413239000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413240000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413241000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413242000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413243000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413244000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413245000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413246000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413247000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413248000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413249000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413250000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413251000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413252000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413253000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413254000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413255000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413256000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413257000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413258000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413259000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413260000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413261000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413262000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413263000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413264000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413265000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413266000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413267000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413268000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413269000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413270000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413271000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413272000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413273000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413274000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413275000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413276000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413277000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413278000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413279000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413280000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413281000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413282000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413283000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413284000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413285000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413286000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413287000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413288000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413289000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413290000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413291000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413292000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413293000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413294000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413295000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413296000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413297000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413298000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413299000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413300000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413301000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413302000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413303000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413304000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413305000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413306000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413307000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413308000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413309000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413310000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413311000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413312000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413313000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413314000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413315000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413316000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413317000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413318000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413319000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413320000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413321000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413322000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413323000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413324000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413325000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413326000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413327000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413328000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413329000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413330000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413331000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413332000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413333000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413334000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413335000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413336000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413337000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413338000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413339000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413340000,
-            "y": 0,
-          },
-        ],
-        "key": "HTTP 4xx",
-      },
-      Object {
-        "avg": 2.25,
-        "dataPoints": Array [
-          Object {
-            "x": 1593413100000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413101000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413102000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413103000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413104000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413105000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413106000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413107000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413108000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413109000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413110000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413111000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413112000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413113000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413114000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413115000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413116000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413117000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413118000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413119000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413120000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413121000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413122000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413123000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413124000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413125000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413126000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413127000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413128000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413129000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413130000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413131000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413132000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413133000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413134000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413135000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413136000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413137000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413138000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413139000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413140000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413141000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413142000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413143000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413144000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413145000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413146000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413147000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413148000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413149000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413150000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413151000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413152000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413153000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413154000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413155000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413156000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413157000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413158000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413159000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413160000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413161000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413162000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413163000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413164000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413165000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413166000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413167000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413168000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413169000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413170000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413171000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413172000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413173000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413174000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413175000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413176000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413177000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413178000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413179000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413180000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413181000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413182000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413183000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413184000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413185000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413186000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413187000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413188000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413189000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413190000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413191000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413192000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413193000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413194000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413195000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413196000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413197000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413198000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413199000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413200000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413201000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413202000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413203000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413204000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413205000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413206000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413207000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413208000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413209000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413210000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413211000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413212000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413213000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413214000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413215000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413216000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413217000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413218000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413219000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413220000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413221000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413222000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413223000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413224000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413225000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413226000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413227000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413228000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413229000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413230000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413231000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413232000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413233000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413234000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413235000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413236000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413237000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413238000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413239000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413240000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413241000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413242000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413243000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413244000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413245000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413246000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413247000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413248000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413249000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413250000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413251000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413252000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413253000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413254000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413255000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413256000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413257000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413258000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413259000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413260000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413261000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413262000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413263000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413264000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413265000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413266000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413267000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413268000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413269000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413270000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413271000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413272000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413273000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413274000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413275000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413276000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413277000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413278000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413279000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413280000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413281000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413282000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413283000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413284000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413285000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413286000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413287000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413288000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413289000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413290000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413291000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413292000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413293000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413294000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413295000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413296000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413297000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413298000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413299000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413300000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413301000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413302000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413303000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413304000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413305000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413306000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413307000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413308000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413309000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413310000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413311000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413312000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413313000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413314000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413315000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413316000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413317000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413318000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413319000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413320000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413321000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413322000,
-            "y": 1,
-          },
-          Object {
-            "x": 1593413323000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413324000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413325000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413326000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413327000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413328000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413329000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413330000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413331000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413332000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413333000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413334000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413335000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413336000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413337000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413338000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413339000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413340000,
-            "y": 0,
-          },
-        ],
-        "key": "HTTP 5xx",
-      },
-      Object {
-        "avg": 0.25,
-        "dataPoints": Array [
-          Object {
-            "x": 1593413100000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413101000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413102000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413103000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413104000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413105000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413106000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413107000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413108000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413109000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413110000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413111000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413112000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413113000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413114000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413115000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413116000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413117000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413118000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413119000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413120000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413121000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413122000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413123000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413124000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413125000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413126000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413127000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413128000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413129000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413130000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413131000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413132000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413133000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413134000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413135000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413136000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413137000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413138000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413139000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413140000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413141000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413142000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413143000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413144000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413145000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413146000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413147000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413148000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413149000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413150000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413151000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413152000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413153000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413154000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413155000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413156000,
-            "y": 0,
-          },
+        Object {
+          "x": 1600161090000,
+          "y": 1732608,
+        },
+        Object {
+          "x": 1600161120000,
+          "y": 1916864,
+        },
+        Object {
+          "x": 1600161150000,
+          "y": 1335168,
+        },
+        Object {
+          "x": 1600161180000,
+          "y": 1703936,
+        },
+        Object {
+          "x": 1600161210000,
+          "y": 1306624,
+        },
+        Object {
+          "x": 1600161240000,
+          "y": 1343424,
+        },
+        Object {
+          "x": 1600161270000,
+          "y": 794560,
+        },
+        Object {
+          "x": 1600161300000,
+          "y": 1351552,
+        },
+        Object {
+          "x": 1600161330000,
+          "y": 1275904,
+        },
+        Object {
+          "x": 1600161360000,
+          "y": 1515264,
+        },
+        Object {
+          "x": 1600161390000,
+          "y": 1359808,
+        },
+        Object {
+          "x": 1600161420000,
+          "y": 1187808,
+        },
+        Object {
+          "x": 1600161450000,
+          "y": 1069056,
+        },
+        Object {
+          "x": 1600161480000,
+          "y": 24896,
+        },
+        Object {
+          "x": 1600161510000,
+          "y": 804864,
+        },
+        Object {
+          "x": 1600161540000,
+          "y": 1347584,
+        },
+        Object {
+          "x": 1600161570000,
+          "y": 1138688,
+        },
+        Object {
+          "x": 1600161600000,
+          "y": 1588224,
+        },
+        Object {
+          "x": 1600161630000,
+          "y": 1089280,
+        },
+        Object {
+          "x": 1600161660000,
+          "y": 1793920,
+        },
+        Object {
+          "x": 1600161690000,
+          "y": 1679360,
+        },
+        Object {
+          "x": 1600161720000,
+          "y": 1384416,
+        },
+        Object {
+          "x": 1600161750000,
+          "y": 19328,
+        },
+        Object {
+          "x": 1600161780000,
+          "y": 1554432,
+        },
+      ],
+    },
+    "tpmBuckets": Array [
+      Object {
+        "avg": 2.8333333333333335,
+        "dataPoints": Array [
           Object {
-            "x": 1593413157000,
+            "x": 1600159980000,
             "y": 0,
           },
           Object {
-            "x": 1593413158000,
+            "x": 1600160010000,
             "y": 0,
           },
           Object {
-            "x": 1593413159000,
+            "x": 1600160040000,
             "y": 0,
           },
           Object {
-            "x": 1593413160000,
-            "y": 0,
+            "x": 1600160070000,
+            "y": 3,
           },
           Object {
-            "x": 1593413161000,
-            "y": 0,
+            "x": 1600160100000,
+            "y": 2,
           },
           Object {
-            "x": 1593413162000,
+            "x": 1600160130000,
             "y": 0,
           },
           Object {
-            "x": 1593413163000,
-            "y": 0,
+            "x": 1600160160000,
+            "y": 2,
           },
           Object {
-            "x": 1593413164000,
-            "y": 0,
+            "x": 1600160190000,
+            "y": 1,
           },
           Object {
-            "x": 1593413165000,
-            "y": 0,
+            "x": 1600160220000,
+            "y": 1,
           },
           Object {
-            "x": 1593413166000,
+            "x": 1600160250000,
             "y": 0,
           },
           Object {
-            "x": 1593413167000,
-            "y": 0,
+            "x": 1600160280000,
+            "y": 3,
           },
           Object {
-            "x": 1593413168000,
-            "y": 0,
+            "x": 1600160310000,
+            "y": 3,
           },
           Object {
-            "x": 1593413169000,
-            "y": 0,
+            "x": 1600160340000,
+            "y": 2,
           },
           Object {
-            "x": 1593413170000,
+            "x": 1600160370000,
             "y": 0,
           },
           Object {
-            "x": 1593413171000,
-            "y": 0,
+            "x": 1600160400000,
+            "y": 8,
           },
           Object {
-            "x": 1593413172000,
-            "y": 0,
+            "x": 1600160430000,
+            "y": 1,
           },
           Object {
-            "x": 1593413173000,
-            "y": 0,
+            "x": 1600160460000,
+            "y": 1,
           },
           Object {
-            "x": 1593413174000,
+            "x": 1600160490000,
             "y": 0,
           },
           Object {
-            "x": 1593413175000,
+            "x": 1600160520000,
             "y": 0,
           },
           Object {
-            "x": 1593413176000,
-            "y": 0,
+            "x": 1600160550000,
+            "y": 3,
           },
           Object {
-            "x": 1593413177000,
+            "x": 1600160580000,
             "y": 0,
           },
           Object {
-            "x": 1593413178000,
+            "x": 1600160610000,
             "y": 0,
           },
           Object {
-            "x": 1593413179000,
-            "y": 0,
+            "x": 1600160640000,
+            "y": 8,
           },
           Object {
-            "x": 1593413180000,
-            "y": 0,
+            "x": 1600160670000,
+            "y": 1,
           },
           Object {
-            "x": 1593413181000,
-            "y": 0,
+            "x": 1600160700000,
+            "y": 3,
           },
           Object {
-            "x": 1593413182000,
+            "x": 1600160730000,
             "y": 0,
           },
           Object {
-            "x": 1593413183000,
-            "y": 0,
+            "x": 1600160760000,
+            "y": 4,
           },
           Object {
-            "x": 1593413184000,
+            "x": 1600160790000,
             "y": 0,
           },
           Object {
-            "x": 1593413185000,
-            "y": 0,
+            "x": 1600160820000,
+            "y": 2,
           },
           Object {
-            "x": 1593413186000,
+            "x": 1600160850000,
             "y": 0,
           },
           Object {
-            "x": 1593413187000,
+            "x": 1600160880000,
             "y": 0,
           },
           Object {
-            "x": 1593413188000,
-            "y": 0,
+            "x": 1600160910000,
+            "y": 5,
           },
           Object {
-            "x": 1593413189000,
+            "x": 1600160940000,
             "y": 0,
           },
           Object {
-            "x": 1593413190000,
+            "x": 1600160970000,
             "y": 0,
           },
           Object {
-            "x": 1593413191000,
-            "y": 0,
+            "x": 1600161000000,
+            "y": 3,
           },
           Object {
-            "x": 1593413192000,
-            "y": 0,
+            "x": 1600161030000,
+            "y": 5,
           },
           Object {
-            "x": 1593413193000,
-            "y": 0,
+            "x": 1600161060000,
+            "y": 1,
           },
           Object {
-            "x": 1593413194000,
+            "x": 1600161090000,
             "y": 0,
           },
           Object {
-            "x": 1593413195000,
-            "y": 0,
+            "x": 1600161120000,
+            "y": 2,
           },
           Object {
-            "x": 1593413196000,
-            "y": 0,
+            "x": 1600161150000,
+            "y": 1,
           },
           Object {
-            "x": 1593413197000,
+            "x": 1600161180000,
             "y": 0,
           },
           Object {
-            "x": 1593413198000,
+            "x": 1600161210000,
             "y": 0,
           },
           Object {
-            "x": 1593413199000,
-            "y": 0,
+            "x": 1600161240000,
+            "y": 1,
           },
           Object {
-            "x": 1593413200000,
-            "y": 0,
+            "x": 1600161270000,
+            "y": 2,
           },
           Object {
-            "x": 1593413201000,
-            "y": 0,
+            "x": 1600161300000,
+            "y": 1,
           },
           Object {
-            "x": 1593413202000,
+            "x": 1600161330000,
             "y": 0,
           },
           Object {
-            "x": 1593413203000,
-            "y": 0,
+            "x": 1600161360000,
+            "y": 1,
           },
           Object {
-            "x": 1593413204000,
-            "y": 0,
+            "x": 1600161390000,
+            "y": 3,
           },
           Object {
-            "x": 1593413205000,
-            "y": 0,
+            "x": 1600161420000,
+            "y": 2,
           },
           Object {
-            "x": 1593413206000,
+            "x": 1600161450000,
             "y": 0,
           },
           Object {
-            "x": 1593413207000,
-            "y": 0,
+            "x": 1600161480000,
+            "y": 2,
           },
           Object {
-            "x": 1593413208000,
+            "x": 1600161510000,
             "y": 0,
           },
           Object {
-            "x": 1593413209000,
+            "x": 1600161540000,
             "y": 0,
           },
           Object {
-            "x": 1593413210000,
+            "x": 1600161570000,
             "y": 0,
           },
           Object {
-            "x": 1593413211000,
+            "x": 1600161600000,
             "y": 0,
           },
           Object {
-            "x": 1593413212000,
-            "y": 0,
+            "x": 1600161630000,
+            "y": 1,
           },
           Object {
-            "x": 1593413213000,
-            "y": 0,
+            "x": 1600161660000,
+            "y": 1,
           },
           Object {
-            "x": 1593413214000,
+            "x": 1600161690000,
             "y": 0,
           },
           Object {
-            "x": 1593413215000,
-            "y": 0,
+            "x": 1600161720000,
+            "y": 5,
           },
           Object {
-            "x": 1593413216000,
-            "y": 0,
+            "x": 1600161750000,
+            "y": 1,
           },
           Object {
-            "x": 1593413217000,
+            "x": 1600161780000,
             "y": 0,
           },
+        ],
+        "key": "HTTP 2xx",
+      },
+      Object {
+        "avg": 0.23333333333333334,
+        "dataPoints": Array [
           Object {
-            "x": 1593413218000,
+            "x": 1600159980000,
             "y": 0,
           },
           Object {
-            "x": 1593413219000,
+            "x": 1600160010000,
             "y": 0,
           },
           Object {
-            "x": 1593413220000,
+            "x": 1600160040000,
             "y": 0,
           },
           Object {
-            "x": 1593413221000,
+            "x": 1600160070000,
             "y": 0,
           },
           Object {
-            "x": 1593413222000,
+            "x": 1600160100000,
             "y": 0,
           },
           Object {
-            "x": 1593413223000,
+            "x": 1600160130000,
             "y": 0,
           },
           Object {
-            "x": 1593413224000,
-            "y": 0,
+            "x": 1600160160000,
+            "y": 1,
           },
           Object {
-            "x": 1593413225000,
+            "x": 1600160190000,
             "y": 0,
           },
           Object {
-            "x": 1593413226000,
+            "x": 1600160220000,
             "y": 0,
           },
           Object {
-            "x": 1593413227000,
+            "x": 1600160250000,
             "y": 0,
           },
           Object {
-            "x": 1593413228000,
+            "x": 1600160280000,
             "y": 0,
           },
           Object {
-            "x": 1593413229000,
+            "x": 1600160310000,
             "y": 0,
           },
           Object {
-            "x": 1593413230000,
+            "x": 1600160340000,
             "y": 0,
           },
           Object {
-            "x": 1593413231000,
+            "x": 1600160370000,
             "y": 0,
           },
           Object {
-            "x": 1593413232000,
+            "x": 1600160400000,
             "y": 0,
           },
           Object {
-            "x": 1593413233000,
-            "y": 0,
+            "x": 1600160430000,
+            "y": 3,
           },
           Object {
-            "x": 1593413234000,
+            "x": 1600160460000,
             "y": 0,
           },
           Object {
-            "x": 1593413235000,
+            "x": 1600160490000,
             "y": 0,
           },
           Object {
-            "x": 1593413236000,
+            "x": 1600160520000,
             "y": 0,
           },
           Object {
-            "x": 1593413237000,
+            "x": 1600160550000,
             "y": 0,
           },
           Object {
-            "x": 1593413238000,
+            "x": 1600160580000,
             "y": 0,
           },
           Object {
-            "x": 1593413239000,
+            "x": 1600160610000,
             "y": 0,
           },
           Object {
-            "x": 1593413240000,
-            "y": 0,
+            "x": 1600160640000,
+            "y": 1,
           },
           Object {
-            "x": 1593413241000,
+            "x": 1600160670000,
             "y": 0,
           },
           Object {
-            "x": 1593413242000,
+            "x": 1600160700000,
             "y": 0,
           },
           Object {
-            "x": 1593413243000,
+            "x": 1600160730000,
             "y": 0,
           },
           Object {
-            "x": 1593413244000,
+            "x": 1600160760000,
             "y": 0,
           },
           Object {
-            "x": 1593413245000,
+            "x": 1600160790000,
             "y": 0,
           },
           Object {
-            "x": 1593413246000,
+            "x": 1600160820000,
             "y": 0,
           },
           Object {
-            "x": 1593413247000,
+            "x": 1600160850000,
             "y": 0,
           },
           Object {
-            "x": 1593413248000,
-            "y": 0,
+            "x": 1600160880000,
+            "y": 1,
           },
           Object {
-            "x": 1593413249000,
+            "x": 1600160910000,
             "y": 0,
           },
           Object {
-            "x": 1593413250000,
+            "x": 1600160940000,
             "y": 0,
           },
           Object {
-            "x": 1593413251000,
+            "x": 1600160970000,
             "y": 0,
           },
           Object {
-            "x": 1593413252000,
+            "x": 1600161000000,
             "y": 0,
           },
           Object {
-            "x": 1593413253000,
+            "x": 1600161030000,
             "y": 0,
           },
           Object {
-            "x": 1593413254000,
+            "x": 1600161060000,
             "y": 0,
           },
           Object {
-            "x": 1593413255000,
+            "x": 1600161090000,
             "y": 0,
           },
           Object {
-            "x": 1593413256000,
+            "x": 1600161120000,
             "y": 0,
           },
           Object {
-            "x": 1593413257000,
+            "x": 1600161150000,
             "y": 0,
           },
           Object {
-            "x": 1593413258000,
+            "x": 1600161180000,
             "y": 0,
           },
           Object {
-            "x": 1593413259000,
+            "x": 1600161210000,
             "y": 0,
           },
           Object {
-            "x": 1593413260000,
+            "x": 1600161240000,
             "y": 0,
           },
           Object {
-            "x": 1593413261000,
-            "y": 0,
+            "x": 1600161270000,
+            "y": 1,
           },
           Object {
-            "x": 1593413262000,
+            "x": 1600161300000,
             "y": 0,
           },
           Object {
-            "x": 1593413263000,
+            "x": 1600161330000,
             "y": 0,
           },
           Object {
-            "x": 1593413264000,
+            "x": 1600161360000,
             "y": 0,
           },
           Object {
-            "x": 1593413265000,
+            "x": 1600161390000,
             "y": 0,
           },
           Object {
-            "x": 1593413266000,
+            "x": 1600161420000,
             "y": 0,
           },
           Object {
-            "x": 1593413267000,
+            "x": 1600161450000,
             "y": 0,
           },
           Object {
-            "x": 1593413268000,
+            "x": 1600161480000,
             "y": 0,
           },
           Object {
-            "x": 1593413269000,
+            "x": 1600161510000,
             "y": 0,
           },
           Object {
-            "x": 1593413270000,
+            "x": 1600161540000,
             "y": 0,
           },
           Object {
-            "x": 1593413271000,
+            "x": 1600161570000,
             "y": 0,
           },
           Object {
-            "x": 1593413272000,
+            "x": 1600161600000,
             "y": 0,
           },
           Object {
-            "x": 1593413273000,
+            "x": 1600161630000,
             "y": 0,
           },
           Object {
-            "x": 1593413274000,
+            "x": 1600161660000,
             "y": 0,
           },
           Object {
-            "x": 1593413275000,
+            "x": 1600161690000,
             "y": 0,
           },
           Object {
-            "x": 1593413276000,
+            "x": 1600161720000,
             "y": 0,
           },
           Object {
-            "x": 1593413277000,
+            "x": 1600161750000,
             "y": 0,
           },
           Object {
-            "x": 1593413278000,
+            "x": 1600161780000,
             "y": 0,
           },
+        ],
+        "key": "HTTP 4xx",
+      },
+      Object {
+        "avg": 4.466666666666667,
+        "dataPoints": Array [
           Object {
-            "x": 1593413279000,
-            "y": 0,
+            "x": 1600159980000,
+            "y": 2,
           },
           Object {
-            "x": 1593413280000,
-            "y": 0,
+            "x": 1600160010000,
+            "y": 2,
           },
           Object {
-            "x": 1593413281000,
-            "y": 0,
+            "x": 1600160040000,
+            "y": 1,
           },
           Object {
-            "x": 1593413282000,
-            "y": 0,
+            "x": 1600160070000,
+            "y": 2,
           },
           Object {
-            "x": 1593413283000,
-            "y": 0,
+            "x": 1600160100000,
+            "y": 3,
           },
           Object {
-            "x": 1593413284000,
+            "x": 1600160130000,
             "y": 0,
           },
           Object {
-            "x": 1593413285000,
-            "y": 0,
+            "x": 1600160160000,
+            "y": 3,
           },
           Object {
-            "x": 1593413286000,
-            "y": 0,
+            "x": 1600160190000,
+            "y": 2,
           },
           Object {
-            "x": 1593413287000,
-            "y": 0,
+            "x": 1600160220000,
+            "y": 3,
           },
           Object {
-            "x": 1593413288000,
-            "y": 0,
+            "x": 1600160250000,
+            "y": 2,
           },
           Object {
-            "x": 1593413289000,
-            "y": 0,
+            "x": 1600160280000,
+            "y": 2,
           },
           Object {
-            "x": 1593413290000,
-            "y": 0,
+            "x": 1600160310000,
+            "y": 3,
           },
           Object {
-            "x": 1593413291000,
-            "y": 0,
+            "x": 1600160340000,
+            "y": 1,
           },
           Object {
-            "x": 1593413292000,
-            "y": 0,
+            "x": 1600160370000,
+            "y": 2,
           },
           Object {
-            "x": 1593413293000,
-            "y": 0,
+            "x": 1600160400000,
+            "y": 3,
           },
           Object {
-            "x": 1593413294000,
-            "y": 0,
+            "x": 1600160430000,
+            "y": 1,
           },
           Object {
-            "x": 1593413295000,
-            "y": 0,
+            "x": 1600160460000,
+            "y": 3,
           },
           Object {
-            "x": 1593413296000,
-            "y": 0,
+            "x": 1600160490000,
+            "y": 2,
           },
           Object {
-            "x": 1593413297000,
-            "y": 0,
+            "x": 1600160520000,
+            "y": 4,
           },
           Object {
-            "x": 1593413298000,
-            "y": 0,
+            "x": 1600160550000,
+            "y": 1,
           },
           Object {
-            "x": 1593413299000,
-            "y": 0,
+            "x": 1600160580000,
+            "y": 3,
           },
           Object {
-            "x": 1593413300000,
-            "y": 0,
+            "x": 1600160610000,
+            "y": 3,
           },
           Object {
-            "x": 1593413301000,
-            "y": 0,
+            "x": 1600160640000,
+            "y": 2,
           },
           Object {
-            "x": 1593413302000,
-            "y": 0,
+            "x": 1600160670000,
+            "y": 2,
           },
           Object {
-            "x": 1593413303000,
-            "y": 0,
+            "x": 1600160700000,
+            "y": 1,
           },
           Object {
-            "x": 1593413304000,
-            "y": 0,
+            "x": 1600160730000,
+            "y": 2,
           },
           Object {
-            "x": 1593413305000,
-            "y": 0,
+            "x": 1600160760000,
+            "y": 2,
           },
           Object {
-            "x": 1593413306000,
-            "y": 0,
+            "x": 1600160790000,
+            "y": 3,
           },
           Object {
-            "x": 1593413307000,
-            "y": 0,
+            "x": 1600160820000,
+            "y": 2,
           },
           Object {
-            "x": 1593413308000,
-            "y": 0,
+            "x": 1600160850000,
+            "y": 2,
           },
           Object {
-            "x": 1593413309000,
+            "x": 1600160880000,
             "y": 1,
           },
           Object {
-            "x": 1593413310000,
-            "y": 0,
-          },
-          Object {
-            "x": 1593413311000,
-            "y": 0,
+            "x": 1600160910000,
+            "y": 3,
           },
           Object {
-            "x": 1593413312000,
-            "y": 0,
+            "x": 1600160940000,
+            "y": 3,
           },
           Object {
-            "x": 1593413313000,
-            "y": 0,
+            "x": 1600160970000,
+            "y": 1,
           },
           Object {
-            "x": 1593413314000,
-            "y": 0,
+            "x": 1600161000000,
+            "y": 4,
           },
           Object {
-            "x": 1593413315000,
-            "y": 0,
+            "x": 1600161030000,
+            "y": 2,
           },
           Object {
-            "x": 1593413316000,
-            "y": 0,
+            "x": 1600161060000,
+            "y": 3,
           },
           Object {
-            "x": 1593413317000,
-            "y": 0,
+            "x": 1600161090000,
+            "y": 3,
           },
           Object {
-            "x": 1593413318000,
-            "y": 0,
+            "x": 1600161120000,
+            "y": 1,
           },
           Object {
-            "x": 1593413319000,
-            "y": 0,
+            "x": 1600161150000,
+            "y": 4,
           },
           Object {
-            "x": 1593413320000,
-            "y": 0,
+            "x": 1600161180000,
+            "y": 2,
           },
           Object {
-            "x": 1593413321000,
-            "y": 0,
+            "x": 1600161210000,
+            "y": 3,
           },
           Object {
-            "x": 1593413322000,
-            "y": 0,
+            "x": 1600161240000,
+            "y": 2,
           },
           Object {
-            "x": 1593413323000,
-            "y": 0,
+            "x": 1600161270000,
+            "y": 2,
           },
           Object {
-            "x": 1593413324000,
-            "y": 0,
+            "x": 1600161300000,
+            "y": 1,
           },
           Object {
-            "x": 1593413325000,
-            "y": 0,
+            "x": 1600161330000,
+            "y": 2,
           },
           Object {
-            "x": 1593413326000,
-            "y": 0,
+            "x": 1600161360000,
+            "y": 2,
           },
           Object {
-            "x": 1593413327000,
-            "y": 0,
+            "x": 1600161390000,
+            "y": 2,
           },
           Object {
-            "x": 1593413328000,
-            "y": 0,
+            "x": 1600161420000,
+            "y": 3,
           },
           Object {
-            "x": 1593413329000,
-            "y": 0,
+            "x": 1600161450000,
+            "y": 3,
           },
           Object {
-            "x": 1593413330000,
+            "x": 1600161480000,
             "y": 0,
           },
           Object {
-            "x": 1593413331000,
-            "y": 0,
+            "x": 1600161510000,
+            "y": 3,
           },
           Object {
-            "x": 1593413332000,
-            "y": 0,
+            "x": 1600161540000,
+            "y": 3,
           },
           Object {
-            "x": 1593413333000,
-            "y": 0,
+            "x": 1600161570000,
+            "y": 1,
           },
           Object {
-            "x": 1593413334000,
-            "y": 0,
+            "x": 1600161600000,
+            "y": 4,
           },
           Object {
-            "x": 1593413335000,
-            "y": 0,
+            "x": 1600161630000,
+            "y": 2,
           },
           Object {
-            "x": 1593413336000,
-            "y": 0,
+            "x": 1600161660000,
+            "y": 3,
           },
           Object {
-            "x": 1593413337000,
-            "y": 0,
+            "x": 1600161690000,
+            "y": 1,
           },
           Object {
-            "x": 1593413338000,
-            "y": 0,
+            "x": 1600161720000,
+            "y": 4,
           },
           Object {
-            "x": 1593413339000,
+            "x": 1600161750000,
             "y": 0,
           },
           Object {
-            "x": 1593413340000,
-            "y": 0,
+            "x": 1600161780000,
+            "y": 2,
           },
         ],
         "key": "success",
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts
index 21f3aaa04a7b3..087bf1f0655e6 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
+import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
@@ -11,8 +12,11 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
   const transactionName = '/products';
   const uiFilters = encodeURIComponent(JSON.stringify({}));
 
