kibana Lens embeddables/hosts

Summary

Summarize your PR. If it involves visual changes include a screenshot or gif.

Checklist

Delete any items that are not applicable to this PR.

[ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
[ ] Documentation was added for features that require explanation or tutorials
[ ] Unit or functional tests were updated or added to match the most common scenarios
[ ] Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
[ ] Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
[ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
[ ] This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
[ ] This was checked for cross-browser compatibility

Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release.

When forming the risk matrix, consider some of the following examples and how they may potentially impact the change:

Risk	Probability	Severity	Mitigation/Notes
Multiple Spaces—unexpected behavior in non-default Kibana Space.	Low	High	Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces.
Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks.	High	Low	Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure.
Code should gracefully handle cases when feature X or plugin Y are disabled.	Medium	High	Unit tests will verify that any feature flag or plugin combination still results in our service operational.
See more potential risk examples

For maintainers

[ ] This was checked for breaking API changes and was labeled appropriately

Aug 09 '22 09:08 angorayc

:yellow_heart: Build succeeded, but was flaky

Buildkite Build
Commit: 833cc613885eb54153fdd7216c869222ac83f821

Failed CI Steps

Test Failures

[job] [logs] Security Solution Tests #1 / Alerts timeline Privileges: can crud should allow a user with crud privileges to attach alerts to cases
[job] [logs] Security Solution Tests #4 / Timeline search and filters Update kqlMode for timeline "before all" hook for "should be able to update timeline kqlMode with filter"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	3040	3045	+5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`lens`	1.2MB	1.2MB	+30.0B
`securitySolution`	5.4MB	5.4MB	+5.0KB
total			+5.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`lens`	34.5KB	34.6KB	+58.0B
`securitySolution`	255.0KB	255.2KB	+192.0B
total			+250.0B

History

:yellow_heart: Build #65776 was flaky 57b679fb9a4804e4384e5b1d4fb2d99fa3102e06
:broken_heart: Build #65720 failed 7c64e37da42b430602ea51f70ee8c76d36ba2f6c
:broken_heart: Build #65384 failed bb5fbbe1e1e67e5e11ffb091c45083fd8f4392fd
:green_heart: Build #65072 succeeded 424330d931e1a3b6606eacb8caae485b31290db4
:broken_heart: Build #65038 failed 270cbc8bae3842f5c35c9b0335998ab2eb42f996
:broken_heart: Build #64815 failed 32fab08d2d0d1d70d6fa28ff26e5464a61abd3e7

To update your PR or re-run it, just comment with: @elasticmachine merge upstream

Aug 17 '22 19:08 kibana-ci

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

Nov 07 '22 09:11 elasticmachine

Pinging @elastic/security-solution (Team: SecuritySolution)

Nov 07 '22 09:11 elasticmachine

@angorayc I noticed some weird-looking UI. Let me know if it is a problem with my environment.

When I open the host page I get an error and dark background behind the scroll bar and a black square in the header. Screenshot 2022-11-07 at 17 29 14

When I open it on a smaller screen: Loading state Screenshot 2022-11-07 at 17 28 28 Empty state: When loaded: Screenshot 2022-11-07 at 17 29 02

Nov 07 '22 16:11 machadoum

Hey @machadoum , thanks for catching this. I think that's because source.ip and destination.ip both have conflict in their field. Lens doesn't seem to allow aggregation on a non keyword type, but our current charts are retrieving data from Elasticsearch api, which doesn't show error in this case. Guessing that's why we have the inconsistency between current charts and Lens Embeddables. I'm asking Lens' opinion on how to fix this https://elastic.slack.com/archives/C013C7Z2X8W/p1667905889860969 Update: Lens team has this issue open: https://github.com/elastic/kibana/issues/143673

Nov 08 '22 11:11 angorayc