diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.links.md b/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.links.md
index fd05ae139ba215..80e2702451d861 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.links.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.links.md
@@ -8,6 +8,9 @@
 
 ```typescript
 readonly links: {
+        readonly dashboard: {
+            readonly drilldowns: string;
+        };
         readonly filebeat: {
             readonly base: string;
             readonly installation: string;
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.md b/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.md
index 1114e05589c4b7..9e7938bd9c8507 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinkssetup.md
@@ -17,5 +17,5 @@ export interface DocLinksSetup
 |  --- | --- | --- |
 |  [DOC\_LINK\_VERSION](./kibana-plugin-core-public.doclinkssetup.doc_link_version.md) | <code>string</code> |  |
 |  [ELASTIC\_WEBSITE\_URL](./kibana-plugin-core-public.doclinkssetup.elastic_website_url.md) | <code>string</code> |  |
-|  [links](./kibana-plugin-core-public.doclinkssetup.links.md) | <code>{</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly loadingData: string;</code><br/><code>            readonly introduction: string;</code><br/><code>        };</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly siem: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>    }</code> |  |
+|  [links](./kibana-plugin-core-public.doclinkssetup.links.md) | <code>{</code><br/><code>        readonly dashboard: {</code><br/><code>            readonly drilldowns: string;</code><br/><code>        };</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly loadingData: string;</code><br/><code>            readonly introduction: string;</code><br/><code>        };</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly siem: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>    }</code> |  |
 
diff --git a/docs/maps/connect-to-ems.asciidoc b/docs/maps/connect-to-ems.asciidoc
index d7740d76b0456b..2b88ffe2e2ddab 100644
--- a/docs/maps/connect-to-ems.asciidoc
+++ b/docs/maps/connect-to-ems.asciidoc
@@ -1,17 +1,17 @@
 [role="xpack"]
 [[maps-connect-to-ems]]
-== Connecting to Elastic Maps Service
+== Connect to Elastic Maps Service
 
 https://www.elastic.co/elastic-maps-service[Elastic Maps Service (EMS)] is a service that hosts
 tile layers and vector shapes of administrative boundaries.
-If you are using Kibana's out-of-the-box settings, **Elastic Maps** is already configured to use EMS.
+If you are using Kibana's out-of-the-box settings, Maps is already configured to use EMS.
 
 EMS requests are made to the following domains:
 
 * tiles.maps.elastic.co
 * vector.maps.elastic.co
 
-**Elastic Maps** makes requests directly from the browser to EMS.
+Maps makes requests directly from the browser to EMS.
 
 [float]
 === Connect to Elastic Maps Service from an internal network
@@ -33,5 +33,5 @@ behind a firewall. If this happens, you can disable the EMS connection to avoid
 To disable EMS, change your <<settings, kibana.yml>> file.
 
 . Set `map.includeElasticMapsService` to `false` to turn off the EMS connection.
-. Set `map.tilemap.url` to the URL of your tile server. This configures the default tile layer of **Elastic Maps**.
+. Set `map.tilemap.url` to the URL of your tile server. This configures the default tile layer of Maps.
 . (Optional) Set `map.regionmap` to the vector shapes of the administrative boundaries that you want to use.
diff --git a/docs/maps/geojson-upload.asciidoc b/docs/maps/geojson-upload.asciidoc
index 5618e5ab0bd16a..6c288400872525 100644
--- a/docs/maps/geojson-upload.asciidoc
+++ b/docs/maps/geojson-upload.asciidoc
@@ -1,11 +1,13 @@
 [role="xpack"]
 [[geojson-upload]]
 == Upload GeoJSON data
-*Elastic Maps* makes it easy to import geospatial data into the Elastic Stack.
-Using the *GeoJSON Upload* feature, you can drag and drop your point and shape
+
+Maps makes it easy to import geospatial data into the Elastic Stack.
+Using the GeoJSON Upload feature, you can drag and drop your point and shape
 data files directly into {es}, and then use them as layers
 in the map.  You can also use the GeoJSON data in the broader Kibana ecosystem,
 for example, in visualizations and Canvas workpads.
+
 [float]
 === Why GeoJSON?
 GeoJSON is an open-standard file format for storing geospatial vector data.
@@ -17,7 +19,7 @@ GeoJSON is the most commonly used and flexible option.
 Follow these instructions to upload a GeoJSON data file, or try the
 <<indexing-geojson-data-tutorial, end-to-end integrated example>>.
 
-. Open the menu, go to *Elastic Maps*, and then click *Add layer*.
+. Open the menu, go to *Maps*, and then click *Add layer*.
 . Click *Uploaded GeoJSON*.
 +
 [role="screenshot"]
diff --git a/docs/maps/index.asciidoc b/docs/maps/index.asciidoc
index 6480d64bdd1741..8999b9fe20b118 100644
--- a/docs/maps/index.asciidoc
+++ b/docs/maps/index.asciidoc
@@ -1,13 +1,13 @@
 [role="xpack"]
 [[maps]]
-= Elastic Maps
+= Maps
 
 [partintro]
 --
 
-*Elastic Maps* enables you to parse through your geographical data at scale, with speed, and in real time. With features like multiple layers and indices in a map, plotting of raw documents, dynamic client-side styling, and global search across multiple layers, you can understand and monitor your data with ease.
+Maps enables you to parse through your geographical data at scale, with speed, and in real time. With features like multiple layers and indices in a map, plotting of raw documents, dynamic client-side styling, and global search across multiple layers, you can understand and monitor your data with ease.
 
-With *Elastic Maps*, you can:
+With Maps, you can:
 
 * Create maps with multiple layers and indices.
 * Upload GeoJSON files into Elasticsearch.
@@ -15,7 +15,7 @@ With *Elastic Maps*, you can:
 * Symbolize features using data values.
 * Focus in on just the data you want.
 
-*Ready to get started?* Start your tour of *Elastic Maps* with the <<maps-getting-started, getting started tutorial>>.
+*Ready to get started?* Start your tour of Maps with the <<maps-getting-started, getting started tutorial>>.
 
 [float]
 === Create maps with multiple layers and indices
@@ -26,7 +26,7 @@ image::maps/images/sample_data_ecommerce.png[]
 
 [float]
 === Upload GeoJSON files into Elasticsearch
-Elastic Maps makes it easy to import geospatial data into the Elastic Stack. Using the GeoJSON Upload feature, you can drag and drop your point and shape data files directly into Elasticsearch, and then use them as layers in the map.
+Maps makes it easy to import geospatial data into the Elastic Stack. Using the GeoJSON Upload feature, you can drag and drop your point and shape data files directly into Elasticsearch, and then use them as layers in the map.
 
 [float]
 === Embed your map in dashboards
diff --git a/docs/maps/indexing-geojson-data-tutorial.asciidoc b/docs/maps/indexing-geojson-data-tutorial.asciidoc
index c1ca9d0925c9a1..d1a6593f61fe10 100644
--- a/docs/maps/indexing-geojson-data-tutorial.asciidoc
+++ b/docs/maps/indexing-geojson-data-tutorial.asciidoc
@@ -1,6 +1,6 @@
 [role="xpack"]
 [[indexing-geojson-data-tutorial]]
-== Indexing GeoJSON data tutorial
+=== Tutorial: Index GeoJSON data
 
 In this tutorial, you'll build a customized map that shows the flight path between
 two airports, and the lightning hot spots on that route. You'll learn to:
@@ -15,7 +15,7 @@ two airports, and the lightning hot spots on that route. You'll learn to:
 This tutorial requires you to download the following GeoJSON sample data files.
 These files are good examples of the types
 of vector data that you can upload to Kibana and index in
-Elasticsearch for display in *Elastic Maps*.
+Elasticsearch for display in  Maps.
 
 * https://raw.githubusercontent.com/elastic/examples/master/Maps/Getting%20Started%20Examples/geojson_upload_and_styling/logan_international_airport.geojson[Logan International Airport]
 * https://raw.githubusercontent.com/elastic/examples/master/Maps/Getting%20Started%20Examples/geojson_upload_and_styling/bangor_international_airport.geojson[Bangor International Airport]
diff --git a/docs/maps/map-settings.asciidoc b/docs/maps/map-settings.asciidoc
index 4e290b6da2e714..e11be438a2237d 100644
--- a/docs/maps/map-settings.asciidoc
+++ b/docs/maps/map-settings.asciidoc
@@ -1,8 +1,8 @@
 [role="xpack"]
 [[maps-settings]]
-== Map settings
+== Configure map settings
 
-Elastic Maps offers settings that let you configure how a map is displayed.
+Maps offers settings that let you configure how a map is displayed.
 To access these settings, click *Map settings* in the application toolbar.
 
 [float]
diff --git a/docs/maps/maps-aggregations.asciidoc b/docs/maps/maps-aggregations.asciidoc
index 6b03614ab9d6a9..872ed1cdedb7e0 100644
--- a/docs/maps/maps-aggregations.asciidoc
+++ b/docs/maps/maps-aggregations.asciidoc
@@ -2,6 +2,11 @@
 [[maps-aggregations]]
 == Plot big data without plotting too much data
 
+++++
+<titleabbrev>Plot big data</titleabbrev>
+++++
+
+
 Use {ref}/search-aggregations.html[aggregations] to plot large data sets without overwhelming your network or your browser.
 When using aggregations, the documents stay in Elasticsearch and only the calculated values for each group are returned to your computer.
 
@@ -37,7 +42,7 @@ image::maps/images/grid_to_docs.gif[]
 [[maps-grid-aggregation]]
 === Grid aggregation
 
-*Grid aggregation* layers use {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into grids. You can calculate metrics for each gridded cell.
+Grid aggregation layers use {ref}/search-aggregations-bucket-geotilegrid-aggregation.html[GeoTile grid aggregation] to group your documents into grids. You can calculate metrics for each gridded cell.
 
 Symbolize grid aggregation metrics as:
 
@@ -213,7 +218,7 @@ The following shows an example terms aggregation response. Note the *key* proper
 }
 --------------------------------------------------
 
-==== Augmenting the left source with metrics from the right source
+==== Augment the left source with metrics from the right source
 
 The join adds metrics for each terms aggregation bucket to the world country feature with the corresponding ISO 3166-1 alpha-2 code. Features that do not have a corresponding terms aggregation bucket are not visible on the map.
 
diff --git a/docs/maps/maps-getting-started.asciidoc b/docs/maps/maps-getting-started.asciidoc
index 239419695138d8..09a4dc61cae284 100644
--- a/docs/maps/maps-getting-started.asciidoc
+++ b/docs/maps/maps-getting-started.asciidoc
@@ -1,8 +1,14 @@
 [role="xpack"]
 [[maps-getting-started]]
-== Getting started with Elastic Maps
+== Get started with Maps
 
-You work with *Elastic Maps* by adding layers. The data for a layer can come from
+++++
+<titleabbrev>Get started</titleabbrev>
+++++
+
+
+
+You work with Maps by adding layers. The data for a layer can come from
 sources such as {es} documents, vector sources, tile map services, web map
 services, and more. You can symbolize the data in different ways.
 For example, you might show which airports have the longest flight
@@ -25,7 +31,7 @@ image::maps/images/read-only-badge.png[Example of Maps' read only access indicat
 [float]
 === Prerequisites
 Before you start this tutorial, <<add-sample-data, add the web logs sample data set>>. Each
-sample data set includes a map to go along with the data. Once you've added the data, open *Elastic Maps* and
+sample data set includes a map to go along with the data. Once you've added the data, open Maps and
 explore the different layers of the *[Logs] Total Requests and Bytes* map.
 You'll re-create this map in this tutorial.
 
@@ -40,7 +46,7 @@ In this tutorial, you'll learn to:
 
 [role="xpack"]
 [[maps-create]]
-=== Creating a new map
+=== Create a map
 
 The first thing to do is to create a new map.
 
@@ -55,7 +61,7 @@ image::maps/images/gs_create_new_map.png[]
 
 [role="xpack"]
 [[maps-add-choropleth-layer]]
-=== Adding a choropleth layer
+=== Add a choropleth layer
 
 Now that you have a map, you'll want to add layers to it.
 The first layer you'll add is a choropleth layer to shade world countries
@@ -106,7 +112,7 @@ image::maps/images/gs_add_cloropeth_layer.png[]
 
 [role="xpack"]
 [[maps-add-elasticsearch-layer]]
-=== Adding layers for {es} data
+=== Add layers for the {es} data
 
 To avoid overwhelming the user with too much data at once, you'll add two layers for {es} data.
 
@@ -183,7 +189,7 @@ image::maps/images/sample_data_web_logs.png[]
 
 [role="xpack"]
 [[maps-save]]
-=== Saving the map
+=== Save the map
 Now that your map is complete, you'll want to save it so others can use it.
 
 . In the application toolbar, click *Save*.
@@ -202,7 +208,7 @@ You have completed the steps for re-creating the sample data map.
 
 [role="xpack"]
 [[maps-embedding]]
-=== Adding the map to a dashboard
+=== Add the map to a dashboard
 You can add your saved map to a {kibana-ref}/dashboard.html[dashboard] and view your geospatial data alongside bar charts, pie charts, and other visualizations.
 
 . Open the menu, then go to *Dashboard*.
@@ -224,7 +230,7 @@ Your dashboard should look like this:
 [role="screenshot"]
 image::maps/images/gs_dashboard_with_map.png[]
 
-==== Exploring your data using filters
+==== Explore your data using filters
 
 You can apply filters to your dashboard to hone in on the data that you are most interested in.
 The dashboard is interactive--you can quickly create filters by clicking on the desired data in the map and visualizations.
diff --git a/docs/maps/search.asciidoc b/docs/maps/search.asciidoc
index 124a976c009d4e..0c4042a37f700f 100644
--- a/docs/maps/search.asciidoc
+++ b/docs/maps/search.asciidoc
@@ -1,8 +1,8 @@
 [role="xpack"]
 [[maps-search]]
-== Searching your data
+== Search geographic data
 
-**Elastic Maps** embeds the search bar for real-time search.
+Maps embeds the search bar for real-time search.
 Only layers requesting data from {es} are filtered when you submit a search request.
 Layers narrowed by the search context contain the filter icon image:maps/images/filter_icon.png[] next to the layer name in the legend.
 
@@ -23,7 +23,7 @@ image::maps/images/global_search_bar.png[]
 
 [role="xpack"]
 [[maps-create-filter-from-map]]
-=== Creating filters from your map
+=== Create filters from a map
 
 You can create two types of filters by interacting with your map:
 
@@ -62,7 +62,7 @@ image::maps/images/create_phrase_filter.png[]
 
 [role="xpack"]
 [[maps-layer-based-filtering]]
-=== Filtering a single layer
+=== Filter a single layer
 
 You can apply a search request to individual layers by setting `Filters` in the layer details panel.
 Click the *Add filter* button to add a filter to a layer.
@@ -74,7 +74,7 @@ image::maps/images/layer_search.png[]
 
 [role="xpack"]
 [[maps-search-across-multiple-indices]]
-=== Searching across multiple indices
+=== Search across multiple indices
 
 Your map might contain multiple {es} indices.
 This can occur when your map contains two or more layers with {es} sources from different indices.
@@ -85,7 +85,7 @@ The most common cause for empty layers are searches for a field that exists in o
 
 [float]
 [[maps-disable-search-for-layer]]
-==== Disable search for layer
+==== Disable search for a layer
 
 You can prevent the search bar from applying search context to a layer by configuring the following:
 
@@ -95,7 +95,7 @@ You can prevent the search bar from applying search context to a layer by config
 
 [float]
 [[maps-add-index-search]]
-==== Use _index in your search
+==== Use _index in a search
 
 Add {ref}/mapping-index-field.html[_index] to your search to include documents from indices that do not contain a search field.
 
diff --git a/docs/maps/trouble-shooting.asciidoc b/docs/maps/trouble-shooting.asciidoc
index 76383f8953a781..cfc47cf6f0e4ff 100644
--- a/docs/maps/trouble-shooting.asciidoc
+++ b/docs/maps/trouble-shooting.asciidoc
@@ -1,13 +1,18 @@
 [role="xpack"]
 [[maps-troubleshooting]]
-== Elastic Maps troubleshooting
+== Troubleshoot Maps
+
+++++
+<titleabbrev>Troubleshoot</titleabbrev>
+++++
+
 
 Use the information in this section to inspect Elasticsearch requests and find solutions to common problems.
 
 [float]
 === Inspect Elasticsearch requests
 
-*Elastic Maps* uses the {ref}/search-search.html[{es} search API] to get documents and aggregation results from {es}. To troubleshoot these requests, open the Inspector, which shows the most recent requests for each layer. You can switch between different requests using the *Request* dropdown.
+Maps uses the {ref}/search-search.html[{es} search API] to get documents and aggregation results from {es}. To troubleshoot these requests, open the Inspector, which shows the most recent requests for each layer. You can switch between different requests using the *Request* dropdown.
 
 [role="screenshot"]
 image::maps/images/inspector.png[]
@@ -33,6 +38,6 @@ image::maps/images/inspector.png[]
 [float]
 ==== Coordinate and region map visualizations not available in New Visualization menu
 
-Kibana’s out-of-the-box settings no longer offers coordinate and region maps as a choice in the New Visualization menu because you can create these maps in *Elastic Maps*.
+Kibana’s out-of-the-box settings no longer offers coordinate and region maps as a
+choice in the New Visualization menu because you can create these maps in the Maps app.
 If you want to create new coordinate and region map visualizations, set `xpack.maps.showMapVisualizationTypes` to `true`.
-
diff --git a/docs/maps/vector-tooltips.asciidoc b/docs/maps/vector-tooltips.asciidoc
index a3772272eeed5a..a8eb6c20bae772 100644
--- a/docs/maps/vector-tooltips.asciidoc
+++ b/docs/maps/vector-tooltips.asciidoc
@@ -15,7 +15,7 @@ image::maps/images/multifeature_tooltip.png[]
 [float]
 [[maps-vector-tooltip-formatting]]
 
-==== Formatting tooltips
+==== Format tooltips
 
 You can format the attributes in a tooltip by adding <<managing-fields, field formatters>> to your
 Kibana index pattern. You can use field formatters to round numbers, provide units,
@@ -23,7 +23,7 @@ and even display images in your tooltip.
 
 [float]
 [[maps-vector-tooltip-locking]]
-==== Locking a tooltip at the current location
+==== Lock a tooltip at the current location
 You can lock a tooltip in place by clicking a location on the map.
 With locked tooltips you can:
 
diff --git a/docs/setup/connect-to-elasticsearch.asciidoc b/docs/setup/connect-to-elasticsearch.asciidoc
index 6d6996c2094c64..8c04167de12361 100644
--- a/docs/setup/connect-to-elasticsearch.asciidoc
+++ b/docs/setup/connect-to-elasticsearch.asciidoc
@@ -40,7 +40,7 @@ repeated production process, but rather for the initial exploration of your data
 === Upload geospatial data
 
 To visualize geospatial data in a point or shape file, you can upload it using the <<geojson-upload, GeoJSON Upload>>
-feature in *Elastic Maps*, and then use that data as a layer in a map.
+feature in Maps, and then use that data as a layer in a map.
 The data is also available for use in the broader Kibana ecosystem, for example,
 in visualizations and Canvas workpads.
 With GeoJSON Upload, you can upload a file up to 50 MB.
diff --git a/docs/user/dashboard.asciidoc b/docs/user/dashboard.asciidoc
index bd6d10c3d7eb3e..a812d4e3bdd2de 100644
--- a/docs/user/dashboard.asciidoc
+++ b/docs/user/dashboard.asciidoc
@@ -66,7 +66,7 @@ image:images/Dashboard_add_new_visualization.png[Example add new visualization t
 +
 For information on how to create visualizations, see <<visualize,Visualize>>.
 +
-For information on how to create Maps, see <<maps,Elastic Maps>>.
+For information on how to create maps, see <<maps,Maps>>.
 
 To add an existing element:
 
diff --git a/docs/user/introduction.asciidoc b/docs/user/introduction.asciidoc
index 8b987f81779e37..6438098ad2c60d 100644
--- a/docs/user/introduction.asciidoc
+++ b/docs/user/introduction.asciidoc
@@ -85,16 +85,16 @@ image::images/intro-dashboard.png[]
 
 * <<visualize, Visualize>> allows you to display your data in
 line charts, bar graphs, pie charts, histograms, and tables
-(just to name a few). It's also home to *Lens*, the drag-and-drop interface.
-*Visualize* supports the ability to add interactive
+(just to name a few). It's also home to Lens, the drag-and-drop interface.
+Visualize supports the ability to add interactive
 controls to your dashboard, and filter dashboard content in real time.
 
 * <<canvas, Canvas>> gives you the ability to present your data in a
 visually compelling, pixel-perfect report. Give your data the “wow” factor
 needed to impress your CEO or to captivate people with a big-screen display.
 
-* <<maps, Elastic Maps>> enables you to ask (and answer) meaningful
-questions of your location-based data. *Elastic Maps* supports multiple
+* <<maps, Maps>> enables you to ask (and answer) meaningful
+questions of your location-based data. Maps supports multiple
 layers and data sources, mapping of individual geo points and shapes,
 and dynamic client-side styling.
 
diff --git a/docs/user/visualize.asciidoc b/docs/user/visualize.asciidoc
index f020f56774dab0..6919b5a8772eff 100644
--- a/docs/user/visualize.asciidoc
+++ b/docs/user/visualize.asciidoc
@@ -38,7 +38,7 @@ Quickly build several types of basic visualizations by simply dragging and dropp
 data sets.
 
 <<visualize-maps, Maps>>::
-* *<<maps,Elastic Maps>>* &mdash; Displays geospatial data in {kib}.
+* *<<maps,Maps>>* &mdash; Displays geospatial data in {kib}.
 
 * <<heat-map,Heat map>>:: Display shaded cells within a matrix.
 
diff --git a/docs/visualize/vega.asciidoc b/docs/visualize/vega.asciidoc
index 5f127df459ed33..24bd3a44bebbae 100644
--- a/docs/visualize/vega.asciidoc
+++ b/docs/visualize/vega.asciidoc
@@ -213,7 +213,7 @@ url: {
 format: {property: "features"}
 ----
 
-To enable Elastic Maps, the graph must specify `type=map` in the host
+To enable Maps, the graph must specify `type=map` in the host
 configuration:
 
 [source,yaml]
@@ -306,7 +306,7 @@ to your kibana.yml file.
 [[vega-useful-links]]
 === Resources and examples
 
-experimental[] To learn more about Vega and Vega-List, refer to the resources and examples. 
+experimental[] To learn more about Vega and Vega-List, refer to the resources and examples.
 
 ==== Vega editor
 The https://vega.github.io/editor/[Vega Editor] includes examples for Vega & Vega-Lite, but does not support any
diff --git a/package.json b/package.json
index 85eba40c6251ad..06dfb4cdfe3872 100644
--- a/package.json
+++ b/package.json
@@ -123,7 +123,7 @@
     "@babel/plugin-transform-modules-commonjs": "^7.10.1",
     "@babel/register": "^7.10.1",
     "@elastic/apm-rum": "^5.2.0",
-    "@elastic/charts": "19.2.0",
+    "@elastic/charts": "19.5.2",
     "@elastic/datemath": "5.0.3",
     "@elastic/ems-client": "7.9.3",
     "@elastic/eui": "24.1.0",
@@ -144,7 +144,6 @@
     "@kbn/test-subj-selector": "0.2.1",
     "@kbn/ui-framework": "1.0.0",
     "@kbn/ui-shared-deps": "1.0.0",
-    "@types/tar": "^4.0.3",
     "JSONStream": "1.3.5",
     "abortcontroller-polyfill": "^1.4.0",
     "accept": "3.0.2",
@@ -390,9 +389,10 @@
     "@types/styled-components": "^5.1.0",
     "@types/supertest": "^2.0.5",
     "@types/supertest-as-promised": "^2.0.38",
+    "@types/tar": "^4.0.3",
+    "@types/testing-library__dom": "^6.10.0",
     "@types/testing-library__react": "^9.1.2",
     "@types/testing-library__react-hooks": "^3.1.0",
-    "@types/testing-library__dom": "^6.10.0",
     "@types/type-detect": "^4.0.1",
     "@types/uuid": "^3.4.4",
     "@types/vinyl-fs": "^2.4.11",
@@ -486,12 +486,10 @@
     "prettier": "^2.0.5",
     "proxyquire": "1.8.0",
     "react-popper-tooltip": "^2.10.1",
-    "react-textarea-autosize": "^7.1.2",
     "regenerate": "^1.4.0",
     "sass-lint": "^1.12.1",
     "selenium-webdriver": "^4.0.0-alpha.7",
     "simple-git": "1.116.0",
-    "simplebar-react": "^2.1.0",
     "sinon": "^7.4.2",
     "strip-ansi": "^3.0.1",
     "supertest": "^3.1.0",
@@ -509,4 +507,4 @@
     "node": "10.21.0",
     "yarn": "^1.21.1"
   }
-}
\ No newline at end of file
+}
diff --git a/packages/kbn-ui-shared-deps/package.json b/packages/kbn-ui-shared-deps/package.json
index 9b5d614451ad8d..ffe40a8fe1c10b 100644
--- a/packages/kbn-ui-shared-deps/package.json
+++ b/packages/kbn-ui-shared-deps/package.json
@@ -9,7 +9,7 @@
     "kbn:watch": "node scripts/build --dev --watch"
   },
   "dependencies": {
-    "@elastic/charts": "19.2.0",
+    "@elastic/charts": "19.5.2",
     "@elastic/eui": "24.1.0",
     "@elastic/numeral": "^2.5.0",
     "@kbn/i18n": "1.0.0",
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index aeeb8c3342e462..f2bc90a5b08d48 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -37,6 +37,9 @@ export class DocLinksService {
       DOC_LINK_VERSION,
       ELASTIC_WEBSITE_URL,
       links: {
+        dashboard: {
+          drilldowns: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/drilldowns.html`,
+        },
         filebeat: {
           base: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}`,
           installation: `${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-installation.html`,
@@ -144,6 +147,9 @@ export interface DocLinksSetup {
   readonly DOC_LINK_VERSION: string;
   readonly ELASTIC_WEBSITE_URL: string;
   readonly links: {
+    readonly dashboard: {
+      readonly drilldowns: string;
+    };
     readonly filebeat: {
       readonly base: string;
       readonly installation: string;
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 0fdb5e415ec0ed..7970d9f3f86bb2 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -607,6 +607,9 @@ export interface DocLinksSetup {
     readonly ELASTIC_WEBSITE_URL: string;
     // (undocumented)
     readonly links: {
+        readonly dashboard: {
+            readonly drilldowns: string;
+        };
         readonly filebeat: {
             readonly base: string;
             readonly installation: string;
diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker b/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker
index d1fb544de733c3..745a3d1f0c8307 100755
--- a/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker
+++ b/src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker
@@ -235,6 +235,8 @@ kibana_vars=(
     xpack.security.session.lifespan
     xpack.security.loginAssistanceMessage
     xpack.security.loginHelp
+    xpack.spaces.enabled
+    xpack.spaces.maxSpaces
     telemetry.allowChangingOptInStatus
     telemetry.enabled
     telemetry.optIn
diff --git a/src/plugins/dashboard/public/index.ts b/src/plugins/dashboard/public/index.ts
index 28606b7dd9784c..17968dd0281e6c 100644
--- a/src/plugins/dashboard/public/index.ts
+++ b/src/plugins/dashboard/public/index.ts
@@ -32,8 +32,10 @@ export {
 export { DashboardConstants, createDashboardEditUrl } from './dashboard_constants';
 
 export { DashboardStart, DashboardUrlGenerator } from './plugin';
-export { DASHBOARD_APP_URL_GENERATOR } from './url_generator';
+export { DASHBOARD_APP_URL_GENERATOR, createDashboardUrlGenerator } from './url_generator';
 export { addEmbeddableToDashboardUrl } from './url_utils/url_helper';
+export { SavedObjectDashboard } from './saved_dashboards';
+export { SavedDashboardPanel } from './types';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new DashboardPlugin(initializerContext);
diff --git a/src/plugins/dashboard/public/url_generator.ts b/src/plugins/dashboard/public/url_generator.ts
index d6805b2d94119e..188de7fd857be8 100644
--- a/src/plugins/dashboard/public/url_generator.ts
+++ b/src/plugins/dashboard/public/url_generator.ts
@@ -28,6 +28,7 @@ import {
 import { setStateToKbnUrl } from '../../kibana_utils/public';
 import { UrlGeneratorsDefinition, UrlGeneratorState } from '../../share/public';
 import { SavedObjectLoader } from '../../saved_objects/public';
+import { ViewMode } from '../../embeddable/public';
 
 export const STATE_STORAGE_KEY = '_a';
 export const GLOBAL_STATE_STORAGE_KEY = '_g';
@@ -73,6 +74,11 @@ export type DashboardAppLinkGeneratorState = UrlGeneratorState<{
    * true is default
    */
   preserveSavedFilters?: boolean;
+
+  /**
+   * View mode of the dashboard.
+   */
+  viewMode?: ViewMode;
 }>;
 
 export const createDashboardUrlGenerator = (
@@ -123,6 +129,7 @@ export const createDashboardUrlGenerator = (
       cleanEmptyKeys({
         query: state.query,
         filters: filters?.filter((f) => !esFilters.isFilterPinned(f)),
+        viewMode: state.viewMode,
       }),
       { useHash },
       `${appBasePath}#/${hash}`
diff --git a/src/plugins/vis_type_timeseries/public/application/components/_color_picker.scss b/src/plugins/vis_type_timeseries/public/application/components/_color_picker.scss
index e486f56fe0fe8a..9d50b0875dd0dd 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/_color_picker.scss
+++ b/src/plugins/vis_type_timeseries/public/application/components/_color_picker.scss
@@ -8,39 +8,6 @@
   position: relative;
 }
 
-.tvbColorPicker__swatch-empty,
-.tvbColorPicker__swatch {
-  // SASSTODO: Replace with EUI component
-  // sass-lint:disable-block placeholder-in-extend
-  @extend .euiColorPickerSwatch;
-}
-
-.tvbColorPicker__swatch-empty {
-  background-color: transparent;
-  background-size: 22px 22px;
-  background-image: repeating-linear-gradient(
-    -45deg,
-    $euiColorDanger,
-    $euiColorDanger 2px,
-    transparent 2px,
-    transparent $euiSize
-  );
-}
-
 .tvbColorPicker__clear {
   margin-left: $euiSizeXS;
 }
-
-.tvbColorPicker__popover {
-  position: absolute;
-  top: $euiSizeL;
-  z-index: 2;
-}
-
-.tvbColorPicker__cover {
-  position: fixed;
-  top: 0;
-  right: 0;
-  left: 0;
-  bottom: 0;
-}
diff --git a/src/plugins/vis_type_timeseries/public/application/components/_custom_color_picker.scss b/src/plugins/vis_type_timeseries/public/application/components/_custom_color_picker.scss
deleted file mode 100644
index f2f5eff35fc5d6..00000000000000
--- a/src/plugins/vis_type_timeseries/public/application/components/_custom_color_picker.scss
+++ /dev/null
@@ -1,97 +0,0 @@
-// EUITODO: Convert to EuiColorPicker
-// with additional support for alpha, saturation, swatches
-
-// SASSTODO: This custom picker moved all styles from react-color inline styles
-// to SASS, but it should be in EUI.