@@ -28,23 +32,34 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     });
 
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       it('returns the average duration by browser', async () => {
         const response = await supertest.get(
-          `/api/apm/services/client/transaction_groups/avg_duration_by_browser?start=${start}&end=${end}&uiFilters=${uiFilters}`
+          `/api/apm/services/opbeans-rum/transaction_groups/avg_duration_by_browser?start=${start}&end=${end}&uiFilters=${uiFilters}`
         );
 
         expect(response.status).to.be(200);
+
+        expect(response.body.length).to.be.greaterThan(0);
+
         expectSnapshot(response.body).toMatch();
+
+        expectSnapshot(response.body.length).toMatchInline(`1`);
       });
+
       it('returns the average duration by browser filtering by transaction name', async () => {
         const response = await supertest.get(
-          `/api/apm/services/client/transaction_groups/avg_duration_by_browser?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionName=${transactionName}`
+          `/api/apm/services/opbeans-rum/transaction_groups/avg_duration_by_browser?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionName=${transactionName}`
         );
 
         expect(response.status).to.be(200);
+
+        expect(response.body.length).to.be.greaterThan(0);
+
+        expectSnapshot(response.body.length).toMatchInline(`1`);
+
         expectSnapshot(response.body).toMatch();
       });
     });
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
index 4e1b1e57fba0f..1c842ee457dae 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
+import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
@@ -11,8 +12,11 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
   const transactionType = 'request';
   const transactionName = 'GET /api';
   const uiFilters = encodeURIComponent(JSON.stringify({}));
@@ -29,8 +33,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     });
 
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       it('returns the transaction breakdown for a service', async () => {
         const response = await supertest.get(
@@ -46,47 +50,48 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
+
         const { timeseries } = response.body;
+
+        const numberOfSeries = timeseries.length;
+
+        expectSnapshot(numberOfSeries).toMatchInline(`1`);
+
         const { title, color, type, data, hideLegend, legendValue } = timeseries[0];
 
-        expectSnapshot(data).toMatchInline(`
+        const nonNullDataPoints = data.filter((y: number | null) => y !== null);
+
+        expectSnapshot(nonNullDataPoints.length).toMatchInline(`61`);
+
+        expectSnapshot(
+          data.slice(0, 5).map(({ x, y }: { x: number; y: number | null }) => {
+            return {
+              x: new Date(x ?? NaN).toISOString(),
+              y,
+            };
+          })
+        ).toMatchInline(`
           Array [
             Object {
-              "x": 1593413100000,
-              "y": null,
-            },
-            Object {
-              "x": 1593413130000,
+              "x": "2020-09-15T08:53:00.000Z",
               "y": null,
             },
             Object {
-              "x": 1593413160000,
+              "x": "2020-09-15T08:53:30.000Z",
               "y": null,
             },
             Object {
-              "x": 1593413190000,
+              "x": "2020-09-15T08:54:00.000Z",
               "y": null,
             },
             Object {
-              "x": 1593413220000,
+              "x": "2020-09-15T08:54:30.000Z",
               "y": null,
             },
             Object {
-              "x": 1593413250000,
-              "y": null,
-            },
-            Object {
-              "x": 1593413280000,
-              "y": null,
-            },
-            Object {
-              "x": 1593413310000,
+              "x": "2020-09-15T08:55:00.000Z",
               "y": 1,
             },
-            Object {
-              "x": 1593413340000,
-              "y": null,
-            },
           ]
         `);
 
@@ -95,6 +100,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         expectSnapshot(type).toMatchInline(`"areaStacked"`);
         expectSnapshot(hideLegend).toMatchInline(`false`);
         expectSnapshot(legendValue).toMatchInline(`"100%"`);
+
+        expectSnapshot(data).toMatch();
       });
       it('returns the transaction breakdown sorted by name', async () => {
         const response = await supertest.get(
@@ -108,7 +115,6 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             "app",
             "http",
             "postgresql",
-            "redis",
           ]
         `);
       });
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts
index cf23883612b7c..27a2eac3131f5 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/error_rate.ts
@@ -5,6 +5,7 @@
  */
 import expect from '@kbn/expect';
 import { first, last } from 'lodash';
+import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
@@ -12,9 +13,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
   // url parameters
-  const start = encodeURIComponent('2020-08-26T11:00:00.000Z');
-  const end = encodeURIComponent('2020-08-26T11:30:00.000Z');
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
   const uiFilters = encodeURIComponent(JSON.stringify({}));
 
   describe('Error rate', () => {
@@ -24,16 +28,16 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           `/api/apm/services/opbeans-java/transaction_groups/error_rate?start=${start}&end=${end}&uiFilters=${uiFilters}`
         );
         expect(response.status).to.be(200);
-        expect(response.body).to.eql({
-          noHits: true,
-          erroneousTransactionsRate: [],
-          average: null,
-        });
+
+        expect(response.body.noHits).to.be(true);
+
+        expect(response.body.erroneousTransactionsRate.length).to.be(0);
+        expect(response.body.average).to.be(null);
       });
     });
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
       describe('returns the transaction error rate', () => {
         let errorRateResponse: {
@@ -47,16 +51,28 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           errorRateResponse = response.body;
         });
 
+        it('returns some data', () => {
+          expect(errorRateResponse.average).to.be.greaterThan(0);
+
+          expect(errorRateResponse.erroneousTransactionsRate.length).to.be.greaterThan(0);
+
+          const nonNullDataPoints = errorRateResponse.erroneousTransactionsRate.filter(
+            ({ y }) => y !== null
+          );
+
+          expect(nonNullDataPoints.length).to.be.greaterThan(0);
+        });
+
         it('has the correct start date', () => {
           expectSnapshot(
             new Date(first(errorRateResponse.erroneousTransactionsRate)?.x ?? NaN).toISOString()
-          ).toMatchInline(`"2020-08-26T11:00:00.000Z"`);
+          ).toMatchInline(`"2020-09-15T08:53:00.000Z"`);
         });
 
         it('has the correct end date', () => {
           expectSnapshot(
             new Date(last(errorRateResponse.erroneousTransactionsRate)?.x ?? NaN).toISOString()
-          ).toMatchInline(`"2020-08-26T11:30:00.000Z"`);
+          ).toMatchInline(`"2020-09-15T09:23:00.000Z"`);
         });
 
         it('has the correct number of buckets', () => {
@@ -64,13 +80,11 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         });
 
         it('has the correct calculation for average', () => {
-          expectSnapshot(errorRateResponse.average).toMatchInline(`0.18894993894993897`);
+          expectSnapshot(errorRateResponse.average).toMatchInline(`0.14086309523809523`);
         });
 
         it('has the correct error rate', () => {
-          expectSnapshot(first(errorRateResponse.erroneousTransactionsRate)?.y).toMatchInline(
-            `0.5`
-          );
+          expectSnapshot(errorRateResponse.erroneousTransactionsRate).toMatch();
         });
       });
     });
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts
index cebf27ecdff2b..3154cea2626c0 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/top_transaction_groups.ts
@@ -5,6 +5,7 @@
  */
 import expect from '@kbn/expect';
 import { sortBy } from 'lodash';
+import archives_metadata from '../../../common/archives_metadata';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 
@@ -20,9 +21,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
   // url parameters
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
   const uiFilters = encodeURIComponent(JSON.stringify({}));
   const transactionType = 'request';
 
@@ -34,39 +38,37 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
-        expectSnapshot(response.body).toMatchInline(`
-          Object {
-            "bucketSize": 1000,
-            "isAggregationAccurate": true,
-            "items": Array [],
-          }
-        `);
+
+        expect(response.body.isAggregationAccurate).to.be(true);
+        expect(response.body.items.length).to.be(0);
       });
     });
 
     describe('when data is loaded', () => {
       let response: any;
       before(async () => {
-        await esArchiver.load('8.0.0');
+        await esArchiver.load(archiveName);
         response = await supertest.get(
           `/api/apm/services/opbeans-node/transaction_groups?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionType=${transactionType}`
         );
       });
-      after(() => esArchiver.unload('8.0.0'));
+      after(() => esArchiver.unload(archiveName));
 
-      it('returns the correct status code', async () => {
+      it('returns the correct metadata', () => {
         expect(response.status).to.be(200);
+        expect(response.body.isAggregationAccurate).to.be(true);
+        expect(response.body.items.length).to.be.greaterThan(0);
       });
 
-      it('returns the correct number of buckets', async () => {
-        expectSnapshot(response.body.items.length).toMatchInline(`18`);
+      it('returns the correct number of buckets', () => {
+        expectSnapshot(response.body.items.length).toMatchInline(`14`);
       });
 
-      it('returns the correct buckets (when ignoring samples)', async () => {
+      it('returns the correct buckets (when ignoring samples)', () => {
         expectSnapshot(omitSampleFromTransactionGroups(response.body.items)).toMatch();
       });
 
-      it('returns the correct buckets and samples', async () => {
+      it('returns the correct buckets and samples', () => {
         // sample should provide enough information to deeplink to a transaction detail page
         response.body.items.forEach((item: any) => {
           expect(item.sample.trace.id).to.be.an('string');
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/transaction_charts.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/transaction_charts.ts
index a8418fe2860a3..8dd52ef241c59 100644
--- a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/transaction_charts.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/transaction_charts.ts
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import expect from '@kbn/expect';
+import archives_metadata from '../../../common/archives_metadata';
+import { PromiseReturnType } from '../../../../../plugins/apm/typings/common';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 
@@ -11,9 +13,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+
   // url parameters
-  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
-  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
   const uiFilters = encodeURIComponent(JSON.stringify({}));
 
   describe('Transaction charts', () => {
@@ -24,32 +29,44 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
 
         expect(response.status).to.be(200);
-        expectSnapshot(response.body).toMatchInline(`
-          Object {
-            "apmTimeseries": Object {
-              "overallAvgDuration": null,
-              "responseTimes": Object {
-                "avg": Array [],
-                "p95": Array [],
-                "p99": Array [],
-              },
-              "tpmBuckets": Array [],
-            },
-          }
-        `);
+
+        expect(response.body.apmTimeseries.overallAvgDuration).to.be(null);
+        expect(response.body.apmTimeseries.responseTimes.avg.length).to.be(0);
+        expect(response.body.apmTimeseries.responseTimes.p95.length).to.be(0);
+        expect(response.body.apmTimeseries.responseTimes.p99.length).to.be(0);
+        expect(response.body.apmTimeseries.tpmBuckets.length).to.be(0);
       });
     });
 
     describe('when data is loaded', () => {
-      before(() => esArchiver.load('8.0.0'));
-      after(() => esArchiver.unload('8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
-      it('returns the transaction charts', async () => {
-        const response = await supertest.get(
+      let response: PromiseReturnType<typeof supertest.get>;
+
+      before(async () => {
+        response = await supertest.get(
           `/api/apm/services/opbeans-node/transaction_groups/charts?start=${start}&end=${end}&uiFilters=${uiFilters}`
         );
+      });
 