-// Also, some pixel values were kept as is to match inline styles from react-color
-.tvbColorPickerPopUp {
-  @include euiBottomShadowMedium;
-  background-color: $euiColorEmptyShade;
-  border-radius: $euiBorderRadius;
-  box-sizing: initial;
-  width: 275px;
-  font-family: 'Menlo';
-}
-
-.tvbColorPickerPopUp__saturation {
-  width: 100%;
-  padding-bottom: 55%;
-  position: relative;
-  border-radius: $euiBorderRadius $euiBorderRadius 0 0;
-  overflow: hidden;
-}
-
-.tvbColorPickerPopUp__body {
-  padding: $euiSize;
-}
-
-.tvbColorPickerPopUp__controls {
-  display: flex;
-}
-
-.tvbColorPickerPopUp__color {
-  width: $euiSizeXL;
-
-  // The color indicator doesn't work, hiding it until it does
-  display: none;
-}
-
-.tvbColorPickerPopUp__color-disableAlpha {
-  width: $euiSizeL;
-}
-
-.tvbColorPickerPopUp__swatch {
-  margin-top: 6px;
-  width: $euiSize;
-  height: $euiSize;
-  border-radius: $euiSizeS;
-  position: relative;
-  overflow: hidden;
-}
-
-.tvbColorPickerPopUp__swatch-disableAlpha {
-  width: 10px;
-  height: 10px;
-  margin: 0;
-}
-
-.tvbColorPickerPopUp__active {
-  @include euiBottomShadowMedium;
-  position: absolute;
-  top: 0;
-  left: 0;
-  right: 0;
-  bottom: 0;
-  border-radius: $euiSizeS;
-  z-index: 2;
-}
-
-.tvbColorPickerPopUp__toggles {
-  flex: 1;
-}
-
-.tvbColorPickerPopUp__hue {
-  height: 10px;
-  position: relative;
-  margin-bottom: $euiSizeS;
-}
-
-.tvbColorPickerPopUp__hue-disableAlpha {
-  margin-bottom: 0;
-}
-
-.tvbColorPickerPopUp__alpha {
-  height: 10px;
-  position: relative;
-}
-
-.tvbColorPickerPopUp__alpha-disableAlpha {
-  display: none;
-}
-
-.tvbColorPickerPopUp__swatches {
-  display: flex;
-  flex-wrap: wrap;
-  justify-content: center;
-  margin-top: $euiSize;
-}
diff --git a/src/plugins/vis_type_timeseries/public/application/components/_index.scss b/src/plugins/vis_type_timeseries/public/application/components/_index.scss
index 3a10b07c23e2b7..4ee5c1863946b5 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/_index.scss
+++ b/src/plugins/vis_type_timeseries/public/application/components/_index.scss
@@ -1,7 +1,6 @@
 @import './annotations_editor';
 @import './color_rules';
 @import './color_picker';
-@import './custom_color_picker';
 @import './error';
 @import './no_data';
 @import './markdown_editor';
diff --git a/src/plugins/vis_type_timeseries/public/application/components/color_picker.js b/src/plugins/vis_type_timeseries/public/application/components/color_picker.js
deleted file mode 100644
index f12797518cd28f..00000000000000
--- a/src/plugins/vis_type_timeseries/public/application/components/color_picker.js
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/* eslint-disable jsx-a11y/click-events-have-key-events, jsx-a11y/no-static-element-interactions */
-// The color picker is not yet accessible.
-
-import PropTypes from 'prop-types';
-import React, { Component } from 'react';
-import { EuiIconTip } from '@elastic/eui';
-import { CustomColorPicker } from './custom_color_picker';
-import { i18n } from '@kbn/i18n';
-
-export class ColorPicker extends Component {
-  constructor(props) {
-    super(props);
-    this.state = {
-      displayPicker: false,
-      color: {},
-    };
-  }
-
-  handleChange = (color) => {
-    const { rgb } = color;
-    const part = {};
-    part[this.props.name] = `rgba(${rgb.r},${rgb.g},${rgb.b},${rgb.a})`;
-    if (this.props.onChange) this.props.onChange(part);
-  };
-
-  handleClick = () => {
-    this.setState({ displayPicker: !this.state.displayColorPicker });
-  };
-
-  handleClose = () => {
-    this.setState({ displayPicker: false });
-  };
-
-  handleClear = () => {
-    const part = {};
-    part[this.props.name] = null;
-    this.props.onChange(part);
-  };
-
-  renderSwatch() {
-    if (!this.props.value) {
-      return (
-        <button
-          aria-label={i18n.translate('visTypeTimeseries.colorPicker.notAccessibleAriaLabel', {
-            defaultMessage: 'Color picker, not accessible',
-          })}
-          className="tvbColorPicker__swatch-empty"
-          onClick={this.handleClick}
-        />
-      );
-    }
-    return (
-      <button
-        aria-label={i18n.translate(
-          'visTypeTimeseries.colorPicker.notAccessibleWithValueAriaLabel',
-          {
-            defaultMessage: 'Color picker ({value}), not accessible',
-            values: { value: this.props.value },
-          }
-        )}
-        style={{ backgroundColor: this.props.value }}
-        className="tvbColorPicker__swatch"
-        onClick={this.handleClick}
-      />
-    );
-  }
-
-  render() {
-    const swatch = this.renderSwatch();
-    const value = this.props.value || undefined;
-    let clear;
-    if (!this.props.disableTrash) {
-      clear = (
-        <div className="tvbColorPicker__clear" onClick={this.handleClear}>
-          <EuiIconTip
-            size="s"
-            type="cross"
-            color="danger"
-            content={i18n.translate('visTypeTimeseries.colorPicker.clearIconLabel', {
-              defaultMessage: 'Clear',
-            })}
-          />
-        </div>
-      );
-    }
-    return (
-      <div className="tvbColorPicker" data-test-subj="tvbColorPicker">
-        {swatch}
-        {clear}
-        {this.state.displayPicker ? (
-          <div className="tvbColorPicker__popover">
-            <div className="tvbColorPicker__cover" onClick={this.handleClose} />
-            <CustomColorPicker color={value} onChangeComplete={this.handleChange} />
-          </div>
-        ) : null}
-      </div>
-    );
-  }
-}
-
-ColorPicker.propTypes = {
-  name: PropTypes.string.isRequired,
-  value: PropTypes.oneOfType([PropTypes.string, PropTypes.number]),
-  disableTrash: PropTypes.bool,
-  onChange: PropTypes.func,
-};
diff --git a/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.js b/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.js
deleted file mode 100644
index 8d3c65833bdda2..00000000000000
--- a/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.js
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import { ColorPicker } from './color_picker';
-import { mount } from 'enzyme';
-import { CustomColorPicker } from './custom_color_picker';
-
-const defaultProps = {
-  name: 'color',
-  value: null,
-  onChange: jest.fn(),
-  disableTrash: true,
-};
-
-describe('ColorPicker', () => {
-  it('should change state after click', () => {
-    const wrapper = mount(<ColorPicker {...defaultProps} />);
-
-    const stateBefore = wrapper.state();
-    wrapper.find('button').at(0).simulate('click');
-    const stateAfter = wrapper.state();
-
-    expect(stateBefore.displayPicker).toBe(!stateAfter.displayPicker);
-  });
-
-  it('should close popup after click', () => {
-    const wrapper = mount(<ColorPicker {...defaultProps} />);
-    wrapper.setState({ displayPicker: true });
-
-    wrapper.find('.tvbColorPicker__cover').simulate('click');
-
-    expect(wrapper.state().displayPicker).toBeFalsy();
-  });
-
-  it('should exist CustomColorPickerUI component', () => {
-    const wrapper = mount(<ColorPicker {...defaultProps} />);
-    wrapper.setState({ displayPicker: true });
-
-    const w2 = wrapper.find(CustomColorPicker).exists();
-
-    expect(w2).toBeTruthy();
-  });
-
-  it('should call clear function', () => {
-    const props = { ...defaultProps, disableTrash: false, value: 'rgba(85,66,177,1)' };
-    const wrapper = mount(<ColorPicker {...props} />);
-
-    wrapper.find('.tvbColorPicker__clear').simulate('click');
-
-    expect(defaultProps.onChange).toHaveBeenCalled();
-  });
-});
diff --git a/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.tsx b/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.tsx
new file mode 100644
index 00000000000000..ca8750a991d836
--- /dev/null
+++ b/src/plugins/vis_type_timeseries/public/application/components/color_picker.test.tsx
@@ -0,0 +1,61 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import { ColorPicker, ColorPickerProps } from './color_picker';
+import { mount } from 'enzyme';
+import { ReactWrapper } from 'enzyme';
+import { EuiColorPicker, EuiIconTip } from '@elastic/eui';
+
+describe('ColorPicker', () => {
+  const defaultProps: ColorPickerProps = {
+    name: 'color',
+    value: null,
+    onChange: jest.fn(),
+    disableTrash: true,
+  };
+  let component: ReactWrapper<ColorPickerProps>;
+
+  it('should render the EuiColorPicker', () => {
+    component = mount(<ColorPicker {...defaultProps} />);
+    expect(component.find(EuiColorPicker).length).toBe(1);
+  });
+
+  it('should not render the clear button', () => {
+    component = mount(<ColorPicker {...defaultProps} />);
+    expect(component.find('.tvbColorPicker__clear').length).toBe(0);
+  });
+
+  it('should render the correct aria label to the color swatch button', () => {
+    const props = { ...defaultProps, value: 'rgba(85,66,177,0.59)' };
+    component = mount(<ColorPicker {...props} />);
+    const button = component.find('.tvbColorPicker button');
+    expect(button.prop('aria-label')).toBe('Color picker (rgba(85,66,177,0.59)), not accessible');
+  });
+
+  it('should call clear function if the disableTrash prop is false', () => {
+    const props = { ...defaultProps, disableTrash: false, value: 'rgba(85,66,177,1)' };
+    component = mount(<ColorPicker {...props} />);
+
+    component.find('.tvbColorPicker__clear').simulate('click');
+
+    expect(component.find(EuiIconTip).length).toBe(1);
+    expect(defaultProps.onChange).toHaveBeenCalled();
+  });
+});
diff --git a/src/plugins/vis_type_timeseries/public/application/components/color_picker.tsx b/src/plugins/vis_type_timeseries/public/application/components/color_picker.tsx
new file mode 100644
index 00000000000000..be580c80d5941b
--- /dev/null
+++ b/src/plugins/vis_type_timeseries/public/application/components/color_picker.tsx
@@ -0,0 +1,95 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/* eslint-disable jsx-a11y/click-events-have-key-events, jsx-a11y/no-static-element-interactions */
+// The color picker is not yet accessible.
+
+import React, { useState } from 'react';
+import {
+  EuiIconTip,
+  EuiColorPicker,
+  EuiColorPickerProps,
+  EuiColorPickerSwatch,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+const COMMAS_NUMS_ONLY_RE = /[^0-9,]/g;
+
+interface ColorProps {
+  [key: string]: string | null;
+}
+
+export interface ColorPickerProps {
+  name: string;
+  value: string | null;
+  disableTrash?: boolean;
+  onChange: (props: ColorProps) => void;
+}
+
+export function ColorPicker({ name, value, disableTrash = false, onChange }: ColorPickerProps) {
+  const initialColorValue = value ? value.replace(COMMAS_NUMS_ONLY_RE, '') : '';
+  const [color, setColor] = useState(initialColorValue);
+
+  const handleColorChange: EuiColorPickerProps['onChange'] = (text: string, { rgba, hex }) => {
+    setColor(text);
+    const part: ColorProps = {};
+    part[name] = hex ? `rgba(${rgba.join(',')})` : '';
+    onChange(part);
+  };
+
+  const handleClear = () => {
+    setColor('');
+    const part: ColorProps = {};
+    part[name] = null;
+    onChange(part);
+  };
+
+  const label = value
+    ? i18n.translate('visTypeTimeseries.colorPicker.notAccessibleWithValueAriaLabel', {
+        defaultMessage: 'Color picker ({value}), not accessible',
+        values: { value },
+      })
+    : i18n.translate('visTypeTimeseries.colorPicker.notAccessibleAriaLabel', {
+        defaultMessage: 'Color picker, not accessible',
+      });
+
+  return (
+    <div className="tvbColorPicker" data-test-subj="tvbColorPicker">
+      <EuiColorPicker
+        onChange={handleColorChange}
+        color={color}
+        secondaryInputDisplay="top"
+        showAlpha
+        button={<EuiColorPickerSwatch color={color} aria-label={label} />}
+      />
+      {!disableTrash && (
+        <div className="tvbColorPicker__clear" onClick={handleClear}>
+          <EuiIconTip
+            size="s"
+            type="cross"
+            color="danger"
+            content={i18n.translate('visTypeTimeseries.colorPicker.clearIconLabel', {
+              defaultMessage: 'Clear',
+            })}
+          />
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/src/plugins/vis_type_timeseries/public/application/components/custom_color_picker.js b/src/plugins/vis_type_timeseries/public/application/components/custom_color_picker.js
deleted file mode 100644
index bb10c9f495f563..00000000000000
--- a/src/plugins/vis_type_timeseries/public/application/components/custom_color_picker.js
+++ /dev/null
@@ -1,200 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import PropTypes from 'prop-types';
-import React, { PureComponent } from 'react';
-
-import {
-  ColorWrap as colorWrap,
-  Saturation,
-  Hue,
-  Alpha,
-  Checkboard,
-} from 'react-color/lib/components/common';
-import ChromeFields from 'react-color/lib/components/chrome/ChromeFields';
-import ChromePointer from 'react-color/lib/components/chrome/ChromePointer';
-import ChromePointerCircle from 'react-color/lib/components/chrome/ChromePointerCircle';
-import CompactColor from 'react-color/lib/components/compact/CompactColor';
-import color from 'react-color/lib/helpers/color';
-
-class CustomColorPickerUI extends PureComponent {
-  constructor(props) {
-    super(props);
-    this.handleChange = this.handleChange.bind(this);
-  }
-
-  handleChange(data) {
-    this.props.onChange(data);
-  }
-
-  render() {
-    const rgb = this.props.rgb;
-
-    const styles = {
-      active: {
-        background: `rgba(${rgb.r}, ${rgb.g}, ${rgb.b}, ${rgb.a})`,
-      },
-      Saturation: {
-        radius: '2px 2px 0 0 ',
-      },
-      Hue: {
-        radius: '2px',
-      },
-      Alpha: {
-        radius: '2px',
-      },
-    };
-
-    const handleSwatchChange = (data) => {
-      if (data.hex) {
-        color.isValidHex(data.hex) &&
-          this.props.onChange({
-            hex: data.hex,
-            source: 'hex',
-          });
-      } else {
-        this.props.onChange(data);
-      }
-    };
-
-    const swatches = this.props.colors.map((c) => {
-      return <CompactColor key={c} color={c} onClick={handleSwatchChange} />;
-    });
-
-    return (
-      <div className="tvbColorPickerPopUp" data-test-subj="tvbColorPickerPopUp">
-        <div className="tvbColorPickerPopUp__saturation">
-          <Saturation
-            style={styles.Saturation}
-            {...this.props}
-            pointer={ChromePointerCircle}
-            onChange={this.handleChange}
-          />
-        </div>
-        <div className="tvbColorPickerPopUp__body">
-          <div className="tvbColorPickerPopUp__controls">
-            <div
-              className={
-                this.props.disableAlpha
-                  ? 'tvbColorPickerPopUp__color-disableAlpha'
-                  : 'tvbColorPickerPopUp__color'
-              }
-            >
-              <div
-                className={
-                  this.props.disableAlpha
-                    ? 'tvbColorPickerPopUp__swatch-disableAlpha'
-                    : 'tvbColorPickerPopUp__swatch'
-                }
-              >
-                <div className="tvbColorPickerPopUp__active" />
-                <Checkboard />
-              </div>
-            </div>
-            <div className="tvbColorPickerPopUp__toggles">
-              <div
-                className={
-                  this.props.disableAlpha
-                    ? 'tvbColorPickerPopUp__hue-disableAlpha'
-                    : 'tvbColorPickerPopUp__hue'
-                }
-              >
-                <Hue
-                  style={styles.Hue}
-                  {...this.props}
-                  pointer={ChromePointer}
-                  onChange={this.handleChange}
-                />
-              </div>
-              <div
-                className={
-                  this.props.disableAlpha
-                    ? 'tvbColorPickerPopUp__alpha-disableAlpha'
-                    : 'tvbColorPickerPopUp__alpha'
-                }
-              >
-                <Alpha
-                  style={styles.Alpha}
-                  {...this.props}
-                  pointer={ChromePointer}
-                  onChange={this.handleChange}
-                />
-              </div>
-            </div>
-          </div>
-          <ChromeFields
-            {...this.props}
-            onChange={this.handleChange}
-            disableAlpha={this.props.disableAlpha}
-          />
-          <div className="tvbColorPickerPopUp__swatches">{swatches}</div>
-        </div>
-      </div>
-    );
-  }
-}
-
-CustomColorPickerUI.defaultProps = {
-  colors: [
-    '#4D4D4D',
-    '#999999',
-    '#FFFFFF',
-    '#F44E3B',
-    '#FE9200',
-    '#FCDC00',
-    '#DBDF00',
-    '#A4DD00',
-    '#68CCCA',
-    '#73D8FF',
-    '#AEA1FF',
-    '#FDA1FF',
-    '#333333',
-    '#808080',
-    '#cccccc',
-    '#D33115',
-    '#E27300',
-    '#FCC400',
-    '#B0BC00',
-    '#68BC00',
-    '#16A5A5',
-    '#009CE0',
-    '#7B64FF',
-    '#FA28FF',
-    '#0F1419',
-    '#666666',
-    '#B3B3B3',
-    '#9F0500',
-    '#C45100',
-    '#FB9E00',
-    '#808900',
-    '#194D33',
-    '#0C797D',
-    '#0062B1',
-    '#653294',
-    '#AB149E',
-  ],
-};
-
-CustomColorPickerUI.propTypes = {
-  color: PropTypes.oneOfType([PropTypes.string, PropTypes.object]),
-  onChangeComplete: PropTypes.func,
-  onChange: PropTypes.func,
-};
-
-export const CustomColorPicker = colorWrap(CustomColorPickerUI);
diff --git a/test/accessibility/services/a11y/a11y.ts b/test/accessibility/services/a11y/a11y.ts
index 525445c60818ad..35cef2b81d64ea 100644
--- a/test/accessibility/services/a11y/a11y.ts
+++ b/test/accessibility/services/a11y/a11y.ts
@@ -99,6 +99,9 @@ export function A11yProvider({ getService }: FtrProviderContext) {
           'color-contrast': {
             enabled: false,
           },
+          bypass: {
+            enabled: false, // disabled because it's too flaky
+          },
         },
       };
 
diff --git a/test/functional/apps/dashboard/dashboard_snapshots.js b/test/functional/apps/dashboard/dashboard_snapshots.js
index 787e839aa08a5c..20bc30c889d651 100644
--- a/test/functional/apps/dashboard/dashboard_snapshots.js
+++ b/test/functional/apps/dashboard/dashboard_snapshots.js
@@ -28,7 +28,8 @@ export default function ({ getService, getPageObjects, updateBaselines }) {
   const dashboardPanelActions = getService('dashboardPanelActions');
   const dashboardAddPanel = getService('dashboardAddPanel');
 
-  describe('dashboard snapshots', function describeIndexTests() {
+  // FLAKY: https://github.com/elastic/kibana/issues/52854
+  describe.skip('dashboard snapshots', function describeIndexTests() {
     before(async function () {
       await esArchiver.load('dashboard/current/kibana');
       await kibanaServer.uiSettings.replace({
diff --git a/test/functional/page_objects/visual_builder_page.ts b/test/functional/page_objects/visual_builder_page.ts
index 6649231887a4d1..b002bbb171adb1 100644
--- a/test/functional/page_objects/visual_builder_page.ts
+++ b/test/functional/page_objects/visual_builder_page.ts
@@ -502,14 +502,14 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
     public async setBackgroundColor(colorHex: string): Promise<void> {
       await this.clickColorPicker();
       await this.checkColorPickerPopUpIsPresent();
-      await find.setValue('.tvbColorPickerPopUp input', colorHex);
+      await find.setValue('.euiColorPicker input', colorHex);
       await this.clickColorPicker();
       await PageObjects.visChart.waitForVisualizationRenderingStabilized();
     }
 
     public async checkColorPickerPopUpIsPresent(): Promise<void> {
       log.debug(`Check color picker popup is present`);
-      await testSubjects.existOrFail('tvbColorPickerPopUp', { timeout: 5000 });
+      await testSubjects.existOrFail('colorPickerPopover', { timeout: 5000 });
     }
 
     public async changePanelPreview(nth: number = 0): Promise<void> {
diff --git a/vars/kibanaPipeline.groovy b/vars/kibanaPipeline.groovy
index ca9af5d2346cd2..4a5c8dff8a2301 100644
--- a/vars/kibanaPipeline.groovy
+++ b/vars/kibanaPipeline.groovy
@@ -98,7 +98,7 @@ def withGcsArtifactUpload(workerName, closure) {
   def uploadPrefix = "kibana-ci-artifacts/jobs/${env.JOB_NAME}/${BUILD_NUMBER}/${workerName}"
   def ARTIFACT_PATTERNS = [
     'target/kibana-*',
-    'target/kibana-siem/**/*.png',
+    'target/kibana-security-solution/**/*.png',
     'target/junit/**/*',
     'test/**/screenshots/**/*.png',
     'test/functional/failure_debug/html/*.html',
diff --git a/x-pack/package.json b/x-pack/package.json
index e24d75cc0d9680..b40a1e43642516 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -61,6 +61,7 @@
     "@types/d3-shape": "^1.3.1",
     "@types/d3-time": "^1.0.10",
     "@types/d3-time-format": "^2.1.1",
+    "@types/dragselect": "^1.13.1",
     "@types/elasticsearch": "^5.0.33",
     "@types/fancy-log": "^1.3.1",
     "@types/file-saver": "^2.0.0",
diff --git a/x-pack/plugins/apm/common/ml_job_constants.test.ts b/x-pack/plugins/apm/common/ml_job_constants.test.ts
index 020eb993eac899..45bb7133e852ef 100644
--- a/x-pack/plugins/apm/common/ml_job_constants.test.ts
+++ b/x-pack/plugins/apm/common/ml_job_constants.test.ts
@@ -5,7 +5,6 @@
  */
 
 import {
-  getMlIndex,
   getMlJobId,
   getMlPrefix,
   getMlJobServiceName,
@@ -36,16 +35,6 @@ describe('ml_job_constants', () => {
     );
   });
 
-  it('getMlIndex', () => {
-    expect(getMlIndex('myServiceName')).toBe(
-      '.ml-anomalies-myservicename-high_mean_response_time'
-    );
-
-    expect(getMlIndex('myServiceName', 'myTransactionType')).toBe(
-      '.ml-anomalies-myservicename-mytransactiontype-high_mean_response_time'
-    );
-  });
-
   describe('getMlJobServiceName', () => {
     it('extracts the service name from a job id', () => {
       expect(
diff --git a/x-pack/plugins/apm/common/ml_job_constants.ts b/x-pack/plugins/apm/common/ml_job_constants.ts
index 0f0add7c4226b4..f9b0119d8a107e 100644
--- a/x-pack/plugins/apm/common/ml_job_constants.ts
+++ b/x-pack/plugins/apm/common/ml_job_constants.ts
@@ -26,10 +26,6 @@ export function getMlJobServiceName(jobId: string) {
   return jobId.split('-').slice(0, -2).join('-');
 }
 
-export function getMlIndex(serviceName: string, transactionType?: string) {
-  return `.ml-anomalies-${getMlJobId(serviceName, transactionType)}`;
-}
-
 export function encodeForMlApi(value: string) {
   return value.replace(/\s+/g, '_').toLowerCase();
 }
diff --git a/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js b/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js
index 2fae8bdab2b303..d4c8ba49108505 100644
--- a/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js
+++ b/x-pack/plugins/apm/e2e/cypress/integration/snapshots.js
@@ -1,9 +1,9 @@
 module.exports = {
   APM: {
     'Transaction duration charts': {
-      '1': '350.0 ms',
-      '2': '175.0 ms',
-      '3': '0.0 ms',
+      '1': '350 ms',
+      '2': '175 ms',
+      '3': '0 ms',
     },
   },
   __version: '4.5.0',
diff --git a/x-pack/plugins/apm/public/components/app/ServiceDetails/index.tsx b/x-pack/plugins/apm/public/components/app/ServiceDetails/index.tsx
index 0dbde5ea86a187..2d52ad88d20dca 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceDetails/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/ServiceDetails/index.tsx
@@ -4,8 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiFlexGroup, EuiFlexItem, EuiTitle } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiTitle,
+  EuiButtonEmpty,
+} from '@elastic/eui';
 import React from 'react';
+import { i18n } from '@kbn/i18n';
 import { ApmHeader } from '../../shared/ApmHeader';
 import { ServiceDetailTabs } from './ServiceDetailTabs';
 import { ServiceIntegrations } from './ServiceIntegrations';
@@ -33,6 +39,12 @@ export function ServiceDetails({ tab }: Props) {
   const isAlertingAvailable =
     isAlertingPluginEnabled && (canReadAlerts || canSaveAlerts);
 
+  const { core } = useApmPluginContext();
+
+  const ADD_DATA_LABEL = i18n.translate('xpack.apm.addDataButtonLabel', {
+    defaultMessage: 'Add data',
+  });
+
   return (
     <div>
       <ApmHeader>
@@ -53,6 +65,16 @@ export function ServiceDetails({ tab }: Props) {
               />
             </EuiFlexItem>
           )}
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              href={core.http.basePath.prepend('/app/home#/tutorial/apm')}
+              size="s"
+              color="primary"
+              iconType="plusInCircle"
+            >
+              {ADD_DATA_LABEL}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
         </EuiFlexGroup>
       </ApmHeader>
 
diff --git a/x-pack/plugins/apm/public/components/app/ServiceOverview/ServiceList/__test__/List.test.js b/x-pack/plugins/apm/public/components/app/ServiceOverview/ServiceList/__test__/List.test.js
index 09fef5da16ae71..927779b571fd8c 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceOverview/ServiceList/__test__/List.test.js
+++ b/x-pack/plugins/apm/public/components/app/ServiceOverview/ServiceList/__test__/List.test.js
@@ -40,7 +40,7 @@ describe('ServiceOverview -> List', () => {
     expect(renderedColumns[0]).toMatchSnapshot();
     expect(renderedColumns.slice(2)).toEqual([
       'python',
-      '91.5 ms',
+      '92 ms',
       '86.9 tpm',
       '12.6 err.',
     ]);
diff --git a/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/__snapshots__/ServiceOverview.test.tsx.snap b/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/__snapshots__/ServiceOverview.test.tsx.snap
index e89acca55d4fe5..241ba8c2444961 100644
--- a/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/__snapshots__/ServiceOverview.test.tsx.snap
+++ b/x-pack/plugins/apm/public/components/app/ServiceOverview/__test__/__snapshots__/ServiceOverview.test.tsx.snap
@@ -114,7 +114,7 @@ NodeList [
                   <span
                     class="euiButton__text"
                   >
-                    Setup Instructions
+                    Setup instructions
                   </span>
                 </span>
               </button>
diff --git a/x-pack/plugins/apm/public/components/shared/Links/SetupInstructionsLink.tsx b/x-pack/plugins/apm/public/components/shared/Links/SetupInstructionsLink.tsx
index e85605e42981cb..a5bcec1501ad3f 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/SetupInstructionsLink.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/SetupInstructionsLink.tsx
@@ -12,10 +12,14 @@ import { useApmPluginContext } from '../../../hooks/useApmPluginContext';
 const SETUP_INSTRUCTIONS_LABEL = i18n.translate(
   'xpack.apm.setupInstructionsButtonLabel',
   {
-    defaultMessage: 'Setup Instructions',
+    defaultMessage: 'Setup instructions',
   }
 );
 
+const ADD_DATA_LABEL = i18n.translate('xpack.apm.addDataButtonLabel', {
+  defaultMessage: 'Add data',
+});
+
 // renders a filled button or a link as a kibana link to setup instructions
 export function SetupInstructionsLink({
   buttonFill = false,
@@ -30,8 +34,8 @@ export function SetupInstructionsLink({
           {SETUP_INSTRUCTIONS_LABEL}
         </EuiButton>
       ) : (
-        <EuiButtonEmpty size="s" color="primary" iconType="help">
-          {SETUP_INSTRUCTIONS_LABEL}
+        <EuiButtonEmpty size="s" color="primary" iconType="plusInCircle">
+          {ADD_DATA_LABEL}
         </EuiButtonEmpty>
       )}
     </EuiLink>
diff --git a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap
index ba3174156d5d45..6c5a200fb6f270 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap
+++ b/x-pack/plugins/apm/public/components/shared/charts/CustomPlot/test/__snapshots__/CustomPlot.test.js.snap
@@ -9,7 +9,7 @@ Array [
     "text": <ForwardRef(styled.span)>
       Avg.
       <ForwardRef(styled.span)>
-        467.6 ms
+        468 ms
       </ForwardRef(styled.span)>
     </ForwardRef(styled.span)>,
   },
@@ -2744,7 +2744,7 @@ Array [
                 <span
                   className="c4"
                 >
-                  467.6 ms
+                  468 ms
                 </span>
               </styled.span>
             </span>
@@ -5923,7 +5923,7 @@ Array [
                 <span
                   className="c4"
                 >
-                  467.6 ms
+                  468 ms
                 </span>
               </styled.span>
             </span>
diff --git a/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js b/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js
index f84b0cfeda369c..7eaeecca31b36c 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js
+++ b/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/Histogram.test.js
@@ -11,8 +11,8 @@ import d3 from 'd3';
 import { HistogramInner } from '../index';
 import response from './response.json';
 import {
-  asDecimal,
   getDurationFormatter,
+  asInteger,
 } from '../../../../../utils/formatters';
 import { toJson } from '../../../../../utils/testHelpers';
 import { getFormattedBuckets } from '../../../../app/TransactionDetails/Distribution/index';
@@ -33,8 +33,8 @@ describe('Histogram', () => {
         transactionId="myTransactionId"
         onClick={onClick}
         formatX={(time) => timeFormatter(time).formatted}
-        formatYShort={(t) => `${asDecimal(t)} occ.`}
-        formatYLong={(t) => `${asDecimal(t)} occurrences`}
+        formatYShort={(t) => `${asInteger(t)} occ.`}
+        formatYLong={(t) => `${asInteger(t)} occurrences`}
         tooltipHeader={(bucket) => {
           const xFormatted = timeFormatter(bucket.x);
           const x0Formatted = timeFormatter(bucket.x0);
@@ -78,9 +78,9 @@ describe('Histogram', () => {
       const tooltips = wrapper.find('Tooltip');
 
       expect(tooltips.length).toBe(1);
-      expect(tooltips.prop('header')).toBe('811.1 - 926.9 ms');
+      expect(tooltips.prop('header')).toBe('811 - 927 ms');
       expect(tooltips.prop('tooltipPoints')).toEqual([
-        { value: '49.0 occurrences' },
+        { value: '49 occurrences' },
       ]);
       expect(tooltips.prop('x')).toEqual(869010);
       expect(tooltips.prop('y')).toEqual(27.5);
diff --git a/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/__snapshots__/Histogram.test.js.snap b/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/__snapshots__/Histogram.test.js.snap
index ff38ae4b563dd1..1f935af7c89999 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/__snapshots__/Histogram.test.js.snap
+++ b/x-pack/plugins/apm/public/components/shared/charts/Histogram/__test__/__snapshots__/Histogram.test.js.snap
@@ -127,7 +127,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="middle"
                   transform="translate(0, 18)"
                 >
-                  0.0 ms
+                  0 ms
                 </text>
               </g>
               <g
@@ -162,7 +162,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="middle"
                   transform="translate(0, 18)"
                 >
-                  500.0 ms
+                  500 ms
                 </text>
               </g>
               <g
@@ -197,7 +197,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="middle"
                   transform="translate(0, 18)"
                 >
-                  1,000.0 ms
+                  1,000 ms
                 </text>
               </g>
               <g
@@ -232,7 +232,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="middle"
                   transform="translate(0, 18)"
                 >
-                  1,500.0 ms
+                  1,500 ms
                 </text>
               </g>
               <g
@@ -267,7 +267,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="middle"
                   transform="translate(0, 18)"
                 >
-                  2,000.0 ms
+                  2,000 ms
                 </text>
               </g>
               <g
@@ -302,7 +302,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="middle"
                   transform="translate(0, 18)"
                 >
-                  2,500.0 ms
+                  2,500 ms
                 </text>
               </g>
               <g
@@ -337,7 +337,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="middle"
                   transform="translate(0, 18)"
                 >
-                  3,000.0 ms
+                  3,000 ms
                 </text>
               </g>
             </g>
@@ -371,7 +371,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="end"
                   transform="translate(-8, 0)"
                 >
-                  0.0 occ.
+                  0 occ.
                 </text>
               </g>
               <g
@@ -394,7 +394,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="end"
                   transform="translate(-8, 0)"
                 >
-                  27.5 occ.
+                  28 occ.
                 </text>
               </g>
               <g
@@ -417,7 +417,7 @@ exports[`Histogram Initially should have default markup 1`] = `
                   textAnchor="end"
                   transform="translate(-8, 0)"
                 >
-                  55.0 occ.
+                  55 occ.