+      it('returns some data', async () => {
         expect(response.status).to.be(200);
+
+        expect(response.body.apmTimeseries.overallAvgDuration).not.to.be(null);
+        expect(response.body.apmTimeseries.responseTimes.avg.length).to.be.greaterThan(0);
+        expect(response.body.apmTimeseries.responseTimes.p95.length).to.be.greaterThan(0);
+        expect(response.body.apmTimeseries.responseTimes.p99.length).to.be.greaterThan(0);
+        expect(response.body.apmTimeseries.tpmBuckets.length).to.be.greaterThan(0);
+      });
+
+      it('returns the correct data', () => {
+        expectSnapshot(response.body.apmTimeseries.overallAvgDuration).toMatchInline(
+          `600255.7079646018`
+        );
+        expectSnapshot(response.body.apmTimeseries.responseTimes.avg.length).toMatchInline(`61`);
+        expectSnapshot(response.body.apmTimeseries.tpmBuckets.length).toMatchInline(`3`);
+
         expectSnapshot(response.body).toMatch();
       });
     });
diff --git a/x-pack/test/apm_api_integration/common/archives_metadata.ts b/x-pack/test/apm_api_integration/common/archives_metadata.ts
index ab9e3a191e24d..84932310d22d2 100644
--- a/x-pack/test/apm_api_integration/common/archives_metadata.ts
+++ b/x-pack/test/apm_api_integration/common/archives_metadata.ts
@@ -6,7 +6,7 @@
 
 export default {
   'apm_8.0.0': {
-    start: '2020-09-10T06:00:00.000Z',
-    end: '2020-09-10T07:00:00.000Z',
+    start: '2020-09-15T08:53:10.777Z',
+    end: '2020-09-15T09:23:10.777Z',
   },
 };
diff --git a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz
index fa40458dedaff..9b21a59367e80 100644
Binary files a/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz and b/x-pack/test/apm_api_integration/common/fixtures/es_archiver/apm_8.0.0/data.json.gz differ
diff --git a/x-pack/test/apm_api_integration/common/match_snapshot.ts b/x-pack/test/apm_api_integration/common/match_snapshot.ts
index a8cb0418583af..4ac812a0ee168 100644
--- a/x-pack/test/apm_api_integration/common/match_snapshot.ts
+++ b/x-pack/test/apm_api_integration/common/match_snapshot.ts
@@ -12,6 +12,7 @@ import prettier from 'prettier';
 // @ts-expect-error
 import babelTraverse from '@babel/traverse';
 import { Suite, Test } from 'mocha';
+import { flatten } from 'lodash';
 
 type ISnapshotState = InstanceType<typeof SnapshotState>;
 
@@ -143,18 +144,24 @@ Error.prepareStackTrace = (error, structuredStackTrace) => {
   }
 };
 
+function recursivelyGetTestsFromSuite(suite: Suite): Test[] {
+  return suite.tests.concat(flatten(suite.suites.map((s) => recursivelyGetTestsFromSuite(s))));
+}
+
 function getSnapshotState(file: string, test: Test) {
   const dirname = path.dirname(file);
   const filename = path.basename(file);
 
-  let parent = test.parent;
-  const testsInFile: Test[] = [];
+  let parent: Suite | undefined = test.parent;
 
-  while (parent) {
-    testsInFile.push(...parent.tests);
+  while (parent && parent.parent?.file === file) {
     parent = parent.parent;
   }
 
+  if (!parent) {
+    throw new Error('Top-level suite not found');
+  }
+
   const snapshotState = new SnapshotState(
     path.join(dirname + `/__snapshots__/` + filename.replace(path.extname(filename), '.snap')),
     {
@@ -164,7 +171,7 @@ function getSnapshotState(file: string, test: Test) {
     }
   );
 
-  return { snapshotState, testsInFile };
+  return { snapshotState, testsInFile: recursivelyGetTestsFromSuite(parent) };
 }
 
 export function expectSnapshot(received: any) {
diff --git a/x-pack/test/apm_api_integration/trial/tests/service_maps/__snapshots__/service_maps.snap b/x-pack/test/apm_api_integration/trial/tests/service_maps/__snapshots__/service_maps.snap
new file mode 100644
index 0000000000000..2306ca16dd71d
--- /dev/null
+++ b/x-pack/test/apm_api_integration/trial/tests/service_maps/__snapshots__/service_maps.snap
@@ -0,0 +1,1459 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Service Maps with a trial license /api/apm/service-map when there is data returns the correct data 3`] = `
+Array [
+  Object {
+    "data": Object {
+      "id": "opbeans-go~>postgresql",
+      "source": "opbeans-go",
+      "sourceData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": ">postgresql",
+      "targetData": Object {
+        "id": ">postgresql",
+        "label": "postgresql",
+        "span.destination.service.resource": "postgresql",
+        "span.subtype": "postgresql",
+        "span.type": "db",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "bidirectional": true,
+      "id": "opbeans-go~opbeans-java",
+      "source": "opbeans-go",
+      "sourceData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": "opbeans-java",
+      "targetData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "bidirectional": true,
+      "id": "opbeans-go~opbeans-node",
+      "source": "opbeans-go",
+      "sourceData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": "opbeans-node",
+      "targetData": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "bidirectional": true,
+      "id": "opbeans-go~opbeans-python",
+      "source": "opbeans-go",
+      "sourceData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": "opbeans-python",
+      "targetData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-java~>postgresql",
+      "source": "opbeans-java",
+      "sourceData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+      "target": ">postgresql",
+      "targetData": Object {
+        "id": ">postgresql",
+        "label": "postgresql",
+        "span.destination.service.resource": "postgresql",
+        "span.subtype": "postgresql",
+        "span.type": "db",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-java~opbeans-go",
+      "isInverseEdge": true,
+      "source": "opbeans-java",
+      "sourceData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+      "target": "opbeans-go",
+      "targetData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "bidirectional": true,
+      "id": "opbeans-java~opbeans-python",
+      "source": "opbeans-java",
+      "sourceData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+      "target": "opbeans-python",
+      "targetData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "bidirectional": true,
+      "id": "opbeans-java~opbeans-ruby",
+      "source": "opbeans-java",
+      "sourceData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+      "target": "opbeans-ruby",
+      "targetData": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-node~>postgresql",
+      "source": "opbeans-node",
+      "sourceData": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+      "target": ">postgresql",
+      "targetData": Object {
+        "id": ">postgresql",
+        "label": "postgresql",
+        "span.destination.service.resource": "postgresql",
+        "span.subtype": "postgresql",
+        "span.type": "db",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-node~opbeans-go",
+      "isInverseEdge": true,
+      "source": "opbeans-node",
+      "sourceData": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+      "target": "opbeans-go",
+      "targetData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "bidirectional": true,
+      "id": "opbeans-node~opbeans-python",
+      "source": "opbeans-node",
+      "sourceData": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+      "target": "opbeans-python",
+      "targetData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-python~>elasticsearch",
+      "source": "opbeans-python",
+      "sourceData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+      "target": ">elasticsearch",
+      "targetData": Object {
+        "id": ">elasticsearch",
+        "label": "elasticsearch",
+        "span.destination.service.resource": "elasticsearch",
+        "span.subtype": "elasticsearch",
+        "span.type": "db",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-python~>postgresql",
+      "source": "opbeans-python",
+      "sourceData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+      "target": ">postgresql",
+      "targetData": Object {
+        "id": ">postgresql",
+        "label": "postgresql",
+        "span.destination.service.resource": "postgresql",
+        "span.subtype": "postgresql",
+        "span.type": "db",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-python~>redis",
+      "source": "opbeans-python",
+      "sourceData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+      "target": ">redis",
+      "targetData": Object {
+        "id": ">redis",
+        "label": "redis",
+        "span.destination.service.resource": "redis",
+        "span.subtype": "redis",
+        "span.type": "db",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-python~opbeans-go",
+      "isInverseEdge": true,
+      "source": "opbeans-python",
+      "sourceData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+      "target": "opbeans-go",
+      "targetData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-python~opbeans-java",
+      "isInverseEdge": true,
+      "source": "opbeans-python",
+      "sourceData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+      "target": "opbeans-java",
+      "targetData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-python~opbeans-node",
+      "isInverseEdge": true,
+      "source": "opbeans-python",
+      "sourceData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+      "target": "opbeans-node",
+      "targetData": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-ruby~>postgresql",
+      "source": "opbeans-ruby",
+      "sourceData": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": ">postgresql",
+      "targetData": Object {
+        "id": ">postgresql",
+        "label": "postgresql",
+        "span.destination.service.resource": "postgresql",
+        "span.subtype": "postgresql",
+        "span.type": "db",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-ruby~opbeans-go",
+      "source": "opbeans-ruby",
+      "sourceData": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": "opbeans-go",
+      "targetData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-ruby~opbeans-java",
+      "isInverseEdge": true,
+      "source": "opbeans-ruby",
+      "sourceData": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": "opbeans-java",
+      "targetData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-ruby~opbeans-node",
+      "source": "opbeans-ruby",
+      "sourceData": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": "opbeans-node",
+      "targetData": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-ruby~opbeans-python",
+      "source": "opbeans-ruby",
+      "sourceData": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+      "target": "opbeans-python",
+      "targetData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-rum~opbeans-go",
+      "source": "opbeans-rum",
+      "sourceData": Object {
+        "agent.name": "rum-js",
+        "id": "opbeans-rum",
+        "service.environment": "testing",
+        "service.name": "opbeans-rum",
+      },
+      "target": "opbeans-go",
+      "targetData": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-rum~opbeans-java",
+      "source": "opbeans-rum",
+      "sourceData": Object {
+        "agent.name": "rum-js",
+        "id": "opbeans-rum",
+        "service.environment": "testing",
+        "service.name": "opbeans-rum",
+      },
+      "target": "opbeans-java",
+      "targetData": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-rum~opbeans-node",
+      "source": "opbeans-rum",
+      "sourceData": Object {
+        "agent.name": "rum-js",
+        "id": "opbeans-rum",
+        "service.environment": "testing",
+        "service.name": "opbeans-rum",
+      },
+      "target": "opbeans-node",
+      "targetData": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-rum~opbeans-python",
+      "source": "opbeans-rum",
+      "sourceData": Object {
+        "agent.name": "rum-js",
+        "id": "opbeans-rum",
+        "service.environment": "testing",
+        "service.name": "opbeans-rum",
+      },
+      "target": "opbeans-python",
+      "targetData": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": "opbeans-rum~opbeans-ruby",
+      "source": "opbeans-rum",
+      "sourceData": Object {
+        "agent.name": "rum-js",
+        "id": "opbeans-rum",
+        "service.environment": "testing",
+        "service.name": "opbeans-rum",
+      },
+      "target": "opbeans-ruby",
+      "targetData": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "agent.name": "rum-js",
+      "id": "opbeans-rum",
+      "service.environment": "testing",
+      "service.name": "opbeans-rum",
+    },
+  },
+  Object {
+    "data": Object {
+      "agent.name": "python",
+      "id": "opbeans-python",
+      "service.environment": "production",
+      "service.name": "opbeans-python",
+    },
+  },
+  Object {
+    "data": Object {
+      "agent.name": "java",
+      "id": "opbeans-java",
+      "service.environment": "production",
+      "service.name": "opbeans-java",
+    },
+  },
+  Object {
+    "data": Object {
+      "agent.name": "nodejs",
+      "id": "opbeans-node",
+      "service.environment": "testing",
+      "service.name": "opbeans-node",
+    },
+  },
+  Object {
+    "data": Object {
+      "agent.name": "go",
+      "id": "opbeans-go",
+      "service.environment": "testing",
+      "service.name": "opbeans-go",
+      "serviceAnomalyStats": Object {
+        "actualValue": 3933482.1764705875,
+        "anomalyScore": 2.6101702751482714,
+        "jobId": "apm-testing-d457-high_mean_transaction_duration",
+        "transactionType": "request",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "agent.name": "ruby",
+      "id": "opbeans-ruby",
+      "service.environment": "production",
+      "service.name": "opbeans-ruby",
+      "serviceAnomalyStats": Object {
+        "actualValue": 684716.5813953485,
+        "anomalyScore": 0.20498907719907372,
+        "jobId": "apm-production-229a-high_mean_transaction_duration",
+        "transactionType": "request",
+      },
+    },
+  },
+  Object {
+    "data": Object {
+      "id": ">postgresql",
+      "label": "postgresql",
+      "span.destination.service.resource": "postgresql",
+      "span.subtype": "postgresql",
+      "span.type": "db",
+    },
+  },
+  Object {
+    "data": Object {
+      "id": ">elasticsearch",
+      "label": "elasticsearch",
+      "span.destination.service.resource": "elasticsearch",
+      "span.subtype": "elasticsearch",
+      "span.type": "db",
+    },
+  },
+  Object {
+    "data": Object {
+      "id": ">redis",
+      "label": "redis",
+      "span.destination.service.resource": "redis",
+      "span.subtype": "redis",
+      "span.type": "db",
+    },
+  },
+  Object {
+    "data": Object {
+      "agent.name": "dotnet",
+      "id": "opbeans-dotnet",
+      "service.environment": null,
+      "service.name": "opbeans-dotnet",
+    },
+  },
+]
+`;
+
+exports[`Service Maps with a trial license when there is data with anomalies returns the correct anomaly stats 3`] = `
+Object {
+  "elements": Array [
+    Object {
+      "data": Object {
+        "id": "opbeans-go~>postgresql",
+        "source": "opbeans-go",
+        "sourceData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": ">postgresql",
+        "targetData": Object {
+          "id": ">postgresql",
+          "label": "postgresql",
+          "span.destination.service.resource": "postgresql",
+          "span.subtype": "postgresql",
+          "span.type": "db",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "bidirectional": true,
+        "id": "opbeans-go~opbeans-java",
+        "source": "opbeans-go",
+        "sourceData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": "opbeans-java",
+        "targetData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "bidirectional": true,
+        "id": "opbeans-go~opbeans-node",
+        "source": "opbeans-go",
+        "sourceData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": "opbeans-node",
+        "targetData": Object {
+          "agent.name": "nodejs",
+          "id": "opbeans-node",
+          "service.environment": "testing",
+          "service.name": "opbeans-node",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "bidirectional": true,
+        "id": "opbeans-go~opbeans-python",
+        "source": "opbeans-go",
+        "sourceData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": "opbeans-python",
+        "targetData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-java~>postgresql",
+        "source": "opbeans-java",
+        "sourceData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+        "target": ">postgresql",
+        "targetData": Object {
+          "id": ">postgresql",
+          "label": "postgresql",
+          "span.destination.service.resource": "postgresql",
+          "span.subtype": "postgresql",
+          "span.type": "db",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-java~opbeans-go",
+        "isInverseEdge": true,
+        "source": "opbeans-java",
+        "sourceData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+        "target": "opbeans-go",
+        "targetData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "bidirectional": true,
+        "id": "opbeans-java~opbeans-python",
+        "source": "opbeans-java",
+        "sourceData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+        "target": "opbeans-python",
+        "targetData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "bidirectional": true,
+        "id": "opbeans-java~opbeans-ruby",
+        "source": "opbeans-java",
+        "sourceData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+        "target": "opbeans-ruby",
+        "targetData": Object {
+          "agent.name": "ruby",
+          "id": "opbeans-ruby",
+          "service.environment": "production",
+          "service.name": "opbeans-ruby",
+          "serviceAnomalyStats": Object {
+            "actualValue": 684716.5813953485,
+            "anomalyScore": 0.20498907719907372,
+            "jobId": "apm-production-229a-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-node~>postgresql",
+        "source": "opbeans-node",
+        "sourceData": Object {
+          "agent.name": "nodejs",
+          "id": "opbeans-node",
+          "service.environment": "testing",
+          "service.name": "opbeans-node",
+        },
+        "target": ">postgresql",
+        "targetData": Object {
+          "id": ">postgresql",
+          "label": "postgresql",
+          "span.destination.service.resource": "postgresql",
+          "span.subtype": "postgresql",
+          "span.type": "db",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-node~opbeans-go",
+        "isInverseEdge": true,
+        "source": "opbeans-node",
+        "sourceData": Object {
+          "agent.name": "nodejs",
+          "id": "opbeans-node",
+          "service.environment": "testing",
+          "service.name": "opbeans-node",
+        },
+        "target": "opbeans-go",
+        "targetData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "bidirectional": true,
+        "id": "opbeans-node~opbeans-python",
+        "source": "opbeans-node",
+        "sourceData": Object {
+          "agent.name": "nodejs",
+          "id": "opbeans-node",
+          "service.environment": "testing",
+          "service.name": "opbeans-node",
+        },
+        "target": "opbeans-python",
+        "targetData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-python~>elasticsearch",
+        "source": "opbeans-python",
+        "sourceData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+        "target": ">elasticsearch",
+        "targetData": Object {
+          "id": ">elasticsearch",
+          "label": "elasticsearch",
+          "span.destination.service.resource": "elasticsearch",
+          "span.subtype": "elasticsearch",
+          "span.type": "db",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-python~>postgresql",
+        "source": "opbeans-python",
+        "sourceData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+        "target": ">postgresql",
+        "targetData": Object {
+          "id": ">postgresql",
+          "label": "postgresql",
+          "span.destination.service.resource": "postgresql",
+          "span.subtype": "postgresql",
+          "span.type": "db",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-python~>redis",
+        "source": "opbeans-python",
+        "sourceData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+        "target": ">redis",
+        "targetData": Object {
+          "id": ">redis",
+          "label": "redis",
+          "span.destination.service.resource": "redis",
+          "span.subtype": "redis",
+          "span.type": "db",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-python~opbeans-go",
+        "isInverseEdge": true,
+        "source": "opbeans-python",
+        "sourceData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+        "target": "opbeans-go",
+        "targetData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-python~opbeans-java",
+        "isInverseEdge": true,
+        "source": "opbeans-python",
+        "sourceData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+        "target": "opbeans-java",
+        "targetData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-python~opbeans-node",
+        "isInverseEdge": true,
+        "source": "opbeans-python",
+        "sourceData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+        "target": "opbeans-node",
+        "targetData": Object {
+          "agent.name": "nodejs",
+          "id": "opbeans-node",
+          "service.environment": "testing",
+          "service.name": "opbeans-node",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-ruby~>postgresql",
+        "source": "opbeans-ruby",
+        "sourceData": Object {
+          "agent.name": "ruby",
+          "id": "opbeans-ruby",
+          "service.environment": "production",
+          "service.name": "opbeans-ruby",
+          "serviceAnomalyStats": Object {
+            "actualValue": 684716.5813953485,
+            "anomalyScore": 0.20498907719907372,
+            "jobId": "apm-production-229a-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": ">postgresql",
+        "targetData": Object {
+          "id": ">postgresql",
+          "label": "postgresql",
+          "span.destination.service.resource": "postgresql",
+          "span.subtype": "postgresql",
+          "span.type": "db",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-ruby~opbeans-go",
+        "source": "opbeans-ruby",
+        "sourceData": Object {
+          "agent.name": "ruby",
+          "id": "opbeans-ruby",
+          "service.environment": "production",
+          "service.name": "opbeans-ruby",
+          "serviceAnomalyStats": Object {
+            "actualValue": 684716.5813953485,
+            "anomalyScore": 0.20498907719907372,
+            "jobId": "apm-production-229a-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": "opbeans-go",
+        "targetData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-ruby~opbeans-java",
+        "isInverseEdge": true,
+        "source": "opbeans-ruby",
+        "sourceData": Object {
+          "agent.name": "ruby",
+          "id": "opbeans-ruby",
+          "service.environment": "production",
+          "service.name": "opbeans-ruby",
+          "serviceAnomalyStats": Object {
+            "actualValue": 684716.5813953485,
+            "anomalyScore": 0.20498907719907372,
+            "jobId": "apm-production-229a-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": "opbeans-java",
+        "targetData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-ruby~opbeans-node",
+        "source": "opbeans-ruby",
+        "sourceData": Object {
+          "agent.name": "ruby",
+          "id": "opbeans-ruby",
+          "service.environment": "production",
+          "service.name": "opbeans-ruby",
+          "serviceAnomalyStats": Object {
+            "actualValue": 684716.5813953485,
+            "anomalyScore": 0.20498907719907372,
+            "jobId": "apm-production-229a-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": "opbeans-node",
+        "targetData": Object {
+          "agent.name": "nodejs",
+          "id": "opbeans-node",
+          "service.environment": "testing",
+          "service.name": "opbeans-node",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-ruby~opbeans-python",
+        "source": "opbeans-ruby",
+        "sourceData": Object {
+          "agent.name": "ruby",
+          "id": "opbeans-ruby",
+          "service.environment": "production",
+          "service.name": "opbeans-ruby",
+          "serviceAnomalyStats": Object {
+            "actualValue": 684716.5813953485,
+            "anomalyScore": 0.20498907719907372,
+            "jobId": "apm-production-229a-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+        "target": "opbeans-python",
+        "targetData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-rum~opbeans-go",
+        "source": "opbeans-rum",
+        "sourceData": Object {
+          "agent.name": "rum-js",
+          "id": "opbeans-rum",
+          "service.environment": "testing",
+          "service.name": "opbeans-rum",
+        },
+        "target": "opbeans-go",
+        "targetData": Object {
+          "agent.name": "go",
+          "id": "opbeans-go",
+          "service.environment": "testing",
+          "service.name": "opbeans-go",
+          "serviceAnomalyStats": Object {
+            "actualValue": 3933482.1764705875,
+            "anomalyScore": 2.6101702751482714,
+            "jobId": "apm-testing-d457-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-rum~opbeans-java",
+        "source": "opbeans-rum",
+        "sourceData": Object {
+          "agent.name": "rum-js",
+          "id": "opbeans-rum",
+          "service.environment": "testing",
+          "service.name": "opbeans-rum",
+        },
+        "target": "opbeans-java",
+        "targetData": Object {
+          "agent.name": "java",
+          "id": "opbeans-java",
+          "service.environment": "production",
+          "service.name": "opbeans-java",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-rum~opbeans-node",
+        "source": "opbeans-rum",
+        "sourceData": Object {
+          "agent.name": "rum-js",
+          "id": "opbeans-rum",
+          "service.environment": "testing",
+          "service.name": "opbeans-rum",
+        },
+        "target": "opbeans-node",
+        "targetData": Object {
+          "agent.name": "nodejs",
+          "id": "opbeans-node",
+          "service.environment": "testing",
+          "service.name": "opbeans-node",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-rum~opbeans-python",
+        "source": "opbeans-rum",
+        "sourceData": Object {
+          "agent.name": "rum-js",
+          "id": "opbeans-rum",
+          "service.environment": "testing",
+          "service.name": "opbeans-rum",
+        },
+        "target": "opbeans-python",
+        "targetData": Object {
+          "agent.name": "python",
+          "id": "opbeans-python",
+          "service.environment": "production",
+          "service.name": "opbeans-python",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": "opbeans-rum~opbeans-ruby",
+        "source": "opbeans-rum",
+        "sourceData": Object {
+          "agent.name": "rum-js",
+          "id": "opbeans-rum",
+          "service.environment": "testing",
+          "service.name": "opbeans-rum",
+        },
+        "target": "opbeans-ruby",
+        "targetData": Object {
+          "agent.name": "ruby",
+          "id": "opbeans-ruby",
+          "service.environment": "production",
+          "service.name": "opbeans-ruby",
+          "serviceAnomalyStats": Object {
+            "actualValue": 684716.5813953485,
+            "anomalyScore": 0.20498907719907372,
+            "jobId": "apm-production-229a-high_mean_transaction_duration",
+            "transactionType": "request",
+          },
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "agent.name": "rum-js",
+        "id": "opbeans-rum",
+        "service.environment": "testing",
+        "service.name": "opbeans-rum",
+      },
+    },
+    Object {
+      "data": Object {
+        "agent.name": "python",
+        "id": "opbeans-python",
+        "service.environment": "production",
+        "service.name": "opbeans-python",
+      },
+    },
+    Object {
+      "data": Object {
+        "agent.name": "java",
+        "id": "opbeans-java",
+        "service.environment": "production",
+        "service.name": "opbeans-java",
+      },
+    },
+    Object {
+      "data": Object {
+        "agent.name": "nodejs",
+        "id": "opbeans-node",
+        "service.environment": "testing",
+        "service.name": "opbeans-node",
+      },
+    },
+    Object {
+      "data": Object {
+        "agent.name": "go",
+        "id": "opbeans-go",
+        "service.environment": "testing",
+        "service.name": "opbeans-go",
+        "serviceAnomalyStats": Object {
+          "actualValue": 3933482.1764705875,
+          "anomalyScore": 2.6101702751482714,
+          "jobId": "apm-testing-d457-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "agent.name": "ruby",
+        "id": "opbeans-ruby",
+        "service.environment": "production",
+        "service.name": "opbeans-ruby",
+        "serviceAnomalyStats": Object {
+          "actualValue": 684716.5813953485,
+          "anomalyScore": 0.20498907719907372,
+          "jobId": "apm-production-229a-high_mean_transaction_duration",
+          "transactionType": "request",
+        },
+      },
+    },
+    Object {
+      "data": Object {
+        "id": ">postgresql",
+        "label": "postgresql",
+        "span.destination.service.resource": "postgresql",
+        "span.subtype": "postgresql",
+        "span.type": "db",
+      },
+    },
+    Object {
+      "data": Object {
+        "id": ">elasticsearch",
+        "label": "elasticsearch",
+        "span.destination.service.resource": "elasticsearch",
+        "span.subtype": "elasticsearch",
+        "span.type": "db",
+      },
+    },
+    Object {
+      "data": Object {
+        "id": ">redis",
+        "label": "redis",
+        "span.destination.service.resource": "redis",
+        "span.subtype": "redis",
+        "span.type": "db",
+      },
+    },
+    Object {
+      "data": Object {
+        "agent.name": "dotnet",
+        "id": "opbeans-dotnet",
+        "service.environment": null,
+        "service.name": "opbeans-dotnet",
+      },
+    },
+  ],
+}
+`;
diff --git a/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts b/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
index f799d80f6ef13..4d9d4ef9f2cad 100644
--- a/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
+++ b/x-pack/test/apm_api_integration/trial/tests/service_maps/service_maps.ts
@@ -6,7 +6,9 @@
 
 import querystring from 'querystring';
 import expect from '@kbn/expect';
-import { isEmpty } from 'lodash';
+import { isEmpty, uniq } from 'lodash';
+import archives_metadata from '../../../common/archives_metadata';
+import { PromiseReturnType } from '../../../../../plugins/apm/typings/common';
 import { expectSnapshot } from '../../../common/match_snapshot';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
@@ -14,13 +16,16 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
 
+  const archiveName = 'apm_8.0.0';
+  const metadata = archives_metadata[archiveName];
+  const start = encodeURIComponent(metadata.start);
+  const end = encodeURIComponent(metadata.end);
+
   describe('Service Maps with a trial license', () => {
     describe('/api/apm/service-map', () => {
       describe('when there is no data', () => {
         it('returns empty list', async () => {
-          const response = await supertest.get(
-            '/api/apm/service-map?start=2020-06-28T10%3A24%3A46.055Z&end=2020-06-29T10%3A24%3A46.055Z'
-          );
+          const response = await supertest.get(`/api/apm/service-map?start=${start}&end=${end}`);
 
           expect(response.status).to.be(200);
           expect(response.body.elements.length).to.be(0);
@@ -28,239 +33,56 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
       });
 
       describe('when there is data', () => {
-        before(() => esArchiver.load('8.0.0'));
-        after(() => esArchiver.unload('8.0.0'));
+        before(() => esArchiver.load(archiveName));
+        after(() => esArchiver.unload(archiveName));
+
+        let response: PromiseReturnType<typeof supertest.get>;
 
-        it('returns service map elements', async () => {
-          const response = await supertest.get(
-            '/api/apm/service-map?start=2020-06-28T10%3A24%3A46.055Z&end=2020-06-29T10%3A24%3A46.055Z'
-          );
+        before(async () => {
+          response = await supertest.get(`/api/apm/service-map?start=${start}&end=${end}`);
+        });
 
+        it('returns service map elements', () => {
           expect(response.status).to.be(200);
+          expect(response.body.elements.length).to.be.greaterThan(0);
+        });
 
-          expectSnapshot(response.body).toMatchInline(`
-            Object {
-              "elements": Array [
-                Object {
-                  "data": Object {
-                    "id": "client~opbeans-node",
-                    "source": "client",
-                    "sourceData": Object {
-                      "agent.name": "rum-js",
-                      "id": "client",
-                      "service.name": "client",
-                    },
-                    "target": "opbeans-node",
-                    "targetData": Object {
-                      "agent.name": "nodejs",
-                      "id": "opbeans-node",
-                      "service.environment": "production",
-                      "service.name": "opbeans-node",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": "opbeans-java~>opbeans-java:3000",
-                    "source": "opbeans-java",
-                    "sourceData": Object {
-                      "agent.name": "java",
-                      "id": "opbeans-java",
-                      "service.environment": "production",
-                      "service.name": "opbeans-java",
-                    },
-                    "target": ">opbeans-java:3000",
-                    "targetData": Object {
-                      "id": ">opbeans-java:3000",
-                      "label": "opbeans-java:3000",
-                      "span.destination.service.resource": "opbeans-java:3000",
-                      "span.subtype": "http",
-                      "span.type": "external",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": "opbeans-java~>postgresql",
-                    "source": "opbeans-java",
-                    "sourceData": Object {
-                      "agent.name": "java",
-                      "id": "opbeans-java",
-                      "service.environment": "production",
-                      "service.name": "opbeans-java",
-                    },
-                    "target": ">postgresql",
-                    "targetData": Object {
-                      "id": ">postgresql",
-                      "label": "postgresql",
-                      "span.destination.service.resource": "postgresql",
-                      "span.subtype": "postgresql",
-                      "span.type": "db",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "bidirectional": true,
-                    "id": "opbeans-java~opbeans-node",
-                    "source": "opbeans-java",
-                    "sourceData": Object {
-                      "agent.name": "java",
-                      "id": "opbeans-java",
-                      "service.environment": "production",
-                      "service.name": "opbeans-java",
-                    },
-                    "target": "opbeans-node",
-                    "targetData": Object {
-                      "agent.name": "nodejs",
-                      "id": "opbeans-node",
-                      "service.environment": "production",
-                      "service.name": "opbeans-node",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": "opbeans-node~>93.184.216.34:80",
-                    "source": "opbeans-node",
-                    "sourceData": Object {
-                      "agent.name": "nodejs",
-                      "id": "opbeans-node",
-                      "service.environment": "production",
-                      "service.name": "opbeans-node",
-                    },
-                    "target": ">93.184.216.34:80",
-                    "targetData": Object {
-                      "id": ">93.184.216.34:80",
-                      "label": "93.184.216.34:80",
-                      "span.destination.service.resource": "93.184.216.34:80",
-                      "span.subtype": "http",
-                      "span.type": "external",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": "opbeans-node~>postgresql",
-                    "source": "opbeans-node",
-                    "sourceData": Object {
-                      "agent.name": "nodejs",
-                      "id": "opbeans-node",
-                      "service.environment": "production",
-                      "service.name": "opbeans-node",
-                    },
-                    "target": ">postgresql",
-                    "targetData": Object {
-                      "id": ">postgresql",
-                      "label": "postgresql",
-                      "span.destination.service.resource": "postgresql",
-                      "span.subtype": "postgresql",
-                      "span.type": "db",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": "opbeans-node~>redis",
-                    "source": "opbeans-node",
-                    "sourceData": Object {
-                      "agent.name": "nodejs",
-                      "id": "opbeans-node",
-                      "service.environment": "production",
-                      "service.name": "opbeans-node",
-                    },
-                    "target": ">redis",
-                    "targetData": Object {
-                      "id": ">redis",
-                      "label": "redis",
-                      "span.destination.service.resource": "redis",
-                      "span.subtype": "redis",
-                      "span.type": "cache",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": "opbeans-node~opbeans-java",
-                    "isInverseEdge": true,
-                    "source": "opbeans-node",
-                    "sourceData": Object {
-                      "agent.name": "nodejs",
-                      "id": "opbeans-node",
-                      "service.environment": "production",
-                      "service.name": "opbeans-node",
-                    },
-                    "target": "opbeans-java",
-                    "targetData": Object {
-                      "agent.name": "java",
-                      "id": "opbeans-java",
-                      "service.environment": "production",
-                      "service.name": "opbeans-java",
-                    },
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "agent.name": "java",
-                    "id": "opbeans-java",
-                    "service.environment": "production",
-                    "service.name": "opbeans-java",
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "agent.name": "nodejs",
-                    "id": "opbeans-node",
-                    "service.environment": "production",
-                    "service.name": "opbeans-node",
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": ">opbeans-java:3000",
-                    "label": "opbeans-java:3000",
-                    "span.destination.service.resource": "opbeans-java:3000",
-                    "span.subtype": "http",
-                    "span.type": "external",
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "agent.name": "rum-js",
-                    "id": "client",
-                    "service.name": "client",
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": ">redis",
-                    "label": "redis",
-                    "span.destination.service.resource": "redis",
-                    "span.subtype": "redis",
-                    "span.type": "cache",
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": ">postgresql",
-                    "label": "postgresql",
-                    "span.destination.service.resource": "postgresql",
-                    "span.subtype": "postgresql",
-                    "span.type": "db",
-                  },
-                },
-                Object {
-                  "data": Object {
-                    "id": ">93.184.216.34:80",
-                    "label": "93.184.216.34:80",
-                    "span.destination.service.resource": "93.184.216.34:80",
-                    "span.subtype": "http",
-                    "span.type": "external",
-                  },
-                },
-              ],
-            }
+        it('returns the correct data', () => {
+          const elements: Array<{ data: Record<string, any> }> = response.body.elements;
+
+          const serviceNames = uniq(
+            elements
+              .filter((element) => element.data['service.name'] !== undefined)
+              .map((element) => element.data['service.name'])
+          ).sort();
+
+          expectSnapshot(serviceNames).toMatchInline(`
+            Array [
+              "opbeans-dotnet",
+              "opbeans-go",
+              "opbeans-java",
+              "opbeans-node",
+              "opbeans-python",
+              "opbeans-ruby",
+              "opbeans-rum",
+            ]
           `);
+
+          const externalDestinations = uniq(
+            elements
+              .filter((element) => element.data.target?.startsWith('>'))
+              .map((element) => element.data.target)
+          ).sort();
+
+          expectSnapshot(externalDestinations).toMatchInline(`
+            Array [
+              ">elasticsearch",
+              ">postgresql",
+              ">redis",
+            ]
+          `);
+
+          expectSnapshot(elements).toMatch();
         });
       });
     });
@@ -269,48 +91,89 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
       describe('when there is no data', () => {
         it('returns an object with nulls', async () => {
           const q = querystring.stringify({
-            start: '2020-06-28T10:24:46.055Z',
-            end: '2020-06-29T10:24:46.055Z',
+            start: metadata.start,
+            end: metadata.end,
             uiFilters: {},
           });
           const response = await supertest.get(`/api/apm/service-map/service/opbeans-node?${q}`);
 
           expect(response.status).to.be(200);
 
-          expect(response.body).to.eql({
-            avgCpuUsage: null,
-            avgErrorRate: null,
-            avgMemoryUsage: null,
-            transactionStats: {
-              avgRequestsPerMinute: null,
-              avgTransactionDuration: null,
-            },
-          });
+          expect(response.body.avgCpuUsage).to.be(null);
+          expect(response.body.avgErrorRate).to.be(null);
+          expect(response.body.avgMemoryUsage).to.be(null);
+          expect(response.body.transactionStats.avgRequestsPerMinute).to.be(null);
+          expect(response.body.transactionStats.avgTransactionDuration).to.be(null);
         });
       });
     });
 
     describe('when there is data with anomalies', () => {
-      before(() => esArchiver.load('apm_8.0.0'));
-      after(() => esArchiver.unload('apm_8.0.0'));
+      before(() => esArchiver.load(archiveName));
+      after(() => esArchiver.unload(archiveName));
 
-      it('returns service map elements', async () => {
-        const start = encodeURIComponent('2020-09-10T06:00:00.000Z');
-        const end = encodeURIComponent('2020-09-10T07:00:00.000Z');
+      let response: PromiseReturnType<typeof supertest.get>;
 
-        const response = await supertest.get(`/api/apm/service-map?start=${start}&end=${end}`);
+      before(async () => {
+        response = await supertest.get(`/api/apm/service-map?start=${start}&end=${end}`);
+      });
 