                 </text>
               </g>
             </g>
@@ -1477,7 +1477,7 @@ exports[`Histogram when hovering over a non-empty bucket should have correct mar
         <div
           className="c1"
         >
-          811.1 - 926.9 ms
+          811 - 927 ms
         </div>
       </styled.div>
       <styled.div>
@@ -1488,7 +1488,7 @@ exports[`Histogram when hovering over a non-empty bucket should have correct mar
             <div
               className="c3"
             >
-              49.0 occurrences
+              49 occurrences
             </div>
           </styled.div>
         </div>
diff --git a/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/ErrorMarker.test.tsx b/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/ErrorMarker.test.tsx
index 2b6f0c7aa1319f..7dc68910c6bedf 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/ErrorMarker.test.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/ErrorMarker.test.tsx
@@ -37,7 +37,7 @@ describe('ErrorMarker', () => {
     act(() => {
       fireEvent.click(component.getByTestId('popover'));
     });
-    expectTextsInDocument(component, ['10.0 ms']);
+    expectTextsInDocument(component, ['10 ms']);
     return component;
   }
   function getKueryDecoded(url: string) {
diff --git a/x-pack/plugins/apm/public/utils/formatters/__test__/duration.test.ts b/x-pack/plugins/apm/public/utils/formatters/__test__/duration.test.ts
index 6d4b65d2aa9b41..c4d59beb4b7a2a 100644
--- a/x-pack/plugins/apm/public/utils/formatters/__test__/duration.test.ts
+++ b/x-pack/plugins/apm/public/utils/formatters/__test__/duration.test.ts
@@ -14,14 +14,14 @@ describe('duration formatters', () => {
       expect(asDuration(1)).toEqual('1 μs');
       expect(asDuration(toMicroseconds(1, 'milliseconds'))).toEqual('1,000 μs');
       expect(asDuration(toMicroseconds(1000, 'milliseconds'))).toEqual(
-        '1,000.0 ms'
+        '1,000 ms'
       );
       expect(asDuration(toMicroseconds(10000, 'milliseconds'))).toEqual(
-        '10,000.0 ms'
+        '10,000 ms'
       );
-      expect(asDuration(toMicroseconds(20, 'seconds'))).toEqual('20.0 s');
-      expect(asDuration(toMicroseconds(10, 'minutes'))).toEqual('10.0 min');
-      expect(asDuration(toMicroseconds(1, 'hours'))).toEqual('60.0 min');
+      expect(asDuration(toMicroseconds(20, 'seconds'))).toEqual('20 s');
+      expect(asDuration(toMicroseconds(10, 'minutes'))).toEqual('10 min');
+      expect(asDuration(toMicroseconds(1, 'hours'))).toEqual('60 min');
       expect(asDuration(toMicroseconds(1.5, 'hours'))).toEqual('1.5 h');
     });
 
@@ -41,7 +41,7 @@ describe('duration formatters', () => {
 
   describe('asMilliseconds', () => {
     it('converts to formatted decimal milliseconds', () => {
-      expect(asMillisecondDuration(0)).toEqual('0.0 ms');
+      expect(asMillisecondDuration(0)).toEqual('0 ms');
     });
   });
 });
diff --git a/x-pack/plugins/apm/public/utils/formatters/duration.ts b/x-pack/plugins/apm/public/utils/formatters/duration.ts
index a603faab37538f..64a9e3b952b987 100644
--- a/x-pack/plugins/apm/public/utils/formatters/duration.ts
+++ b/x-pack/plugins/apm/public/utils/formatters/duration.ts
@@ -18,13 +18,6 @@ interface FormatterOptions {
 
 type DurationTimeUnit = TimeUnit | 'microseconds';
 
-interface DurationUnit {
-  [unit: string]: {
-    label: string;
-    convert: (value: number) => string;
-  };
-}
-
 interface ConvertedDuration {
   value: string;
   unit?: string;
@@ -38,42 +31,69 @@ export type TimeFormatter = (
 
 type TimeFormatterBuilder = (max: number) => TimeFormatter;
 
-const durationUnit: DurationUnit = {
-  hours: {
-    label: i18n.translate('xpack.apm.formatters.hoursTimeUnitLabel', {
-      defaultMessage: 'h',
-    }),
-    convert: (value: number) =>
-      asDecimal(moment.duration(value / 1000).asHours()),
-  },
-  minutes: {
-    label: i18n.translate('xpack.apm.formatters.minutesTimeUnitLabel', {
-      defaultMessage: 'min',
-    }),
-    convert: (value: number) =>
-      asDecimal(moment.duration(value / 1000).asMinutes()),
-  },
-  seconds: {
-    label: i18n.translate('xpack.apm.formatters.secondsTimeUnitLabel', {
-      defaultMessage: 's',
-    }),
-    convert: (value: number) =>
-      asDecimal(moment.duration(value / 1000).asSeconds()),
-  },
-  milliseconds: {
-    label: i18n.translate('xpack.apm.formatters.millisTimeUnitLabel', {
-      defaultMessage: 'ms',
-    }),
-    convert: (value: number) =>
-      asDecimal(moment.duration(value / 1000).asMilliseconds()),
-  },
-  microseconds: {
-    label: i18n.translate('xpack.apm.formatters.microsTimeUnitLabel', {
-      defaultMessage: 'μs',
-    }),
-    convert: (value: number) => asInteger(value),
-  },
-};
+function asDecimalOrInteger(value: number) {
+  // exact 0 or above 10 should not have decimal
+  if (value === 0 || value >= 10) {
+    return asInteger(value);
+  }
+  return asDecimal(value);
+}
+
+function getUnitLabelAndConvertedValue(
+  unitKey: DurationTimeUnit,
+  value: number
+) {
+  switch (unitKey) {
+    case 'hours': {
+      return {
+        unitLabel: i18n.translate('xpack.apm.formatters.hoursTimeUnitLabel', {
+          defaultMessage: 'h',
+        }),
+        convertedValue: asDecimalOrInteger(
+          moment.duration(value / 1000).asHours()
+        ),
+      };
+    }
+    case 'minutes': {
+      return {
+        unitLabel: i18n.translate('xpack.apm.formatters.minutesTimeUnitLabel', {
+          defaultMessage: 'min',
+        }),
+        convertedValue: asDecimalOrInteger(
+          moment.duration(value / 1000).asMinutes()
+        ),
+      };
+    }
+    case 'seconds': {
+      return {
+        unitLabel: i18n.translate('xpack.apm.formatters.secondsTimeUnitLabel', {
+          defaultMessage: 's',
+        }),
+        convertedValue: asDecimalOrInteger(
+          moment.duration(value / 1000).asSeconds()
+        ),
+      };
+    }
+    case 'milliseconds': {
+      return {
+        unitLabel: i18n.translate('xpack.apm.formatters.millisTimeUnitLabel', {
+          defaultMessage: 'ms',
+        }),
+        convertedValue: asDecimalOrInteger(
+          moment.duration(value / 1000).asMilliseconds()
+        ),
+      };
+    }
+    case 'microseconds': {
+      return {
+        unitLabel: i18n.translate('xpack.apm.formatters.microsTimeUnitLabel', {
+          defaultMessage: 'μs',
+        }),
+        convertedValue: asInteger(value),
+      };
+    }
+  }
+}
 
 /**
  * Converts a microseconds value into the unit defined.
@@ -87,16 +107,19 @@ function convertTo({
   microseconds: Maybe<number>;
   defaultValue?: string;
 }): ConvertedDuration {
-  const duration = durationUnit[unit];
-  if (!duration || microseconds == null) {
+  if (microseconds == null) {
     return { value: defaultValue, formatted: defaultValue };
   }
 
-  const convertedValue = duration.convert(microseconds);
+  const { convertedValue, unitLabel } = getUnitLabelAndConvertedValue(
+    unit,
+    microseconds
+  );
+
   return {
     value: convertedValue,
-    unit: duration.label,
-    formatted: `${convertedValue} ${duration.label}`,
+    unit: unitLabel,
+    formatted: `${convertedValue} ${unitLabel}`,
   };
 }
 
diff --git a/x-pack/plugins/apm/server/feature.ts b/x-pack/plugins/apm/server/feature.ts
index 60a7be9391eea3..80f722bae08686 100644
--- a/x-pack/plugins/apm/server/feature.ts
+++ b/x-pack/plugins/apm/server/feature.ts
@@ -70,3 +70,6 @@ export const APM_FEATURE = {
     },
   },
 };
+
+export const APM_SERVICE_MAPS_FEATURE_NAME = 'APM service maps';
+export const APM_SERVICE_MAPS_LICENSE_TYPE = 'platinum';
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/__snapshots__/fetcher.test.ts.snap b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/__snapshots__/fetcher.test.ts.snap
index 3ad87c48b013dc..cf3fdac221b597 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/__snapshots__/fetcher.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/__snapshots__/fetcher.test.ts.snap
@@ -38,6 +38,11 @@ Array [
         "query": Object {
           "bool": Object {
             "filter": Array [
+              Object {
+                "term": Object {
+                  "job_id": "myservicename-mytransactiontype-high_mean_response_time",
+                },
+              },
               Object {
                 "exists": Object {
                   "field": "bucket_span",
@@ -57,7 +62,6 @@ Array [
         },
         "size": 0,
       },
-      "index": ".ml-anomalies-myservicename-mytransactiontype-high_mean_response_time",
     },
   ],
 ]
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.test.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.test.ts
index 7f0e217ef4c475..313cf818a322da 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.test.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.test.ts
@@ -19,7 +19,11 @@ describe('anomalyAggsFetcher', () => {
         intervalString: 'myInterval',
         mlBucketSize: 10,
         setup: {
-          client: { search: clientSpy },
+          ml: {
+            mlSystem: {
+              mlAnomalySearch: clientSpy,
+            },
+          } as any,
           start: 100000,
           end: 200000,
         } as any,
@@ -42,7 +46,13 @@ describe('anomalyAggsFetcher', () => {
 
     return expect(
       anomalySeriesFetcher({
-        setup: { client: { search: failedRequestSpy } },
+        setup: {
+          ml: {
+            mlSystem: {
+              mlAnomalySearch: failedRequestSpy,
+            },
+          } as any,
+        },
       } as any)
     ).resolves.toEqual(undefined);
   });
@@ -53,7 +63,13 @@ describe('anomalyAggsFetcher', () => {
 
     return expect(
       anomalySeriesFetcher({
-        setup: { client: { search: failedRequestSpy } },
+        setup: {
+          ml: {
+            mlSystem: {
+              mlAnomalySearch: failedRequestSpy,
+            },
+          } as any,
+        },
       } as any)
     ).rejects.toThrow(otherError);
   });
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.ts
index 365adae630297e..8ee078de7f3ce1 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/fetcher.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getMlIndex } from '../../../../../common/ml_job_constants';
+import { getMlJobId } from '../../../../../common/ml_job_constants';
 import { PromiseReturnType } from '../../../../../../observability/typings/common';
 import { Setup, SetupTimeRange } from '../../../helpers/setup_request';
 
@@ -26,19 +26,23 @@ export async function anomalySeriesFetcher({
   mlBucketSize: number;
   setup: Setup & SetupTimeRange;
 }) {
-  const { client, start, end } = setup;
+  const { ml, start, end } = setup;
+  if (!ml) {
+    return;
+  }
 
   // move the start back with one bucket size, to ensure to get anomaly data in the beginning
   // this is required because ML has a minimum bucket size (default is 900s) so if our buckets are smaller, we might have several null buckets in the beginning
   const newStart = start - mlBucketSize * 1000;
+  const jobId = getMlJobId(serviceName, transactionType);
 
   const params = {
-    index: getMlIndex(serviceName, transactionType),
     body: {
       size: 0,
       query: {
         bool: {
           filter: [
+            { term: { job_id: jobId } },
             { exists: { field: 'bucket_span' } },
             {
               range: {
@@ -74,7 +78,7 @@ export async function anomalySeriesFetcher({
   };
 
   try {
-    const response = await client.search(params);
+    const response = await ml.mlSystem.mlAnomalySearch(params);
     return response;
   } catch (err) {
     const isHttpError = 'statusCode' in err;
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/get_ml_bucket_size.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/get_ml_bucket_size.ts
index 31197639dc0e28..d649bfb1927390 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/get_ml_bucket_size.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/get_ml_bucket_size.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getMlIndex } from '../../../../../common/ml_job_constants';
+import { getMlJobId } from '../../../../../common/ml_job_constants';
 import { Setup, SetupTimeRange } from '../../../helpers/setup_request';
 
 interface IOptions {
@@ -22,15 +22,20 @@ export async function getMlBucketSize({
   transactionType,
   setup,
 }: IOptions): Promise<number> {
-  const { client, start, end } = setup;
+  const { ml, start, end } = setup;
+  if (!ml) {
+    return 0;
+  }
+  const jobId = getMlJobId(serviceName, transactionType);
+
   const params = {
-    index: getMlIndex(serviceName, transactionType),
     body: {
       _source: 'bucket_span',
       size: 1,
       query: {
         bool: {
           filter: [
+            { term: { job_id: jobId } },
             { exists: { field: 'bucket_span' } },
             {
               range: {
@@ -48,7 +53,7 @@ export async function getMlBucketSize({
   };
 
   try {
-    const resp = await client.search<ESResponse, typeof params>(params);
+    const resp = await ml.mlSystem.mlAnomalySearch<ESResponse>(params);
     return resp.hits.hits[0]?._source.bucket_span || 0;
   } catch (err) {
     const isHttpError = 'statusCode' in err;
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.test.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.test.ts
index c8fa5adf194353..fb87f1b5707d14 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.test.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.test.ts
@@ -26,8 +26,8 @@ describe('getAnomalySeries', () => {
       setup: {
         start: 0,
         end: 500000,
-        client: { search: clientSpy } as any,
-        internalClient: { search: clientSpy } as any,
+        client: { search: () => {} } as any,
+        internalClient: { search: () => {} } as any,
         config: new Proxy(
           {},
           {
@@ -46,6 +46,12 @@ describe('getAnomalySeries', () => {
           apmCustomLinkIndex: 'myIndex',
         },
         dynamicIndexPattern: null as any,
+        ml: {
+          mlSystem: {
+            mlAnomalySearch: clientSpy,
+            mlCapabilities: async () => ({ isPlatinumOrTrialLicense: true }),
+          },
+        } as any,
       },
     });
   });
diff --git a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.ts b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.ts
index 3b1a6184c70716..6f44cfa1df9f06 100644
--- a/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/charts/get_anomaly_data/index.ts
@@ -42,6 +42,17 @@ export async function getAnomalySeries({
     return;
   }
 
+  // don't fetch anomalies if the ML plugin is not setup
+  if (!setup.ml) {
+    return;
+  }
+
+  // don't fetch anomalies if required license is not satisfied
+  const mlCapabilities = await setup.ml.mlSystem.mlCapabilities();
+  if (!mlCapabilities.isPlatinumOrTrialLicense) {
+    return;
+  }
+
   const mlBucketSize = await getMlBucketSize({
     serviceName,
     transactionType,
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index f0a05dfc0df30c..eb781ee0783075 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -14,7 +14,7 @@ import {
 import { Observable, combineLatest } from 'rxjs';
 import { map, take } from 'rxjs/operators';
 import { ObservabilityPluginSetup } from '../../observability/server';
-import { SecurityPluginSetup } from '../../security/public';
+import { SecurityPluginSetup } from '../../security/server';
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
 import { TaskManagerSetupContract } from '../../task_manager/server';
 import { AlertingPlugin } from '../../alerts/server';
@@ -28,11 +28,19 @@ import { APMConfig, mergeConfigs, APMXPackConfig } from '.';
 import { HomeServerPluginSetup } from '../../../../src/plugins/home/server';
 import { CloudSetup } from '../../cloud/server';
 import { getInternalSavedObjectsClient } from './lib/helpers/get_internal_saved_objects_client';
-import { LicensingPluginSetup } from '../../licensing/public';
+import {
+  LicensingPluginSetup,
+  LicensingPluginStart,
+} from '../../licensing/server';
 import { registerApmAlerts } from './lib/alerts/register_apm_alerts';
 import { createApmTelemetry } from './lib/apm_telemetry';
+
 import { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
-import { APM_FEATURE } from './feature';
+import {
+  APM_FEATURE,
+  APM_SERVICE_MAPS_FEATURE_NAME,
+  APM_SERVICE_MAPS_LICENSE_TYPE,
+} from './feature';
 import { apmIndices, apmTelemetry } from './saved_objects';
 import { createElasticCloudInstructions } from './tutorial/elastic_cloud';
 import { MlPluginSetup } from '../../ml/server';
@@ -120,16 +128,25 @@ export class APMPlugin implements Plugin<APMPluginSetup> {
         elasticCloud: createElasticCloudInstructions(plugins.cloud),
       };
     });
+
     plugins.features.registerFeature(APM_FEATURE);
+    plugins.licensing.featureUsage.register(
+      APM_SERVICE_MAPS_FEATURE_NAME,
+      APM_SERVICE_MAPS_LICENSE_TYPE
+    );
 
-    createApmApi().init(core, {
-      config$: mergedConfig$,
-      logger: this.logger!,
-      plugins: {
-        observability: plugins.observability,
-        security: plugins.security,
-        ml: plugins.ml,
-      },
+    core.getStartServices().then(([_coreStart, pluginsStart]) => {
+      createApmApi().init(core, {
+        config$: mergedConfig$,
+        logger: this.logger!,
+        plugins: {
+          licensing: (pluginsStart as { licensing: LicensingPluginStart })
+            .licensing,
+          observability: plugins.observability,
+          security: plugins.security,
+          ml: plugins.ml,
+        },
+      });
     });
 
     return {
diff --git a/x-pack/plugins/apm/server/routes/create_api/index.test.ts b/x-pack/plugins/apm/server/routes/create_api/index.test.ts
index 3d3e26f680e0d2..f5db936c00d3a7 100644
--- a/x-pack/plugins/apm/server/routes/create_api/index.test.ts
+++ b/x-pack/plugins/apm/server/routes/create_api/index.test.ts
@@ -9,6 +9,7 @@ import { CoreSetup, Logger } from 'src/core/server';
 import { Params } from '../typings';
 import { BehaviorSubject } from 'rxjs';
 import { APMConfig } from '../..';
+import { LicensingPluginStart } from '../../../../licensing/server';
 
 const getCoreMock = () => {
   const get = jest.fn();
@@ -40,7 +41,7 @@ const getCoreMock = () => {
       logger: ({
         error: jest.fn(),
       } as unknown) as Logger,
-      plugins: {},
+      plugins: { licensing: {} as LicensingPluginStart },
     },
   };
 };
diff --git a/x-pack/plugins/apm/server/routes/service_map.ts b/x-pack/plugins/apm/server/routes/service_map.ts
index df0403be7b9759..3937c18b3fe5e0 100644
--- a/x-pack/plugins/apm/server/routes/service_map.ts
+++ b/x-pack/plugins/apm/server/routes/service_map.ts
@@ -15,6 +15,7 @@ import { getServiceMap } from '../lib/service_map/get_service_map';
 import { getServiceMapServiceNodeInfo } from '../lib/service_map/get_service_map_service_node_info';
 import { createRoute } from './create_route';
 import { rangeRt } from './default_api_types';
+import { APM_SERVICE_MAPS_FEATURE_NAME } from '../feature';
 
 export const serviceMapRoute = createRoute(() => ({
   path: '/api/apm/service-map',
@@ -35,6 +36,10 @@ export const serviceMapRoute = createRoute(() => ({
       throw Boom.forbidden(invalidLicenseMessage);
     }
 
+    context.plugins.licensing.featureUsage.notifyUsage(
+      APM_SERVICE_MAPS_FEATURE_NAME
+    );
+
     const setup = await setupRequest(context, request);
     const {
       query: { serviceName, environment },
diff --git a/x-pack/plugins/apm/server/routes/typings.ts b/x-pack/plugins/apm/server/routes/typings.ts
index bc31cb7a582af2..f30a9d18d7aeab 100644
--- a/x-pack/plugins/apm/server/routes/typings.ts
+++ b/x-pack/plugins/apm/server/routes/typings.ts
@@ -14,10 +14,11 @@ import {
 import { PickByValue, Optional } from 'utility-types';
 import { Observable } from 'rxjs';
 import { Server } from 'hapi';
+import { LicensingPluginStart } from '../../../licensing/server';
 import { ObservabilityPluginSetup } from '../../../observability/server';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { FetchOptions } from '../../public/services/rest/callApi';
-import { SecurityPluginSetup } from '../../../security/public';
+import { SecurityPluginSetup } from '../../../security/server';
 import { MlPluginSetup } from '../../../ml/server';
 import { APMConfig } from '..';
 
@@ -66,6 +67,7 @@ export type APMRequestHandlerContext<
   config: APMConfig;
   logger: Logger;
   plugins: {
+    licensing: LicensingPluginStart;
     observability?: ObservabilityPluginSetup;
     security?: SecurityPluginSetup;
     ml?: MlPluginSetup;
@@ -114,6 +116,7 @@ export interface ServerAPI<TRouteState extends RouteState> {
       config$: Observable<APMConfig>;
       logger: Logger;
       plugins: {
+        licensing: LicensingPluginStart;
         observability?: ObservabilityPluginSetup;
         security?: SecurityPluginSetup;
         ml?: MlPluginSetup;
diff --git a/x-pack/plugins/drilldowns/public/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx b/x-pack/plugins/drilldowns/public/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
index 45cf7365ebd917..e05547741871ef 100644
--- a/x-pack/plugins/drilldowns/public/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
+++ b/x-pack/plugins/drilldowns/public/components/connected_flyout_manage_drilldowns/connected_flyout_manage_drilldowns.tsx
@@ -51,10 +51,12 @@ export function createFlyoutManageDrilldowns({
   uiActionsEnhanced,
   storage,
   notifications,
+  docsLink,
 }: {
   uiActionsEnhanced: AdvancedUiActionsStart;
   storage: IStorageWrapper;
   notifications: NotificationsStart;
+  docsLink?: string;
 }) {
   // fine to assume this is static,
   // because all action factories should be registered in setup phase
@@ -145,6 +147,7 @@ export function createFlyoutManageDrilldowns({
       case Routes.Edit:
         return (
           <FlyoutDrilldownWizard
+            docsLink={docsLink}
             showWelcomeMessage={shouldShowWelcomeMessage}
             onWelcomeHideClick={onHideWelcomeMessage}
             drilldownActionFactories={actionFactories}
@@ -197,6 +200,7 @@ export function createFlyoutManageDrilldowns({
       default:
         return (
           <FlyoutListManageDrilldowns
+            docsLink={docsLink}
             showWelcomeMessage={shouldShowWelcomeMessage}
             onWelcomeHideClick={onHideWelcomeMessage}
             drilldowns={drilldowns.map(mapToDrilldownToDrilldownListItem)}
diff --git a/x-pack/plugins/drilldowns/public/components/drilldown_hello_bar/drilldown_hello_bar.tsx b/x-pack/plugins/drilldowns/public/components/drilldown_hello_bar/drilldown_hello_bar.tsx
index 99885e5cc40fe2..e949d16ad536d8 100644
--- a/x-pack/plugins/drilldowns/public/components/drilldown_hello_bar/drilldown_hello_bar.tsx
+++ b/x-pack/plugins/drilldowns/public/components/drilldown_hello_bar/drilldown_hello_bar.tsx
@@ -44,7 +44,9 @@ export const DrilldownHelloBar: React.FC<DrilldownHelloBarProps> = ({
           {docsLink && (
             <>
               <EuiSpacer size={'xs'} />
-              <EuiLink href={docsLink}>{txtViewDocsLinkLabel}</EuiLink>
+              <EuiLink href={docsLink} target="_blank" external>
+                {txtViewDocsLinkLabel}
+              </EuiLink>
             </>
           )}
         </EuiFlexItem>
diff --git a/x-pack/plugins/drilldowns/public/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx b/x-pack/plugins/drilldowns/public/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
index 87f886817517f7..8994aac4123e12 100644
--- a/x-pack/plugins/drilldowns/public/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
+++ b/x-pack/plugins/drilldowns/public/components/flyout_drilldown_wizard/flyout_drilldown_wizard.tsx
@@ -39,6 +39,8 @@ export interface FlyoutDrilldownWizardProps<CurrentActionConfig extends object =
   onWelcomeHideClick?: () => void;
 
   actionFactoryContext?: object;
+
+  docsLink?: string;
 }
 
 function useWizardConfigState(
@@ -118,6 +120,7 @@ export function FlyoutDrilldownWizard<CurrentActionConfig extends object = objec
   onWelcomeHideClick,
   drilldownActionFactories,
   actionFactoryContext,
+  docsLink,
 }: FlyoutDrilldownWizardProps<CurrentActionConfig>) {
   const [wizardConfig, { setActionFactory, setActionConfig, setName }] = useWizardConfigState(
     initialDrilldownWizardConfig
@@ -154,7 +157,11 @@ export function FlyoutDrilldownWizard<CurrentActionConfig extends object = objec
       footer={footer}
       onClose={onClose}
       onBack={onBack}
-      banner={showWelcomeMessage && <DrilldownHelloBar onHideClick={onWelcomeHideClick} />}
+      banner={
+        showWelcomeMessage && (
+          <DrilldownHelloBar docsLink={docsLink} onHideClick={onWelcomeHideClick} />
+        )
+      }
     >
       <FormDrilldownWizard
         name={wizardConfig.name}
diff --git a/x-pack/plugins/drilldowns/public/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.tsx b/x-pack/plugins/drilldowns/public/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.tsx
index a44a7ccccb4dce..1d849b1db06881 100644
--- a/x-pack/plugins/drilldowns/public/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.tsx
+++ b/x-pack/plugins/drilldowns/public/components/flyout_list_manage_drilldowns/flyout_list_manage_drilldowns.tsx
@@ -11,6 +11,7 @@ import { txtManageDrilldowns } from './i18n';
 import { DrilldownHelloBar } from '../drilldown_hello_bar';
 
 export interface FlyoutListManageDrilldownsProps {
+  docsLink?: string;
   drilldowns: DrilldownListItem[];
   onClose?: () => void;
   onCreate?: () => void;
@@ -21,6 +22,7 @@ export interface FlyoutListManageDrilldownsProps {
 }
 
 export function FlyoutListManageDrilldowns({
+  docsLink,
   drilldowns,
   onClose = () => {},
   onCreate,
@@ -33,7 +35,11 @@ export function FlyoutListManageDrilldowns({
     <FlyoutFrame
       title={txtManageDrilldowns}
       onClose={onClose}
-      banner={showWelcomeMessage && <DrilldownHelloBar onHideClick={onWelcomeHideClick} />}
+      banner={
+        showWelcomeMessage && (
+          <DrilldownHelloBar docsLink={docsLink} onHideClick={onWelcomeHideClick} />
+        )
+      }
     >
       <ListManageDrilldowns
         drilldowns={drilldowns}
diff --git a/x-pack/plugins/drilldowns/public/plugin.ts b/x-pack/plugins/drilldowns/public/plugin.ts
index 32176241c102fa..2805e2b747934c 100644
--- a/x-pack/plugins/drilldowns/public/plugin.ts
+++ b/x-pack/plugins/drilldowns/public/plugin.ts
@@ -39,6 +39,7 @@ export class DrilldownsPlugin
         uiActionsEnhanced: plugins.uiActionsEnhanced,
         storage: new Storage(localStorage),
         notifications: core.notifications,
+        docsLink: core.docLinks.links.dashboard.drilldowns,
       }),
     };
   }
diff --git a/x-pack/plugins/embeddable_enhanced/public/plugin.ts b/x-pack/plugins/embeddable_enhanced/public/plugin.ts
index a14cdfd035d2ec..fd0bcc2023269e 100644
--- a/x-pack/plugins/embeddable_enhanced/public/plugin.ts
+++ b/x-pack/plugins/embeddable_enhanced/public/plugin.ts
@@ -17,6 +17,7 @@ import {
   defaultEmbeddableFactoryProvider,
   EmbeddableContext,
   PANEL_NOTIFICATION_TRIGGER,
+  ViewMode,
 } from '../../../../src/plugins/embeddable/public';
 import { EnhancedEmbeddable, EnhancedEmbeddableContext } from './types';
 import {
@@ -106,6 +107,15 @@ export class EmbeddableEnhancedPlugin
     );
   }
 
+  private readonly isEmbeddableContext = (context: unknown): context is EmbeddableContext => {
+    if (!(context as EmbeddableContext)?.embeddable) {
+      // eslint-disable-next-line no-console
+      console.warn('For drilldowns to work action context should contain .embeddable field.');
+      return false;
+    }
+    return true;
+  };
+
   private enhanceEmbeddableWithDynamicActions<E extends IEmbeddable>(
     embeddable: E
   ): EnhancedEmbeddable<E> {
@@ -114,13 +124,9 @@ export class EmbeddableEnhancedPlugin
     const storage = new EmbeddableActionStorage(embeddable as EmbeddableWithDynamicActions);
     const dynamicActions = new DynamicActionManager({
       isCompatible: async (context: unknown) => {
-        if (!(context as EmbeddableContext)?.embeddable) {
-          // eslint-disable-next-line no-console
-          console.warn('For drilldowns to work action context should contain .embeddable field.');
-          return false;
-        }
-
-        return (context as EmbeddableContext).embeddable.runtimeId === embeddable.runtimeId;
+        if (!this.isEmbeddableContext(context)) return false;
+        if (context.embeddable.getInput().viewMode !== ViewMode.VIEW) return false;
+        return context.embeddable.runtimeId === embeddable.runtimeId;
       },
       storage,
       uiActions: this.uiActions!,
diff --git a/x-pack/plugins/infra/public/pages/logs/page_content.tsx b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
index 14c53557ba2c74..78b7f86993cbde 100644
--- a/x-pack/plugins/infra/public/pages/logs/page_content.tsx
+++ b/x-pack/plugins/infra/public/pages/logs/page_content.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { Route, Switch } from 'react-router-dom';
@@ -32,6 +32,8 @@ export const LogsPageContent: React.FunctionComponent = () => {
 
   const { initialize } = useLogSourceContext();
 
+  const kibana = useKibana();
+
   useMount(() => {
     initialize();
   });
@@ -88,6 +90,16 @@ export const LogsPageContent: React.FunctionComponent = () => {
           <EuiFlexItem grow={false}>
             <AlertDropdown />
           </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              href={kibana.services?.application?.getUrlForApp('/home#/tutorial_directory/logging')}
+              size="s"
+              color="primary"
+              iconType="plusInCircle"
+            >
+              {ADD_DATA_LABEL}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
         </EuiFlexGroup>
       </AppNavigation>
       <Switch>
@@ -123,3 +135,7 @@ const settingsTabTitle = i18n.translate('xpack.infra.logs.index.settingsTabTitle
 });
 
 const feedbackLinkUrl = 'https://discuss.elastic.co/c/logs';
+
+const ADD_DATA_LABEL = i18n.translate('xpack.infra.logsHeaderAddDataButtonLabel', {
+  defaultMessage: 'Add data',
+});
diff --git a/x-pack/plugins/infra/public/pages/metrics/index.tsx b/x-pack/plugins/infra/public/pages/metrics/index.tsx
index 35a6cadc786f61..05296fbf6b0a32 100644
--- a/x-pack/plugins/infra/public/pages/metrics/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/index.tsx
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { Route, RouteComponentProps, Switch } from 'react-router-dom';
 
-import { EuiErrorBoundary, EuiFlexItem, EuiFlexGroup } from '@elastic/eui';
+import { EuiErrorBoundary, EuiFlexItem, EuiFlexGroup, EuiButtonEmpty } from '@elastic/eui';