+      it('returns service map elements with anomaly stats', () => {
         expect(response.status).to.be(200);
         const dataWithAnomalies = response.body.elements.filter(
           (el: { data: { serviceAnomalyStats?: {} } }) => !isEmpty(el.data.serviceAnomalyStats)
         );
+
         expect(dataWithAnomalies).to.not.empty();
+
         dataWithAnomalies.forEach(({ data }: any) => {
           expect(
             Object.values(data.serviceAnomalyStats).filter((value) => isEmpty(value))
           ).to.not.empty();
         });
       });
+
+      it('returns the correct anomaly stats', () => {
+        const dataWithAnomalies = response.body.elements.filter(
+          (el: { data: { serviceAnomalyStats?: {} } }) => !isEmpty(el.data.serviceAnomalyStats)
+        );
+
+        expectSnapshot(dataWithAnomalies.length).toMatchInline(`2`);
+        expectSnapshot(dataWithAnomalies.slice(0, 3)).toMatchInline(`
+          Array [
+            Object {
+              "data": Object {
+                "agent.name": "go",
+                "id": "opbeans-go",
+                "service.environment": "testing",
+                "service.name": "opbeans-go",
+                "serviceAnomalyStats": Object {
+                  "actualValue": 3933482.1764705875,
+                  "anomalyScore": 2.6101702751482714,
+                  "jobId": "apm-testing-d457-high_mean_transaction_duration",
+                  "transactionType": "request",
+                },
+              },
+            },
+            Object {
+              "data": Object {
+                "agent.name": "ruby",
+                "id": "opbeans-ruby",
+                "service.environment": "production",
+                "service.name": "opbeans-ruby",
+                "serviceAnomalyStats": Object {
+                  "actualValue": 684716.5813953485,
+                  "anomalyScore": 0.20498907719907372,
+                  "jobId": "apm-production-229a-high_mean_transaction_duration",
+                  "transactionType": "request",
+                },
+              },
+            },
+          ]
+        `);
+
+        expectSnapshot(response.body).toMatch();
+      });
     });
   });
 }
diff --git a/x-pack/test/apm_api_integration/trial/tests/services/top_services.ts b/x-pack/test/apm_api_integration/trial/tests/services/top_services.ts
index 76af02ec1606e..d08064f6aa70e 100644
--- a/x-pack/test/apm_api_integration/trial/tests/services/top_services.ts
+++ b/x-pack/test/apm_api_integration/trial/tests/services/top_services.ts
@@ -61,11 +61,11 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             Array [
               undefined,
               undefined,
+              "warning",
+              "warning",
               undefined,
               undefined,
               undefined,
-              "warning",
-              undefined,
             ]
           `);
         });
diff --git a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts
index 87bed7f416019..33ceee68a6013 100644
--- a/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts
+++ b/x-pack/test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { deepFreeze } from '@kbn/std';
 import {
-  deepFreeze,
   CoreSetup,
   PluginInitializer,
   SavedObjectsNamespaceType,
diff --git a/x-pack/test/functional/apps/dashboard/reporting/download_csv.ts b/x-pack/test/functional/apps/dashboard/reporting/download_csv.ts
index 5c41945cb88d8..87f94855672a9 100644
--- a/x-pack/test/functional/apps/dashboard/reporting/download_csv.ts
+++ b/x-pack/test/functional/apps/dashboard/reporting/download_csv.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import expect from '@kbn/expect';
 import fs from 'fs';
 import path from 'path';
diff --git a/x-pack/test/functional/apps/maps/documents_source/docvalue_fields.js b/x-pack/test/functional/apps/maps/documents_source/docvalue_fields.js
index d5d82a9b743e3..4edee0a0b78ba 100644
--- a/x-pack/test/functional/apps/maps/documents_source/docvalue_fields.js
+++ b/x-pack/test/functional/apps/maps/documents_source/docvalue_fields.js
@@ -10,12 +10,18 @@ export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['maps']);
   const inspector = getService('inspector');
   const testSubjects = getService('testSubjects');
+  const security = getService('security');
 
   describe('docvalue_fields', () => {
     before(async () => {
+      await security.testUser.setRoles(['global_maps_read', 'test_logstash_reader'], false);
       await PageObjects.maps.loadSavedMap('document example');
     });
 
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     async function getResponse() {
       await inspector.open();
       await inspector.openInspectorRequestsView();
diff --git a/x-pack/test/functional/apps/maps/documents_source/search_hits.js b/x-pack/test/functional/apps/maps/documents_source/search_hits.js
index cc0f3a7df32de..810e7e370e727 100644
--- a/x-pack/test/functional/apps/maps/documents_source/search_hits.js
+++ b/x-pack/test/functional/apps/maps/documents_source/search_hits.js
@@ -9,12 +9,26 @@ import expect from '@kbn/expect';
 export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['maps']);
   const inspector = getService('inspector');
+  const security = getService('security');
 
   describe('search hits', () => {
     before(async () => {
+      await security.testUser.setRoles(
+        [
+          'global_maps_all',
+          'test_logstash_reader',
+          'antimeridian_points_reader',
+          'antimeridian_shapes_reader',
+        ],
+        false
+      );
       await PageObjects.maps.loadSavedMap('document example');
     });
 
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     async function getRequestTimestamp() {
       await inspector.open();
       await inspector.openInspectorRequestsView();
diff --git a/x-pack/test/functional/apps/maps/documents_source/top_hits.js b/x-pack/test/functional/apps/maps/documents_source/top_hits.js
index 322401ee81648..4276bc9419a10 100644
--- a/x-pack/test/functional/apps/maps/documents_source/top_hits.js
+++ b/x-pack/test/functional/apps/maps/documents_source/top_hits.js
@@ -12,13 +12,19 @@ export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['maps', 'common']);
   const inspector = getService('inspector');
   const find = getService('find');
+  const security = getService('security');
 
   describe('geo top hits', () => {
     describe('split on string field', () => {
       before(async () => {
+        await security.testUser.setRoles(['global_maps_all', 'test_logstash_reader'], false);
         await PageObjects.maps.loadSavedMap('document example top hits');
       });
 
+      after(async () => {
+        await security.testUser.restoreDefaults();
+      });
+
       it('should not fetch any search hits', async () => {
         await inspector.open();
         await inspector.openInspectorRequestsView();
diff --git a/x-pack/test/functional/apps/maps/es_geo_grid_source.js b/x-pack/test/functional/apps/maps/es_geo_grid_source.js
index f5a603742c89a..19680ae851a34 100644
--- a/x-pack/test/functional/apps/maps/es_geo_grid_source.js
+++ b/x-pack/test/functional/apps/maps/es_geo_grid_source.js
@@ -10,6 +10,7 @@ export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['maps']);
   const inspector = getService('inspector');
   const DOC_COUNT_PROP_NAME = 'doc_count';
+  const security = getService('security');
 
   describe('layer geo grid aggregation source', () => {
     const EXPECTED_NUMBER_FEATURES_ZOOMED_OUT = 4;
@@ -17,6 +18,17 @@ export default function ({ getPageObjects, getService }) {
     const DATA_CENTER_LON = -98;
     const DATA_CENTER_LAT = 38;
 
+    before(async () => {
+      await security.testUser.setRoles(
+        ['global_maps_all', 'test_logstash_reader', 'geoshape_data_reader'],
+        false
+      );
+    });
+
+    after(async () => {
+      await security.testUser.restoreDefaults();
+    });
+
     async function getRequestTimestamp() {
       await inspector.open();
       await inspector.openInspectorRequestsView();
diff --git a/x-pack/test/functional/apps/maps/joins.js b/x-pack/test/functional/apps/maps/joins.js
index 1139ae204aefd..bd5ecfe2a2504 100644
--- a/x-pack/test/functional/apps/maps/joins.js
+++ b/x-pack/test/functional/apps/maps/joins.js
@@ -25,14 +25,20 @@ const TOO_MANY_FEATURES_LAYER_INDEX = 4;
 export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['maps']);
   const inspector = getService('inspector');
+  const security = getService('security');
 
   describe('layer with joins', () => {
     before(async () => {
+      await security.testUser.setRoles(
+        ['global_maps_all', 'geoshape_data_reader', 'meta_for_geoshape_data_reader'],
+        false
+      );
       await PageObjects.maps.loadSavedMap('join example');
     });
 
     after(async () => {
       await inspector.close();
+      await security.testUser.restoreDefaults();
     });
 
     it('should re-fetch join with refresh timer', async () => {
diff --git a/x-pack/test/functional/apps/maps/mvt_scaling.js b/x-pack/test/functional/apps/maps/mvt_scaling.js
index e50b72658fb43..46ae2c0b9463a 100644
--- a/x-pack/test/functional/apps/maps/mvt_scaling.js
+++ b/x-pack/test/functional/apps/maps/mvt_scaling.js
@@ -11,14 +11,17 @@ const VECTOR_SOURCE_ID = 'caffa63a-ebfb-466d-8ff6-d797975b88ab';
 export default function ({ getPageObjects, getService }) {
   const PageObjects = getPageObjects(['maps']);
   const inspector = getService('inspector');
+  const security = getService('security');
 
   describe('mvt geoshape layer', () => {
     before(async () => {
+      await security.testUser.setRoles(['global_maps_all', 'geoshape_data_reader'], false);
       await PageObjects.maps.loadSavedMap('geo_shape_mvt');
     });
 
     after(async () => {
       await inspector.close();
+      await security.testUser.restoreDefaults();
     });
 
     it('should render with mvt-source', async () => {
diff --git a/x-pack/test/functional/apps/ml/data_visualizer/file_data_visualizer.ts b/x-pack/test/functional/apps/ml/data_visualizer/file_data_visualizer.ts
index 4b3b0c38f2acf..fc0c339ca2693 100644
--- a/x-pack/test/functional/apps/ml/data_visualizer/file_data_visualizer.ts
+++ b/x-pack/test/functional/apps/ml/data_visualizer/file_data_visualizer.ts
@@ -20,6 +20,7 @@ export default function ({ getService }: FtrProviderContext) {
       expected: {
         results: {
           title: 'artificial_server_log',
+          numberOfFields: 4,
         },
       },
     },
@@ -62,6 +63,9 @@ export default function ({ getService }: FtrProviderContext) {
           await ml.dataVisualizerFileBased.assertFileContentPanelExists();
           await ml.dataVisualizerFileBased.assertSummaryPanelExists();
           await ml.dataVisualizerFileBased.assertFileStatsPanelExists();
+          await ml.dataVisualizerFileBased.assertNumberOfFieldCards(
+            testData.expected.results.numberOfFields
+          );
 
           await ml.testExecution.logTestStep('loads the import settings page');
           await ml.dataVisualizerFileBased.navigateToFileImport();
diff --git a/x-pack/test/functional/config.js b/x-pack/test/functional/config.js
index 360d66d223937..4d85ac4f286e3 100644
--- a/x-pack/test/functional/config.js
+++ b/x-pack/test/functional/config.js
@@ -287,6 +287,17 @@ export default async function ({ readConfigFile }) {
           ],
         },
 
+        global_maps_read: {
+          kibana: [
+            {
+              feature: {
+                maps: ['read'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        },
+
         geoshape_data_reader: {
           elasticsearch: {
             indices: [
@@ -297,6 +308,37 @@ export default async function ({ readConfigFile }) {
             ],
           },
         },
+        antimeridian_points_reader: {
+          elasticsearch: {
+            indices: [
+              {
+                names: ['antimeridian_points*'],
+                privileges: ['read', 'view_index_metadata'],
+              },
+            ],
+          },
+        },
+        antimeridian_shapes_reader: {
+          elasticsearch: {
+            indices: [
+              {
+                names: ['antimeridian_shapes*'],
+                privileges: ['read', 'view_index_metadata'],
+              },
+            ],
+          },
+        },
+
+        meta_for_geoshape_data_reader: {
+          elasticsearch: {
+            indices: [
+              {
+                names: ['meta_for_geo_shapes*'],
+                privileges: ['read', 'view_index_metadata'],
+              },
+            ],
+          },
+        },
 
         geoconnections_data_reader: {
           elasticsearch: {
diff --git a/x-pack/test/functional/page_objects/accountsetting_page.js b/x-pack/test/functional/page_objects/account_settings_page.ts
similarity index 80%
rename from x-pack/test/functional/page_objects/accountsetting_page.js
rename to x-pack/test/functional/page_objects/account_settings_page.ts
index 283199a76a033..b7351b1e1cf22 100644
--- a/x-pack/test/functional/page_objects/accountsetting_page.js
+++ b/x-pack/test/functional/page_objects/account_settings_page.ts
@@ -4,15 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-//import { map as mapAsync } from 'bluebird';
 import expect from '@kbn/expect';
+import { FtrProviderContext } from '../ftr_provider_context';
 
-export function AccountSettingProvider({ getService }) {
+export function AccountSettingProvider({ getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const userMenu = getService('userMenu');
 
   class AccountSettingsPage {
-    async verifyAccountSettings(expectedEmail, expectedUserName) {
+    async verifyAccountSettings(expectedEmail: string, expectedUserName: string) {
       await userMenu.clickProvileLink();
 
       const usernameField = await testSubjects.find('username');
@@ -25,7 +25,7 @@ export function AccountSettingProvider({ getService }) {
       await userMenu.closeMenu();
     }
 
-    async changePassword(currentPassword, newPassword) {
+    async changePassword(currentPassword: string, newPassword: string) {
       await testSubjects.setValue('currentPassword', currentPassword);
       await testSubjects.setValue('newPassword', newPassword);
       await testSubjects.setValue('confirmNewPassword', newPassword);
diff --git a/x-pack/test/functional/page_objects/gis_page.js b/x-pack/test/functional/page_objects/gis_page.ts
similarity index 90%
rename from x-pack/test/functional/page_objects/gis_page.js
rename to x-pack/test/functional/page_objects/gis_page.ts
index 4998635096c39..7be0aa425509e 100644
--- a/x-pack/test/functional/page_objects/gis_page.js
+++ b/x-pack/test/functional/page_objects/gis_page.ts
@@ -6,8 +6,9 @@
 
 import _ from 'lodash';
 import { APP_ID } from '../../../plugins/maps/common/constants';
+import { FtrProviderContext } from '../ftr_provider_context';
 
-export function GisPageProvider({ getService, getPageObjects }) {
+export function GisPageProvider({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'header', 'timePicker']);
 
   const log = getService('log');
@@ -19,25 +20,27 @@ export function GisPageProvider({ getService, getPageObjects }) {
   const comboBox = getService('comboBox');
   const renderable = getService('renderable');
 
-  function escapeLayerName(layerName) {
+  function escapeLayerName(layerName: string) {
     return layerName.split(' ').join('_');
   }
 
   class GisPage {
+    basePath;
+
     constructor() {
       this.basePath = '';
     }
 
-    setBasePath(basePath) {
+    setBasePath(basePath: string) {
       this.basePath = basePath;
     }
 
-    async setAbsoluteRange(start, end) {
+    async setAbsoluteRange(start: string, end: string) {
       await PageObjects.timePicker.setAbsoluteRange(start, end);
       await this.waitForLayersToLoad();
     }
 
-    async setAndSubmitQuery(query) {
+    async setAndSubmitQuery(query: string) {
       await queryBar.setQuery(query);
       await queryBar.submitQuery();
       await this.waitForLayersToLoad();
@@ -70,7 +73,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
     // this method waits until the map view has stabilized, signaling that the panning/zooming is complete.
     // Pass origView parameter when the new map view determinition is async
     // so method knows when panning/zooming has started.
-    async waitForMapPanAndZoom(origView) {
+    async waitForMapPanAndZoom(origView?: { lon: number; lat: number; zoom: number }) {
       await retry.try(async () => {
         log.debug('Waiting for map pan and zoom to complete');
         const prevView = await this.getView();
@@ -94,7 +97,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       });
     }
 
-    async waitForLayerDeleted(layerName) {
+    async waitForLayerDeleted(layerName: string) {
       log.debug('Wait for layer deleted');
       await retry.waitFor('Layer to be deleted', async () => {
         const doesLayerExist = await this.doesLayerExist(layerName);
@@ -104,7 +107,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
 
     // use the search filter box to narrow the results down to a single
     // entry, or at least to a single page of results
-    async loadSavedMap(name) {
+    async loadSavedMap(name: string) {
       log.debug(`Load Saved Map ${name}`);
 
       await retry.try(async () => {
@@ -121,7 +124,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await this.waitForLayersToLoad();
     }
 
-    async deleteSavedMaps(search) {
+    async deleteSavedMaps(search: string) {
       await this.searchForMapWithName(search);
       await testSubjects.click('checkboxSelectAll');
       await testSubjects.click('deleteSelectedItems');
@@ -139,7 +142,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await renderable.waitForRender();
     }
 
-    async saveMap(name, uncheckReturnToOriginModeSwitch = false) {
+    async saveMap(name: string, uncheckReturnToOriginModeSwitch = false) {
       await testSubjects.click('mapSaveButton');
       await testSubjects.setValue('savedObjectTitle', name);
       if (uncheckReturnToOriginModeSwitch) {
@@ -180,7 +183,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       return exists;
     }
 
-    async searchForMapWithName(name) {
+    async searchForMapWithName(name: string) {
       log.debug(`searchForMapWithName: ${name}`);
 
       await this.gotoMapListingPage();
@@ -196,7 +199,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await PageObjects.header.waitUntilLoadingHasFinished();
     }
 
-    async selectMap(name) {
+    async selectMap(name: string) {
       await testSubjects.click(`mapListingTitleLink-${name.split(' ').join('-')}`);
     }
 
@@ -221,7 +224,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       }
     }
 
-    async getMapCountWithName(name) {
+    async getMapCountWithName(name: string) {
       await this.gotoMapListingPage();
 
       log.debug(`getMapCountWithName: ${name}`);
@@ -260,7 +263,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       }
     }
 
-    async setView(lat, lon, zoom) {
+    async setView(lat: number, lon: number, zoom: number) {
       log.debug(
         `Set view lat: ${lat.toString()}, lon: ${lon.toString()}, zoom: ${zoom.toString()}`
       );
@@ -286,7 +289,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       };
     }
 
-    async toggleLayerVisibility(layerName) {
+    async toggleLayerVisibility(layerName: string) {
       log.debug(`Toggle layer visibility, layer: ${layerName}`);
       await this.openLayerTocActionsPanel(layerName);
       await testSubjects.click('layerVisibilityToggleButton');
@@ -300,7 +303,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       }
     }
 
-    async clickFitToBounds(layerName) {
+    async clickFitToBounds(layerName: string) {
       log.debug(`Fit to bounds, layer: ${layerName}`);
       const origView = await this.getView();
       await this.openLayerTocActionsPanel(layerName);
@@ -308,7 +311,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await this.waitForMapPanAndZoom(origView);
     }
 
-    async openLayerTocActionsPanel(layerName) {
+    async openLayerTocActionsPanel(layerName: string) {
       const escapedDisplayName = escapeLayerName(layerName);
       const isOpen = await testSubjects.exists(`layerTocActionsPanel${escapedDisplayName}`);
       if (!isOpen) {
@@ -316,7 +319,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       }
     }
 
-    async openLayerPanel(layerName) {
+    async openLayerPanel(layerName: string) {
       log.debug(`Open layer panel, layer: ${layerName}`);
       await this.openLayerTocActionsPanel(layerName);
       await testSubjects.click('editLayerButton');
@@ -327,7 +330,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await this.waitForLayersToLoad();
     }
 
-    async getLayerTOCDetails(layerName) {
+    async getLayerTOCDetails(layerName: string) {
       return await testSubjects.getVisibleText(`mapLayerTOCDetails${escapeLayerName(layerName)}`);
     }
 
@@ -352,13 +355,13 @@ export function GisPageProvider({ getService, getPageObjects }) {
       }
     }
 
-    async doesLayerExist(layerName) {
+    async doesLayerExist(layerName: string) {
       return await testSubjects.exists(
         `layerTocActionsPanelToggleButton${escapeLayerName(layerName)}`
       );
     }
 