 import { DocumentTitle } from '../../components/document_title';
 import { HelpCenterContent } from '../../components/help_center_content';
 import { RoutedTabs } from '../../components/navigation/routed_tabs';
@@ -32,9 +32,15 @@ import { WaffleFiltersProvider } from './inventory_view/hooks/use_waffle_filters
 import { InventoryAlertDropdown } from '../../components/alerting/inventory/alert_dropdown';
 import { MetricsAlertDropdown } from '../../alerting/metric_threshold/components/alert_dropdown';
 
+const ADD_DATA_LABEL = i18n.translate('xpack.infra.metricsHeaderAddDataButtonLabel', {
+  defaultMessage: 'Add data',
+});
+
 export const InfrastructurePage = ({ match }: RouteComponentProps) => {
   const uiCapabilities = useKibana().services.application?.capabilities;
 
+  const kibana = useKibana();
+
   return (
     <EuiErrorBoundary>
       <Source.Provider sourceId="default">
@@ -102,6 +108,18 @@ export const InfrastructurePage = ({ match }: RouteComponentProps) => {
                       <Route path={'/explorer'} component={MetricsAlertDropdown} />
                       <Route path={'/inventory'} component={InventoryAlertDropdown} />
                     </EuiFlexItem>
+                    <EuiFlexItem grow={false}>
+                      <EuiButtonEmpty
+                        href={kibana.services?.application?.getUrlForApp(
+                          '/home#/tutorial_directory/metrics'
+                        )}
+                        size="s"
+                        color="primary"
+                        iconType="plusInCircle"
+                      >
+                        {ADD_DATA_LABEL}
+                      </EuiButtonEmpty>
+                    </EuiFlexItem>
                   </EuiFlexGroup>
                 </AppNavigation>
 
diff --git a/x-pack/plugins/ingest_manager/common/services/config_to_yaml.ts b/x-pack/plugins/ingest_manager/common/services/config_to_yaml.ts
index 9dfd76b9ddd211..a3bef72e8db5a3 100644
--- a/x-pack/plugins/ingest_manager/common/services/config_to_yaml.ts
+++ b/x-pack/plugins/ingest_manager/common/services/config_to_yaml.ts
@@ -11,10 +11,11 @@ const CONFIG_KEYS_ORDER = [
   'name',
   'revision',
   'type',
-  'outputs',
   'settings',
-  'datasources',
+  'outputs',
+  'inputs',
   'enabled',
+  'use_output',
   'package',
   'input',
 ];
diff --git a/x-pack/plugins/ingest_manager/common/services/datasource_to_agent_datasource.test.ts b/x-pack/plugins/ingest_manager/common/services/datasource_to_agent_datasource.test.ts
deleted file mode 100644
index d319ba2beddf94..00000000000000
--- a/x-pack/plugins/ingest_manager/common/services/datasource_to_agent_datasource.test.ts
+++ /dev/null
@@ -1,190 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { Datasource, DatasourceInput } from '../types';
-import { storedDatasourceToAgentDatasource } from './datasource_to_agent_datasource';
-
-describe('Ingest Manager - storedDatasourceToAgentDatasource', () => {
-  const mockDatasource: Datasource = {
-    id: 'some-uuid',
-    name: 'mock-datasource',
-    description: '',
-    created_at: '',
-    created_by: '',
-    updated_at: '',
-    updated_by: '',
-    config_id: '',
-    enabled: true,
-    output_id: '',
-    namespace: 'default',
-    inputs: [],
-    revision: 1,
-  };
-
-  const mockInput: DatasourceInput = {
-    type: 'test-logs',
-    enabled: true,
-    vars: {
-      inputVar: { value: 'input-value' },
-      inputVar2: { value: undefined },
-      inputVar3: {
-        type: 'yaml',
-        value: 'testField: test',
-      },
-      inputVar4: { value: '' },
-    },
-    streams: [
-      {
-        id: 'test-logs-foo',
-        enabled: true,
-        dataset: 'foo',
-        vars: {
-          fooVar: { value: 'foo-value' },
-          fooVar2: { value: [1, 2] },
-        },
-        agent_stream: {
-          fooKey: 'fooValue1',
-          fooKey2: ['fooValue2'],
-        },
-      },
-      {
-        id: 'test-logs-bar',
-        enabled: true,
-        dataset: 'bar',
-        vars: {
-          barVar: { value: 'bar-value' },
-          barVar2: { value: [1, 2] },
-          barVar3: {
-            type: 'yaml',
-            value:
-              '- namespace: mockNamespace\n  #disabledProp: ["test"]\n  anotherProp: test\n- namespace: mockNamespace2\n  #disabledProp: ["test2"]\n  anotherProp: test2',
-          },
-          barVar4: {
-            type: 'yaml',
-            value: '',
-          },
-          barVar5: {
-            type: 'yaml',
-            value: 'testField: test\n invalidSpacing: foo',
-          },
-        },
-      },
-    ],
-  };
-
-  it('returns agent datasource config for datasource with no inputs', () => {
-    expect(storedDatasourceToAgentDatasource(mockDatasource)).toEqual({
-      id: 'some-uuid',
-      name: 'mock-datasource',
-      namespace: 'default',
-      enabled: true,
-      use_output: 'default',
-      inputs: [],
-    });
-
-    expect(
-      storedDatasourceToAgentDatasource({
-        ...mockDatasource,
-        package: {
-          name: 'mock-package',
-          title: 'Mock package',
-          version: '0.0.0',
-        },
-      })
-    ).toEqual({
-      id: 'some-uuid',
-      name: 'mock-datasource',
-      namespace: 'default',
-      enabled: true,
-      use_output: 'default',
-      package: {
-        name: 'mock-package',
-        version: '0.0.0',
-      },
-      inputs: [],
-    });
-  });
-
-  it('returns agent datasource config with flattened input and package stream', () => {
-    expect(storedDatasourceToAgentDatasource({ ...mockDatasource, inputs: [mockInput] })).toEqual({
-      id: 'some-uuid',
-      name: 'mock-datasource',
-      namespace: 'default',
-      enabled: true,
-      use_output: 'default',
-      inputs: [
-        {
-          type: 'test-logs',
-          enabled: true,
-          streams: [
-            {
-              id: 'test-logs-foo',
-              enabled: true,
-              dataset: 'foo',
-              fooKey: 'fooValue1',
-              fooKey2: ['fooValue2'],
-            },
-            {
-              id: 'test-logs-bar',
-              enabled: true,
-              dataset: 'bar',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  it('returns agent datasource config without disabled streams', () => {
-    expect(
-      storedDatasourceToAgentDatasource({
-        ...mockDatasource,
-        inputs: [
-          {
-            ...mockInput,
-            streams: [{ ...mockInput.streams[0] }, { ...mockInput.streams[1], enabled: false }],
-          },
-        ],
-      })
-    ).toEqual({
-      id: 'some-uuid',
-      name: 'mock-datasource',
-      namespace: 'default',
-      enabled: true,
-      use_output: 'default',
-      inputs: [
-        {
-          type: 'test-logs',
-          enabled: true,
-          streams: [
-            {
-              id: 'test-logs-foo',
-              enabled: true,
-              dataset: 'foo',
-              fooKey: 'fooValue1',
-              fooKey2: ['fooValue2'],
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  it('returns agent datasource config without disabled inputs', () => {
-    expect(
-      storedDatasourceToAgentDatasource({
-        ...mockDatasource,
-        inputs: [{ ...mockInput, enabled: false }],
-      })
-    ).toEqual({
-      id: 'some-uuid',
-      name: 'mock-datasource',
-      namespace: 'default',
-      enabled: true,
-      use_output: 'default',
-      inputs: [],
-    });
-  });
-});
diff --git a/x-pack/plugins/ingest_manager/common/services/datasource_to_agent_datasource.ts b/x-pack/plugins/ingest_manager/common/services/datasource_to_agent_datasource.ts
deleted file mode 100644
index 2a8b687675bf9e..00000000000000
--- a/x-pack/plugins/ingest_manager/common/services/datasource_to_agent_datasource.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { Datasource, FullAgentConfigDatasource } from '../types';
-import { DEFAULT_OUTPUT } from '../constants';
-
-export const storedDatasourceToAgentDatasource = (
-  datasource: Datasource
-): FullAgentConfigDatasource => {
-  const { id, name, namespace, enabled, package: pkg, inputs } = datasource;
-
-  const fullDatasource: FullAgentConfigDatasource = {
-    id: id || name,
-    name,
-    namespace,
-    enabled,
-    use_output: DEFAULT_OUTPUT.name, // TODO: hardcoded to default output for now
-    inputs: inputs
-      .filter((input) => input.enabled)
-      .map((input) => {
-        const fullInput = {
-          ...input,
-          ...Object.entries(input.config || {}).reduce((acc, [key, { value }]) => {
-            acc[key] = value;
-            return acc;
-          }, {} as { [k: string]: any }),
-          streams: input.streams
-            .filter((stream) => stream.enabled)
-            .map((stream) => {
-              const fullStream = {
-                ...stream,
-                ...stream.agent_stream,
-                ...Object.entries(stream.config || {}).reduce((acc, [key, { value }]) => {
-                  acc[key] = value;
-                  return acc;
-                }, {} as { [k: string]: any }),
-              };
-              delete fullStream.agent_stream;
-              delete fullStream.vars;
-              delete fullStream.config;
-              return fullStream;
-            }),
-        };
-        delete fullInput.vars;
-        delete fullInput.config;
-        return fullInput;
-      }),
-  };
-
-  if (pkg) {
-    fullDatasource.package = {
-      name: pkg.name,
-      version: pkg.version,
-    };
-  }
-
-  return fullDatasource;
-};
diff --git a/x-pack/plugins/ingest_manager/common/services/datasources_to_agent_inputs.test.ts b/x-pack/plugins/ingest_manager/common/services/datasources_to_agent_inputs.test.ts
new file mode 100644
index 00000000000000..df94168ec88d02
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/common/services/datasources_to_agent_inputs.test.ts
@@ -0,0 +1,158 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Datasource, DatasourceInput } from '../types';
+import { storedDatasourcesToAgentInputs } from './datasources_to_agent_inputs';
+
+describe('Ingest Manager - storedDatasourcesToAgentInputs', () => {
+  const mockDatasource: Datasource = {
+    id: 'some-uuid',
+    name: 'mock-datasource',
+    description: '',
+    created_at: '',
+    created_by: '',
+    updated_at: '',
+    updated_by: '',
+    config_id: '',
+    enabled: true,
+    output_id: '',
+    namespace: 'default',
+    inputs: [],
+    revision: 1,
+  };
+
+  const mockInput: DatasourceInput = {
+    type: 'test-logs',
+    enabled: true,
+    vars: {
+      inputVar: { value: 'input-value' },
+      inputVar2: { value: undefined },
+      inputVar3: {
+        type: 'yaml',
+        value: 'testField: test',
+      },
+      inputVar4: { value: '' },
+    },
+    streams: [
+      {
+        id: 'test-logs-foo',
+        enabled: true,
+        dataset: 'foo',
+        vars: {
+          fooVar: { value: 'foo-value' },
+          fooVar2: { value: [1, 2] },
+        },
+        agent_stream: {
+          fooKey: 'fooValue1',
+          fooKey2: ['fooValue2'],
+        },
+      },
+      {
+        id: 'test-logs-bar',
+        enabled: true,
+        dataset: 'bar',
+        vars: {
+          barVar: { value: 'bar-value' },
+          barVar2: { value: [1, 2] },
+          barVar3: {
+            type: 'yaml',
+            value:
+              '- namespace: mockNamespace\n  #disabledProp: ["test"]\n  anotherProp: test\n- namespace: mockNamespace2\n  #disabledProp: ["test2"]\n  anotherProp: test2',
+          },
+          barVar4: {
+            type: 'yaml',
+            value: '',
+          },
+          barVar5: {
+            type: 'yaml',
+            value: 'testField: test\n invalidSpacing: foo',
+          },
+        },
+      },
+    ],
+  };
+
+  it('returns no inputs for datasource with no inputs, or only disabled inputs', () => {
+    expect(storedDatasourcesToAgentInputs([mockDatasource])).toEqual([]);
+
+    expect(
+      storedDatasourcesToAgentInputs([
+        {
+          ...mockDatasource,
+          package: {
+            name: 'mock-package',
+            title: 'Mock package',
+            version: '0.0.0',
+          },
+        },
+      ])
+    ).toEqual([]);
+
+    expect(
+      storedDatasourcesToAgentInputs([
+        {
+          ...mockDatasource,
+          inputs: [{ ...mockInput, enabled: false }],
+        },
+      ])
+    ).toEqual([]);
+  });
+
+  it('returns agent inputs', () => {
+    expect(storedDatasourcesToAgentInputs([{ ...mockDatasource, inputs: [mockInput] }])).toEqual([
+      {
+        id: 'some-uuid',
+        name: 'mock-datasource',
+        type: 'test-logs',
+        dataset: { namespace: 'default' },
+        use_output: 'default',
+        streams: [
+          {
+            id: 'test-logs-foo',
+            dataset: { name: 'foo' },
+            fooKey: 'fooValue1',
+            fooKey2: ['fooValue2'],
+          },
+          {
+            id: 'test-logs-bar',
+            dataset: { name: 'bar' },
+          },
+        ],
+      },
+    ]);
+  });
+
+  it('returns agent inputs without disabled streams', () => {
+    expect(
+      storedDatasourcesToAgentInputs([
+        {
+          ...mockDatasource,
+          inputs: [
+            {
+              ...mockInput,
+              streams: [{ ...mockInput.streams[0] }, { ...mockInput.streams[1], enabled: false }],
+            },
+          ],
+        },
+      ])
+    ).toEqual([
+      {
+        id: 'some-uuid',
+        name: 'mock-datasource',
+        type: 'test-logs',
+        dataset: { namespace: 'default' },
+        use_output: 'default',
+        streams: [
+          {
+            id: 'test-logs-foo',
+            dataset: { name: 'foo' },
+            fooKey: 'fooValue1',
+            fooKey2: ['fooValue2'],
+          },
+        ],
+      },
+    ]);
+  });
+});
diff --git a/x-pack/plugins/ingest_manager/common/services/datasources_to_agent_inputs.ts b/x-pack/plugins/ingest_manager/common/services/datasources_to_agent_inputs.ts
new file mode 100644
index 00000000000000..d5a752e817b4f2
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/common/services/datasources_to_agent_inputs.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Datasource, FullAgentConfigInput, FullAgentConfigInputStream } from '../types';
+import { DEFAULT_OUTPUT } from '../constants';
+
+export const storedDatasourcesToAgentInputs = (
+  datasources: Datasource[]
+): FullAgentConfigInput[] => {
+  const fullInputs: FullAgentConfigInput[] = [];
+
+  datasources.forEach((datasource) => {
+    if (!datasource.enabled || !datasource.inputs || !datasource.inputs.length) {
+      return;
+    }
+    datasource.inputs.forEach((input) => {
+      if (!input.enabled) {
+        return;
+      }
+
+      const fullInput: FullAgentConfigInput = {
+        id: datasource.id || datasource.name,
+        name: datasource.name,
+        type: input.type,
+        dataset: { namespace: datasource.namespace || 'default' },
+        use_output: DEFAULT_OUTPUT.name,
+        ...Object.entries(input.config || {}).reduce((acc, [key, { value }]) => {
+          acc[key] = value;
+          return acc;
+        }, {} as { [k: string]: any }),
+        streams: input.streams
+          .filter((stream) => stream.enabled)
+          .map((stream) => {
+            const fullStream: FullAgentConfigInputStream = {
+              id: stream.id,
+              dataset: { name: stream.dataset },
+              ...stream.agent_stream,
+              ...Object.entries(stream.config || {}).reduce((acc, [key, { value }]) => {
+                acc[key] = value;
+                return acc;
+              }, {} as { [k: string]: any }),
+            };
+            if (stream.processors) {
+              fullStream.processors = stream.processors;
+            }
+            return fullStream;
+          }),
+      };
+
+      if (datasource.package) {
+        fullInput.package = {
+          name: datasource.package.name,
+          version: datasource.package.version,
+        };
+      }
+
+      fullInputs.push(fullInput);
+    });
+  });
+
+  return fullInputs;
+};
diff --git a/x-pack/plugins/ingest_manager/common/services/index.ts b/x-pack/plugins/ingest_manager/common/services/index.ts
index c595c9a52f66f8..e53d97972fa2f3 100644
--- a/x-pack/plugins/ingest_manager/common/services/index.ts
+++ b/x-pack/plugins/ingest_manager/common/services/index.ts
@@ -7,7 +7,7 @@ import * as AgentStatusKueryHelper from './agent_status';
 
 export * from './routes';
 export { packageToConfigDatasourceInputs, packageToConfigDatasource } from './package_to_config';
-export { storedDatasourceToAgentDatasource } from './datasource_to_agent_datasource';
+export { storedDatasourcesToAgentInputs } from './datasources_to_agent_inputs';
 export { configToYaml } from './config_to_yaml';
 export { AgentStatusKueryHelper };
 export { decodeCloudId } from './decode_cloud_id';
diff --git a/x-pack/plugins/ingest_manager/common/types/models/agent_config.ts b/x-pack/plugins/ingest_manager/common/types/models/agent_config.ts
index 7547f56237eec1..36b3176ffa4151 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/agent_config.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/agent_config.ts
@@ -3,12 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import {
-  Datasource,
-  DatasourcePackage,
-  DatasourceInput,
-  DatasourceInputStream,
-} from './datasource';
+import { Datasource, DatasourcePackage, DatasourceInputStream } from './datasource';
 import { Output } from './output';
 
 export enum AgentConfigStatus {
@@ -35,23 +30,22 @@ export interface AgentConfig extends NewAgentConfig {
 
 export type AgentConfigSOAttributes = Omit<AgentConfig, 'id'>;
 
-export type FullAgentConfigDatasource = Pick<
-  Datasource,
-  'id' | 'name' | 'namespace' | 'enabled'
-> & {
-  package?: Pick<DatasourcePackage, 'name' | 'version'>;
-  use_output: string;
-  inputs: Array<
-    Omit<DatasourceInput, 'streams'> & {
-      streams: Array<
-        Omit<DatasourceInputStream, 'config'> & {
-          [key: string]: any;
-        }
-      >;
-    }
-  >;
+export type FullAgentConfigInputStream = Pick<DatasourceInputStream, 'id' | 'processors'> & {
+  dataset: { name: string };
+  [key: string]: any;
 };
 
+export interface FullAgentConfigInput {
+  id: string;
+  name: string;
+  type: string;
+  dataset: { namespace: string };
+  use_output: string;
+  package?: Pick<DatasourcePackage, 'name' | 'version'>;
+  streams: FullAgentConfigInputStream[];
+  [key: string]: any;
+}
+
 export interface FullAgentConfig {
   id: string;
   outputs: {
@@ -59,7 +53,7 @@ export interface FullAgentConfig {
       [key: string]: any;
     };
   };
-  datasources: FullAgentConfigDatasource[];
+  inputs: FullAgentConfigInput[];
   revision?: number;
   settings?: {
     monitoring: {
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/header.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/header.tsx
index 9354d94f468018..e0623108e7d39c 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/header.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/header.tsx
@@ -36,6 +36,7 @@ export interface HeaderProps {
   rightColumn?: JSX.Element;
   rightColumnGrow?: EuiFlexItemProps['grow'];
   tabs?: EuiTabProps[];
+  'data-test-subj'?: string;
 }
 
 const HeaderColumns: React.FC<Omit<HeaderProps, 'tabs'>> = memo(
@@ -53,8 +54,9 @@ export const Header: React.FC<HeaderProps> = ({
   rightColumnGrow,
   tabs,
   maxWidth,
+  'data-test-subj': dataTestSubj,
 }) => (
-  <Container>
+  <Container data-test-subj={dataTestSubj}>
     <Wrapper maxWidth={maxWidth}>
       <HeaderColumns
         leftColumn={leftColumn}
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_intra_app_state.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_intra_app_state.tsx
new file mode 100644
index 00000000000000..565c5b364893cc
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_intra_app_state.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, useContext, useMemo } from 'react';
+import { AppMountParameters } from 'kibana/public';
+import { useLocation } from 'react-router-dom';
+import { AnyIntraAppRouteState } from '../types';
+
+interface IntraAppState<S extends AnyIntraAppRouteState = AnyIntraAppRouteState> {
+  forRoute: string;
+  routeState?: S;
+}
+
+const IntraAppStateContext = React.createContext<IntraAppState>({ forRoute: '' });
+const wasHandled = new WeakSet<IntraAppState>();
+
+/**
+ * Provides a bridget between Kibana's ScopedHistory instance (normally used with BrowserRouter)
+ * and the Hash router used within the app in order to enable state to be used between kibana
+ * apps
+ */
+export const IntraAppStateProvider = memo<{
+  kibanaScopedHistory: AppMountParameters['history'];
+  children: React.ReactNode;
+}>(({ kibanaScopedHistory, children }) => {
+  const internalAppToAppState = useMemo<IntraAppState>(() => {
+    return {
+      forRoute: kibanaScopedHistory.location.hash.substr(1),
+      routeState: kibanaScopedHistory.location.state as AnyIntraAppRouteState,
+    };
+  }, [kibanaScopedHistory.location.hash, kibanaScopedHistory.location.state]);
+  return (
+    <IntraAppStateContext.Provider value={internalAppToAppState}>
+      {children}
+    </IntraAppStateContext.Provider>
+  );
+});
+
+/**
+ * Retrieve UI Route state from the React Router History for the current URL location.
+ * This state can be used by other Kibana Apps to influence certain behaviours in Ingest, for example,
+ * redirecting back to an given Application after a craete action.
+ */
+export function useIntraAppState<S = AnyIntraAppRouteState>():
+  | IntraAppState<S>['routeState']
+  | undefined {
+  const location = useLocation();
+  const intraAppState = useContext(IntraAppStateContext);
+  if (!intraAppState) {
+    throw new Error('Hook called outside of IntraAppStateContext');
+  }
+  return useMemo(() => {
+    // Due to the use of HashRouter in Ingest, we only want state to be returned
+    // once so that it does not impact navigation to the page from within the
+    // ingest app. side affect is that the browser back button would not work
+    // consistently either.
+    if (location.pathname === intraAppState.forRoute && !wasHandled.has(intraAppState)) {
+      wasHandled.add(intraAppState);
+      return intraAppState.routeState as S;
+    }
+  }, [intraAppState, location.pathname]);
+}
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/index.tsx
index ed5a75ce6c991e..623df428b7dd92 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/index.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useEffect, useState } from 'react';
+import React, { memo, useEffect, useState } from 'react';
 import ReactDOM from 'react-dom';
 import { useObservable } from 'react-use';
 import { HashRouter as Router, Redirect, Switch, Route, RouteProps } from 'react-router-dom';
@@ -28,6 +28,7 @@ import { useCore, sendSetup, sendGetPermissionsCheck } from './hooks';
 import { FleetStatusProvider } from './hooks/use_fleet_status';
 import './index.scss';
 import { KibanaContextProvider } from '../../../../../../src/plugins/kibana_react/public';
+import { IntraAppStateProvider } from './hooks/use_intra_app_state';
 
 export interface ProtectedRouteProps extends RouteProps {
   isAllowed?: boolean;
@@ -56,163 +57,170 @@ const ErrorLayout = ({ children }: { children: JSX.Element }) => (
   </EuiErrorBoundary>
 );
 
-const IngestManagerRoutes = ({ ...rest }) => {
-  const { epm, fleet } = useConfig();
-  const { notifications } = useCore();
+const IngestManagerRoutes = memo<{ history: AppMountParameters['history']; basepath: string }>(
+  ({ history, ...rest }) => {
+    const { epm, fleet } = useConfig();
+    const { notifications } = useCore();
 
-  const [isPermissionsLoading, setIsPermissionsLoading] = useState<boolean>(false);
-  const [permissionsError, setPermissionsError] = useState<string>();
-  const [isInitialized, setIsInitialized] = useState(false);
-  const [initializationError, setInitializationError] = useState<Error | null>(null);
+    const [isPermissionsLoading, setIsPermissionsLoading] = useState<boolean>(false);
+    const [permissionsError, setPermissionsError] = useState<string>();
+    const [isInitialized, setIsInitialized] = useState(false);
+    const [initializationError, setInitializationError] = useState<Error | null>(null);
 
-  useEffect(() => {
-    (async () => {
-      setIsPermissionsLoading(false);
-      setPermissionsError(undefined);
-      setIsInitialized(false);
-      setInitializationError(null);
-      try {
-        setIsPermissionsLoading(true);
-        const permissionsResponse = await sendGetPermissionsCheck();
+    useEffect(() => {
+      (async () => {
         setIsPermissionsLoading(false);
-        if (permissionsResponse.data?.success) {
-          try {
-            const setupResponse = await sendSetup();
-            if (setupResponse.error) {
-              setInitializationError(setupResponse.error);
+        setPermissionsError(undefined);
+        setIsInitialized(false);
+        setInitializationError(null);
+        try {
+          setIsPermissionsLoading(true);
+          const permissionsResponse = await sendGetPermissionsCheck();
+          setIsPermissionsLoading(false);
+          if (permissionsResponse.data?.success) {
+            try {
+              const setupResponse = await sendSetup();
+              if (setupResponse.error) {
+                setInitializationError(setupResponse.error);
+              }
+            } catch (err) {
+              setInitializationError(err);
             }
-          } catch (err) {
-            setInitializationError(err);
+            setIsInitialized(true);
+          } else {
+            setPermissionsError(permissionsResponse.data?.error || 'REQUEST_ERROR');
           }
-          setIsInitialized(true);
-        } else {
-          setPermissionsError(permissionsResponse.data?.error || 'REQUEST_ERROR');
+        } catch (err) {
+          setPermissionsError('REQUEST_ERROR');
         }
-      } catch (err) {
-        setPermissionsError('REQUEST_ERROR');
-      }
-    })();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
+      })();
+      // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
 
-  if (isPermissionsLoading || permissionsError) {
-    return (
-      <ErrorLayout>
-        {isPermissionsLoading ? (
-          <Loading />
-        ) : permissionsError === 'REQUEST_ERROR' ? (
-          <Error
-            title={
-              <FormattedMessage
-                id="xpack.ingestManager.permissionsRequestErrorMessageTitle"
-                defaultMessage="Unable to check permissions"
-              />
-            }
-            error={i18n.translate('xpack.ingestManager.permissionsRequestErrorMessageDescription', {
-              defaultMessage: 'There was a problem checking Ingest Manager permissions',
-            })}
-          />
-        ) : (
-          <Panel>
-            <EuiEmptyPrompt
-              iconType="securityApp"
+    if (isPermissionsLoading || permissionsError) {
+      return (
+        <ErrorLayout>
+          {isPermissionsLoading ? (
+            <Loading />
+          ) : permissionsError === 'REQUEST_ERROR' ? (
+            <Error
               title={
-                <h2>
-                  {permissionsError === 'MISSING_SUPERUSER_ROLE' ? (
-                    <FormattedMessage
-                      id="xpack.ingestManager.permissionDeniedErrorTitle"
-                      defaultMessage="Permission denied"
-                    />
-                  ) : (
-                    <FormattedMessage
-                      id="xpack.ingestManager.securityRequiredErrorTitle"
-                      defaultMessage="Security is not enabled"
-                    />
-                  )}
-                </h2>
+                <FormattedMessage
+                  id="xpack.ingestManager.permissionsRequestErrorMessageTitle"
+                  defaultMessage="Unable to check permissions"
+                />
               }
-              body={
-                <p>
-                  {permissionsError === 'MISSING_SUPERUSER_ROLE' ? (
-                    <FormattedMessage
-                      id="xpack.ingestManager.permissionDeniedErrorMessage"
-                      defaultMessage="You are not authorized to access Ingest Manager. Ingest Manager requires {roleName} privileges."
-                      values={{ roleName: <EuiCode>superuser</EuiCode> }}
-                    />
-                  ) : (
-                    <FormattedMessage
-                      id="xpack.ingestManager.securityRequiredErrorMessage"
-                      defaultMessage="You must enable security in Kibana and Elasticsearch to use Ingest Manager."
-                    />
-                  )}
-                </p>
+              error={i18n.translate(
+                'xpack.ingestManager.permissionsRequestErrorMessageDescription',
+                {
+                  defaultMessage: 'There was a problem checking Ingest Manager permissions',
+                }
+              )}
+            />
+          ) : (
+            <Panel>
+              <EuiEmptyPrompt
+                iconType="securityApp"
+                title={
+                  <h2>
+                    {permissionsError === 'MISSING_SUPERUSER_ROLE' ? (
+                      <FormattedMessage
+                        id="xpack.ingestManager.permissionDeniedErrorTitle"
+                        defaultMessage="Permission denied"
+                      />
+                    ) : (
+                      <FormattedMessage
+                        id="xpack.ingestManager.securityRequiredErrorTitle"
+                        defaultMessage="Security is not enabled"
+                      />
+                    )}
+                  </h2>
+                }
+                body={
+                  <p>
+                    {permissionsError === 'MISSING_SUPERUSER_ROLE' ? (
+                      <FormattedMessage
+                        id="xpack.ingestManager.permissionDeniedErrorMessage"
+                        defaultMessage="You are not authorized to access Ingest Manager. Ingest Manager requires {roleName} privileges."
+                        values={{ roleName: <EuiCode>superuser</EuiCode> }}
+                      />
+                    ) : (
+                      <FormattedMessage
+                        id="xpack.ingestManager.securityRequiredErrorMessage"
+                        defaultMessage="You must enable security in Kibana and Elasticsearch to use Ingest Manager."
+                      />
+                    )}
+                  </p>
+                }
+              />
+            </Panel>
+          )}
+        </ErrorLayout>
+      );
+    }
+
+    if (!isInitialized || initializationError) {
+      return (
+        <ErrorLayout>
+          {initializationError ? (
+            <Error
+              title={
+                <FormattedMessage
+                  id="xpack.ingestManager.initializationErrorMessageTitle"
+                  defaultMessage="Unable to initialize Ingest Manager"
+                />
               }
+              error={initializationError}
             />
-          </Panel>
-        )}
-      </ErrorLayout>
-    );
-  }
+          ) : (
+            <Loading />
+          )}
+        </ErrorLayout>
+      );
+    }
 
-  if (!isInitialized || initializationError) {
     return (
-      <ErrorLayout>
-        {initializationError ? (
-          <Error
-            title={
-              <FormattedMessage
-                id="xpack.ingestManager.initializationErrorMessageTitle"
-                defaultMessage="Unable to initialize Ingest Manager"
-              />
-            }
-            error={initializationError}
-          />
-        ) : (
-          <Loading />
-        )}
-      </ErrorLayout>
+      <EuiErrorBoundary>
+        <FleetStatusProvider>
+          <IntraAppStateProvider kibanaScopedHistory={history}>
+            <Router {...rest}>
+              <PackageInstallProvider notifications={notifications}>
+                <Switch>
+                  <ProtectedRoute path={PAGE_ROUTING_PATHS.integrations} isAllowed={epm.enabled}>
+                    <DefaultLayout section="epm">
+                      <EPMApp />
+                    </DefaultLayout>
+                  </ProtectedRoute>
+                  <Route path={PAGE_ROUTING_PATHS.configurations}>
+                    <DefaultLayout section="agent_config">
+                      <AgentConfigApp />
+                    </DefaultLayout>
+                  </Route>
+                  <Route path={PAGE_ROUTING_PATHS.data_streams}>
+                    <DefaultLayout section="data_stream">
+                      <DataStreamApp />
+                    </DefaultLayout>
+                  </Route>
+                  <ProtectedRoute path={PAGE_ROUTING_PATHS.fleet} isAllowed={fleet.enabled}>
+                    <DefaultLayout section="fleet">
+                      <FleetApp />
+                    </DefaultLayout>
+                  </ProtectedRoute>
+                  <Route exact path={PAGE_ROUTING_PATHS.overview}>
+                    <DefaultLayout section="overview">
+                      <IngestManagerOverview />
+                    </DefaultLayout>
+                  </Route>
+                  <Redirect to="/" />
+                </Switch>
+              </PackageInstallProvider>
+            </Router>
+          </IntraAppStateProvider>
+        </FleetStatusProvider>
+      </EuiErrorBoundary>
     );
   }
-
-  return (
-    <EuiErrorBoundary>
-      <FleetStatusProvider>
-        <Router {...rest}>
-          <PackageInstallProvider notifications={notifications}>
-            <Switch>
-              <ProtectedRoute path={PAGE_ROUTING_PATHS.integrations} isAllowed={epm.enabled}>
-                <DefaultLayout section="epm">
-                  <EPMApp />
-                </DefaultLayout>
-              </ProtectedRoute>
-              <Route path={PAGE_ROUTING_PATHS.configurations}>
-                <DefaultLayout section="agent_config">
-                  <AgentConfigApp />
-                </DefaultLayout>
-              </Route>
-              <Route path={PAGE_ROUTING_PATHS.data_streams}>
-                <DefaultLayout section="data_stream">
-                  <DataStreamApp />
-                </DefaultLayout>
-              </Route>
-              <ProtectedRoute path={PAGE_ROUTING_PATHS.fleet} isAllowed={fleet.enabled}>
-                <DefaultLayout section="fleet">
-                  <FleetApp />
-                </DefaultLayout>
-              </ProtectedRoute>
-              <Route exact path={PAGE_ROUTING_PATHS.overview}>
-                <DefaultLayout section="overview">
-                  <IngestManagerOverview />
-                </DefaultLayout>
-              </Route>
-              <Redirect to="/" />
-            </Switch>
-          </PackageInstallProvider>
-        </Router>
-      </FleetStatusProvider>
-    </EuiErrorBoundary>
-  );
-};
+);
 
 const IngestManagerApp = ({
   basepath,
@@ -220,12 +228,14 @@ const IngestManagerApp = ({
   setupDeps,
   startDeps,
   config,
+  history,
 }: {
   basepath: string;
   coreStart: CoreStart;
   setupDeps: IngestManagerSetupDeps;
   startDeps: IngestManagerStartDeps;
   config: IngestManagerConfigType;
+  history: AppMountParameters['history'];
 }) => {
   const isDarkMode = useObservable<boolean>(coreStart.uiSettings.get$('theme:darkMode'));
   return (
@@ -234,7 +244,7 @@ const IngestManagerApp = ({
         <DepsContext.Provider value={{ setup: setupDeps, start: startDeps }}>
           <ConfigContext.Provider value={config}>
             <EuiThemeProvider darkMode={isDarkMode}>
-              <IngestManagerRoutes basepath={basepath} />
+              <IngestManagerRoutes history={history} basepath={basepath} />
             </EuiThemeProvider>
           </ConfigContext.Provider>
         </DepsContext.Provider>
@@ -245,7 +255,7 @@ const IngestManagerApp = ({
 
 export function renderApp(
   coreStart: CoreStart,
-  { element, appBasePath }: AppMountParameters,
+  { element, appBasePath, history }: AppMountParameters,
   setupDeps: IngestManagerSetupDeps,
   startDeps: IngestManagerStartDeps,
   config: IngestManagerConfigType
@@ -258,6 +268,7 @@ export function renderApp(
       setupDeps={setupDeps}
       startDeps={startDeps}
       config={config}
+      history={history}
     />,
     element
   );
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/layouts/with_header.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/layouts/with_header.tsx
index ac7f85bf5f594e..58ca989850bf1f 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/layouts/with_header.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/layouts/with_header.tsx
@@ -15,6 +15,7 @@ const Page = styled(EuiPage)`
 interface Props extends HeaderProps {
   restrictWidth?: number;
   restrictHeaderWidth?: number;
+  'data-test-subj'?: string;
   children?: React.ReactNode;
 }
 
@@ -22,11 +23,19 @@ export const WithHeaderLayout: React.FC<Props> = ({
   restrictWidth,
   restrictHeaderWidth,
   children,
+  'data-test-subj': dataTestSubj,
   ...rest
 }) => (
   <Fragment>
-    <Header maxWidth={restrictHeaderWidth} {...rest} />
-    <Page restrictWidth={restrictWidth || 1200}>
+    <Header
+      maxWidth={restrictHeaderWidth}
+      data-test-subj={dataTestSubj ? `${dataTestSubj}_header` : undefined}
+      {...rest}
+    />
+    <Page
+      restrictWidth={restrictWidth || 1200}
+      data-test-subj={dataTestSubj ? `${dataTestSubj}_page` : undefined}
+    >
       <EuiPageBody>
         <EuiSpacer size="m" />
         {children}
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx
index ccd2bc75fe2230..7939feed801430 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/components/layout.tsx
@@ -23,13 +23,31 @@ import { CreateDatasourceFrom } from '../types';
 export const CreateDatasourcePageLayout: React.FunctionComponent<{
   from: CreateDatasourceFrom;
   cancelUrl: string;
+  cancelOnClick?: React.ReactEventHandler;
   agentConfig?: AgentConfig;
   packageInfo?: PackageInfo;
-}> = ({ from, cancelUrl, agentConfig, packageInfo, children }) => {
+  'data-test-subj'?: string;
+}> = ({
+  from,
+  cancelUrl,
+  cancelOnClick,
+  agentConfig,
+  packageInfo,
+  children,
+  'data-test-subj': dataTestSubj,
+}) => {
   const leftColumn = (
     <EuiFlexGroup direction="column" gutterSize="s" alignItems="flexStart">
       <EuiFlexItem>
-        <EuiButtonEmpty size="xs" iconType="arrowLeft" flush="left" href={cancelUrl}>
+        {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
+        <EuiButtonEmpty
+          size="xs"
+          iconType="arrowLeft"
+          flush="left"
+          href={cancelUrl}
+          onClick={cancelOnClick}
+          data-test-subj={`${dataTestSubj}_cancelBackLink`}
+        >
           <FormattedMessage
             id="xpack.ingestManager.createDatasource.cancelLinkText"
             defaultMessage="Cancel"
@@ -130,6 +148,7 @@ export const CreateDatasourcePageLayout: React.FunctionComponent<{
       leftColumn={leftColumn}
       rightColumn={rightColumn}
       rightColumnGrow={false}
+      data-test-subj={dataTestSubj}
     >
       {children}
     </WithHeaderLayout>
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx
index 577f08cdc33138..876383770aa718 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/index.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useState, useEffect, useMemo, useCallback } from 'react';
+import React, { useState, useEffect, useMemo, useCallback, ReactEventHandler } from 'react';
 import { useRouteMatch, useHistory } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -17,7 +17,12 @@ import {
   EuiSpacer,
 } from '@elastic/eui';
 import { EuiStepProps } from '@elastic/eui/src/components/steps/step';
-import { AgentConfig, PackageInfo, NewDatasource } from '../../../types';
+import {
+  AgentConfig,
+  PackageInfo,
+  NewDatasource,
+  CreateDatasourceRouteState,
+} from '../../../types';
 import {
   useLink,
   useBreadcrumbs,
@@ -34,12 +39,14 @@ import { StepSelectPackage } from './step_select_package';
 import { StepSelectConfig } from './step_select_config';
 import { StepConfigureDatasource } from './step_configure_datasource';
 import { StepDefineDatasource } from './step_define_datasource';
+import { useIntraAppState } from '../../../hooks/use_intra_app_state';
 
 export const CreateDatasourcePage: React.FunctionComponent = () => {
   const {
     notifications,
     chrome: { getIsNavDrawerLocked$ },
     uiSettings,
+    application: { navigateToApp },
   } = useCore();
   const {
     fleet: { enabled: isFleetEnabled },
@@ -49,6 +56,7 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
   } = useRouteMatch();
   const { getHref, getPath } = useLink();
   const history = useHistory();
+  const routeState = useIntraAppState<CreateDatasourceRouteState>();
   const from: CreateDatasourceFrom = configId ? 'config' : 'package';
   const [isNavDrawerLocked, setIsNavDrawerLocked] = useState(false);
 
@@ -171,10 +179,24 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
   };
 
   // Cancel path
-  const cancelUrl =
-    from === 'config'
-      ? getHref('configuration_details', { configId: agentConfig?.id || configId })
+  const cancelUrl = useMemo(() => {
+    if (routeState && routeState.onCancelUrl) {
+      return routeState.onCancelUrl;
+    }
+    return from === 'config'
+      ? getHref('configuration_details', { configId: agentConfigId || configId })
       : getHref('integration_details', { pkgkey });
+  }, [agentConfigId, configId, from, getHref, pkgkey, routeState]);
+
+  const cancelClickHandler: ReactEventHandler = useCallback(
+    (ev) => {
+      if (routeState && routeState.onCancelNavigateTo) {
+        ev.preventDefault();
+        navigateToApp(...routeState.onCancelNavigateTo);
+      }
+    },
+    [routeState, navigateToApp]
+  );
 
   // Save datasource
   const saveDatasource = async () => {
@@ -193,9 +215,18 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
       setFormState('CONFIRM');
       return;
     }
-    const { error } = await saveDatasource();
+    const { error, data } = await saveDatasource();
     if (!error) {
-      history.push(getPath('configuration_details', { configId: agentConfig?.id || configId }));
+      if (routeState && routeState.onSaveNavigateTo) {
+        navigateToApp(
+          ...(typeof routeState.onSaveNavigateTo === 'function'
+            ? routeState.onSaveNavigateTo(data!.item)
+            : routeState.onSaveNavigateTo)
+        );
+      } else {
+        history.push(getPath('configuration_details', { configId: agentConfig?.id || configId }));
+      }
+
       notifications.toasts.addSuccess({
         title: i18n.translate('xpack.ingestManager.createDatasource.addedNotificationTitle', {
           defaultMessage: `Successfully added '{datasourceName}'`,
@@ -212,6 +243,7 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
                 },
               })
             : undefined,
+        'data-test-subj': 'datasourceCreateSuccessToast',
       });
     } else {
       notifications.toasts.addError(error, {
@@ -224,6 +256,7 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
   const layoutProps = {
     from,
     cancelUrl,
+    cancelOnClick: cancelClickHandler,
     agentConfig,
     packageInfo,
   };
@@ -287,6 +320,7 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
         defaultMessage: 'Select the data you want to collect',
       }),
       status: !packageInfo || !agentConfig ? 'disabled' : undefined,
+      'data-test-subj': 'dataCollectionSetupStep',
       children:
         agentConfig && packageInfo ? (
           <StepConfigureDatasource
@@ -301,7 +335,7 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
   ];
 
   return (
-    <CreateDatasourcePageLayout {...layoutProps}>
+    <CreateDatasourcePageLayout {...layoutProps} data-test-subj="createDataSource">
       {formState === 'CONFIRM' && agentConfig && (
         <ConfirmDeployConfigModal
           agentCount={agentCount}
@@ -334,7 +368,13 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
       >
         <EuiFlexGroup gutterSize="s" justifyContent="flexEnd">
           <EuiFlexItem grow={false}>
-            <EuiButtonEmpty color="ghost" href={cancelUrl}>
+            {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
+            <EuiButtonEmpty
+              color="ghost"
+              href={cancelUrl}
+              onClick={cancelClickHandler}
+              data-test-subj="createDatasourceCancelButton"
+            >
               <FormattedMessage
                 id="xpack.ingestManager.createDatasource.cancelButton"
                 defaultMessage="Cancel"
@@ -349,6 +389,7 @@ export const CreateDatasourcePage: React.FunctionComponent = () => {
               iconType="save"
               color="primary"
               fill
+              data-test-subj="createDatasourceSaveButton"
             >
               <FormattedMessage
                 id="xpack.ingestManager.createDatasource.saveButton"
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_define_datasource.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_define_datasource.tsx
index 3b227564093307..2651615b458f74 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_define_datasource.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_define_datasource.tsx
@@ -88,6 +88,7 @@ export const StepDefineDatasource: React.FunctionComponent<{
                   name: e.target.value,
                 })
               }
+              data-test-subj="datasourceNameInput"
             />
           </EuiFormRow>
         </EuiFlexItem>
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_select_config.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_select_config.tsx
index 22cb219f911f6a..5f556a46e518df 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_select_config.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/create_datasource_page/step_select_config.tsx
@@ -113,6 +113,7 @@ export const StepSelectConfig: React.FunctionComponent<{
               label: name,
               key: id,
               checked: selectedConfigId === id ? 'on' : undefined,
+              'data-test-subj': 'agentConfigItem',
             };
           })}
           renderOption={(option) => (
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts
index 6dbc8d67caaee6..ece7aef2c247fe 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/services/index.ts
@@ -19,7 +19,7 @@ export {
   settingsRoutesService,
   appRoutesService,
   packageToConfigDatasourceInputs,
-  storedDatasourceToAgentDatasource,
+  storedDatasourcesToAgentInputs,
   configToYaml,
   AgentStatusKueryHelper,
 } from '../../../../common';
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/index.ts b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/index.ts
index 412bf412d1ef5a..1a4c6a8a86f6ed 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/index.ts
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/index.ts
@@ -99,3 +99,5 @@ export {
   InstallationStatus,
   Installable,
 } from '../../../../common';
+
+export * from './intra_app_route_state';
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/intra_app_route_state.ts b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/intra_app_route_state.ts
new file mode 100644
index 00000000000000..6e85d12f718910
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/types/intra_app_route_state.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ApplicationStart } from 'kibana/public';
+import { Datasource } from '../../../../common/types/models';
+
+/**
+ * Supported routing state for the create datasource page routes
+ */
+export interface CreateDatasourceRouteState {
+  /** On a successful save of the datasource, use navigate to the given app */
+  onSaveNavigateTo?:
+    | Parameters<ApplicationStart['navigateToApp']>
+    | ((newDatasource: Datasource) => Parameters<ApplicationStart['navigateToApp']>);
+  /** On cancel, navigate to the given app */
+  onCancelNavigateTo?: Parameters<ApplicationStart['navigateToApp']>;
+  /** Url to be used on cancel links */
+  onCancelUrl?: string;
+}
+
+/**
+ * All possible Route states.
+ */
+export type AnyIntraAppRouteState = CreateDatasourceRouteState;
diff --git a/x-pack/plugins/ingest_manager/public/index.ts b/x-pack/plugins/ingest_manager/public/index.ts
index e26f310b6d9c6c..9f4893ac6e499f 100644
--- a/x-pack/plugins/ingest_manager/public/index.ts
+++ b/x-pack/plugins/ingest_manager/public/index.ts
@@ -19,3 +19,4 @@ export {
 } from './applications/ingest_manager/sections/agent_config/create_datasource_page/components/custom_configure_datasource';
 
 export { NewDatasource } from './applications/ingest_manager/types';
+export * from './applications/ingest_manager/types/intra_app_route_state';
diff --git a/x-pack/plugins/ingest_manager/server/services/agent_config.test.ts b/x-pack/plugins/ingest_manager/server/services/agent_config.test.ts
index 17758f6e3d7f12..c46e648ad088a3 100644
--- a/x-pack/plugins/ingest_manager/server/services/agent_config.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agent_config.test.ts
@@ -59,7 +59,7 @@ describe('agent config', () => {
             api_key: undefined,
           },
         },
-        datasources: [],
+        inputs: [],
         revision: 1,
         settings: {
           monitoring: {
@@ -88,7 +88,7 @@ describe('agent config', () => {
             api_key: undefined,
           },
         },
-        datasources: [],
+        inputs: [],
         revision: 1,
         settings: {
           monitoring: {
@@ -118,7 +118,7 @@ describe('agent config', () => {
             api_key: undefined,
           },
         },
-        datasources: [],
+        inputs: [],
         revision: 1,
         settings: {
           monitoring: {
diff --git a/x-pack/plugins/ingest_manager/server/services/agent_config.ts b/x-pack/plugins/ingest_manager/server/services/agent_config.ts
index 18d5d8dedfb1fa..9e0386de747630 100644
--- a/x-pack/plugins/ingest_manager/server/services/agent_config.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agent_config.ts
@@ -20,7 +20,7 @@ import {
   AgentConfigStatus,
   ListWithKuery,
 } from '../types';
-import { DeleteAgentConfigResponse, storedDatasourceToAgentDatasource } from '../../common';
+import { DeleteAgentConfigResponse, storedDatasourcesToAgentInputs } from '../../common';
 import { listAgents } from './agents';
 import { datasourceService } from './datasource';
 import { outputService } from './output';
@@ -375,9 +375,7 @@ class AgentConfigService {
           {} as FullAgentConfig['outputs']
         ),
       },
-      datasources: (config.datasources as Datasource[])
-        .filter((datasource) => datasource.enabled)
-        .map((ds) => storedDatasourceToAgentDatasource(ds)),
+      inputs: storedDatasourcesToAgentInputs(config.datasources as Datasource[]),
       revision: config.revision,
       ...(config.monitoring_enabled && config.monitoring_enabled.length > 0
         ? {
diff --git a/x-pack/plugins/ingest_manager/server/types/index.tsx b/x-pack/plugins/ingest_manager/server/types/index.tsx
index 2218d967fa8aa1..2b543490ca8dab 100644
--- a/x-pack/plugins/ingest_manager/server/types/index.tsx
+++ b/x-pack/plugins/ingest_manager/server/types/index.tsx
@@ -20,7 +20,7 @@ export {
   Datasource,
   NewDatasource,
   DatasourceSOAttributes,
-  FullAgentConfigDatasource,
+  FullAgentConfigInput,
   FullAgentConfig,
   AgentConfig,
   AgentConfigSOAttributes,
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form_fields.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form_fields.tsx
index a0e7c8fd8bcd73..52d1a77c1df6da 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form_fields.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form_fields.tsx
@@ -128,8 +128,7 @@ export const PipelineFormFields: React.FunctionComponent<Props> = ({
           return (
             <PipelineProcessorsEditor
               onFlyoutOpen={onEditorFlyoutOpen}
-              learnMoreAboutProcessorsUrl={services.documentation.getProcessorsUrl()}
-              learnMoreAboutOnFailureProcessorsUrl={services.documentation.getHandlingFailureUrl()}
+              esDocsBasePath={services.documentation.getEsDocsBasePath()}
               isTestButtonDisabled={isTestButtonDisabled}
               onTestPipelineClick={onTestPipelineClick}
               onUpdate={onProcessorsUpdate}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx
index 758d6f5e620ce4..ad0474a94f56c0 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/__jest__/pipeline_processors_editor.test.tsx
@@ -36,8 +36,7 @@ describe('Pipeline Editor', () => {
       onUpdate,
       isTestButtonDisabled: false,
       onTestPipelineClick: jest.fn(),
-      learnMoreAboutProcessorsUrl: 'test',
-      learnMoreAboutOnFailureProcessorsUrl: 'test',
+      esDocsBasePath: 'test',
     });
 
     const {
@@ -56,8 +55,7 @@ describe('Pipeline Editor', () => {
       onUpdate: jest.fn(),
       isTestButtonDisabled: false,
       onTestPipelineClick: jest.fn(),
-      learnMoreAboutProcessorsUrl: 'test',
-      learnMoreAboutOnFailureProcessorsUrl: 'test',
+      esDocsBasePath: 'test',
     });
 
     expect(exists('pipelineEditorOnFailureTree')).toBe(false);
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts
index cb5d5a10e9f422..2d512a6bfa2ed6 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/index.ts
@@ -4,9 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { SettingsFormFlyout, OnSubmitHandler } from './settings_form_flyout';
-
-export { ProcessorSettingsForm, ProcessorSettingsFromOnSubmitArg } from './processor_settings_form';
+export {
+  ProcessorSettingsForm,
+  ProcessorSettingsFromOnSubmitArg,
+  OnSubmitHandler,
+} from './processor_settings_form';
 
 export { ProcessorsTree, ProcessorInfo, OnActionHandler } from './processors_tree';
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx
index 1c8edac7cfd649..6451096c897d74 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/on_failure_processors_title.tsx
@@ -34,7 +34,10 @@ export const OnFailureProcessorsTitle: FunctionComponent = () => {
             defaultMessage="The processors used to pre-process documents before indexing. {learnMoreLink}"
             values={{
               learnMoreLink: (
-                <EuiLink href={links.learnMoreAboutOnFailureProcessorsUrl} target="_blank">
+                <EuiLink
+                  href={links.esDocsBasePath + '/handling-failure-in-pipelines.html'}
+                  target="_blank"
+                >
                   {i18n.translate(
                     'xpack.ingestPipelines.pipelineEditor.onFailureProcessorsDocumentationLink',
                     {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/documentation_button.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/documentation_button.tsx
new file mode 100644
index 00000000000000..b1fd9e97aa23d3
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/documentation_button.tsx
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import { EuiButtonEmpty } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+interface Props {
+  processorLabel: string;
+  docLink: string;
+}
+
+export const DocumentationButton: FunctionComponent<Props> = ({ processorLabel, docLink }) => {
+  return (
+    <EuiButtonEmpty size="s" flush="right" href={docLink} target="_blank" iconType="help">
+      {i18n.translate(
+        'xpack.ingestPipelines.pipelineEditor.settingsForm.learnMoreLabelLink.processor',
+        { defaultMessage: '{processorLabel} documentation', values: { processorLabel } }
+      )}
+    </EuiButtonEmpty>
+  );
+};
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/index.ts
index 60a1aa0a96fb10..1a7da4891967a2 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/index.ts
@@ -7,4 +7,5 @@
 export {
   ProcessorSettingsForm,
   ProcessorSettingsFromOnSubmitArg,
+  OnSubmitHandler,
 } from './processor_settings_form.container';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/map_processor_type_to_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/map_processor_type_to_form.tsx
index e8164a0057d393..5993d7fb3f87a2 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/map_processor_type_to_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/map_processor_type_to_form.tsx
@@ -4,53 +4,270 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { FunctionComponent } from 'react';
 
 // import { SetProcessor } from './processors/set';
 // import { Gsub } from './processors/gsub';
 
-const mapProcessorTypeToForm = {
-  append: undefined, // TODO: Implement
-  bytes: undefined, // TODO: Implement
-  circle: undefined, // TODO: Implement
-  convert: undefined, // TODO: Implement
-  csv: undefined, // TODO: Implement
-  date: undefined, // TODO: Implement
-  date_index_name: undefined, // TODO: Implement
-  dissect: undefined, // TODO: Implement
-  dot_expander: undefined, // TODO: Implement
-  drop: undefined, // TODO: Implement
-  enrich: undefined, // TODO: Implement
-  fail: undefined, // TODO: Implement
-  foreach: undefined, // TODO: Implement
-  geoip: undefined, // TODO: Implement
-  grok: undefined, // TODO: Implement
-  html_strip: undefined, // TODO: Implement
-  inference: undefined, // TODO: Implement
-  join: undefined, // TODO: Implement
-  json: undefined, // TODO: Implement
-  kv: undefined, // TODO: Implement
-  lowercase: undefined, // TODO: Implement
-  pipeline: undefined, // TODO: Implement
-  remove: undefined, // TODO: Implement
-  rename: undefined, // TODO: Implement
-  script: undefined, // TODO: Implement
-  set_security_user: undefined, // TODO: Implement
-  split: undefined, // TODO: Implement
-  sort: undefined, // TODO: Implement
-  trim: undefined, // TODO: Implement
-  uppercase: undefined, // TODO: Implement
-  urldecode: undefined, // TODO: Implement
-  user_agent: undefined, // TODO: Implement
-
-  gsub: undefined,
-  set: undefined,
+interface FieldsFormDescriptor {
+  FieldsComponent?: FunctionComponent;
+  docLinkPath: string;
+  /**
+   * A sentence case label that can be displayed to users
+   */
+  label: string;
+}
+
+const mapProcessorTypeToFormDescriptor: Record<string, FieldsFormDescriptor> = {
+  append: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/append-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.append', {
+      defaultMessage: 'Append',
+    }),
+  },
+  bytes: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/bytes-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.bytes', {
+      defaultMessage: 'Bytes',
+    }),
+  },
+  circle: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/ingest-circle-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.circle', {
+      defaultMessage: 'Circle',
+    }),
+  },
+  convert: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/convert-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.convert', {
+      defaultMessage: 'Convert',
+    }),
+  },
+  csv: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/csv-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.csv', {
+      defaultMessage: 'CSV',
+    }),
+  },
+  date: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/date-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.date', {
+      defaultMessage: 'Date',
+    }),
+  },
+  date_index_name: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/date-index-name-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.dateIndexName', {
+      defaultMessage: 'Date Index Name',
+    }),
+  },
+  dissect: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/dissect-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.dissect', {
+      defaultMessage: 'Dissect',
+    }),
+  },
+  dot_expander: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/dot-expand-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.dotExpander', {
+      defaultMessage: 'Dot Expander',
+    }),
+  },
+  drop: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/drop-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.drop', {
+      defaultMessage: 'Drop',
+    }),
+  },
+  enrich: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/enrich-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.enrich', {
+      defaultMessage: 'Enrich',
+    }),
+  },
+  fail: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/fail-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.fail', {
+      defaultMessage: 'Fail',
+    }),
+  },
+  foreach: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/foreach-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.foreach', {
+      defaultMessage: 'Foreach',
+    }),
+  },
+  geoip: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/geoip-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.geoip', {
+      defaultMessage: 'GeoIP',
+    }),
+  },
+  gsub: {
+    FieldsComponent: undefined,
+    docLinkPath: '/gsub-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.gsub', {
+      defaultMessage: 'Gsub',
+    }),
+  },
+  html_strip: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/htmlstrip-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.htmlStrip', {
+      defaultMessage: 'HTML Strip',
+    }),
+  },
+  inference: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/inference-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.inference', {
+      defaultMessage: 'Inference',
+    }),
+  },
+  join: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/join-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.join', {
+      defaultMessage: 'Join',
+    }),
+  },
+  json: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/json-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.json', {
+      defaultMessage: 'JSON',
+    }),
+  },
+  kv: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/kv-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.kv', {
+      defaultMessage: 'KV',
+    }),
+  },
+  lowercase: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/lowercase-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.lowercase', {
+      defaultMessage: 'Lowercase',
+    }),
+  },
+  pipeline: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/pipeline-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.pipeline', {
+      defaultMessage: 'Pipeline',
+    }),
+  },
+  remove: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/remove-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.remove', {
+      defaultMessage: 'Remove',
+    }),
+  },
+  rename: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/rename-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.rename', {
+      defaultMessage: 'Rename',
+    }),
+  },
+  script: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/script-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.script', {
+      defaultMessage: 'Script',
+    }),
+  },
+  set_security_user: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/ingest-node-set-security-user-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.setSecurityUser', {
+      defaultMessage: 'Set Security User',
+    }),
+  },
+  split: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/split-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.split', {
+      defaultMessage: 'Split',
+    }),
+  },
+  sort: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/sort-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.sort', {
+      defaultMessage: 'Sort',
+    }),
+  },
+  trim: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/trim-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.trim', {
+      defaultMessage: 'Trim',
+    }),
+  },
+  uppercase: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/uppercase-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.uppercase', {
+      defaultMessage: 'Uppercase',
+    }),
+  },
+  urldecode: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/urldecode-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.urldecode', {
+      defaultMessage: 'URL Decode',
+    }),
+  },
+  user_agent: {
+    FieldsComponent: undefined, // TODO: Implement
+    docLinkPath: '/user-agent-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.userAgent', {
+      defaultMessage: 'User Agent',
+    }),
+  },
+
+  // --- The below processor descriptors have components implemented ---
+  set: {
+    FieldsComponent: undefined,
+    docLinkPath: '/set-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.set', {
+      defaultMessage: 'Set',
+    }),
+  },
+  grok: {
+    FieldsComponent: undefined,
+    docLinkPath: '/grok-processor.html',
+    label: i18n.translate('xpack.ingestPipelines.processors.label.grok', {
+      defaultMessage: 'Grok',
+    }),
+  },
 };
 
-export const types = Object.keys(mapProcessorTypeToForm);
+export const types = Object.keys(mapProcessorTypeToFormDescriptor).sort();
 
-export type ProcessorType = keyof typeof mapProcessorTypeToForm;
+export type ProcessorType = keyof typeof mapProcessorTypeToFormDescriptor;
 
-export const getProcessorForm = (type: ProcessorType | string): FunctionComponent | undefined => {
-  return mapProcessorTypeToForm[type as ProcessorType];
+export const getProcessorFormDescriptor = (
+  type: ProcessorType | string
+): FieldsFormDescriptor | undefined => {
+  return mapProcessorTypeToFormDescriptor[type as ProcessorType];
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.container.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.container.tsx
index 29b52ef84600ab..d76e9225c1a137 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.container.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.container.tsx
@@ -13,9 +13,16 @@ import { ProcessorSettingsForm as ViewComponent } from './processor_settings_for
 
 export type ProcessorSettingsFromOnSubmitArg = Omit<ProcessorInternal, 'id'>;
 
+export type OnSubmitHandler = (processor: ProcessorSettingsFromOnSubmitArg) => void;
+
+export type OnFormUpdateHandler = (form: OnFormUpdateArg<any>) => void;
+
 interface Props {
-  onFormUpdate: (form: OnFormUpdateArg<any>) => void;
-  onSubmit: (processor: ProcessorSettingsFromOnSubmitArg) => void;
+  onFormUpdate: OnFormUpdateHandler;
+  onSubmit: OnSubmitHandler;
+  isOnFailure: boolean;
+  onOpen: () => void;
+  onClose: () => void;
   processor?: ProcessorInternal;
 }
 
@@ -23,6 +30,7 @@ export const ProcessorSettingsForm: FunctionComponent<Props> = ({
   processor,
   onFormUpdate,
   onSubmit,
+  ...rest
 }) => {
   const handleSubmit = useCallback(
     async (data: FormData, isValid: boolean) => {
@@ -52,5 +60,5 @@ export const ProcessorSettingsForm: FunctionComponent<Props> = ({
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [onFormUpdate]);
 
-  return <ViewComponent processor={processor} form={form} />;
+  return <ViewComponent processor={processor} form={form} {...rest} />;
 };
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx
index 49bde2129aab6d..81b5731a96d5fb 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processor_settings_form/processor_settings_form.tsx
@@ -3,67 +3,141 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
 import { i18n } from '@kbn/i18n';
-import React, { FunctionComponent, memo } from 'react';
-import { EuiButton, EuiHorizontalRule } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import React, { FunctionComponent, memo, useEffect } from 'react';
+import {
+  EuiButton,
+  EuiHorizontalRule,
+  EuiFlyout,
+  EuiFlyoutHeader,
+  EuiTitle,
+  EuiFlyoutBody,
+  EuiFlexGroup,
+  EuiFlexItem,
+} from '@elastic/eui';
 
 import { Form, useForm, FormDataProvider } from '../../../../../shared_imports';
-
+import { usePipelineProcessorsContext } from '../../context';
 import { ProcessorInternal } from '../../types';
 
-import { getProcessorForm } from './map_processor_type_to_form';
+import { DocumentationButton } from './documentation_button';
+import { ProcessorSettingsFromOnSubmitArg } from './processor_settings_form.container';
+import { getProcessorFormDescriptor } from './map_processor_type_to_form';
 import { CommonProcessorFields, ProcessorTypeField } from './processors/common_fields';
 import { Custom } from './processors/custom';
 
+export type OnSubmitHandler = (processor: ProcessorSettingsFromOnSubmitArg) => void;
+
 export interface Props {
+  isOnFailure: boolean;
   processor?: ProcessorInternal;
   form: ReturnType<typeof useForm>['form'];
+  onClose: () => void;
+  onOpen: () => void;
 }
 
 export const ProcessorSettingsForm: FunctionComponent<Props> = memo(
-  ({ processor, form }) => {
+  ({ processor, form, isOnFailure, onClose, onOpen }) => {
+    const {
+      links: { esDocsBasePath },
+    } = usePipelineProcessorsContext();
+
+    const flyoutTitleContent = isOnFailure ? (
+      <FormattedMessage
+        id="xpack.ingestPipelines.settingsFormOnFailureFlyout.title"
+        defaultMessage="Configure on-failure processor"
+      />
+    ) : (
+      <FormattedMessage
+        id="xpack.ingestPipelines.settingsFormFlyout.title"
+        defaultMessage="Configure processor"
+      />
+    );
+
+    useEffect(
+      () => {
+        onOpen();
+      },
+      [] /* eslint-disable-line react-hooks/exhaustive-deps */
+    );
+
     return (
       <Form form={form}>
-        <ProcessorTypeField initialType={processor?.type} />
-
-        <EuiHorizontalRule />
-
-        <FormDataProvider pathsToWatch="type">
-          {(arg: any) => {
-            const { type } = arg;
-            let formContent: React.ReactNode | undefined;
-
-            if (type?.length) {
-              const ProcessorFormFields = getProcessorForm(type as any);
-
-              if (ProcessorFormFields) {
-                formContent = (
-                  <>
-                    <ProcessorFormFields />
-                    <CommonProcessorFields />
-                  </>
-                );
-              } else {
-                formContent = <Custom defaultOptions={processor?.options} />;
-              }
-
-              return (
-                <>
-                  {formContent}
-                  <EuiButton onClick={form.submit}>
-                    {i18n.translate(
-                      'xpack.ingestPipelines.pipelineEditor.settingsForm.submitButtonLabel',
-                      { defaultMessage: 'Submit' }
-                    )}
-                  </EuiButton>
-                </>
-              );
-            }
-
-            // If the user has not yet defined a type, we do not show any settings fields
-            return null;
-          }}
-        </FormDataProvider>
+        <EuiFlyout onClose={onClose}>
+          <EuiFlyoutHeader>
+            <EuiFlexGroup gutterSize="xs">
+              <EuiFlexItem>
+                <div>
+                  <EuiTitle size="m">
+                    <h2>{flyoutTitleContent}</h2>
+                  </EuiTitle>
+                </div>
+              </EuiFlexItem>
+
+              <EuiFlexItem grow={false}>
+                <FormDataProvider pathsToWatch="type">
+                  {({ type }) => {
+                    const formDescriptor = getProcessorFormDescriptor(type as any);
+
+                    if (formDescriptor) {
+                      return (
+                        <DocumentationButton
+                          processorLabel={formDescriptor.label}
+                          docLink={esDocsBasePath + formDescriptor.docLinkPath}
+                        />
+                      );
+                    }
+                    return null;
+                  }}
+                </FormDataProvider>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFlyoutHeader>
+          <EuiFlyoutBody>
+            <ProcessorTypeField initialType={processor?.type} />
+
+            <EuiHorizontalRule />
+
+            <FormDataProvider pathsToWatch="type">