-    async hasFilePickerLoadedFile(fileName) {
+    async hasFilePickerLoadedFile(fileName: string) {
       log.debug(`Has file picker loaded file ${fileName}`);
       const filePickerText = await find.byCssSelector('.euiFilePicker__promptText');
       const filePickerTextContent = await filePickerText.getVisibleText();
@@ -393,7 +396,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       });
     }
 
-    async cancelLayerAdd(layerName) {
+    async cancelLayerAdd(layerName: string) {
       log.debug(`Cancel layer add`);
       const cancelExists = await testSubjects.exists('layerAddCancelButton');
       if (cancelExists) {
@@ -405,7 +408,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       }
     }
 
-    async closeOrCancelLayer(layerName) {
+    async closeOrCancelLayer(layerName: string) {
       log.debug(`Close or cancel layer add`);
       const cancelExists = await testSubjects.exists('layerAddCancelButton');
       const closeExists = await testSubjects.exists('layerPanelCancelButton');
@@ -449,24 +452,24 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await testSubjects.click('importFileButton');
     }
 
-    async setIndexName(indexName) {
+    async setIndexName(indexName: string) {
       log.debug(`Set index name to: ${indexName}`);
       await testSubjects.setValue('fileUploadIndexNameInput', indexName);
     }
 
-    async setIndexType(indexType) {
+    async setIndexType(indexType: string) {
       log.debug(`Set index type to: ${indexType}`);
       await testSubjects.selectValue('fileImportIndexSelect', indexType);
     }
 
-    async indexTypeOptionExists(indexType) {
+    async indexTypeOptionExists(indexType: string) {
       log.debug(`Check index type "${indexType}" available`);
       return await find.existsByCssSelector(
         `select[data-test-subj="fileImportIndexSelect"] > option[value="${indexType}"]`
       );
     }
 
-    async getCodeBlockParsedJson(dataTestSubjName) {
+    async getCodeBlockParsedJson(dataTestSubjName: string) {
       log.debug(`Get parsed code block for ${dataTestSubjName}`);
       const indexRespCodeBlock = await testSubjects.find(`${dataTestSubjName}`);
       const indexRespJson = await indexRespCodeBlock.getAttribute('innerText');
@@ -483,7 +486,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       return await this.getCodeBlockParsedJson('indexPatternRespCodeBlock');
     }
 
-    async setLayerQuery(layerName, query) {
+    async setLayerQuery(layerName: string, query: string) {
       await this.openLayerPanel(layerName);
       await testSubjects.click('mapLayerPanelOpenFilterEditorButton');
       const filterEditorContainer = await testSubjects.find('mapFilterEditor');
@@ -505,7 +508,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await this.waitForLayersToLoad();
     }
 
-    async setJoinWhereQuery(layerName, query) {
+    async setJoinWhereQuery(layerName: string, query: string) {
       await this.openLayerPanel(layerName);
       await testSubjects.click('mapJoinWhereExpressionButton');
       const filterEditorContainer = await testSubjects.find('mapJoinWhereFilterEditor');
@@ -531,7 +534,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await testSubjects.click('uploadGeoJson');
     }
 
-    async uploadJsonFileForIndexing(path) {
+    async uploadJsonFileForIndexing(path: string) {
       await PageObjects.common.setFileInputPath(path);
       log.debug(`File selected`);
 
@@ -540,7 +543,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
     }
 
     // Returns first layer by default
-    async selectVectorLayer(vectorLayerName) {
+    async selectVectorLayer(vectorLayerName: string) {
       log.debug(`Select EMS vector layer ${vectorLayerName}`);
       if (!vectorLayerName) {
         throw new Error(`You did not provide the EMS layer to select`);
@@ -549,14 +552,14 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await this.waitForLayersToLoad();
     }
 
-    async removeLayer(layerName) {
+    async removeLayer(layerName: string) {
       log.debug(`Remove layer ${layerName}`);
       await this.openLayerPanel(layerName);
       await testSubjects.click(`mapRemoveLayerButton`);
       await this.waitForLayerDeleted(layerName);
     }
 
-    async getLayerErrorText(layerName) {
+    async getLayerErrorText(layerName: string) {
       log.debug(`Remove layer ${layerName}`);
       await this.openLayerPanel(layerName);
       return await testSubjects.getVisibleText(`layerErrorMessage`);
@@ -589,7 +592,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
 
     // Method should only be used when multiple requests are expected
     // RequestSelector will only display inspectorRequestChooser when there is more than one request
-    async openInspectorRequest(requestName) {
+    async openInspectorRequest(requestName: string) {
       await inspector.open();
       await inspector.openInspectorRequestsView();
       log.debug(`Open Inspector request ${requestName}`);
@@ -620,12 +623,12 @@ export function GisPageProvider({ getService, getPageObjects }) {
       return mapboxStyle;
     }
 
-    getInspectorStatRowHit(stats, rowName) {
+    getInspectorStatRowHit(stats: string[][], rowName: string) {
       const STATS_ROW_NAME_INDEX = 0;
       const STATS_ROW_VALUE_INDEX = 1;
 
-      const statsRow = stats.find((statsRow) => {
-        return statsRow[STATS_ROW_NAME_INDEX] === rowName;
+      const statsRow = stats.find((row) => {
+        return row[STATS_ROW_NAME_INDEX] === rowName;
       });
       if (!statsRow) {
         throw new Error(`Unable to find value for row ${rowName} in ${stats}`);
@@ -634,7 +637,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       return statsRow[STATS_ROW_VALUE_INDEX];
     }
 
-    async triggerSingleRefresh(refreshInterval) {
+    async triggerSingleRefresh(refreshInterval: number) {
       log.debug(`triggerSingleRefresh, refreshInterval: ${refreshInterval}`);
       await PageObjects.timePicker.resumeAutoRefresh();
       log.debug('waiting to give time for refresh timer to fire');
@@ -643,7 +646,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
       await this.waitForLayersToLoad();
     }
 
-    async lockTooltipAtPosition(xOffset, yOffset) {
+    async lockTooltipAtPosition(xOffset: number, yOffset: number) {
       await retry.try(async () => {
         const mapContainerElement = await testSubjects.find('mapContainer');
         await mapContainerElement.moveMouseTo({ xOffset, yOffset });
@@ -656,12 +659,12 @@ export function GisPageProvider({ getService, getPageObjects }) {
       });
     }
 
-    async setStyleByValue(styleName, fieldName) {
+    async setStyleByValue(styleName: string, fieldName: string) {
       await testSubjects.selectValue(`staticDynamicSelect_${styleName}`, 'DYNAMIC');
       await comboBox.set(`styleFieldSelect_${styleName}`, fieldName);
     }
 
-    async selectCustomColorRamp(styleName) {
+    async selectCustomColorRamp(styleName: string) {
       // open super select menu
       await testSubjects.click(`colorMapSelect_${styleName}`);
       // Click option
diff --git a/x-pack/test/functional/page_objects/graph_page.ts b/x-pack/test/functional/page_objects/graph_page.ts
index 639add8b0e904..9ce1f87b5bf3d 100644
--- a/x-pack/test/functional/page_objects/graph_page.ts
+++ b/x-pack/test/functional/page_objects/graph_page.ts
@@ -23,7 +23,7 @@ export function GraphPageProvider({ getService, getPageObjects }: FtrProviderCon
   const find = getService('find');
   const log = getService('log');
   const testSubjects = getService('testSubjects');
-  const PageObjects = getPageObjects(['common', 'header', 'settings']);
+  const PageObjects = getPageObjects(['common', 'header']);
   const retry = getService('retry');
 
   class GraphPage {
diff --git a/x-pack/test/functional/page_objects/grok_debugger_page.js b/x-pack/test/functional/page_objects/grok_debugger_page.ts
similarity index 86%
rename from x-pack/test/functional/page_objects/grok_debugger_page.js
rename to x-pack/test/functional/page_objects/grok_debugger_page.ts
index fec3e9de3c74b..d3edbe6c27e77 100644
--- a/x-pack/test/functional/page_objects/grok_debugger_page.js
+++ b/x-pack/test/functional/page_objects/grok_debugger_page.ts
@@ -4,7 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export function GrokDebuggerPageProvider({ getPageObjects, getService }) {
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export function GrokDebuggerPageProvider({ getPageObjects, getService }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common']);
   const grokDebugger = getService('grokDebugger');
 
diff --git a/x-pack/test/functional/page_objects/index.ts b/x-pack/test/functional/page_objects/index.ts
index 833cc452a5d31..7569904fe90fd 100644
--- a/x-pack/test/functional/page_objects/index.ts
+++ b/x-pack/test/functional/page_objects/index.ts
@@ -7,30 +7,20 @@
 import { pageObjects as kibanaFunctionalPageObjects } from '../../../../test/functional/page_objects';
 
 import { CanvasPageProvider } from './canvas_page';
-// @ts-ignore not ts yet
 import { SecurityPageProvider } from './security_page';
-// @ts-ignore not ts yet
 import { MonitoringPageProvider } from './monitoring_page';
 // @ts-ignore not ts yet
 import { LogstashPageProvider } from './logstash_page';
-// @ts-ignore not ts yet
 import { GraphPageProvider } from './graph_page';
-// @ts-ignore not ts yet
 import { GrokDebuggerPageProvider } from './grok_debugger_page';
-// @ts-ignore not ts yet
 import { WatcherPageProvider } from './watcher_page';
 import { ReportingPageProvider } from './reporting_page';
-// @ts-ignore not ts yet
-import { AccountSettingProvider } from './accountsetting_page';
+import { AccountSettingProvider } from './account_settings_page';
 import { InfraHomePageProvider } from './infra_home_page';
 import { InfraLogsPageProvider } from './infra_logs_page';
-// @ts-ignore not ts yet
 import { GisPageProvider } from './gis_page';
-// @ts-ignore not ts yet
 import { StatusPagePageProvider } from './status_page';
-// @ts-ignore not ts yet
-import { UpgradeAssistantProvider } from './upgrade_assistant';
-// @ts-ignore not ts yet
+import { UpgradeAssistantPageProvider } from './upgrade_assistant_page';
 import { RollupPageProvider } from './rollup_page';
 import { UptimePageProvider } from './uptime_page';
 import { ApiKeysPageProvider } from './api_keys_page';
@@ -66,7 +56,7 @@ export const pageObjects = {
   infraLogs: InfraLogsPageProvider,
   maps: GisPageProvider,
   statusPage: StatusPagePageProvider,
-  upgradeAssistant: UpgradeAssistantProvider,
+  upgradeAssistant: UpgradeAssistantPageProvider,
   uptime: UptimePageProvider,
   rollup: RollupPageProvider,
   apiKeys: ApiKeysPageProvider,
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index edd7c2a43b343..e3c21085b92d3 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -13,14 +13,7 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
   const retry = getService('retry');
   const find = getService('find');
   const comboBox = getService('comboBox');
-  const PageObjects = getPageObjects([
-    'header',
-    'common',
-    'visualize',
-    'dashboard',
-    'header',
-    'timePicker',
-  ]);
+  const PageObjects = getPageObjects(['header', 'header', 'timePicker']);
 
   return logWrapper('lensPage', log, {
     /**
diff --git a/x-pack/test/functional/page_objects/monitoring_page.js b/x-pack/test/functional/page_objects/monitoring_page.ts
similarity index 84%
rename from x-pack/test/functional/page_objects/monitoring_page.js
rename to x-pack/test/functional/page_objects/monitoring_page.ts
index c3b9d20b3ac4a..bbfa884e71cda 100644
--- a/x-pack/test/functional/page_objects/monitoring_page.js
+++ b/x-pack/test/functional/page_objects/monitoring_page.ts
@@ -4,8 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export function MonitoringPageProvider({ getPageObjects, getService }) {
-  const PageObjects = getPageObjects(['common', 'header', 'security', 'login', 'spaceSelector']);
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export function MonitoringPageProvider({ getPageObjects, getService }: FtrProviderContext) {
+  const PageObjects = getPageObjects(['common', 'header', 'security', 'login']);
   const testSubjects = getService('testSubjects');
   const security = getService('security');
   const find = getService('find');
@@ -35,34 +37,34 @@ export function MonitoringPageProvider({ getPageObjects, getService }) {
       return testSubjects.getVisibleText('accessDeniedTitle');
     }
 
-    async clickBreadcrumb(subj) {
+    async clickBreadcrumb(subj: string) {
       return testSubjects.click(subj);
     }
 
-    async assertTableNoData(subj) {
+    async assertTableNoData(subj: string) {
       if (!(await testSubjects.exists(subj))) {
         throw new Error('Expected to find the no data message');
       }
     }
 
-    async tableGetRows(subj) {
+    async tableGetRows(subj: string) {
       const table = await testSubjects.find(subj);
       return table.findAllByTagName('tr');
     }
 
-    async tableGetRowsFromContainer(subj) {
+    async tableGetRowsFromContainer(subj: string) {
       const table = await testSubjects.find(subj);
       const tbody = await table.findByTagName('tbody');
       return tbody.findAllByTagName('tr');
     }
 
-    async tableSetFilter(subj, text) {
+    async tableSetFilter(subj: string, text: string) {
       await testSubjects.setValue(subj, text);
       await PageObjects.common.pressEnterKey();
       await PageObjects.header.waitUntilLoadingHasFinished();
     }
 
-    async tableClearFilter(subj) {
+    async tableClearFilter(subj: string) {
       return await testSubjects.setValue(subj, ' \uE003'); // space and backspace to trigger onChange event
     }
   })();
diff --git a/x-pack/test/functional/page_objects/reporting_page.ts b/x-pack/test/functional/page_objects/reporting_page.ts
index 7631d0cbce59a..5828871d7c685 100644
--- a/x-pack/test/functional/page_objects/reporting_page.ts
+++ b/x-pack/test/functional/page_objects/reporting_page.ts
@@ -5,16 +5,15 @@
  */
 
 import http, { IncomingMessage } from 'http';
-import { FtrProviderContext } from 'test/functional/ftr_provider_context';
 import { parse } from 'url';
+import { FtrProviderContext } from '../ftr_provider_context';
 
 export function ReportingPageProvider({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
   const log = getService('log');
   const retry = getService('retry');
   const testSubjects = getService('testSubjects');
-
-  const PageObjects = getPageObjects(['common', 'security' as any, 'share', 'timePicker']); // FIXME: Security PageObject is not Typescript
+  const PageObjects = getPageObjects(['security', 'share', 'timePicker']);
 
   class ReportingPage {
     async forceSharedItemsContainerSize({ width }: { width: number }) {
diff --git a/x-pack/test/functional/page_objects/rollup_page.js b/x-pack/test/functional/page_objects/rollup_page.ts
similarity index 85%
rename from x-pack/test/functional/page_objects/rollup_page.js
rename to x-pack/test/functional/page_objects/rollup_page.ts
index f974f60271746..fbeb6acd3ebf2 100644
--- a/x-pack/test/functional/page_objects/rollup_page.js
+++ b/x-pack/test/functional/page_objects/rollup_page.ts
@@ -6,8 +6,9 @@
 
 import expect from '@kbn/expect';
 import { map as mapAsync } from 'bluebird';
+import { FtrProviderContext } from '../ftr_provider_context';
 
-export function RollupPageProvider({ getService, getPageObjects }) {
+export function RollupPageProvider({ getService, getPageObjects }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const log = getService('log');
   const find = getService('find');
@@ -15,16 +16,16 @@ export function RollupPageProvider({ getService, getPageObjects }) {
 
   class RollupJobPage {
     async createNewRollUpJob(
-      jobName,
-      indexPattern,
-      indexName,
-      interval,
+      jobName: string,
+      indexPattern: string,
+      indexName: string,
+      interval: string,
       delay = '1d',
       startImmediately = false,
       scheduledTime = { time: 'minute', cron: true }
     ) {
       let stepNum = 1;
-      //Step 1
+      // Step 1
       await testSubjects.click('createRollupJobButton');
       await this.verifyStepIsActive(stepNum);
       await this.addRollupNameandIndexPattern(jobName, indexPattern);
@@ -34,47 +35,47 @@ export function RollupPageProvider({ getService, getPageObjects }) {
       await this.setRollupDelay(delay);
       stepNum = await this.moveToNextStep(stepNum);
 
-      //Step 2: Histogram
+      // Step 2: Histogram
       await this.verifyStepIsActive(stepNum);
       await this.setJobInterval(interval);
       stepNum = await this.moveToNextStep(stepNum);
 
-      //Step 3: Terms (optional)
+      // Step 3: Terms (optional)
       await this.verifyStepIsActive(stepNum);
       stepNum = await this.moveToNextStep();
 
-      //Step 4: Histogram(optional)
+      // Step 4: Histogram(optional)
       await this.verifyStepIsActive(stepNum);
       stepNum = await this.moveToNextStep();
 
-      //Step 5: Metrics(optional)
+      // Step 5: Metrics(optional)
       await this.verifyStepIsActive(stepNum);
       stepNum = await this.moveToNextStep();
 
-      //Step 6: saveJob and verify the name in the list
+      // Step 6: saveJob and verify the name in the list
       await this.verifyStepIsActive(stepNum);
       await this.saveJob(startImmediately);
     }
 
-    async verifyStepIsActive(stepNumber) {
+    async verifyStepIsActive(stepNumber = 0) {
       await testSubjects.exists(`createRollupStep${stepNumber}--active`);
     }
 
-    async setScheduleTime(time, cron) {
-      if (cron) {
+    async setScheduleTime(time: string, isCron: boolean) {
+      if (isCron) {
         await testSubjects.click('rollupShowAdvancedCronLink');
         await testSubjects.setValue('rollupAdvancedCron', time);
       }
       // TODO: Add handling for if Cron is false to go through clicking options.
     }
 
-    async addRollupNameandIndexPattern(name, indexPattern) {
+    async addRollupNameandIndexPattern(name: string, indexPattern: string) {
       log.debug(`Adding name ${name} to form`);
       await testSubjects.setValue('rollupJobName', name);
       await testSubjects.setValue('rollupIndexPattern', indexPattern);
     }
 
-    async setRollupDelay(time) {
+    async setRollupDelay(time: string) {
       log.debug(`Setting rollup delay to "${time}"`);
       await testSubjects.setValue('rollupDelay', time);
     }
@@ -86,20 +87,20 @@ export function RollupPageProvider({ getService, getPageObjects }) {
       expect(text).to.be.equal('Success! Index pattern has matching indices.');
     }
 
-    async setIndexName(name) {
+    async setIndexName(name: string) {
       await testSubjects.setValue('rollupIndexName', name);
     }
 
-    async moveToNextStep(stepNum) {
+    async moveToNextStep(stepNum = 0) {
       await testSubjects.click('rollupJobNextButton');
       return stepNum + 1;
     }
 
-    async setJobInterval(time) {
+    async setJobInterval(time: string) {
       await testSubjects.setValue('rollupJobInterval', time);
     }
 
-    async saveJob(startImmediately) {
+    async saveJob(startImmediately: boolean) {
       if (startImmediately) {
         const checkbox = await find.byCssSelector('.euiCheckbox');
         await checkbox.click();
diff --git a/x-pack/test/functional/page_objects/security_page.ts b/x-pack/test/functional/page_objects/security_page.ts
index e3efc8731e6b3..3ce8a0e681d69 100644
--- a/x-pack/test/functional/page_objects/security_page.ts
+++ b/x-pack/test/functional/page_objects/security_page.ts
@@ -17,7 +17,7 @@ export function SecurityPageProvider({ getService, getPageObjects }: FtrProvider
   const esArchiver = getService('esArchiver');
   const userMenu = getService('userMenu');
   const comboBox = getService('comboBox');
-  const PageObjects = getPageObjects(['common', 'header', 'settings', 'home', 'error']);
+  const PageObjects = getPageObjects(['common', 'header', 'error']);
 
   interface LoginOptions {
     expectSpaceSelector?: boolean;
diff --git a/x-pack/test/functional/page_objects/space_selector_page.ts b/x-pack/test/functional/page_objects/space_selector_page.ts
index b272175ff2b21..acf8a65362f01 100644
--- a/x-pack/test/functional/page_objects/space_selector_page.ts
+++ b/x-pack/test/functional/page_objects/space_selector_page.ts
@@ -13,7 +13,7 @@ export function SpaceSelectorPageProvider({ getService, getPageObjects }: FtrPro
   const testSubjects = getService('testSubjects');
   const browser = getService('browser');
   const find = getService('find');
-  const PageObjects = getPageObjects(['common', 'header', 'security']);
+  const PageObjects = getPageObjects(['common']);
 
   class SpaceSelectorPage {
     async initTests() {
diff --git a/x-pack/test/functional/page_objects/status_page.js b/x-pack/test/functional/page_objects/status_page.ts
similarity index 81%
rename from x-pack/test/functional/page_objects/status_page.js
rename to x-pack/test/functional/page_objects/status_page.ts
index eba5e7dd18496..08726e1320f29 100644
--- a/x-pack/test/functional/page_objects/status_page.js
+++ b/x-pack/test/functional/page_objects/status_page.ts
@@ -5,13 +5,14 @@
  */
 
 import expect from '@kbn/expect';
+import { FtrProviderContext } from '../ftr_provider_context';
 
-export function StatusPagePageProvider({ getService, getPageObjects }) {
+export function StatusPagePageProvider({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const log = getService('log');
   const browser = getService('browser');
   const find = getService('find');
-  const PageObjects = getPageObjects(['common', 'home', 'security']);
+  const { common } = getPageObjects(['common']);
 
   class StatusPage {
     async initTests() {
@@ -20,13 +21,13 @@ export function StatusPagePageProvider({ getService, getPageObjects }) {
 
     async navigateToPage() {
       return await retry.try(async () => {
-        const url = PageObjects.common.getHostPort() + '/status';
+        const url = common.getHostPort() + '/status';
         log.info(`StatusPage:navigateToPage(): ${url}`);
         await browser.get(url);
       });
     }
 
-    async expectStatusPage() {
+    async expectStatusPage(): Promise<void> {
       return await retry.try(async () => {
         log.debug(`expectStatusPage()`);
         await find.byCssSelector('[data-test-subj="statusPageRoot"]', 20000);
diff --git a/x-pack/test/functional/page_objects/upgrade_assistant.js b/x-pack/test/functional/page_objects/upgrade_assistant_page.ts
similarity index 76%
rename from x-pack/test/functional/page_objects/upgrade_assistant.js
rename to x-pack/test/functional/page_objects/upgrade_assistant_page.ts
index 72dbb2175abc9..3fe60747505a7 100644
--- a/x-pack/test/functional/page_objects/upgrade_assistant.js
+++ b/x-pack/test/functional/page_objects/upgrade_assistant_page.ts
@@ -5,14 +5,15 @@
  */
 
 import expect from '@kbn/expect';
+import { FtrProviderContext } from '../ftr_provider_context';
 
-export function UpgradeAssistantProvider({ getService, getPageObjects }) {
+export function UpgradeAssistantPageProvider({ getPageObjects, getService }: FtrProviderContext) {
   const retry = getService('retry');
   const log = getService('log');
   const browser = getService('browser');
   const find = getService('find');
   const testSubjects = getService('testSubjects');
-  const PageObjects = getPageObjects(['common', 'settings', 'security']);
+  const { common } = getPageObjects(['common']);
 
   class UpgradeAssistant {
     async initTests() {
@@ -21,7 +22,7 @@ export function UpgradeAssistantProvider({ getService, getPageObjects }) {
 
     async navigateToPage() {
       return await retry.try(async () => {
-        await PageObjects.common.navigateToApp('settings');
+        await common.navigateToApp('settings');
         await testSubjects.click('upgrade_assistant');
       });
     }
@@ -29,7 +30,7 @@ export function UpgradeAssistantProvider({ getService, getPageObjects }) {
     async expectUpgradeAssistant() {
       return await retry.try(async () => {
         log.debug(`expectUpgradeAssistant()`);
-        expect(testSubjects.exists('upgradeAssistantRoot')).to.be.true;
+        expect(await testSubjects.exists('upgradeAssistantRoot')).to.equal(true);
         const url = await browser.getCurrentUrl();
         expect(url).to.contain(`/upgrade_assistant`);
       });
@@ -42,7 +43,7 @@ export function UpgradeAssistantProvider({ getService, getPageObjects }) {
       });
     }
 
-    async expectDeprecationLoggingLabel(labelText) {
+    async expectDeprecationLoggingLabel(labelText: string) {
       return await retry.try(async () => {
         log.debug('expectDeprecationLoggingLabel()');
         const label = await find.byCssSelector(
@@ -53,19 +54,17 @@ export function UpgradeAssistantProvider({ getService, getPageObjects }) {
       });
     }
 
-    async clickTab(tabId) {
+    async clickTab(tabId: string) {
       return await retry.try(async () => {
         log.debug('clickTab()');
-        const tab = await find.byCssSelector(`.euiTabs .euiTab#${tabId}`);
-        await tab.click();
+        await find.clickByCssSelector(`.euiTabs .euiTab#${tabId}`);
       });
     }
 
-    async expectIssueSummary(summary) {
+    async expectIssueSummary(summary: string) {
       return await retry.try(async () => {
         log.debug('expectIssueSummary()');
-        const summaryEl = await testSubjects.find('upgradeAssistantIssueSummary');
-        const summaryElText = await summaryEl.getVisibleText();
+        const summaryElText = await testSubjects.getVisibleText('upgradeAssistantIssueSummary');
         expect(summaryElText).to.eql(summary);
       });
     }
diff --git a/x-pack/test/functional/page_objects/uptime_page.ts b/x-pack/test/functional/page_objects/uptime_page.ts
index d0b610ec861b8..fd47478909585 100644
--- a/x-pack/test/functional/page_objects/uptime_page.ts
+++ b/x-pack/test/functional/page_objects/uptime_page.ts
@@ -8,7 +8,7 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../ftr_provider_context';
 
 export function UptimePageProvider({ getPageObjects, getService }: FtrProviderContext) {
-  const pageObjects = getPageObjects(['common', 'timePicker', 'header']);
+  const pageObjects = getPageObjects(['timePicker', 'header']);
   const { common: commonService, monitor, navigation } = getService('uptime');
   const retry = getService('retry');
 
diff --git a/x-pack/test/functional/page_objects/watcher_page.js b/x-pack/test/functional/page_objects/watcher_page.ts
similarity index 89%
rename from x-pack/test/functional/page_objects/watcher_page.js
rename to x-pack/test/functional/page_objects/watcher_page.ts
index dfc31a6ad5ed2..ce6d9edcb6cdb 100644
--- a/x-pack/test/functional/page_objects/watcher_page.js
+++ b/x-pack/test/functional/page_objects/watcher_page.ts
@@ -5,9 +5,10 @@
  */
 
 import { map as mapAsync } from 'bluebird';
+import { FtrProviderContext } from '../ftr_provider_context';
 
-export function WatcherPageProvider({ getPageObjects, getService }) {
-  const PageObjects = getPageObjects(['common', 'header', 'settings']);
+export function WatcherPageProvider({ getPageObjects, getService }: FtrProviderContext) {
+  const PageObjects = getPageObjects(['header']);
   const find = getService('find');
   const testSubjects = getService('testSubjects');
 
@@ -22,7 +23,7 @@ export function WatcherPageProvider({ getPageObjects, getService }) {
       }
     }
 
-    async createWatch(watchName, name) {
+    async createWatch(watchName: string, name: string) {
       await testSubjects.click('createWatchButton');
       await testSubjects.click('jsonWatchCreateLink');
       await find.setValue('#id', watchName);
@@ -31,7 +32,7 @@ export function WatcherPageProvider({ getPageObjects, getService }) {
       await PageObjects.header.waitUntilLoadingHasFinished();
     }
 
-    async getWatch(watchID) {
+    async getWatch(watchID: string) {
       const watchIdColumn = await testSubjects.find(`watchIdColumn-${watchID}`);
       const watchNameColumn = await testSubjects.find(`watchNameColumn-${watchID}`);
       const id = await watchIdColumn.getVisibleText();
@@ -47,7 +48,7 @@ export function WatcherPageProvider({ getPageObjects, getService }) {
       await testSubjects.click('btnDeleteWatches');
     }
 
-    //get all the watches in the list
+    // get all the watches in the list
     async getWatches() {
       const watches = await find.allByCssSelector('.euiTableRow');
       return mapAsync(watches, async (watch) => {
diff --git a/x-pack/test/functional/services/ml/data_visualizer_file_based.ts b/x-pack/test/functional/services/ml/data_visualizer_file_based.ts
index 61496debb97e2..91169a5ff53b7 100644
--- a/x-pack/test/functional/services/ml/data_visualizer_file_based.ts
+++ b/x-pack/test/functional/services/ml/data_visualizer_file_based.ts
@@ -54,6 +54,14 @@ export function MachineLearningDataVisualizerFileBasedProvider(
       await testSubjects.existOrFail('mlFileDataVisFileStatsPanel');
     },
 
+    async assertNumberOfFieldCards(number: number) {
+      const cards = await testSubjects.findAll('mlPageFileDataVisFieldDataCard');
+      expect(cards.length).to.eql(
+        number,
+        `expected ${number} field cards to exist, but found ${cards.length}`
+      );
+    },
+
     async assertImportButtonEnabled(expectedValue: boolean) {
       const isEnabled = await testSubjects.isEnabled('mlFileDataVisOpenImportPageButton');
       expect(isEnabled).to.eql(
diff --git a/x-pack/test/reporting_api_integration/reporting_and_security/constants.ts b/x-pack/test/reporting_api_integration/reporting_and_security/constants.ts
index 590ef6325dd51..c1a518507ec37 100644
--- a/x-pack/test/reporting_api_integration/reporting_and_security/constants.ts
+++ b/x-pack/test/reporting_api_integration/reporting_and_security/constants.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import path from 'path';
 
 export const OSS_KIBANA_ARCHIVE_PATH = path.resolve(
diff --git a/x-pack/test/saved_object_api_integration/common/config.ts b/x-pack/test/saved_object_api_integration/common/config.ts
index 61884f521cfaf..32ece6aa6437a 100644
--- a/x-pack/test/saved_object_api_integration/common/config.ts
+++ b/x-pack/test/saved_object_api_integration/common/config.ts
@@ -6,7 +6,7 @@
 