+              {(arg: any) => {
+                const { type } = arg;
+                let formContent: React.ReactNode | undefined;
+
+                if (type?.length) {
+                  const formDescriptor = getProcessorFormDescriptor(type as any);
+
+                  if (formDescriptor?.FieldsComponent) {
+                    formContent = (
+                      <>
+                        <formDescriptor.FieldsComponent />
+                        <CommonProcessorFields />
+                      </>
+                    );
+                  } else {
+                    formContent = <Custom defaultOptions={processor?.options} />;
+                  }
+
+                  return (
+                    <>
+                      {formContent}
+                      <EuiButton onClick={form.submit}>
+                        {i18n.translate(
+                          'xpack.ingestPipelines.pipelineEditor.settingsForm.submitButtonLabel',
+                          { defaultMessage: 'Submit' }
+                        )}
+                      </EuiButton>
+                    </>
+                  );
+                }
+
+                // If the user has not yet defined a type, we do not show any settings fields
+                return null;
+              }}
+            </FormDataProvider>
+          </EuiFlyoutBody>
+        </EuiFlyout>
       </Form>
     );
   },
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_title_and_test_button.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_title_and_test_button.tsx
index bc646c9eefa559..6d1e2610b5c2b0 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_title_and_test_button.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/processors_title_and_test_button.tsx
@@ -42,7 +42,7 @@ export const ProcessorsTitleAndTestButton: FunctionComponent<Props> = ({
             defaultMessage="The processors used to pre-process documents before indexing. {learnMoreLink}"
             values={{
               learnMoreLink: (
-                <EuiLink href={links.learnMoreAboutProcessorsUrl} target="_blank">
+                <EuiLink href={links.esDocsBasePath + '/ingest-processors.html'} target="_blank">
                   {i18n.translate(
                     'xpack.ingestPipelines.pipelineEditor.processorsDocumentationLink',
                     {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/settings_form_flyout.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/settings_form_flyout.tsx
deleted file mode 100644
index 94d5f0eda64542..00000000000000
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/components/settings_form_flyout.tsx
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { EuiFlyout, EuiFlyoutBody, EuiFlyoutHeader, EuiTitle } from '@elastic/eui';
-
-import React, { FunctionComponent, memo, useEffect } from 'react';
-
-import { FormattedMessage } from '@kbn/i18n/react';
-
-import { OnFormUpdateArg } from '../../../../shared_imports';
-
-import { ProcessorInternal } from '../types';
-
-import { ProcessorSettingsForm, ProcessorSettingsFromOnSubmitArg } from '.';
-
-export type OnSubmitHandler = (processor: ProcessorSettingsFromOnSubmitArg) => void;
-
-export interface Props {
-  processor: ProcessorInternal | undefined;
-  onFormUpdate: (form: OnFormUpdateArg<any>) => void;
-  onSubmit: OnSubmitHandler;
-  isOnFailureProcessor: boolean;
-  onOpen: () => void;
-  onClose: () => void;
-}
-
-export const SettingsFormFlyout: FunctionComponent<Props> = memo(
-  ({ onClose, processor, onSubmit, onFormUpdate, onOpen, isOnFailureProcessor }) => {
-    useEffect(
-      () => {
-        onOpen();
-      },
-      [] /* eslint-disable-line react-hooks/exhaustive-deps */
-    );
-    const flyoutTitleContent = isOnFailureProcessor ? (
-      <FormattedMessage
-        id="xpack.ingestPipelines.settingsFormOnFailureFlyout.title"
-        defaultMessage="Configure on-failure processor"
-      />
-    ) : (
-      <FormattedMessage
-        id="xpack.ingestPipelines.settingsFormFlyout.title"
-        defaultMessage="Configure processor"
-      />
-    );
-
-    return (
-      <EuiFlyout onClose={onClose}>
-        <EuiFlyoutHeader>
-          <EuiTitle>
-            <h2>{flyoutTitleContent}</h2>
-          </EuiTitle>
-        </EuiFlyoutHeader>
-        <EuiFlyoutBody>
-          <ProcessorSettingsForm
-            onFormUpdate={onFormUpdate}
-            processor={processor}
-            onSubmit={onSubmit}
-          />
-        </EuiFlyoutBody>
-      </EuiFlyout>
-    );
-  }
-);
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context.tsx
index 150a52f1a5fe06..fbc06f41208fe1 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/context.tsx
@@ -9,8 +9,7 @@ import { EditorMode } from './types';
 import { ProcessorsDispatch } from './processors_reducer';
 
 interface Links {
-  learnMoreAboutProcessorsUrl: string;
-  learnMoreAboutOnFailureProcessorsUrl: string;
+  esDocsBasePath: string;
 }
 
 const PipelineProcessorsContext = createContext<{
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.container.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.container.tsx
index 057f8638700a42..7257677c08fc20 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.container.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.container.tsx
@@ -26,8 +26,7 @@ export interface Props {
   onUpdate: (arg: OnUpdateHandlerArg) => void;
   isTestButtonDisabled: boolean;
   onTestPipelineClick: () => void;
-  learnMoreAboutProcessorsUrl: string;
-  learnMoreAboutOnFailureProcessorsUrl: string;
+  esDocsBasePath: string;
   /**
    * Give users a way to react to this component opening a flyout
    */
@@ -41,8 +40,7 @@ export const PipelineProcessorsEditor: FunctionComponent<Props> = ({
   onFlyoutOpen,
   onUpdate,
   isTestButtonDisabled,
-  learnMoreAboutOnFailureProcessorsUrl,
-  learnMoreAboutProcessorsUrl,
+  esDocsBasePath,
   onTestPipelineClick,
 }) => {
   const deserializedResult = useMemo(
@@ -61,7 +59,7 @@ export const PipelineProcessorsEditor: FunctionComponent<Props> = ({
   return (
     <PipelineProcessorsContextProvider
       processorsDispatch={processorsDispatch}
-      links={{ learnMoreAboutOnFailureProcessorsUrl, learnMoreAboutProcessorsUrl }}
+      links={{ esDocsBasePath }}
     >
       <PipelineProcessorsEditorUI
         onFlyoutOpen={onFlyoutOpen}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx
index 24b9598a74d479..b64f77f582b3af 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/pipeline_processors_editor.tsx
@@ -14,19 +14,22 @@ import {
   ProcessorsTitleAndTestButton,
   OnFailureProcessorsTitle,
   ProcessorsTree,
-  SettingsFormFlyout,
   ProcessorRemoveModal,
   OnActionHandler,
   OnSubmitHandler,
+  ProcessorSettingsForm,
 } from './components';
 
+import { ProcessorInternal, OnUpdateHandlerArg, FormValidityState, OnFormUpdateArg } from './types';
+
 import {
-  ProcessorInternal,
-  ProcessorSelector,
-  OnUpdateHandlerArg,
-  FormValidityState,
-  OnFormUpdateArg,
-} from './types';
+  ON_FAILURE_STATE_SCOPE,
+  PROCESSOR_STATE_SCOPE,
+  isOnFailureSelector,
+} from './processors_reducer';
+
+const PROCESSORS_BASE_SELECTOR = [PROCESSOR_STATE_SCOPE];
+const ON_FAILURE_BASE_SELECTOR = [ON_FAILURE_STATE_SCOPE];
 
 import { serialize } from './serialize';
 import { getValue } from './utils';
@@ -41,9 +44,6 @@ export interface Props {
   onFlyoutOpen: () => void;
 }
 
-const PROCESSOR_STATE_SCOPE: ProcessorSelector = ['processors'];
-const ON_FAILURE_STATE_SCOPE: ProcessorSelector = ['onFailure'];
-
 export const PipelineProcessorsEditor: FunctionComponent<Props> = memo(
   function PipelineProcessorsEditor({
     processors,
@@ -168,7 +168,7 @@ export const PipelineProcessorsEditor: FunctionComponent<Props> = memo(
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
             <ProcessorsTree
-              baseSelector={PROCESSOR_STATE_SCOPE}
+              baseSelector={PROCESSORS_BASE_SELECTOR}
               processors={processors}
               onAction={onTreeAction}
               movingProcessor={movingProcessor}
@@ -197,7 +197,7 @@ export const PipelineProcessorsEditor: FunctionComponent<Props> = memo(
             <EuiFlexItem grow={false}>
               <ProcessorsTree
                 data-test-subj="pipelineEditorOnFailureTree"
-                baseSelector={ON_FAILURE_STATE_SCOPE}
+                baseSelector={ON_FAILURE_BASE_SELECTOR}
                 processors={onFailureProcessors}
                 onAction={onTreeAction}
                 movingProcessor={movingProcessor}
@@ -206,8 +206,8 @@ export const PipelineProcessorsEditor: FunctionComponent<Props> = memo(
           ) : undefined}
         </EuiFlexGroup>
         {editorMode.id === 'editingProcessor' || editorMode.id === 'creatingProcessor' ? (
-          <SettingsFormFlyout
-            isOnFailureProcessor={editorMode.arg.selector.length > 1}
+          <ProcessorSettingsForm
+            isOnFailure={isOnFailureSelector(editorMode.arg.selector)}
             processor={editorMode.id === 'editingProcessor' ? editorMode.arg.processor : undefined}
             onOpen={onFlyoutOpen}
             onFormUpdate={onFormUpdate}
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/constants.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/constants.ts
new file mode 100644
index 00000000000000..51d5cac8ceef29
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/constants.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const PROCESSOR_STATE_SCOPE = 'processors';
+export const ON_FAILURE_STATE_SCOPE = 'onFailure';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/index.ts
index b43d94e19bf9f8..7265f63f45a5dd 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/index.ts
@@ -12,4 +12,6 @@ export {
   Action,
 } from './processors_reducer';
 
-export { isChildPath } from './utils';
+export { ON_FAILURE_STATE_SCOPE, PROCESSOR_STATE_SCOPE } from './constants';
+
+export { isChildPath, isOnFailureSelector } from './utils';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/utils.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/utils.ts
index 7cb7d076623aa8..6ee6b321f8b461 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/utils.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_processors_editor/processors_reducer/utils.ts
@@ -9,6 +9,17 @@ import { ProcessorInternal, ProcessorSelector } from '../types';
 import { DropSpecialLocations } from '../constants';
 import { checkIfSamePath, getValue } from '../utils';
 
+import { ON_FAILURE_STATE_SCOPE } from './constants';
+
+/**
+ * We know that it must be an on-failure handler if the selector length is greater than 2
+ * because the first element will always be either processors or the global on-failure
+ * array and the second element will be a number indicating the processor position in the
+ * array. Anything more than that we know we are add an on failure handler.
+ */
+export const isOnFailureSelector = (selector: ProcessorSelector) =>
+  selector[0] === ON_FAILURE_STATE_SCOPE || selector.length > 2;
+
 export const PARENT_CHILD_NEST_ERROR = 'PARENT_CHILD_NEST_ERROR';
 
 export const duplicateProcessor = (sourceProcessor: ProcessorInternal): ProcessorInternal => {
diff --git a/x-pack/plugins/ingest_pipelines/public/application/services/documentation.ts b/x-pack/plugins/ingest_pipelines/public/application/services/documentation.ts
index 05fdc4b1dfb84c..7f6a87a46fea35 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/services/documentation.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/services/documentation.ts
@@ -15,6 +15,10 @@ export class DocumentationService {
     this.esDocBasePath = `${docsBase}/elasticsearch/reference/${DOC_LINK_VERSION}`;
   }
 
+  public getEsDocsBasePath() {
+    return this.esDocBasePath;
+  }
+
   public getIngestNodeUrl() {
     return `${this.esDocBasePath}/ingest.html`;
   }
diff --git a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
index f8f467b25643b6..fc5ed7480dd1f8 100644
--- a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
+++ b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
@@ -4,7 +4,7 @@ exports[`xy_expression XYChart component it renders area 1`] = `
 <Chart
   renderer="canvas"
 >
-  <Connect(spec)
+  <Connect(SpecInstance)
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
@@ -13,21 +13,21 @@ exports[`xy_expression XYChart component it renders area 1`] = `
     showLegendExtra={false}
     theme={Object {}}
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="x"
     position="bottom"
     showGridLines={false}
     tickFormat={[Function]}
     title="c"
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="y"
     position="left"
     showGridLines={false}
     tickFormat={[Function]}
     title=""
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     data={
       Array [
         Object {
@@ -72,7 +72,7 @@ exports[`xy_expression XYChart component it renders bar 1`] = `
 <Chart
   renderer="canvas"
 >
-  <Connect(spec)
+  <Connect(SpecInstance)
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
@@ -81,21 +81,21 @@ exports[`xy_expression XYChart component it renders bar 1`] = `
     showLegendExtra={false}
     theme={Object {}}
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="x"
     position="bottom"
     showGridLines={false}
     tickFormat={[Function]}
     title="c"
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="y"
     position="left"
     showGridLines={false}
     tickFormat={[Function]}
     title=""
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     data={
       Array [
         Object {
@@ -140,7 +140,7 @@ exports[`xy_expression XYChart component it renders horizontal bar 1`] = `
 <Chart
   renderer="canvas"
 >
-  <Connect(spec)
+  <Connect(SpecInstance)
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
@@ -149,21 +149,21 @@ exports[`xy_expression XYChart component it renders horizontal bar 1`] = `
     showLegendExtra={false}
     theme={Object {}}
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="x"
     position="left"
     showGridLines={false}
     tickFormat={[Function]}
     title="c"
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="y"
     position="bottom"
     showGridLines={false}
     tickFormat={[Function]}
     title=""
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     data={
       Array [
         Object {
@@ -208,7 +208,7 @@ exports[`xy_expression XYChart component it renders line 1`] = `
 <Chart
   renderer="canvas"
 >
-  <Connect(spec)
+  <Connect(SpecInstance)
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
@@ -217,21 +217,21 @@ exports[`xy_expression XYChart component it renders line 1`] = `
     showLegendExtra={false}
     theme={Object {}}
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="x"
     position="bottom"
     showGridLines={false}
     tickFormat={[Function]}
     title="c"
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="y"
     position="left"
     showGridLines={false}
     tickFormat={[Function]}
     title=""
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     data={
       Array [
         Object {
@@ -276,7 +276,7 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
 <Chart
   renderer="canvas"
 >
-  <Connect(spec)
+  <Connect(SpecInstance)
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
@@ -285,21 +285,21 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
     showLegendExtra={false}
     theme={Object {}}
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="x"
     position="bottom"
     showGridLines={false}
     tickFormat={[Function]}
     title="c"
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="y"
     position="left"
     showGridLines={false}
     tickFormat={[Function]}
     title=""
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     data={
       Array [
         Object {
@@ -348,7 +348,7 @@ exports[`xy_expression XYChart component it renders stacked bar 1`] = `
 <Chart
   renderer="canvas"
 >
-  <Connect(spec)
+  <Connect(SpecInstance)
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
@@ -357,21 +357,21 @@ exports[`xy_expression XYChart component it renders stacked bar 1`] = `
     showLegendExtra={false}
     theme={Object {}}
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="x"
     position="bottom"
     showGridLines={false}
     tickFormat={[Function]}
     title="c"
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="y"
     position="left"
     showGridLines={false}
     tickFormat={[Function]}
     title=""
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     data={
       Array [
         Object {
@@ -420,7 +420,7 @@ exports[`xy_expression XYChart component it renders stacked horizontal bar 1`] =
 <Chart
   renderer="canvas"
 >
-  <Connect(spec)
+  <Connect(SpecInstance)
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
@@ -429,21 +429,21 @@ exports[`xy_expression XYChart component it renders stacked horizontal bar 1`] =
     showLegendExtra={false}
     theme={Object {}}
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="x"
     position="left"
     showGridLines={false}
     tickFormat={[Function]}
     title="c"
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     id="y"
     position="bottom"
     showGridLines={false}
     tickFormat={[Function]}
     title=""
   />
-  <Connect(spec)
+  <Connect(SpecInstance)
     data={
       Array [
         Object {
diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index ad99780a7d32fb..edb395633827f6 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -227,3 +227,9 @@ export enum INITIAL_LOCATION {
   FIXED_LOCATION = 'FIXED_LOCATION',
   BROWSER_LOCATION = 'BROWSER_LOCATION',
 }
+
+export enum LAYER_WIZARD_CATEGORY {
+  ELASTICSEARCH = 'ELASTICSEARCH',
+  REFERENCE = 'REFERENCE',
+  SOLUTIONS = 'SOLUTIONS',
+}
diff --git a/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts b/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts
index 2bdeb6446cf288..a255ffb00e312b 100644
--- a/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts
+++ b/x-pack/plugins/maps/public/classes/layers/layer_wizard_registry.ts
@@ -7,6 +7,7 @@
 
 import { ReactElement } from 'react';
 import { LayerDescriptor } from '../../../common/descriptor_types';
+import { LAYER_WIZARD_CATEGORY } from '../../../common/constants';
 
 export type RenderWizardArguments = {
   previewLayers: (layerDescriptors: LayerDescriptor[], isIndexingSource?: boolean) => void;
@@ -20,6 +21,7 @@ export type RenderWizardArguments = {
 };
 
 export type LayerWizard = {
+  categories: LAYER_WIZARD_CATEGORY[];
   checkVisibility?: () => Promise<boolean>;
   description: string;
   icon: string;
diff --git a/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/observability_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/observability_layer_wizard.tsx
index db97c08596e065..ddb07a9facee7b 100644
--- a/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/observability_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/solution_layers/observability/observability_layer_wizard.tsx
@@ -6,12 +6,14 @@
 
 import React from 'react';
 import { i18n } from '@kbn/i18n';
+import { LAYER_WIZARD_CATEGORY } from '../../../../../common/constants';
 import { LayerWizard, RenderWizardArguments } from '../../layer_wizard_registry';
 import { ObservabilityLayerTemplate } from './observability_layer_template';
 import { APM_INDEX_PATTERN_ID } from './create_layer_descriptor';
 import { getIndexPatternService } from '../../../../kibana_services';
 
 export const ObservabilityLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.ELASTICSEARCH, LAYER_WIZARD_CATEGORY.SOLUTIONS],
   checkVisibility: async () => {
     try {
       await getIndexPatternService().get(APM_INDEX_PATTERN_ID);
diff --git a/x-pack/plugins/maps/public/classes/layers/solution_layers/security/security_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/layers/solution_layers/security/security_layer_wizard.tsx
index cece00fa373503..f51aa5b40aa80b 100644
--- a/x-pack/plugins/maps/public/classes/layers/solution_layers/security/security_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/solution_layers/security/security_layer_wizard.tsx
@@ -6,11 +6,13 @@
 
 import React from 'react';
 import { i18n } from '@kbn/i18n';
+import { LAYER_WIZARD_CATEGORY } from '../../../../../common/constants';
 import { LayerWizard, RenderWizardArguments } from '../../layer_wizard_registry';
 import { getSecurityIndexPatterns } from './security_index_pattern_utils';
 import { SecurityLayerTemplate } from './security_layer_template';
 
 export const SecurityLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.ELASTICSEARCH, LAYER_WIZARD_CATEGORY.SOLUTIONS],
   checkVisibility: async () => {
     const indexPatterns = await getSecurityIndexPatterns();
     return indexPatterns.length > 0;
diff --git a/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx
index 3f4ec0d3f12685..0a224f75b981d6 100644
--- a/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/client_file_source/upload_layer_wizard.tsx
@@ -22,6 +22,7 @@ import { GeojsonFileSource } from './geojson_file_source';
 import { VectorLayer } from '../../layers/vector_layer/vector_layer';
 
 export const uploadLayerWizardConfig: LayerWizard = {
+  categories: [],
   description: i18n.translate('xpack.maps.source.geojsonFileDescription', {
     defaultMessage: 'Index GeoJSON data in Elasticsearch',
   }),
diff --git a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_boundaries_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_boundaries_layer_wizard.tsx
index 7eec84ef5bb2e1..c53a7a4facb0c3 100644
--- a/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_boundaries_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/ems_file_source/ems_boundaries_layer_wizard.tsx
@@ -13,8 +13,10 @@ import { EMSFileSource, sourceTitle } from './ems_file_source';
 // @ts-ignore
 import { getIsEmsEnabled } from '../../../kibana_services';
 import { EMSFileSourceDescriptor } from '../../../../common/descriptor_types';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 export const emsBoundariesLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.REFERENCE],
   checkVisibility: () => {
     return getIsEmsEnabled();
   },
diff --git a/x-pack/plugins/maps/public/classes/sources/ems_tms_source/ems_base_map_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/ems_tms_source/ems_base_map_layer_wizard.tsx
index 60e67b1ae70534..49d262cbad1a10 100644
--- a/x-pack/plugins/maps/public/classes/sources/ems_tms_source/ems_base_map_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/ems_tms_source/ems_base_map_layer_wizard.tsx
@@ -13,8 +13,10 @@ import { VectorTileLayer } from '../../layers/vector_tile_layer/vector_tile_laye
 // @ts-ignore
 import { TileServiceSelect } from './tile_service_select';
 import { getIsEmsEnabled } from '../../../kibana_services';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 export const emsBaseMapLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.REFERENCE],
   checkVisibility: () => {
     return getIsEmsEnabled();
   },
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/clusters_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/clusters_layer_wizard.tsx
index b9d5faa8e18f1b..715c16b22dc51a 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/clusters_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/clusters_layer_wizard.tsx
@@ -23,6 +23,7 @@ import {
   COUNT_PROP_NAME,
   COLOR_MAP_TYPE,
   FIELD_ORIGIN,
+  LAYER_WIZARD_CATEGORY,
   RENDER_AS,
   VECTOR_STYLES,
   STYLE_TYPE,
@@ -30,6 +31,7 @@ import {
 import { COLOR_GRADIENTS } from '../../styles/color_utils';
 
 export const clustersLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.ELASTICSEARCH],
   description: i18n.translate('xpack.maps.source.esGridClustersDescription', {
     defaultMessage: 'Geospatial data grouped in grids with metrics for each gridded cell',
   }),
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/heatmap_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/heatmap_layer_wizard.tsx
index 79252c7febf8c9..92a0f1006ea439 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/heatmap_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/heatmap_layer_wizard.tsx
@@ -14,9 +14,10 @@ import { LayerWizard, RenderWizardArguments } from '../../layers/layer_wizard_re
 // @ts-ignore
 import { HeatmapLayer } from '../../layers/heatmap_layer/heatmap_layer';
 import { ESGeoGridSourceDescriptor } from '../../../../common/descriptor_types';
-import { RENDER_AS } from '../../../../common/constants';
+import { LAYER_WIZARD_CATEGORY, RENDER_AS } from '../../../../common/constants';
 
 export const heatmapLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.ELASTICSEARCH],
   description: i18n.translate('xpack.maps.source.esGridHeatmapDescription', {
     defaultMessage: 'Geospatial data grouped in grids to show density',
   }),
diff --git a/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/point_2_point_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/point_2_point_layer_wizard.tsx
index 5169af9bdddf2f..ae7414b827c8d8 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/point_2_point_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_pew_pew_source/point_2_point_layer_wizard.tsx
@@ -14,6 +14,7 @@ import { VectorStyle } from '../../styles/vector/vector_style';
 import {
   FIELD_ORIGIN,
   COUNT_PROP_NAME,
+  LAYER_WIZARD_CATEGORY,
   VECTOR_STYLES,
   STYLE_TYPE,
 } from '../../../../common/constants';
@@ -24,6 +25,7 @@ import { LayerWizard, RenderWizardArguments } from '../../layers/layer_wizard_re
 import { ColorDynamicOptions, SizeDynamicOptions } from '../../../../common/descriptor_types';
 
 export const point2PointLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.ELASTICSEARCH],
   description: i18n.translate('xpack.maps.source.pewPewDescription', {
     defaultMessage: 'Aggregated data paths between the source and destination',
   }),
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx
index 888de2e7297cba..4598b1467229d4 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/es_documents_layer_wizard.tsx
@@ -13,7 +13,7 @@ import { LayerWizard, RenderWizardArguments } from '../../layers/layer_wizard_re
 import { ESSearchSource, sourceTitle } from './es_search_source';
 import { BlendedVectorLayer } from '../../layers/blended_vector_layer/blended_vector_layer';
 import { VectorLayer } from '../../layers/vector_layer/vector_layer';
-import { SCALING_TYPES } from '../../../../common/constants';
+import { LAYER_WIZARD_CATEGORY, SCALING_TYPES } from '../../../../common/constants';
 
 export function createDefaultLayerDescriptor(sourceConfig: unknown, mapColors: string[]) {
   const sourceDescriptor = ESSearchSource.createDescriptor(sourceConfig);
@@ -24,6 +24,7 @@ export function createDefaultLayerDescriptor(sourceConfig: unknown, mapColors: s
 }
 
 export const esDocumentsLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.ELASTICSEARCH],
   description: i18n.translate('xpack.maps.source.esSearchDescription', {
     defaultMessage: 'Vector data from a Kibana index pattern',
   }),
diff --git a/x-pack/plugins/maps/public/classes/sources/kibana_regionmap_source/kibana_regionmap_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/kibana_regionmap_source/kibana_regionmap_layer_wizard.tsx
index ca78aaefe404f7..c8a1c346646e01 100644
--- a/x-pack/plugins/maps/public/classes/sources/kibana_regionmap_source/kibana_regionmap_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/kibana_regionmap_source/kibana_regionmap_layer_wizard.tsx
@@ -13,8 +13,10 @@ import { VectorLayer } from '../../layers/vector_layer/vector_layer';
 // @ts-ignore
 import { CreateSourceEditor } from './create_source_editor';
 import { getKibanaRegionList } from '../../../meta';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 export const kibanaRegionMapLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.REFERENCE],
   checkVisibility: async () => {
     const regions = getKibanaRegionList();
     return regions.length > 0;
diff --git a/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/kibana_base_map_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/kibana_base_map_layer_wizard.tsx
index 84d2e5e74fa9a1..9f63372a785119 100644
--- a/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/kibana_base_map_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/kibana_tilemap_source/kibana_base_map_layer_wizard.tsx
@@ -13,8 +13,10 @@ import { CreateSourceEditor } from './create_source_editor';
 import { KibanaTilemapSource, sourceTitle } from './kibana_tilemap_source';
 import { TileLayer } from '../../layers/tile_layer/tile_layer';
 import { getKibanaTileMap } from '../../../meta';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 export const kibanaBasemapLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.REFERENCE],
   checkVisibility: async () => {
     const tilemap = getKibanaTileMap();
     // @ts-ignore
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/layer_wizard.tsx
index c29302a2058b21..067c7f5a47ca35 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/layer_wizard.tsx
@@ -13,8 +13,10 @@ import {
 import { MVTSingleLayerVectorSource, sourceTitle } from './mvt_single_layer_vector_source';
 import { LayerWizard, RenderWizardArguments } from '../../layers/layer_wizard_registry';
 import { TiledVectorLayer } from '../../layers/tiled_vector_layer/tiled_vector_layer';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 export const mvtVectorSourceWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.REFERENCE],
   description: i18n.translate('xpack.maps.source.mvtVectorSourceWizard', {
     defaultMessage: 'Vector source wizard',
   }),
diff --git a/x-pack/plugins/maps/public/classes/sources/wms_source/wms_layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/wms_source/wms_layer_wizard.tsx
index 62eeef234f4141..b3950baf8dbeb0 100644
--- a/x-pack/plugins/maps/public/classes/sources/wms_source/wms_layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/wms_source/wms_layer_wizard.tsx
@@ -12,8 +12,10 @@ import { WMSCreateSourceEditor } from './wms_create_source_editor';
 import { sourceTitle, WMSSource } from './wms_source';
 import { LayerWizard, RenderWizardArguments } from '../../layers/layer_wizard_registry';
 import { TileLayer } from '../../layers/tile_layer/tile_layer';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 export const wmsLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.REFERENCE],
   description: i18n.translate('xpack.maps.source.wmsDescription', {
     defaultMessage: 'Maps from OGC Standard WMS',
   }),
diff --git a/x-pack/plugins/maps/public/classes/sources/xyz_tms_source/layer_wizard.tsx b/x-pack/plugins/maps/public/classes/sources/xyz_tms_source/layer_wizard.tsx
index b99b17c1d22d47..48c526855d3a4f 100644
--- a/x-pack/plugins/maps/public/classes/sources/xyz_tms_source/layer_wizard.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/xyz_tms_source/layer_wizard.tsx
@@ -10,8 +10,10 @@ import { XYZTMSEditor, XYZTMSSourceConfig } from './xyz_tms_editor';
 import { XYZTMSSource, sourceTitle } from './xyz_tms_source';
 import { LayerWizard, RenderWizardArguments } from '../../layers/layer_wizard_registry';
 import { TileLayer } from '../../layers/tile_layer/tile_layer';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 export const tmsLayerWizardConfig: LayerWizard = {
+  categories: [LAYER_WIZARD_CATEGORY.REFERENCE],
   description: i18n.translate('xpack.maps.source.ems_xyzDescription', {
     defaultMessage: 'Tile map service configured in interface',
   }),
diff --git a/x-pack/plugins/maps/public/connected_components/_index.scss b/x-pack/plugins/maps/public/connected_components/_index.scss
index 6de2a51590700a..bd8070e8c36fdb 100644
--- a/x-pack/plugins/maps/public/connected_components/_index.scss
+++ b/x-pack/plugins/maps/public/connected_components/_index.scss
@@ -1,5 +1,4 @@
 @import 'gis_map/gis_map';
-@import 'add_layer_panel/index';
 @import 'layer_panel/index';
 @import 'widget_overlay/index';
 @import 'toolbar_overlay/index';
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/_index.scss b/x-pack/plugins/maps/public/connected_components/add_layer_panel/_index.scss
deleted file mode 100644
index 4e60b8d4b7c4b0..00000000000000
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/_index.scss
+++ /dev/null
@@ -1,12 +0,0 @@
-.mapLayerAddpanel__card {
-  // EUITODO: Fix horizontal layout so it works with any size icon
-  .euiCard__content {
-    // sass-lint:disable-block no-important
-    padding-top: 0 !important;
-  }
-
-  .euiCard__top + .euiCard__content {
-    // sass-lint:disable-block no-important
-    padding-top: 2px !important;
-  }
-}
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/__snapshots__/layer_wizard_select.test.tsx.snap b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/__snapshots__/layer_wizard_select.test.tsx.snap
new file mode 100644
index 00000000000000..ef11f9958d8db6
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/__snapshots__/layer_wizard_select.test.tsx.snap
@@ -0,0 +1,83 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`LayerWizardSelect Should render layer select after layer wizards are loaded 1`] = `
+<Fragment>
+  <EuiFacetGroup
+    layout="horizontal"
+  >
+    <EuiFacetButton
+      isSelected={true}
+      key="all"
+      onClick={[Function]}
+    >
+      <FormattedMessage
+        defaultMessage="All"
+        id="xpack.maps.layerWizardSelect.allCategories"
+        values={Object {}}
+      />
+    </EuiFacetButton>
+    <EuiFacetButton
+      isSelected={false}
+      key="ELASTICSEARCH"
+      onClick={[Function]}
+    >
+      Elasticsearch
+    </EuiFacetButton>
+    <EuiFacetButton
+      isSelected={false}
+      key="SOLUTIONS"
+      onClick={[Function]}
+    >
+      Solutions
+    </EuiFacetButton>
+  </EuiFacetGroup>
+  <EuiSpacer
+    size="s"
+  />
+  <EuiFlexGrid
+    columns={2}
+    gutterSize="m"
+  >
+    <EuiFlexItem
+      key="wizard 1"
+    >
+      <EuiCard
+        data-test-subj="wizard1"
+        description="mock wizard without icon"
+        onClick={[Function]}
+        title="wizard 1"
+      />
+    </EuiFlexItem>
+    <EuiFlexItem
+      key="wizard 2"
+    >
+      <EuiCard
+        data-test-subj="wizard2"
+        description="mock wizard with icon"
+        icon={
+          <EuiIcon
+            size="l"
+            type="logoObservability"
+          />
+        }
+        onClick={[Function]}
+        title="wizard 2"
+      />
+    </EuiFlexItem>
+  </EuiFlexGrid>
+</Fragment>
+`;
+
+exports[`LayerWizardSelect Should render loading screen before layer wizards are loaded 1`] = `
+<div>
+  <EuiCard
+    description={
+      <EuiLoadingContent
+        lines={2}
+      />
+    }
+    layout="horizontal"
+    title=""
+  />
+</div>
+`;
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/layer_wizard_select.test.tsx b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/layer_wizard_select.test.tsx
new file mode 100644
index 00000000000000..e802c5259e5eda
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/layer_wizard_select.test.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+jest.mock('../../../classes/layers/layer_wizard_registry', () => ({}));
+
+import React from 'react';
+import { shallow } from 'enzyme';
+import { LayerWizardSelect } from './layer_wizard_select';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
+
+const defaultProps = {
+  onSelect: () => {},
+};
+
+describe('LayerWizardSelect', () => {
+  beforeAll(() => {
+    require('../../../classes/layers/layer_wizard_registry').getLayerWizards = async () => {
+      return [
+        {
+          categories: [LAYER_WIZARD_CATEGORY.ELASTICSEARCH],
+          description: 'mock wizard without icon',
+          renderWizard: () => {
+            return <div />;
+          },
+          title: 'wizard 1',
+        },
+        {
+          categories: [LAYER_WIZARD_CATEGORY.SOLUTIONS],
+          description: 'mock wizard with icon',
+          icon: 'logoObservability',
+          renderWizard: () => {
+            return <div />;
+          },
+          title: 'wizard 2',
+        },
+      ];
+    };
+  });
+
+  test('Should render layer select after layer wizards are loaded', async () => {
+    const component = shallow(<LayerWizardSelect {...defaultProps} />);
+
+    // Ensure all promises resolve
+    await new Promise((resolve) => process.nextTick(resolve));
+    // Ensure the state changes are reflected
+    component.update();
+
+    expect(component).toMatchSnapshot();
+  });
+
+  test('Should render loading screen before layer wizards are loaded', () => {
+    const component = shallow(<LayerWizardSelect {...defaultProps} />);
+
+    expect(component).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/layer_wizard_select.tsx b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/layer_wizard_select.tsx
index b0c50133ceabb8..f0195bc5dee2f2 100644
--- a/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/layer_wizard_select.tsx
+++ b/x-pack/plugins/maps/public/connected_components/add_layer_panel/flyout_body/layer_wizard_select.tsx
@@ -5,26 +5,63 @@
  */
 
 import _ from 'lodash';
-import React, { Component, Fragment } from 'react';
-import { EuiSpacer, EuiCard, EuiIcon } from '@elastic/eui';
-import { EuiLoadingContent } from '@elastic/eui';
+import React, { Component } from 'react';
+import {
+  EuiCard,
+  EuiIcon,
+  EuiFlexGrid,
+  EuiFlexItem,
+  EuiLoadingContent,
+  EuiFacetGroup,
+  EuiFacetButton,
+  EuiSpacer,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
 import { getLayerWizards, LayerWizard } from '../../../classes/layers/layer_wizard_registry';
+import { LAYER_WIZARD_CATEGORY } from '../../../../common/constants';
 
 interface Props {
   onSelect: (layerWizard: LayerWizard) => void;
 }
 
 interface State {
-  layerWizards: LayerWizard[];
+  activeCategories: LAYER_WIZARD_CATEGORY[];
   hasLoadedWizards: boolean;
+  layerWizards: LayerWizard[];
+  selectedCategory: LAYER_WIZARD_CATEGORY | null;
+}
+
+function getCategoryLabel(category: LAYER_WIZARD_CATEGORY): string {
+  if (category === LAYER_WIZARD_CATEGORY.ELASTICSEARCH) {
+    return i18n.translate('xpack.maps.layerWizardSelect.elasticsearchCategoryLabel', {
+      defaultMessage: 'Elasticsearch',
+    });
+  }
+
+  if (category === LAYER_WIZARD_CATEGORY.REFERENCE) {
+    return i18n.translate('xpack.maps.layerWizardSelect.referenceCategoryLabel', {
+      defaultMessage: 'Reference',
+    });
+  }
+
+  if (category === LAYER_WIZARD_CATEGORY.SOLUTIONS) {
+    return i18n.translate('xpack.maps.layerWizardSelect.solutionsCategoryLabel', {
+      defaultMessage: 'Solutions',
+    });
+  }
+
+  throw new Error(`Unexpected category: ${category}`);
 }
 
 export class LayerWizardSelect extends Component<Props, State> {
   private _isMounted: boolean = false;
 
   state = {
-    layerWizards: [],
+    activeCategories: [],
     hasLoadedWizards: false,
+    layerWizards: [],
+    selectedCategory: null,
   };
 
   componentDidMount() {
@@ -38,9 +75,57 @@ export class LayerWizardSelect extends Component<Props, State> {
 
   async _loadLayerWizards() {
     const layerWizards = await getLayerWizards();
+    const activeCategories: LAYER_WIZARD_CATEGORY[] = [];
+    layerWizards.forEach((layerWizard: LayerWizard) => {
+      layerWizard.categories.forEach((category: LAYER_WIZARD_CATEGORY) => {
+        if (!activeCategories.includes(category)) {
+          activeCategories.push(category);
+        }
+      });
+    });
+
     if (this._isMounted) {
-      this.setState({ layerWizards, hasLoadedWizards: true });
+      this.setState({
+        activeCategories,
+        layerWizards,
+        hasLoadedWizards: true,
+      });
+    }
+  }
+
+  _filterByCategory(category: LAYER_WIZARD_CATEGORY | null) {
+    this.setState({ selectedCategory: category });
+  }
+
+  _renderCategoryFacets() {
+    if (this.state.activeCategories.length === 0) {
+      return null;
     }
+
+    const facets = this.state.activeCategories.map((category: LAYER_WIZARD_CATEGORY) => {
+      return (
+        <EuiFacetButton
+          key={category}
+          isSelected={category === this.state.selectedCategory}
+          onClick={() => this._filterByCategory(category)}
+        >
+          {getCategoryLabel(category)}
+        </EuiFacetButton>
+      );
+    });
+
+    return (
+      <EuiFacetGroup layout="horizontal">
+        <EuiFacetButton
+          key="all"
+          isSelected={!this.state.selectedCategory}
+          onClick={() => this._filterByCategory(null)}
+        >
+          <FormattedMessage id="xpack.maps.layerWizardSelect.allCategories" defaultMessage="All" />
+        </EuiFacetButton>
+        {facets}
+      </EuiFacetGroup>
+    );
   }
 
   render() {
@@ -51,27 +136,41 @@ export class LayerWizardSelect extends Component<Props, State> {
         </div>
       );
     }
-    return this.state.layerWizards.map((layerWizard: LayerWizard) => {
-      const icon = layerWizard.icon ? <EuiIcon type={layerWizard.icon} size="l" /> : undefined;
 
-      const onClick = () => {
-        this.props.onSelect(layerWizard);
-      };
+    const wizardCards = this.state.layerWizards
+      .filter((layerWizard: LayerWizard) => {
+        return this.state.selectedCategory
+          ? layerWizard.categories.includes(this.state.selectedCategory!)