 import path from 'path';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
 
 import { services } from './services';
diff --git a/x-pack/test/security_solution_cypress/es_archives/case_and_timeline/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/case_and_timeline/data.json.gz
new file mode 100644
index 0000000000000..5838d18e1c7dd
Binary files /dev/null and b/x-pack/test/security_solution_cypress/es_archives/case_and_timeline/data.json.gz differ
diff --git a/x-pack/test/security_solution_cypress/es_archives/case_and_timeline/mappings.json b/x-pack/test/security_solution_cypress/es_archives/case_and_timeline/mappings.json
new file mode 100644
index 0000000000000..557bf347b64a4
--- /dev/null
+++ b/x-pack/test/security_solution_cypress/es_archives/case_and_timeline/mappings.json
@@ -0,0 +1,2616 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_transactional": "43b8830d5d0df85a6823d290885fc9fd",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
+          "cases": "32aa96a6d3855ddda53010ae2048ac22",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
+          "dashboard": "74eb4b909f81222fa1ddeaba2881a37e",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "4b9c0e7cfaf86d82a7ee9ed68065e50d",
+          "enterprise_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "epm-packages": "386dc9996a3b74607de64c2ab2171582",
+          "exception-list": "497afa2f881a675d72d58e20057f3d8b",
+          "exception-list-agnostic": "497afa2f881a675d72d58e20057f3d8b",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "fleet-agent-actions": "9511b565b1cc6441a42033db3d5de8e9",
+          "fleet-agent-events": "e20a508b6e805189356be381dbfac8db",
+          "fleet-agents": "6012d61d15e72564e47fc3402332756e",
+          "fleet-enrollment-api-keys": "a69ef7ae661dab31561d6c6f052ef2a7",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "45915a1ad866812242df474eb0479052",
+          "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
+          "ingest-agent-policies": "8b0733cce189659593659dad8db426f0",
+          "ingest-outputs": "8aa988c376e65443fefc26f1075e93a3",
+          "ingest-package-policies": "f74dfe498e1849267cda41580b2be110",
+          "ingest_manager_settings": "02a03095f0e05b7a538fa801b88a217f",
+          "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "52346cfec69ff7b47d5f0c12361a2797",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "a8df1d270ee48c969d22d23812d08187",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "originId": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "7f9e077078cab612f6a58e3bfdedb71a",
+          "search-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "siem-detection-engine-rule-actions": "6569b288c169539db10cb262bf79de18",
+          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
+          "siem-ui-timeline": "94bc38c7a421d15fbfe8ea565370a421",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "uptime-dynamic-settings": "3d1b76c39bfb2cc8296b024d73854724",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
+          "visualization": "44d6bd48a1a653bcb60ea01614b9e3c9",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "agent_actions": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "agent_configs": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "agent_events": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "agents": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
+                "errorIndices": {
+                  "type": "keyword"
+                },
+                "metricsIndices": {
+                  "type": "keyword"
+                },
+                "onboardingIndices": {
+                  "type": "keyword"
+                },
+                "sourcemapIndices": {
+                  "type": "keyword"
+                },
+                "spanIndices": {
+                  "type": "keyword"
+                },
+                "transactionIndices": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apm-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "app_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_totals": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_transactional": {
+          "dynamic": "false",
+          "properties": {
+            "timestamp": {
+              "type": "date"
+            }
+          }
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad-template": {
+          "dynamic": "false",
+          "properties": {
+            "help": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "tags": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "template_key": {
+              "type": "keyword"
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "external_service": {
+              "properties": {
+                "connector_id": {
+                  "type": "keyword"
+                },
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "connector_name": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-user-actions": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "action_at": {
+              "type": "date"
+            },
+            "action_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "action_field": {
+              "type": "keyword"
+            },
+            "new_value": {
+              "type": "text"
+            },
+            "old_value": {
+              "type": "text"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "doc_values": false,
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "panelsJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "pause": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "boolean"
+                },
+                "section": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "integer"
+                },
+                "value": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "timeTo": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "datasources": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "endpoint:user-artifact": {
+          "properties": {
+            "body": {
+              "type": "binary"
+            },
+            "compressionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "decodedSha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "decodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encodedSha256": {
+              "type": "keyword"
+            },
+            "encodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encryptionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "identifier": {
+              "type": "keyword"
+            }
+          }
+        },
+        "endpoint:user-artifact-manifest": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "ids": {
+              "index": false,
+              "type": "keyword"
+            },
+            "schemaVersion": {
+              "type": "keyword"
+            },
+            "semanticVersion": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "enrollment_api_keys": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "enterprise_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "epm-package": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "install_started_at": {
+              "type": "date"
+            },
+            "install_status": {
+              "type": "keyword"
+            },
+            "install_version": {
+              "type": "keyword"
+            },
+            "installed_es": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "installed_kibana": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "internal": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "removable": {
+              "type": "boolean"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list-agnostic": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "file-upload-telemetry": {
+          "properties": {
+            "filesUploadedTotalCount": {
+              "type": "long"
+            }
+          }
+        },
+        "fleet-agent-actions": {
+          "properties": {
+            "ack_data": {
+              "type": "text"
+            },
+            "agent_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "data": {
+              "type": "binary"
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "policy_revision": {
+              "type": "integer"
+            },
+            "sent_at": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agent-events": {
+          "properties": {
+            "action_id": {
+              "type": "keyword"
+            },
+            "agent_id": {
+              "type": "keyword"
+            },
+            "data": {
+              "type": "text"
+            },
+            "message": {
+              "type": "text"
+            },
+            "payload": {
+              "type": "text"
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "stream_id": {
+              "type": "keyword"
+            },
+            "subtype": {
+              "type": "keyword"
+            },
+            "timestamp": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-agents": {
+          "properties": {
+            "access_api_key_id": {
+              "type": "keyword"
+            },
+            "active": {
+              "type": "boolean"
+            },
+            "current_error_events": {
+              "index": false,
+              "type": "text"
+            },
+            "default_api_key": {
+              "type": "binary"
+            },
+            "default_api_key_id": {
+              "type": "keyword"
+            },
+            "enrolled_at": {
+              "type": "date"
+            },
+            "last_checkin": {
+              "type": "date"
+            },
+            "last_checkin_status": {
+              "type": "keyword"
+            },
+            "last_updated": {
+              "type": "date"
+            },
+            "local_metadata": {
+              "type": "flattened"
+            },
+            "packages": {
+              "type": "keyword"
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "policy_revision": {
+              "type": "integer"
+            },
+            "shared_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "unenrolled_at": {
+              "type": "date"
+            },
+            "unenrollment_started_at": {
+              "type": "date"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "user_provided_metadata": {
+              "type": "flattened"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-enrollment-api-keys": {
+          "properties": {
+            "active": {
+              "type": "boolean"
+            },
+            "api_key": {
+              "type": "binary"
+            },
+            "api_key_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "expire_at": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "dynamic": "false",
+          "properties": {
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "fields": {
+              "properties": {
+                "container": {
+                  "type": "keyword"
+                },
+                "host": {
+                  "type": "keyword"
+                },
+                "pod": {
+                  "type": "keyword"
+                },
+                "tiebreaker": {
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "inventoryDefaultView": {
+              "type": "keyword"
+            },
+            "logAlias": {
+              "type": "keyword"
+            },
+            "logColumns": {
+              "properties": {
+                "fieldColumn": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "messageColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestampColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "metricAlias": {
+              "type": "keyword"
+            },
+            "metricsExplorerDefaultView": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "ingest-agent-policies": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "monitoring_enabled": {
+              "index": false,
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "package_policies": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-outputs": {
+          "properties": {
+            "ca_sha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "config": {
+              "type": "flattened"
+            },
+            "fleet_enroll_password": {
+              "type": "binary"
+            },
+            "fleet_enroll_username": {
+              "type": "binary"
+            },
+            "hosts": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-package-policies": {
+          "properties": {
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "inputs": {
+              "enabled": false,
+              "properties": {
+                "config": {
+                  "type": "flattened"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "streams": {
+                  "properties": {
+                    "compiled_stream": {
+                      "type": "flattened"
+                    },
+                    "config": {
+                      "type": "flattened"
+                    },
+                    "data_stream": {
+                      "properties": {
+                        "dataset": {
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "vars": {
+                      "type": "flattened"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "vars": {
+                  "type": "flattened"
+                }
+              },
+              "type": "nested"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "output_id": {
+              "type": "keyword"
+            },
+            "package": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                },
+                "title": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest_manager_settings": {
+          "properties": {
+            "agent_auto_upgrade": {
+              "type": "keyword"
+            },
+            "has_seen_add_data_notice": {
+              "index": false,
+              "type": "boolean"
+            },
+            "kibana_ca_sha256": {
+              "type": "keyword"
+            },
+            "kibana_urls": {
+              "type": "keyword"
+            },
+            "package_auto_upgrade": {
+              "type": "keyword"
+            }
+          }
+        },
+        "inventory-view": {
+          "properties": {
+            "accountId": {
+              "type": "keyword"
+            },
+            "autoBounds": {
+              "type": "boolean"
+            },
+            "autoReload": {
+              "type": "boolean"
+            },
+            "boundsOverride": {
+              "properties": {
+                "max": {
+                  "type": "integer"
+                },
+                "min": {
+                  "type": "integer"
+                }
+              }
+            },
+            "customMetrics": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "customOptions": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "text": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "filterQuery": {
+              "properties": {
+                "expression": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "groupBy": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "legend": {
+              "properties": {
+                "palette": {
+                  "type": "keyword"
+                },
+                "reverseColors": {
+                  "type": "boolean"
+                },
+                "steps": {
+                  "type": "long"
+                }
+              }
+            },
+            "metric": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "nodeType": {
+              "type": "keyword"
+            },
+            "region": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "by": {
+                  "type": "keyword"
+                },
+                "direction": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "time": {
+              "type": "long"
+            },
+            "view": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "expression": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "enabled": false,
+          "type": "object"
+        },
+        "metrics-explorer-view": {
+          "properties": {
+            "chartOptions": {
+              "properties": {
+                "stack": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "yAxisMode": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "currentTimerange": {
+              "properties": {
+                "from": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "options": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "filterQuery": {
+                  "type": "keyword"
+                },
+                "forceInterval": {
+                  "type": "boolean"
+                },
+                "groupBy": {
+                  "type": "keyword"
+                },
+                "limit": {
+                  "type": "integer"
+                },
+                "metrics": {
+                  "properties": {
+                    "aggregation": {
+                      "type": "keyword"
+                    },
+                    "color": {
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "label": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "source": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "originId": {
+          "type": "keyword"
+        },
+        "outputs": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "doc_values": false,
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "search-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "server": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "siem-detection-engine-rule-actions": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "action_type_id": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              }
+            },
+            "alertThrottle": {
+              "type": "keyword"
+            },
+            "ruleAlertId": {
+              "type": "keyword"
+            },
+            "ruleThrottle": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-status": {
+          "properties": {
+            "alertId": {
+              "type": "keyword"
+            },
+            "bulkCreateTimeDurations": {
+              "type": "float"
+            },
+            "gap": {
+              "type": "text"
+            },
+            "lastFailureAt": {
+              "type": "date"
+            },
+            "lastFailureMessage": {
+              "type": "text"
+            },
+            "lastLookBackDate": {
+              "type": "date"
+            },
+            "lastSuccessAt": {
+              "type": "date"
+            },
+            "lastSuccessMessage": {
+              "type": "text"
+            },
+            "searchAfterTimeDurations": {
+              "type": "float"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "statusDate": {
+              "type": "date"
+            }
+          }
+        },
+        "siem-ui-timeline": {
+          "properties": {
+            "columns": {
+              "properties": {
+                "aggregatable": {
+                  "type": "boolean"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "columnHeaderType": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "text"
+                },
+                "example": {
+                  "type": "text"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "indexes": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "placeholder": {
+                  "type": "text"
+                },
+                "searchable": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "dataProviders": {
+              "properties": {
+                "and": {
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "excluded": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "kqlQuery": {
+                      "type": "text"
+                    },
+                    "name": {
+                      "type": "text"
+                    },
+                    "queryMatch": {
+                      "properties": {
+                        "displayField": {
+                          "type": "text"
+                        },
+                        "displayValue": {
+                          "type": "text"
+                        },
+                        "field": {
+                          "type": "text"
+                        },
+                        "operator": {
+                          "type": "text"
+                        },
+                        "value": {
+                          "type": "text"
+                        }
+                      }
+                    },
+                    "type": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "excluded": {
+                  "type": "boolean"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kqlQuery": {
+                  "type": "text"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "queryMatch": {
+                  "properties": {
+                    "displayField": {
+                      "type": "text"
+                    },
+                    "displayValue": {
+                      "type": "text"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "operator": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "type": {
+                  "type": "text"
+                }
+              }
+            },
+            "dateRange": {
+              "properties": {
+                "end": {
+                  "type": "date"
+                },
+                "start": {
+                  "type": "date"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "eventType": {
+              "type": "keyword"
+            },
+            "excludedRowRendererIds": {
+              "type": "text"
+            },
+            "favorite": {
+              "properties": {
+                "favoriteDate": {
+                  "type": "date"
+                },
+                "fullName": {
+                  "type": "text"
+                },
+                "keySearch": {
+                  "type": "text"
+                },
+                "userName": {
+                  "type": "text"
+                }
+              }
+            },
+            "filters": {
+              "properties": {
+                "exists": {
+                  "type": "text"
+                },
+                "match_all": {
+                  "type": "text"
+                },
+                "meta": {
+                  "properties": {
+                    "alias": {
+                      "type": "text"
+                    },
+                    "controlledBy": {
+                      "type": "text"
+                    },
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "formattedValue": {
+                      "type": "text"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "type": "keyword"
+                    },
+                    "negate": {
+                      "type": "boolean"
+                    },
+                    "params": {
+                      "type": "text"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "missing": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "range": {
+                  "type": "text"
+                },
+                "script": {
+                  "type": "text"
+                }
+              }
+            },
+            "kqlMode": {
+              "type": "keyword"
+            },
+            "kqlQuery": {
+              "properties": {
+                "filterQuery": {
+                  "properties": {
+                    "kuery": {
+                      "properties": {
+                        "expression": {
+                          "type": "text"
+                        },
+                        "kind": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "serializedQuery": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "savedQueryId": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "columnId": {
+                  "type": "keyword"
+                },
+                "sortDirection": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "templateTimelineId": {
+              "type": "text"
+            },
+            "templateTimelineVersion": {
+              "type": "integer"
+            },
+            "timelineType": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-note": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "note": {
+              "type": "text"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-pinned-event": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "spaceId": {
+          "type": "keyword"
+        },
+        "telemetry": {
+          "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-reindex-operation": {
+          "properties": {
+            "errorMessage": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "indexName": {
+              "type": "keyword"
+            },
+            "lastCompletedStep": {
+              "type": "long"
+            },
+            "locked": {
+              "type": "date"
+            },
+            "newIndexName": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexOptions": {
+              "properties": {
+                "openAndClose": {
+                  "type": "boolean"
+                },
+                "queueSettings": {
+                  "properties": {
+                    "queuedAt": {
+                      "type": "long"
+                    },
+                    "startedAt": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "reindexTaskId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexTaskPercComplete": {
+              "type": "float"
+            },
+            "runningReindexCount": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            },
+            "ui_open": {
+              "properties": {
+                "cluster": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "indices": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "overview": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "ui_reindex": {
+              "properties": {
+                "close": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "open": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "start": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "stop": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "uptime-dynamic-settings": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "index": false,
+              "type": "text"
+            }
+          }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/security_solution_cypress/es_archives/custom_rules/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/custom_rules/data.json.gz
index 8f31a1a469053..60c0550481d1e 100644
Binary files a/x-pack/test/security_solution_cypress/es_archives/custom_rules/data.json.gz and b/x-pack/test/security_solution_cypress/es_archives/custom_rules/data.json.gz differ
diff --git a/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_package_policy_page.ts b/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_package_policy_page.ts
index 13b1f8c9d9842..523b327b8de1c 100644
--- a/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_package_policy_page.ts
+++ b/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_package_policy_page.ts
@@ -52,13 +52,11 @@ export function IngestManagerCreatePackagePolicy({
     async selectAgentPolicy(name?: string) {
       // if we have a name, then find the button with that `title` set.
       if (name) {
-        await (
-          await find.byCssSelector(`[data-test-subj="agentPolicyItem"][title="${name}"]`)
-        ).click();
+        await find.clickByCssSelector(`[data-test-subj="agentPolicyItem"][title="${name}"]`);
       }
       // Else, just select the first agent policy that is present
       else {
-        await (await testSubjects.find('agentPolicyItem')).click();
+        await testSubjects.click('agentPolicyItem');
       }
     },
 
diff --git a/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts b/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts
index 9c1fa0c6e86b2..d661b3097bd35 100644
--- a/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts
+++ b/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts
@@ -27,7 +27,7 @@ export function EndpointPolicyPageProvider({ getService, getPageObjects }: FtrPr
      */
     async findFirstActionsButton() {
       await this.ensureIsOnPolicyPage();
-      return (await testSubjects.findAll('policyActionsButton'))[0];
+      return await testSubjects.find('policyActionsButton');
     },
 
     /**
@@ -36,8 +36,7 @@ export function EndpointPolicyPageProvider({ getService, getPageObjects }: FtrPr
     async launchAndFindDeleteModal() {
       const actionsButton = await this.findFirstActionsButton();
       await actionsButton.click();
-      const deleteAction = await testSubjects.find('policyDeleteButton');
-      await deleteAction.click();
+      await testSubjects.click('policyDeleteButton');
       return await testSubjects.find('policyListDeleteModal');
     },
 
diff --git a/x-pack/test/spaces_api_integration/common/config.ts b/x-pack/test/spaces_api_integration/common/config.ts
index 89fa07566ecba..b1da9931f3c9b 100644
--- a/x-pack/test/spaces_api_integration/common/config.ts
+++ b/x-pack/test/spaces_api_integration/common/config.ts
@@ -6,7 +6,7 @@
 
 import path from 'path';
 
-import { REPO_ROOT } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
 
 import { TestInvoker } from './lib/types';
 // @ts-ignore
diff --git a/yarn.lock b/yarn.lock
index ddecaf17f7bcd..ba793307e1e97 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4017,6 +4017,13 @@
   dependencies:
     "@types/jest" "*"
 
+"@types/jest-when@^2.7.1":
+  version "2.7.1"
+  resolved "https://registry.yarnpkg.com/@types/jest-when/-/jest-when-2.7.1.tgz#0b04a33a48a17370c390e9830a975822b3ac5e32"
+  integrity sha512-PRrGzDkU859cdkFL2KwWN4fRLRDGIUkRNT0StbthhKmj+naU4wImpoJeMnhjprvSou4pKAzU0dKfdQvjceJVhg==
+  dependencies:
+    "@types/jest" "*"
+
 "@types/jest@*", "@types/jest@^25.2.3":
   version "25.2.3"
   resolved "https://registry.yarnpkg.com/@types/jest/-/jest-25.2.3.tgz#33d27e4c4716caae4eced355097a47ad363fdcaf"
@@ -7806,6 +7813,16 @@ builtin-status-codes@^3.0.0:
   resolved "https://registry.yarnpkg.com/builtin-status-codes/-/builtin-status-codes-3.0.0.tgz#85982878e21b98e1c66425e03d0174788f569ee8"
   integrity sha1-hZgoeOIbmOHGZCXgPQF0eI9Wnug=
 
+bunyan@^1.8.12:
+  version "1.8.14"
+  resolved "https://registry.yarnpkg.com/bunyan/-/bunyan-1.8.14.tgz#3d8c1afea7de158a5238c7cb8a66ab6b38dd45b4"
+  integrity sha512-LlahJUxXzZLuw/hetUQJmRgZ1LF6+cr5TPpRj6jf327AsiIq2jhYEH4oqUUkVKTor+9w2BT3oxVwhzE5lw9tcg==
+  optionalDependencies:
+    dtrace-provider "~0.8"
+    moment "^2.19.3"
+    mv "~2"
+    safe-json-stringify "~1"
+
 bytes@1:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/bytes/-/bytes-1.0.0.tgz#3569ede8ba34315fab99c3e92cb04c7220de1fa8"
@@ -11110,6 +11127,13 @@ dragselect@1.13.1:
   resolved "https://registry.yarnpkg.com/dragselect/-/dragselect-1.13.1.tgz#aa4166e1164b51ed5ee0cd89e0c5310a9c35be6a"
   integrity sha512-spfUz6/sNnlY4fF/OxPBwaKLa5hVz6V+fq5XhVuD+h47RAkA75TMkfvr4AoWUh5Ufq3V1oIAbfu+sjc9QbewoA==
 
+dtrace-provider@~0.8:
+  version "0.8.8"
+  resolved "https://registry.yarnpkg.com/dtrace-provider/-/dtrace-provider-0.8.8.tgz#2996d5490c37e1347be263b423ed7b297fb0d97e"
+  integrity sha512-b7Z7cNtHPhH9EJhNNbbeqTcXB8LGFFZhq1PGgEvpeHlzd36bhbdTWoE/Ba/YguqpBSlAPKnARWhVlhunCMwfxg==
+  dependencies:
+    nan "^2.14.0"
+
 duplexer2@^0.1.4, duplexer2@~0.1.4:
   version "0.1.4"
   resolved "https://registry.yarnpkg.com/duplexer2/-/duplexer2-0.1.4.tgz#8b12dab878c0d69e3e7891051662a32fc6bddcc1"
@@ -12433,7 +12457,7 @@ expect.js@~0.2.0:
   resolved "https://registry.yarnpkg.com/expect.js/-/expect.js-0.2.0.tgz#1028533d2c1c363f74a6796ff57ec0520ded2be1"
   integrity sha1-EChTPSwcNj90pnlv9X7AUg3tK+E=
 
-expect@^24.9.0:
+expect@^24.8.0, expect@^24.9.0:
   version "24.9.0"
   resolved "https://registry.yarnpkg.com/expect/-/expect-24.9.0.tgz#b75165b4817074fa4a157794f46fe9f1ba15b6ca"
   integrity sha512-wvVAx8XIol3Z5m9zvZXiyZOQ+sRJqNTIm6sGjdWlaZIeupQGO3WbYI+15D/AmEwZywL6wtJkbAbJtzkOfBuR0Q==
@@ -17645,6 +17669,14 @@ jest-watcher@^25.5.0:
     jest-util "^25.5.0"
     string-length "^3.1.0"
 
+jest-when@^2.7.2:
+  version "2.7.2"
+  resolved "https://registry.yarnpkg.com/jest-when/-/jest-when-2.7.2.tgz#b7b4225e8882bd84a1cfd09216b2c63d22f892bd"
+  integrity sha512-GuVzimG0wW18A5JlYwhHrvuwmWRAQpsnilRVdJktvrZX5V0++al1f/iwITE7+Cud8Rbw/U2eka4tyy7kvxIWnw==
+  dependencies:
+    bunyan "^1.8.12"
+    expect "^24.8.0"
+
 jest-worker@^24.9.0:
   version "24.9.0"
   resolved "https://registry.yarnpkg.com/jest-worker/-/jest-worker-24.9.0.tgz#5dbfdb5b2d322e98567898238a9697bcce67b3e5"
@@ -20143,7 +20175,7 @@ moment-timezone@^0.5.27:
   resolved "https://registry.yarnpkg.com/moment/-/moment-2.24.0.tgz#0d055d53f5052aa653c9f6eb68bb5d12bf5c2b5b"
   integrity sha512-bV7f+6l2QigeBBZSM/6yTNq4P2fNpSWj/0e7jQcy87A8e7o2nAfP/34/2ky5Vw4B9S446EtIhodAzkFCcR4dQg==
 
-moment@^2.27.0:
+moment@^2.19.3, moment@^2.27.0:
   version "2.27.0"
   resolved "https://registry.yarnpkg.com/moment/-/moment-2.27.0.tgz#8bff4e3e26a236220dfe3e36de756b6ebaa0105d"
   integrity sha512-al0MUK7cpIcglMv3YF13qSgdAIqxHTO7brRtaz3DlSULbqfazqkc5kEjNrLDOM7fsjshoFIihnU8snrP7zUvhQ==
@@ -20303,6 +20335,15 @@ mute-stream@0.0.8:
   resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.8.tgz#1630c42b2251ff81e2a283de96a5497ea92e5e0d"
   integrity sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==
 
+mv@~2:
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/mv/-/mv-2.1.1.tgz#ae6ce0d6f6d5e0a4f7d893798d03c1ea9559b6a2"
+  integrity sha1-rmzg1vbV4KT32JN5jQPB6pVZtqI=
+  dependencies:
+    mkdirp "~0.5.1"
+    ncp "~2.0.0"
+    rimraf "~2.4.0"
+
 nan@^2.12.1, nan@^2.13.2:
   version "2.14.0"
   resolved "https://registry.yarnpkg.com/nan/-/nan-2.14.0.tgz#7818f722027b2459a86f0295d434d1fc2336c52c"
@@ -20357,7 +20398,7 @@ natural-compare@^1.4.0:
   resolved "https://registry.yarnpkg.com/natural-compare/-/natural-compare-1.4.0.tgz#4abebfeed7541f2c27acfb29bdbbd15c8d5ba4f7"
   integrity sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=
 
-ncp@^2.0.0:
+ncp@^2.0.0, ncp@~2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/ncp/-/ncp-2.0.0.tgz#195a21d6c46e361d2fb1281ba38b91e9df7bdbb3"
   integrity sha1-GVoh1sRuNh0vsSgbo4uR6d9727M=
@@ -25161,6 +25202,13 @@ rimraf@~2.0.2:
   optionalDependencies:
     graceful-fs "~1.1"
 
+rimraf@~2.4.0:
+  version "2.4.5"
+  resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.4.5.tgz#ee710ce5d93a8fdb856fb5ea8ff0e2d75934b2da"
+  integrity sha1-7nEM5dk6j9uFb7Xqj/Di11k0sto=
+  dependencies:
+    glob "^6.0.1"
+
 ripemd160@^2.0.0, ripemd160@^2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/ripemd160/-/ripemd160-2.0.1.tgz#0f4584295c53a3628af7e6d79aca21ce57d1c6e7"
@@ -25329,7 +25377,7 @@ safe-json-parse@~1.0.1:
   resolved "https://registry.yarnpkg.com/safe-json-parse/-/safe-json-parse-1.0.1.tgz#3e76723e38dfdda13c9b1d29a1e07ffee4b30b57"
   integrity sha1-PnZyPjjf3aE8mx0poeB//uSzC1c=
 
-safe-json-stringify@^1.2.0:
+safe-json-stringify@^1.2.0, safe-json-stringify@~1:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/safe-json-stringify/-/safe-json-stringify-1.2.0.tgz#356e44bc98f1f93ce45df14bcd7c01cda86e0afd"
   integrity sha512-gH8eh2nZudPQO6TytOvbxnuhYBOvDBBLW52tz5q6X58lJcd/tkmqFR+5Z9adS8aJtURSXWThWy/xJtJwixErvg==