+          : true;
+      })
+      .map((layerWizard: LayerWizard) => {
+        const icon = layerWizard.icon ? <EuiIcon type={layerWizard.icon} size="l" /> : undefined;
 
-      return (
-        <Fragment key={layerWizard.title}>
-          <EuiSpacer size="s" />
-          <EuiCard
-            className="mapLayerAddpanel__card"
-            title={layerWizard.title}
-            icon={icon}
-            onClick={onClick}
-            description={layerWizard.description}
-            layout="horizontal"
-            data-test-subj={_.camelCase(layerWizard.title)}
-          />
-        </Fragment>
-      );
-    });
+        const onClick = () => {
+          this.props.onSelect(layerWizard);
+        };
+
+        return (
+          <EuiFlexItem key={layerWizard.title}>
+            <EuiCard
+              title={layerWizard.title}
+              icon={icon}
+              onClick={onClick}
+              description={layerWizard.description}
+              data-test-subj={_.camelCase(layerWizard.title)}
+            />
+          </EuiFlexItem>
+        );
+      });
+
+    return (
+      <>
+        {this._renderCategoryFacets()}
+        <EuiSpacer size="s" />
+        <EuiFlexGrid columns={2} gutterSize="m">
+          {wizardCards}
+        </EuiFlexGrid>
+      </>
+    );
   }
 }
diff --git a/x-pack/plugins/maps/public/connected_components/gis_map/_gis_map.scss b/x-pack/plugins/maps/public/connected_components/gis_map/_gis_map.scss
index 85168d970c6dec..2180573ef4583d 100644
--- a/x-pack/plugins/maps/public/connected_components/gis_map/_gis_map.scss
+++ b/x-pack/plugins/maps/public/connected_components/gis_map/_gis_map.scss
@@ -9,11 +9,11 @@
   overflow: hidden;
 
   > * {
-    width: $euiSizeXXL * 11;
+    width: $euiSizeXXL * 12;
   }
 
   &-isVisible {
-    width: $euiSizeXXL * 11;
+    width: $euiSizeXXL * 12;
     transition: width $euiAnimSpeedNormal $euiAnimSlightResistance;
   }
 }
diff --git a/x-pack/plugins/ml/public/application/app.tsx b/x-pack/plugins/ml/public/application/app.tsx
index 4b6ff8c64822b9..b871d857f7fded 100644
--- a/x-pack/plugins/ml/public/application/app.tsx
+++ b/x-pack/plugins/ml/public/application/app.tsx
@@ -35,6 +35,8 @@ const App: FC<AppProps> = ({ coreStart, deps }) => {
   };
   const services = {
     appName: 'ML',
+    kibanaVersion: deps.kibanaVersion,
+    share: deps.share,
     data: deps.data,
     security: deps.security,
     licenseManagement: deps.licenseManagement,
diff --git a/x-pack/plugins/ml/public/application/components/loading_indicator/index.js b/x-pack/plugins/ml/public/application/components/loading_indicator/index.ts
similarity index 100%
rename from x-pack/plugins/ml/public/application/components/loading_indicator/index.js
rename to x-pack/plugins/ml/public/application/components/loading_indicator/index.ts
diff --git a/x-pack/plugins/ml/public/application/components/loading_indicator/loading_indicator.js b/x-pack/plugins/ml/public/application/components/loading_indicator/loading_indicator.tsx
similarity index 70%
rename from x-pack/plugins/ml/public/application/components/loading_indicator/loading_indicator.js
rename to x-pack/plugins/ml/public/application/components/loading_indicator/loading_indicator.tsx
index 20f4fb86b5372c..364b23a27eaf7c 100644
--- a/x-pack/plugins/ml/public/application/components/loading_indicator/loading_indicator.js
+++ b/x-pack/plugins/ml/public/application/components/loading_indicator/loading_indicator.tsx
@@ -4,12 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import PropTypes from 'prop-types';
-import React from 'react';
+import React, { FC } from 'react';
 
 import { EuiLoadingChart, EuiSpacer } from '@elastic/eui';
 
-export function LoadingIndicator({ height, label }) {
+export const LoadingIndicator: FC<{ height?: number; label?: string }> = ({ height, label }) => {
   height = height ? +height : 100;
   return (
     <div
@@ -21,13 +20,9 @@ export function LoadingIndicator({ height, label }) {
       {label && (
         <>
           <EuiSpacer size="s" />
-          <div ml-loading-indicator-label="true">{label}</div>
+          <div>{label}</div>
         </>
       )}
     </div>
   );
-}
-LoadingIndicator.propTypes = {
-  height: PropTypes.number,
-  label: PropTypes.string,
 };
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts b/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts
index c65d872212ad67..2a156b5716ad4d 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/kibana_context.ts
@@ -12,13 +12,15 @@ import {
 } from '../../../../../../../src/plugins/kibana_react/public';
 import { SecurityPluginSetup } from '../../../../../security/public';
 import { LicenseManagementUIPluginSetup } from '../../../../../license_management/public';
+import { SharePluginStart } from '../../../../../../../src/plugins/share/public';
 
 interface StartPlugins {
   data: DataPublicPluginStart;
   security?: SecurityPluginSetup;
   licenseManagement?: LicenseManagementUIPluginSetup;
+  share: SharePluginStart;
 }
-export type StartServices = CoreStart & StartPlugins;
+export type StartServices = CoreStart & StartPlugins & { kibanaVersion: string };
 // eslint-disable-next-line react-hooks/rules-of-hooks
 export const useMlKibana = () => useKibana<StartServices>();
 export type MlKibanaReactContextValue = KibanaReactContextValue<StartServices>;
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts b/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
index f8abd48ce85620..07d5a153664b75 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/ml_context.ts
@@ -14,6 +14,7 @@ export interface MlContextValue {
   currentSavedSearch: SavedSearchSavedObject | null;
   indexPatterns: IndexPatternsContract;
   kibanaConfig: any; // IUiSettingsClient;
+  kibanaVersion: string;
 }
 
 export type SavedSearchQuery = object;
diff --git a/x-pack/plugins/ml/public/application/explorer/add_to_dashboard_control.tsx b/x-pack/plugins/ml/public/application/explorer/add_to_dashboard_control.tsx
new file mode 100644
index 00000000000000..cb11a33ccfd76a
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/explorer/add_to_dashboard_control.tsx
@@ -0,0 +1,321 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC, useCallback, useMemo, useState, useEffect } from 'react';
+import { debounce } from 'lodash';
+import {
+  EuiFormRow,
+  EuiCheckboxGroup,
+  EuiInMemoryTableProps,
+  EuiModal,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiOverlayMask,
+  EuiSpacer,
+  EuiButtonEmpty,
+  EuiButton,
+  EuiModalFooter,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiModalBody } from '@elastic/eui';
+import { EuiInMemoryTable } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { useMlKibana } from '../contexts/kibana';
+import { SavedObjectDashboard } from '../../../../../../src/plugins/dashboard/public';
+import {
+  ANOMALY_SWIMLANE_EMBEDDABLE_TYPE,
+  getDefaultPanelTitle,
+} from '../../embeddables/anomaly_swimlane/anomaly_swimlane_embeddable';
+import { useDashboardService } from '../services/dashboard_service';
+import { SWIMLANE_TYPE, SwimlaneType } from './explorer_constants';
+import { JobId } from '../../../common/types/anomaly_detection_jobs';
+
+export interface DashboardItem {
+  id: string;
+  title: string;
+  description: string | undefined;
+  attributes: SavedObjectDashboard;
+}
+
+export type EuiTableProps = EuiInMemoryTableProps<DashboardItem>;
+
+function getDefaultEmbeddablepaPanelConfig(jobIds: JobId[]) {
+  return {
+    type: ANOMALY_SWIMLANE_EMBEDDABLE_TYPE,
+    title: getDefaultPanelTitle(jobIds),
+  };
+}
+
+interface AddToDashboardControlProps {
+  jobIds: JobId[];
+  viewBy: string;
+  limit: number;
+  onClose: (callback?: () => Promise<any>) => void;
+}
+
+/**
+ * Component for attaching anomaly swimlane embeddable to dashboards.
+ */
+export const AddToDashboardControl: FC<AddToDashboardControlProps> = ({
+  onClose,
+  jobIds,
+  viewBy,
+  limit,
+}) => {
+  const {
+    notifications: { toasts },
+    services: {
+      application: { navigateToUrl },
+    },
+  } = useMlKibana();
+
+  useEffect(() => {
+    fetchDashboards();
+
+    return () => {
+      fetchDashboards.cancel();
+    };
+  }, []);
+
+  const dashboardService = useDashboardService();
+
+  const [isLoading, setIsLoading] = useState(false);
+  const [selectedSwimlanes, setSelectedSwimlanes] = useState<{ [key in SwimlaneType]: boolean }>({
+    [SWIMLANE_TYPE.OVERALL]: true,
+    [SWIMLANE_TYPE.VIEW_BY]: false,
+  });
+  const [dashboardItems, setDashboardItems] = useState<DashboardItem[]>([]);
+  const [selectedItems, setSelectedItems] = useState<DashboardItem[]>([]);
+
+  const fetchDashboards = useCallback(
+    debounce(async (query?: string) => {
+      try {
+        const response = await dashboardService.fetchDashboards(query);
+        const items: DashboardItem[] = response.savedObjects.map((savedObject) => {
+          return {
+            id: savedObject.id,
+            title: savedObject.attributes.title,
+            description: savedObject.attributes.description,
+            attributes: savedObject.attributes,
+          };
+        });
+        setDashboardItems(items);
+      } catch (e) {
+        toasts.danger({
+          body: e,
+        });
+      }
+      setIsLoading(false);
+    }, 500),
+    []
+  );
+
+  const search: EuiTableProps['search'] = useMemo(() => {
+    return {
+      onChange: ({ queryText }) => {
+        setIsLoading(true);
+        fetchDashboards(queryText);
+      },
+      box: {
+        incremental: true,
+        'data-test-subj': 'mlDashboardsSearchBox',
+      },
+    };
+  }, []);
+
+  const addSwimlaneToDashboardCallback = useCallback(async () => {
+    const swimlanes = Object.entries(selectedSwimlanes)
+      .filter(([, isSelected]) => isSelected)
+      .map(([swimlaneType]) => swimlaneType);
+
+    for (const selectedDashboard of selectedItems) {
+      const panelsData = swimlanes.map((swimlaneType) => {
+        const config = getDefaultEmbeddablepaPanelConfig(jobIds);
+        if (swimlaneType === SWIMLANE_TYPE.VIEW_BY) {
+          return {
+            ...config,
+            embeddableConfig: {
+              jobIds,
+              swimlaneType,
+              viewBy,
+              limit,
+            },
+          };
+        }
+        return {
+          ...config,
+          embeddableConfig: {
+            jobIds,
+            swimlaneType,
+          },
+        };
+      });
+
+      try {
+        await dashboardService.attachPanels(
+          selectedDashboard.id,
+          selectedDashboard.attributes,
+          panelsData
+        );
+        toasts.success({
+          title: (
+            <FormattedMessage
+              id="xpack.ml.explorer.dashboardsTable.savedSuccessfullyTitle"
+              defaultMessage='Dashboard "{dashboardTitle}" updated successfully'
+              values={{ dashboardTitle: selectedDashboard.title }}
+            />
+          ),
+          toastLifeTimeMs: 3000,
+        });
+      } catch (e) {
+        toasts.danger({
+          body: e,
+        });
+      }
+    }
+  }, [selectedSwimlanes, selectedItems]);
+
+  const columns: EuiTableProps['columns'] = [
+    {
+      field: 'title',
+      name: i18n.translate('xpack.ml.explorer.dashboardsTable.titleColumnHeader', {
+        defaultMessage: 'Title',
+      }),
+      sortable: true,
+      truncateText: true,
+    },
+    {
+      field: 'description',
+      name: i18n.translate('xpack.ml.explorer.dashboardsTable.descriptionColumnHeader', {
+        defaultMessage: 'Description',
+      }),
+      truncateText: true,
+    },
+  ];
+
+  const swimlaneTypeOptions = [
+    {
+      id: SWIMLANE_TYPE.OVERALL,
+      label: i18n.translate('xpack.ml.explorer.overallLabel', {
+        defaultMessage: 'Overall',
+      }),
+    },
+    {
+      id: SWIMLANE_TYPE.VIEW_BY,
+      label: i18n.translate('xpack.ml.explorer.viewByFieldLabel', {
+        defaultMessage: 'View by {viewByField}, up to {limit} rows',
+        values: { viewByField: viewBy, limit },
+      }),
+    },
+  ];
+
+  const selection: EuiTableProps['selection'] = {
+    onSelectionChange: setSelectedItems,
+  };
+
+  const noSwimlaneSelected = Object.values(selectedSwimlanes).every((isSelected) => !isSelected);
+
+  return (
+    <EuiOverlayMask data-test-subj="mlAddToDashboardModal">
+      <EuiModal onClose={onClose.bind(null, undefined)}>
+        <EuiModalHeader>
+          <EuiModalHeaderTitle>
+            <FormattedMessage
+              id="xpack.ml.explorer.dashboardsTitle"
+              defaultMessage="Add swimlanes to dashboards"
+            />
+          </EuiModalHeaderTitle>
+        </EuiModalHeader>
+        <EuiModalBody>
+          <EuiFormRow
+            label={
+              <FormattedMessage
+                id="xpack.ml.explorer.addToDashboard.selectSwimlanesLabel"
+                defaultMessage="Select swimlane view:"
+              />
+            }
+          >
+            <EuiCheckboxGroup
+              options={swimlaneTypeOptions}
+              idToSelectedMap={selectedSwimlanes}
+              onChange={(optionId) => {
+                const newSelection = {
+                  ...selectedSwimlanes,
+                  [optionId]: !selectedSwimlanes[optionId as SwimlaneType],
+                };
+                setSelectedSwimlanes(newSelection);
+              }}
+              data-test-subj="mlAddToDashboardSwimlaneTypeSelector"
+            />
+          </EuiFormRow>
+
+          <EuiSpacer size="m" />
+
+          <EuiFormRow
+            fullWidth
+            label={
+              <FormattedMessage
+                id="xpack.ml.explorer.addToDashboard.selectDashboardsLabel"
+                defaultMessage="Select dashboards:"
+              />
+            }
+            data-test-subj="mlDashboardSelectionContainer"
+          >
+            <EuiInMemoryTable
+              itemId="id"
+              isSelectable={true}
+              selection={selection}
+              items={dashboardItems}
+              loading={isLoading}
+              columns={columns}
+              search={search}
+              pagination={true}
+              sorting={true}
+              data-test-subj="mlDashboardSelectionTable"
+            />
+          </EuiFormRow>
+        </EuiModalBody>
+        <EuiModalFooter>
+          <EuiButtonEmpty onClick={onClose.bind(null, undefined)}>
+            <FormattedMessage
+              id="xpack.ml.explorer.addToDashboard.cancelButtonLabel"
+              defaultMessage="Cancel"
+            />
+          </EuiButtonEmpty>
+          <EuiButton
+            disabled={noSwimlaneSelected || selectedItems.length !== 1}
+            onClick={async () => {
+              onClose(async () => {
+                const selectedDashboardId = selectedItems[0].id;
+                await addSwimlaneToDashboardCallback();
+                await navigateToUrl(
+                  await dashboardService.getDashboardEditUrl(selectedDashboardId)
+                );
+              });
+            }}
+            data-test-subj="mlAddAndEditDashboardButton"
+          >
+            <FormattedMessage
+              id="xpack.ml.explorer.dashboardsTable.addAndEditDashboardLabel"
+              defaultMessage="Add and edit dashboard"
+            />
+          </EuiButton>
+          <EuiButton
+            fill
+            onClick={onClose.bind(null, addSwimlaneToDashboardCallback)}
+            disabled={noSwimlaneSelected || selectedItems.length === 0}
+            data-test-subj="mlAddToDashboardsButton"
+          >
+            <FormattedMessage
+              id="xpack.ml.explorer.dashboardsTable.addToDashboardLabel"
+              defaultMessage="Add to dashboards"
+            />
+          </EuiButton>
+        </EuiModalFooter>
+      </EuiModal>
+    </EuiOverlayMask>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/explorer/anomaly_timeline.tsx b/x-pack/plugins/ml/public/application/explorer/anomaly_timeline.tsx
new file mode 100644
index 00000000000000..b4d32e2af64b8e
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/explorer/anomaly_timeline.tsx
@@ -0,0 +1,392 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC, useCallback, useMemo, useRef, useState } from 'react';
+import { isEqual } from 'lodash';
+import DragSelect from 'dragselect';
+import {
+  EuiPanel,
+  EuiPopover,
+  EuiContextMenuPanel,
+  EuiButtonIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiSelect,
+  EuiTitle,
+  EuiSpacer,
+  EuiContextMenuItem,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { DRAG_SELECT_ACTION, VIEW_BY_JOB_LABEL } from './explorer_constants';
+import { AddToDashboardControl } from './add_to_dashboard_control';
+import { useMlKibana } from '../contexts/kibana';
+import { TimeBuckets } from '../util/time_buckets';
+import { UI_SETTINGS } from '../../../../../../src/plugins/data/common';
+import { SelectLimit } from './select_limit';
+import {
+  ALLOW_CELL_RANGE_SELECTION,
+  dragSelect$,
+  explorerService,
+} from './explorer_dashboard_service';
+import { ExplorerState } from './reducers/explorer_reducer';
+import { hasMatchingPoints } from './has_matching_points';
+import { ExplorerNoInfluencersFound } from './components/explorer_no_influencers_found/explorer_no_influencers_found';
+import { LoadingIndicator } from '../components/loading_indicator';
+import { SwimlaneContainer } from './swimlane_container';
+import { OverallSwimlaneData } from './explorer_utils';
+
+function mapSwimlaneOptionsToEuiOptions(options: string[]) {
+  return options.map((option) => ({
+    value: option,
+    text: option,
+  }));
+}
+
+interface AnomalyTimelineProps {
+  explorerState: ExplorerState;
+  setSelectedCells: (cells?: any) => void;
+}
+
+export const AnomalyTimeline: FC<AnomalyTimelineProps> = React.memo(
+  ({ explorerState, setSelectedCells }) => {
+    const {
+      services: {
+        uiSettings,
+        application: { capabilities },
+      },
+    } = useMlKibana();
+
+    const [isMenuOpen, setIsMenuOpen] = useState(false);
+    const [isAddDashboardsActive, setIsAddDashboardActive] = useState(false);
+
+    const isSwimlaneSelectActive = useRef(false);
+    // make sure dragSelect is only available if the mouse pointer is actually over a swimlane
+    const disableDragSelectOnMouseLeave = useRef(true);
+
+    const canEditDashboards = capabilities.dashboard?.createNew ?? false;
+
+    const timeBuckets = useMemo(() => {
+      return new TimeBuckets({
+        'histogram:maxBars': uiSettings.get(UI_SETTINGS.HISTOGRAM_MAX_BARS),
+        'histogram:barTarget': uiSettings.get(UI_SETTINGS.HISTOGRAM_BAR_TARGET),
+        dateFormat: uiSettings.get('dateFormat'),
+        'dateFormat:scaled': uiSettings.get('dateFormat:scaled'),
+      });
+    }, [uiSettings]);
+
+    const dragSelect = useMemo(
+      () =>
+        new DragSelect({
+          selectorClass: 'ml-swimlane-selector',
+          selectables: document.querySelectorAll('.sl-cell'),
+          callback(elements) {
+            if (elements.length > 1 && !ALLOW_CELL_RANGE_SELECTION) {
+              elements = [elements[0]];
+            }
+
+            if (elements.length > 0) {
+              dragSelect$.next({
+                action: DRAG_SELECT_ACTION.NEW_SELECTION,
+                elements,
+              });
+            }
+
+            disableDragSelectOnMouseLeave.current = true;
+          },
+          onDragStart(e) {
+            let target = e.target as HTMLElement;
+            while (target && target !== document.body && !target.classList.contains('sl-cell')) {
+              target = target.parentNode as HTMLElement;
+            }
+            if (ALLOW_CELL_RANGE_SELECTION && target !== document.body) {
+              dragSelect$.next({
+                action: DRAG_SELECT_ACTION.DRAG_START,
+              });
+              disableDragSelectOnMouseLeave.current = false;
+            }
+          },
+          onElementSelect() {
+            if (ALLOW_CELL_RANGE_SELECTION) {
+              dragSelect$.next({
+                action: DRAG_SELECT_ACTION.ELEMENT_SELECT,
+              });
+            }
+          },
+        }),
+      []
+    );
+
+    const {
+      filterActive,
+      filteredFields,
+      maskAll,
+      overallSwimlaneData,
+      selectedCells,
+      viewByLoadedForTimeFormatted,
+      viewBySwimlaneData,
+      viewBySwimlaneDataLoading,
+      viewBySwimlaneFieldName,
+      viewBySwimlaneOptions,
+      swimlaneLimit,
+      selectedJobs,
+    } = explorerState;
+
+    const setSwimlaneSelectActive = useCallback((active: boolean) => {
+      if (isSwimlaneSelectActive.current && !active && disableDragSelectOnMouseLeave.current) {
+        dragSelect.stop();
+        isSwimlaneSelectActive.current = active;
+        return;
+      }
+      if (!isSwimlaneSelectActive.current && active) {
+        dragSelect.start();
+        dragSelect.clearSelection();
+        dragSelect.setSelectables(document.querySelectorAll('.sl-cell'));
+        isSwimlaneSelectActive.current = active;
+      }
+    }, []);
+    const onSwimlaneEnterHandler = () => setSwimlaneSelectActive(true);
+    const onSwimlaneLeaveHandler = () => setSwimlaneSelectActive(false);
+
+    // Listens to render updates of the swimlanes to update dragSelect
+    const swimlaneRenderDoneListener = useCallback(() => {
+      dragSelect.clearSelection();
+      dragSelect.setSelectables(document.querySelectorAll('.sl-cell'));
+    }, []);
+
+    // Listener for click events in the swimlane to load corresponding anomaly data.
+    const swimlaneCellClick = useCallback((selectedCellsUpdate: any) => {
+      // If selectedCells is an empty object we clear any existing selection,
+      // otherwise we save the new selection in AppState and update the Explorer.
+      if (Object.keys(selectedCellsUpdate).length === 0) {
+        setSelectedCells();
+      } else {
+        setSelectedCells(selectedCellsUpdate);
+      }
+    }, []);
+
+    const showOverallSwimlane =
+      overallSwimlaneData !== null &&
+      overallSwimlaneData.laneLabels &&
+      overallSwimlaneData.laneLabels.length > 0;
+
+    const showViewBySwimlane =
+      viewBySwimlaneData !== null &&
+      viewBySwimlaneData.laneLabels &&
+      viewBySwimlaneData.laneLabels.length > 0;
+
+    const menuItems = useMemo(() => {
+      const items = [];
+      if (canEditDashboards) {
+        items.push(
+          <EuiContextMenuItem
+            key="addToDashboard"
+            onClick={setIsAddDashboardActive.bind(null, true)}
+            data-test-subj="mlAnomalyTimelinePanelAddToDashboardButton"
+          >
+            <FormattedMessage
+              id="xpack.ml.explorer.addToDashboardLabel"
+              defaultMessage="Add to dashboard"
+            />
+          </EuiContextMenuItem>
+        );
+      }
+      return items;
+    }, [canEditDashboards]);
+
+    return (
+      <>
+        <EuiPanel paddingSize="m">
+          <EuiFlexGroup direction="row" gutterSize="m" responsive={false} alignItems="center">
+            <EuiFlexItem grow={false}>
+              <EuiTitle className="panel-title">
+                <h2>
+                  <FormattedMessage
+                    id="xpack.ml.explorer.anomalyTimelineTitle"
+                    defaultMessage="Anomaly timeline"
+                  />
+                </h2>
+              </EuiTitle>
+            </EuiFlexItem>
+            {viewBySwimlaneOptions.length > 0 && (
+              <>
+                <EuiFlexItem grow={false}>
+                  <EuiFormRow
+                    label={
+                      <span className="eui-textNoWrap">
+                        <FormattedMessage
+                          id="xpack.ml.explorer.viewByLabel"
+                          defaultMessage="View by"
+                        />
+                      </span>
+                    }
+                    display={'columnCompressed'}
+                  >
+                    <EuiSelect
+                      compressed
+                      id="selectViewBy"
+                      options={mapSwimlaneOptionsToEuiOptions(viewBySwimlaneOptions)}
+                      value={viewBySwimlaneFieldName}
+                      onChange={(e) => explorerService.setViewBySwimlaneFieldName(e.target.value)}
+                    />
+                  </EuiFormRow>
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  <EuiFormRow
+                    label={
+                      <span className="eui-textNoWrap">
+                        <FormattedMessage
+                          id="xpack.ml.explorer.limitLabel"
+                          defaultMessage="Limit"
+                        />
+                      </span>
+                    }
+                    display={'columnCompressed'}
+                  >
+                    <SelectLimit />
+                  </EuiFormRow>
+                </EuiFlexItem>
+                <EuiFlexItem grow={false} style={{ alignSelf: 'center' }}>
+                  <div className="panel-sub-title">
+                    {viewByLoadedForTimeFormatted && (
+                      <FormattedMessage
+                        id="xpack.ml.explorer.sortedByMaxAnomalyScoreForTimeFormattedLabel"
+                        defaultMessage="(Sorted by max anomaly score for {viewByLoadedForTimeFormatted})"
+                        values={{ viewByLoadedForTimeFormatted }}
+                      />
+                    )}
+                    {viewByLoadedForTimeFormatted === undefined && (
+                      <FormattedMessage
+                        id="xpack.ml.explorer.sortedByMaxAnomalyScoreLabel"
+                        defaultMessage="(Sorted by max anomaly score)"
+                      />
+                    )}
+                    {filterActive === true && viewBySwimlaneFieldName === VIEW_BY_JOB_LABEL && (
+                      <FormattedMessage
+                        id="xpack.ml.explorer.jobScoreAcrossAllInfluencersLabel"
+                        defaultMessage="(Job score across all influencers)"
+                      />
+                    )}
+                  </div>
+                </EuiFlexItem>
+              </>
+            )}
+
+            {menuItems.length > 0 && (
+              <EuiFlexItem grow={false} style={{ marginLeft: 'auto', alignSelf: 'baseline' }}>
+                <EuiPopover
+                  button={
+                    <EuiButtonIcon
+                      size="s"
+                      aria-label={i18n.translate('xpack.ml.explorer.swimlaneActions', {
+                        defaultMessage: 'Actions',
+                      })}
+                      color="subdued"
+                      iconType="boxesHorizontal"
+                      onClick={setIsMenuOpen.bind(null, !isMenuOpen)}
+                      data-test-subj="mlAnomalyTimelinePanelMenu"
+                    />
+                  }
+                  isOpen={isMenuOpen}
+                  closePopover={setIsMenuOpen.bind(null, false)}
+                  panelPaddingSize="none"
+                  anchorPosition="downLeft"
+                >
+                  <EuiContextMenuPanel items={menuItems} />
+                </EuiPopover>
+              </EuiFlexItem>
+            )}
+          </EuiFlexGroup>
+
+          <EuiSpacer size="m" />
+
+          <div
+            className="ml-explorer-swimlane euiText"
+            onMouseEnter={onSwimlaneEnterHandler}
+            onMouseLeave={onSwimlaneLeaveHandler}
+            data-test-subj="mlAnomalyExplorerSwimlaneOverall"
+          >
+            {showOverallSwimlane && (
+              <SwimlaneContainer
+                filterActive={filterActive}
+                maskAll={maskAll}
+                timeBuckets={timeBuckets}
+                swimlaneCellClick={swimlaneCellClick}
+                swimlaneData={overallSwimlaneData as OverallSwimlaneData}
+                swimlaneType={'overall'}
+                selection={selectedCells}
+                swimlaneRenderDoneListener={swimlaneRenderDoneListener}
+                onResize={(width) => explorerService.setSwimlaneContainerWidth(width)}
+              />
+            )}
+          </div>
+
+          {viewBySwimlaneOptions.length > 0 && (
+            <>
+              {showViewBySwimlane && (
+                <>
+                  <EuiSpacer size="m" />
+                  <div
+                    className="ml-explorer-swimlane euiText"
+                    onMouseEnter={onSwimlaneEnterHandler}
+                    onMouseLeave={onSwimlaneLeaveHandler}
+                    data-test-subj="mlAnomalyExplorerSwimlaneViewBy"
+                  >
+                    <SwimlaneContainer
+                      filterActive={filterActive}
+                      maskAll={
+                        maskAll &&
+                        !hasMatchingPoints({
+                          filteredFields,
+                          swimlaneData: viewBySwimlaneData,
+                        })
+                      }
+                      timeBuckets={timeBuckets}
+                      swimlaneCellClick={swimlaneCellClick}
+                      swimlaneData={viewBySwimlaneData as OverallSwimlaneData}
+                      swimlaneType={'viewBy'}
+                      selection={selectedCells}
+                      swimlaneRenderDoneListener={swimlaneRenderDoneListener}
+                      onResize={(width) => explorerService.setSwimlaneContainerWidth(width)}
+                    />
+                  </div>
+                </>
+              )}
+
+              {viewBySwimlaneDataLoading && <LoadingIndicator />}
+
+              {!showViewBySwimlane &&
+                !viewBySwimlaneDataLoading &&
+                typeof viewBySwimlaneFieldName === 'string' && (
+                  <ExplorerNoInfluencersFound
+                    viewBySwimlaneFieldName={viewBySwimlaneFieldName}
+                    showFilterMessage={filterActive === true}
+                  />
+                )}
+            </>
+          )}
+        </EuiPanel>
+        {isAddDashboardsActive && selectedJobs && (
+          <AddToDashboardControl
+            onClose={async (callback) => {
+              setIsAddDashboardActive(false);
+              if (callback) {
+                await callback();
+              }
+            }}
+            jobIds={selectedJobs.map(({ id }) => id)}
+            viewBy={viewBySwimlaneFieldName!}
+            limit={swimlaneLimit}
+          />
+        )}
+      </>
+    );
+  },
+  (prevProps, nextProps) => {
+    return isEqual(prevProps.explorerState, nextProps.explorerState);
+  }
+);
diff --git a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_influencers_found/explorer_no_influencers_found.js b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_influencers_found/explorer_no_influencers_found.tsx
similarity index 78%
rename from x-pack/plugins/ml/public/application/explorer/components/explorer_no_influencers_found/explorer_no_influencers_found.js
rename to x-pack/plugins/ml/public/application/explorer/components/explorer_no_influencers_found/explorer_no_influencers_found.tsx
index 5f54c383e76ad7..639c0f7b785043 100644
--- a/x-pack/plugins/ml/public/application/explorer/components/explorer_no_influencers_found/explorer_no_influencers_found.js
+++ b/x-pack/plugins/ml/public/application/explorer/components/explorer_no_influencers_found/explorer_no_influencers_found.tsx
@@ -4,20 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-/*
- * React component for rendering EuiEmptyPrompt when no influencers were found.
- */
-
-import PropTypes from 'prop-types';
-import React from 'react';
+import React, { FC } from 'react';
 
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiEmptyPrompt } from '@elastic/eui';
 
-export const ExplorerNoInfluencersFound = ({
-  viewBySwimlaneFieldName,
-  showFilterMessage = false,
-}) => (
+/*
+ * React component for rendering EuiEmptyPrompt when no influencers were found.
+ */
+export const ExplorerNoInfluencersFound: FC<{
+  viewBySwimlaneFieldName: string;
+  showFilterMessage?: boolean;
+}> = ({ viewBySwimlaneFieldName, showFilterMessage = false }) => (
   <EuiEmptyPrompt
     titleSize="xs"
     title={
@@ -40,8 +38,3 @@ export const ExplorerNoInfluencersFound = ({
     }
   />
 );
-
-ExplorerNoInfluencersFound.propTypes = {
-  viewBySwimlaneFieldName: PropTypes.string.isRequired,
-  showFilterMessage: PropTypes.bool,
-};
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer.js b/x-pack/plugins/ml/public/application/explorer/explorer.js
index 1a5a9a9d828623..71c96840d1b579 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer.js
+++ b/x-pack/plugins/ml/public/application/explorer/explorer.js
@@ -9,10 +9,9 @@
  */
 
 import PropTypes from 'prop-types';
-import React, { createRef } from 'react';
+import React from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import DragSelect from 'dragselect/dist/ds.min.js';
 import { Subject } from 'rxjs';
 import { takeUntil } from 'rxjs/operators';
 
@@ -26,34 +25,23 @@ import {
   EuiPageBody,
   EuiPageHeader,
   EuiPageHeaderSection,
-  EuiSelect,
   EuiSpacer,
   EuiTitle,
 } from '@elastic/eui';
 
 import { AnnotationFlyout } from '../components/annotations/annotation_flyout';
 import { AnnotationsTable } from '../components/annotations/annotations_table';
-import {
-  ExplorerNoInfluencersFound,
-  ExplorerNoJobsFound,
-  ExplorerNoResultsFound,
-} from './components';
-import { ExplorerSwimlane } from './explorer_swimlane';
-import { getTimeBucketsFromCache } from '../util/time_buckets';
+import { ExplorerNoJobsFound, ExplorerNoResultsFound } from './components';
 import { DatePickerWrapper } from '../components/navigation_menu/date_picker_wrapper';
 import { InfluencersList } from '../components/influencers_list';
-import {
-  ALLOW_CELL_RANGE_SELECTION,
-  dragSelect$,
-  explorerService,
-} from './explorer_dashboard_service';
+import { explorerService } from './explorer_dashboard_service';
 import { AnomalyResultsViewSelector } from '../components/anomaly_results_view_selector';
 import { LoadingIndicator } from '../components/loading_indicator/loading_indicator';
 import { NavigationMenu } from '../components/navigation_menu';
 import { CheckboxShowCharts } from '../components/controls/checkbox_showcharts';
 import { JobSelector } from '../components/job_selector';
 import { SelectInterval } from '../components/controls/select_interval/select_interval';
-import { SelectLimit, limit$ } from './select_limit/select_limit';
+import { limit$ } from './select_limit/select_limit';
 import { SelectSeverity } from '../components/controls/select_severity/select_severity';
 import {
   ExplorerQueryBar,
@@ -67,14 +55,9 @@ import {
   escapeParens,
   escapeDoubleQuotes,
 } from './explorer_utils';
-import { getSwimlaneContainerWidth } from './legacy_utils';
+import { AnomalyTimeline } from './anomaly_timeline';
 
-import {
-  DRAG_SELECT_ACTION,
-  FILTER_ACTION,
-  SWIMLANE_TYPE,
-  VIEW_BY_JOB_LABEL,
-} from './explorer_constants';
+import { FILTER_ACTION } from './explorer_constants';
 
 // Explorer Charts
 import { ExplorerChartsContainer } from './explorer_charts/explorer_charts_container';
@@ -82,17 +65,7 @@ import { ExplorerChartsContainer } from './explorer_charts/explorer_charts_conta
 // Anomalies Table
 import { AnomaliesTable } from '../components/anomalies_table/anomalies_table';
 
-import { ResizeChecker } from '../../../../../../src/plugins/kibana_utils/public';
 import { getTimefilter, getToastNotifications } from '../util/dependency_cache';
-import { MlTooltipComponent } from '../components/chart_tooltip';
-import { hasMatchingPoints } from './has_matching_points';
-
-function mapSwimlaneOptionsToEuiOptions(options) {
-  return options.map((option) => ({
-    value: option,
-    text: option,
-  }));
-}
 
 const ExplorerPage = ({
   children,
@@ -105,9 +78,8 @@ const ExplorerPage = ({
   queryString,
   filterIconTriggeredQuery,
   updateLanguage,
-  resizeRef,
 }) => (
-  <div ref={resizeRef} data-test-subj="mlPageAnomalyExplorer">
+  <div data-test-subj="mlPageAnomalyExplorer">
     <NavigationMenu tabId="anomaly_detection" />
     <EuiPage style={{ background: 'none' }}>
       <EuiPageBody>
@@ -171,108 +143,18 @@ export class Explorer extends React.Component {
   state = { filterIconTriggeredQuery: undefined, language: DEFAULT_QUERY_LANG };
 
   _unsubscribeAll = new Subject();
-  // make sure dragSelect is only available if the mouse pointer is actually over a swimlane
-  disableDragSelectOnMouseLeave = true;
-
-  dragSelect = new DragSelect({
-    selectorClass: 'ml-swimlane-selector',
-    selectables: document.getElementsByClassName('sl-cell'),
-    callback(elements) {
-      if (elements.length > 1 && !ALLOW_CELL_RANGE_SELECTION) {
-        elements = [elements[0]];
-      }
-
-      if (elements.length > 0) {
-        dragSelect$.next({
-          action: DRAG_SELECT_ACTION.NEW_SELECTION,
-          elements,
-        });
-      }
-
-      this.disableDragSelectOnMouseLeave = true;
-    },
-    onDragStart(e) {
-      let target = e.target;
-      while (target && target !== document.body && !target.classList.contains('sl-cell')) {
-        target = target.parentNode;
-      }
-      if (ALLOW_CELL_RANGE_SELECTION && target !== document.body) {
-        dragSelect$.next({
-          action: DRAG_SELECT_ACTION.DRAG_START,
-        });
-        this.disableDragSelectOnMouseLeave = false;
-      }
-    },
-    onElementSelect() {
-      if (ALLOW_CELL_RANGE_SELECTION) {
-        dragSelect$.next({
-          action: DRAG_SELECT_ACTION.ELEMENT_SELECT,
-        });
-      }
-    },
-  });
-
-  // Listens to render updates of the swimlanes to update dragSelect
-  swimlaneRenderDoneListener = () => {
-    this.dragSelect.clearSelection();
-    this.dragSelect.setSelectables(document.getElementsByClassName('sl-cell'));
-  };
-
-  resizeRef = createRef();
-  resizeChecker = undefined;
-  resizeHandler = () => {
-    explorerService.setSwimlaneContainerWidth(getSwimlaneContainerWidth());
-  };
 
   componentDidMount() {
     limit$.pipe(takeUntil(this._unsubscribeAll)).subscribe(explorerService.setSwimlaneLimit);
-
-    // Required to redraw the time series chart when the container is resized.
-    this.resizeChecker = new ResizeChecker(this.resizeRef.current);
-    this.resizeChecker.on('resize', this.resizeHandler);
-
-    this.timeBuckets = getTimeBucketsFromCache();
   }
 
   componentWillUnmount() {
     this._unsubscribeAll.next();
     this._unsubscribeAll.complete();
-    this.resizeChecker.destroy();
-  }
-
-  resetCache() {
-    this.anomaliesTablePreviousArgs = null;
   }
 
   viewByChangeHandler = (e) => explorerService.setViewBySwimlaneFieldName(e.target.value);
 
-  isSwimlaneSelectActive = false;
-  onSwimlaneEnterHandler = () => this.setSwimlaneSelectActive(true);
-  onSwimlaneLeaveHandler = () => this.setSwimlaneSelectActive(false);
-  setSwimlaneSelectActive = (active) => {
-    if (this.isSwimlaneSelectActive && !active && this.disableDragSelectOnMouseLeave) {
-      this.dragSelect.stop();
-      this.isSwimlaneSelectActive = active;
-      return;
-    }
-    if (!this.isSwimlaneSelectActive && active) {
-      this.dragSelect.start();
-      this.dragSelect.clearSelection();
-      this.dragSelect.setSelectables(document.getElementsByClassName('sl-cell'));
-      this.isSwimlaneSelectActive = active;
-    }
-  };
-
-  // Listener for click events in the swimlane to load corresponding anomaly data.
-  swimlaneCellClick = (selectedCells) => {
-    // If selectedCells is an empty object we clear any existing selection,
-    // otherwise we save the new selection in AppState and update the Explorer.
-    if (Object.keys(selectedCells).length === 0) {
-      this.props.setSelectedCells();
-    } else {
-      this.props.setSelectedCells(selectedCells);
-    }
-  };
   // Escape regular parens from fieldName as that portion of the query is not wrapped in double quotes
   // and will cause a syntax error when called with getKqlQueryValues
   applyFilter = (fieldName, fieldValue, action) => {
@@ -339,24 +221,16 @@ export class Explorer extends React.Component {
       annotationsData,
       chartsData,
       filterActive,
-      filteredFields,
       filterPlaceHolder,
       indexPattern,
       influencers,
       loading,
-      maskAll,
       noInfluencersConfigured,
       overallSwimlaneData,
       queryString,
       selectedCells,
       selectedJobs,
-      swimlaneContainerWidth,
       tableData,
-      viewByLoadedForTimeFormatted,
-      viewBySwimlaneData,
-      viewBySwimlaneDataLoading,
-      viewBySwimlaneFieldName,
-      viewBySwimlaneOptions,
     } = this.props.explorerState;
 
     const jobSelectorProps = {
@@ -378,7 +252,6 @@ export class Explorer extends React.Component {
           indexPattern={indexPattern}
           queryString={queryString}
           updateLanguage={this.updateLanguage}
-          resizeRef={this.resizeRef}
         >
           <LoadingIndicator
             label={i18n.translate('xpack.ml.explorer.loadingLabel', {
@@ -391,7 +264,7 @@ export class Explorer extends React.Component {
 
     if (noJobsFound) {
       return (
-        <ExplorerPage jobSelectorProps={jobSelectorProps} resizeRef={this.resizeRef}>
+        <ExplorerPage jobSelectorProps={jobSelectorProps}>
           <ExplorerNoJobsFound />
         </ExplorerPage>
       );
@@ -399,7 +272,7 @@ export class Explorer extends React.Component {
 
     if (noJobsFound && hasResults === false) {
       return (
-        <ExplorerPage jobSelectorProps={jobSelectorProps} resizeRef={this.resizeRef}>
+        <ExplorerPage jobSelectorProps={jobSelectorProps}>
           <ExplorerNoResultsFound />
         </ExplorerPage>
       );
@@ -408,15 +281,6 @@ export class Explorer extends React.Component {
     const mainColumnWidthClassName = noInfluencersConfigured === true ? 'col-xs-12' : 'col-xs-10';
     const mainColumnClasses = `column ${mainColumnWidthClassName}`;
 
-    const showOverallSwimlane =
-      overallSwimlaneData !== null &&
-      overallSwimlaneData.laneLabels &&
-      overallSwimlaneData.laneLabels.length > 0;
-    const showViewBySwimlane =
-      viewBySwimlaneData !== null &&
-      viewBySwimlaneData.laneLabels &&
-      viewBySwimlaneData.laneLabels.length > 0;
-
     const timefilter = getTimefilter();
     const bounds = timefilter.getActiveBounds();
 
@@ -431,7 +295,6 @@ export class Explorer extends React.Component {
         indexPattern={indexPattern}
         queryString={queryString}
         updateLanguage={this.updateLanguage}
-        resizeRef={this.resizeRef}
       >
         <div className="results-container">
           {noInfluencersConfigured && (
@@ -462,142 +325,12 @@ export class Explorer extends React.Component {
           )}
 
           <div className={mainColumnClasses}>
-            <EuiTitle className="panel-title">
-              <h2>
-                <FormattedMessage
-                  id="xpack.ml.explorer.anomalyTimelineTitle"
-                  defaultMessage="Anomaly timeline"
-                />
-              </h2>
-            </EuiTitle>
-
-            <div
-              className="ml-explorer-swimlane euiText"
-              onMouseEnter={this.onSwimlaneEnterHandler}
-              onMouseLeave={this.onSwimlaneLeaveHandler}
-              data-test-subj="mlAnomalyExplorerSwimlaneOverall"
-            >
-              {showOverallSwimlane && (
-                <MlTooltipComponent>
-                  {(tooltipService) => (
-                    <ExplorerSwimlane
-                      chartWidth={swimlaneContainerWidth}
-                      filterActive={filterActive}
-                      filteredFields={filteredFields}
-                      maskAll={maskAll}
-                      timeBuckets={this.timeBuckets}
-                      swimlaneCellClick={this.swimlaneCellClick}
-                      swimlaneData={overallSwimlaneData}
-                      swimlaneType={SWIMLANE_TYPE.OVERALL}
-                      selection={selectedCells}
-                      swimlaneRenderDoneListener={this.swimlaneRenderDoneListener}
-                      tooltipService={tooltipService}
-                    />
-                  )}
-                </MlTooltipComponent>
-              )}
-            </div>
-
-            {viewBySwimlaneOptions.length > 0 && (
-              <>
-                <EuiFlexGroup direction="row" gutterSize="l" responsive={true}>
-                  <EuiFlexItem grow={false}>
-                    <EuiFormRow
-                      label={i18n.translate('xpack.ml.explorer.viewByLabel', {
-                        defaultMessage: 'View by',
-                      })}
-                    >
-                      <EuiSelect
-                        id="selectViewBy"
-                        options={mapSwimlaneOptionsToEuiOptions(viewBySwimlaneOptions)}
-                        value={viewBySwimlaneFieldName}
-                        onChange={this.viewByChangeHandler}
-                      />
-                    </EuiFormRow>
-                  </EuiFlexItem>
-                  <EuiFlexItem grow={false}>
-                    <EuiFormRow
-                      label={i18n.translate('xpack.ml.explorer.limitLabel', {
-                        defaultMessage: 'Limit',
-                      })}
-                    >
-                      <SelectLimit />
-                    </EuiFormRow>
-                  </EuiFlexItem>
-                  <EuiFlexItem grow={false} style={{ alignSelf: 'center' }}>
-                    <EuiFormRow label="&#8203;">
-                      <div className="panel-sub-title">
-                        {viewByLoadedForTimeFormatted && (
-                          <FormattedMessage
-                            id="xpack.ml.explorer.sortedByMaxAnomalyScoreForTimeFormattedLabel"
-                            defaultMessage="(Sorted by max anomaly score for {viewByLoadedForTimeFormatted})"
-                            values={{ viewByLoadedForTimeFormatted }}
-                          />
-                        )}
-                        {viewByLoadedForTimeFormatted === undefined && (
-                          <FormattedMessage
-                            id="xpack.ml.explorer.sortedByMaxAnomalyScoreLabel"
-                            defaultMessage="(Sorted by max anomaly score)"
-                          />
-                        )}
-                        {filterActive === true && viewBySwimlaneFieldName === VIEW_BY_JOB_LABEL && (
-                          <FormattedMessage
-                            id="xpack.ml.explorer.jobScoreAcrossAllInfluencersLabel"
-                            defaultMessage="(Job score across all influencers)"
-                          />
-                        )}
-                      </div>
-                    </EuiFormRow>
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-
-                {showViewBySwimlane && (
-                  <>
-                    <EuiSpacer size="m" />
-                    <div
-                      className="ml-explorer-swimlane euiText"
-                      onMouseEnter={this.onSwimlaneEnterHandler}
-                      onMouseLeave={this.onSwimlaneLeaveHandler}
-                      data-test-subj="mlAnomalyExplorerSwimlaneViewBy"
-                    >
-                      <MlTooltipComponent>
-                        {(tooltipService) => (
-                          <ExplorerSwimlane
-                            chartWidth={swimlaneContainerWidth}
-                            filterActive={filterActive}
-                            maskAll={
-                              maskAll &&
-                              !hasMatchingPoints({
-                                filteredFields,
-                                swimlaneData: viewBySwimlaneData,
-                              })
-                            }
-                            timeBuckets={this.timeBuckets}
-                            swimlaneCellClick={this.swimlaneCellClick}
-                            swimlaneData={viewBySwimlaneData}
-                            swimlaneType={SWIMLANE_TYPE.VIEW_BY}
-                            selection={selectedCells}
-                            swimlaneRenderDoneListener={this.swimlaneRenderDoneListener}
-                            tooltipService={tooltipService}
-                          />
-                        )}
-                      </MlTooltipComponent>
-                    </div>
-                  </>
-                )}
-
-                {viewBySwimlaneDataLoading && <LoadingIndicator />}
-
-                {!showViewBySwimlane &&
-                  !viewBySwimlaneDataLoading &&
-                  viewBySwimlaneFieldName !== null && (
-                    <ExplorerNoInfluencersFound
-                      viewBySwimlaneFieldName={viewBySwimlaneFieldName}
-                      showFilterMessage={filterActive === true}
-                    />
-                  )}
-              </>
-            )}
+            <EuiSpacer size="m" />
+            <AnomalyTimeline
+              explorerState={this.props.explorerState}
+              setSelectedCells={this.props.setSelectedCells}
+            />
+            <EuiSpacer size="m" />
 
             {annotationsData.length > 0 && (
               <>
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_constants.ts b/x-pack/plugins/ml/public/application/explorer/explorer_constants.ts
index 1cfd29e2f60d22..d1adf8c7ad744c 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_constants.ts
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_constants.ts
@@ -37,10 +37,12 @@ export const FILTER_ACTION = {
   REMOVE: '-',
 };
 
-export enum SWIMLANE_TYPE {
-  OVERALL = 'overall',
-  VIEW_BY = 'viewBy',
-}
+export const SWIMLANE_TYPE = {
+  OVERALL: 'overall',
+  VIEW_BY: 'viewBy',
+} as const;
+
+export type SwimlaneType = typeof SWIMLANE_TYPE[keyof typeof SWIMLANE_TYPE];
 
 export const CHART_TYPE = {
   EVENT_DISTRIBUTION: 'event_distribution',
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx b/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx
index 18b5de1d51f9c5..4e6dcdcc5129ca 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_swimlane.tsx
@@ -22,7 +22,7 @@ import { numTicksForDateFormat } from '../util/chart_utils';
 import { getSeverityColor } from '../../../common/util/anomaly_utils';
 import { mlEscape } from '../util/string_utils';
 import { ALLOW_CELL_RANGE_SELECTION, dragSelect$ } from './explorer_dashboard_service';
-import { DRAG_SELECT_ACTION } from './explorer_constants';
+import { DRAG_SELECT_ACTION, SwimlaneType } from './explorer_constants';
 import { EMPTY_FIELD_VALUE_LABEL } from '../timeseriesexplorer/components/entity_control/entity_control';
 import { TimeBuckets as TimeBucketsClass } from '../util/time_buckets';
 import {
@@ -58,7 +58,7 @@ export interface ExplorerSwimlaneProps {
   timeBuckets: InstanceType<typeof TimeBucketsClass>;
   swimlaneCellClick?: Function;
   swimlaneData: OverallSwimlaneData;
-  swimlaneType: string;
+  swimlaneType: SwimlaneType;
   selection?: {
     lanes: any[];
     type: string;
diff --git a/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/state.ts b/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/state.ts
index 0a2dbf5bcff35f..4e1a2af9b13a60 100644
--- a/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/state.ts
+++ b/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/state.ts
@@ -16,8 +16,9 @@ import {
   AnomaliesTableData,
   ExplorerJob,
   AppStateSelectedCells,
-  SwimlaneData,
   TimeRangeBounds,
+  OverallSwimlaneData,
+  SwimlaneData,
 } from '../../explorer_utils';
 
 export interface ExplorerState {
@@ -35,7 +36,7 @@ export interface ExplorerState {
   loading: boolean;
   maskAll: boolean;
   noInfluencersConfigured: boolean;
-  overallSwimlaneData: SwimlaneData;
+  overallSwimlaneData: SwimlaneData | OverallSwimlaneData;
   queryString: string;
   selectedCells: AppStateSelectedCells | undefined;
   selectedJobs: ExplorerJob[] | null;
@@ -45,7 +46,7 @@ export interface ExplorerState {
   tableData: AnomaliesTableData;
   tableQueryString: string;
   viewByLoadedForTimeFormatted: string | null;
-  viewBySwimlaneData: SwimlaneData;
+  viewBySwimlaneData: SwimlaneData | OverallSwimlaneData;
   viewBySwimlaneDataLoading: boolean;
   viewBySwimlaneFieldName?: string;
   viewBySwimlaneOptions: string[];
diff --git a/x-pack/plugins/ml/public/application/explorer/select_limit/select_limit.tsx b/x-pack/plugins/ml/public/application/explorer/select_limit/select_limit.tsx
index 7f7a8fc5a70bd0..7a2df1a0f05350 100644
--- a/x-pack/plugins/ml/public/application/explorer/select_limit/select_limit.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/select_limit/select_limit.tsx
@@ -36,5 +36,5 @@ export const SelectLimit = () => {
     setLimit(parseInt(e.target.value, 10));
   }
 
-  return <EuiSelect options={euiOptions} onChange={onChange} value={limit} />;
+  return <EuiSelect compressed options={euiOptions} onChange={onChange} value={limit} />;
 };
diff --git a/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx b/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
new file mode 100644
index 00000000000000..57d1fd81000b7e
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/explorer/swimlane_container.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC, useCallback, useState } from 'react';
+import { EuiResizeObserver, EuiText } from '@elastic/eui';
+
+import { throttle } from 'lodash';
+import {
+  ExplorerSwimlane,
+  ExplorerSwimlaneProps,
+} from '../../application/explorer/explorer_swimlane';
+
+import { MlTooltipComponent } from '../../application/components/chart_tooltip';
+
+const RESIZE_THROTTLE_TIME_MS = 500;
+
+export const SwimlaneContainer: FC<
+  Omit<ExplorerSwimlaneProps, 'chartWidth' | 'tooltipService'> & {
+    onResize: (width: number) => void;
+  }
+> = ({ children, onResize, ...props }) => {
+  const [chartWidth, setChartWidth] = useState<number>(0);
+
+  const resizeHandler = useCallback(
+    throttle((e: { width: number; height: number }) => {
+      const labelWidth = 200;
+      setChartWidth(e.width - labelWidth);
+      onResize(e.width);
+    }, RESIZE_THROTTLE_TIME_MS),
+    []
+  );
+
+  return (
+    <EuiResizeObserver onResize={resizeHandler}>
+      {(resizeRef) => (
+        <div
+          ref={(el) => {
+            resizeRef(el);
+          }}
+        >
+          <div style={{ width: '100%' }}>
+            <EuiText color="subdued" size="s">
+              <MlTooltipComponent>
+                {(tooltipService) => (
+                  <ExplorerSwimlane
+                    chartWidth={chartWidth}
+                    tooltipService={tooltipService}
+                    {...props}
+                  />
+                )}
+              </MlTooltipComponent>
+            </EuiText>
+          </div>
+        </div>
+      )}
+    </EuiResizeObserver>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/services/dashboard_service.test.ts b/x-pack/plugins/ml/public/application/services/dashboard_service.test.ts
new file mode 100644
index 00000000000000..6cab23eb187c7c
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/services/dashboard_service.test.ts
@@ -0,0 +1,174 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { dashboardServiceProvider } from './dashboard_service';
+import { savedObjectsServiceMock } from '../../../../../../src/core/public/mocks';
+import { SavedObjectDashboard } from '../../../../../../src/plugins/dashboard/public/saved_dashboards';
+import {
+  DashboardUrlGenerator,
+  SavedDashboardPanel,
+} from '../../../../../../src/plugins/dashboard/public';
+
+jest.mock('@elastic/eui', () => {
+  return {
+    htmlIdGenerator: jest.fn(() => {
+      return jest.fn(() => 'test-panel-id');
+    }),
+  };
+});
+
+describe('DashboardService', () => {
+  const mockSavedObjectClient = savedObjectsServiceMock.createStartContract().client;
+  const dashboardUrlGenerator = ({
+    createUrl: jest.fn(),
+  } as unknown) as DashboardUrlGenerator;
+  const dashboardService = dashboardServiceProvider(
+    mockSavedObjectClient,
+    '8.0.0',
+    dashboardUrlGenerator
+  );
+
+  test('should fetch dashboard', () => {
+    // act
+    dashboardService.fetchDashboards('test');
+    // assert
+    expect(mockSavedObjectClient.find).toHaveBeenCalledWith({
+      type: 'dashboard',
+      perPage: 10,
+      search: `test*`,
+      searchFields: ['title^3', 'description'],
+    });
+  });
+
+  test('should attach panel to the dashboard', () => {
+    // act
+    dashboardService.attachPanels(
+      'test-dashboard',
+      ({
+        title: 'ML Test',
+        hits: 0,
+        description: '',
+        panelsJSON: JSON.stringify([
+          {
+            version: '8.0.0',
+            type: 'ml_anomaly_swimlane',
+            gridData: { x: 0, y: 0, w: 24, h: 15, i: 'i63c960b1-ab1b-11ea-809d-f5c60c43347f' },
+            panelIndex: 'i63c960b1-ab1b-11ea-809d-f5c60c43347f',
+            embeddableConfig: {
+              title: 'Panel test!',
+              jobIds: ['cw_multi_1'],
+              swimlaneType: 'overall',
+            },
+            title: 'Panel test!',
+          },
+          {
+            version: '8.0.0',
+            type: 'ml_anomaly_swimlane',
+            gridData: { x: 24, y: 0, w: 24, h: 15, i: '0aa334bd-8308-4ded-9462-80dbd37680ee' },
+            panelIndex: '0aa334bd-8308-4ded-9462-80dbd37680ee',
+            embeddableConfig: {
+              title: 'ML anomaly swimlane for fb_population_1',
+              jobIds: ['fb_population_1'],
+              limit: 5,
+              swimlaneType: 'overall',
+            },
+            title: 'ML anomaly swimlane for fb_population_1',
+          },
+          {
+            version: '8.0.0',
+            gridData: { x: 0, y: 15, w: 24, h: 15, i: 'abd36eb7-4774-4216-891e-12100752b46d' },
+            panelIndex: 'abd36eb7-4774-4216-891e-12100752b46d',
+            embeddableConfig: {},
+            panelRefName: 'panel_2',
+          },
+        ]),
+        optionsJSON: '{"hidePanelTitles":false,"useMargins":true}',
+        version: 1,
+        timeRestore: false,
+        kibanaSavedObjectMeta: {
+          searchSourceJSON: '{"query":{"language":"kuery","query":""},"filter":[]}',
+        },
+      } as unknown) as SavedObjectDashboard,
+      [{ title: 'Test title', type: 'test-panel', embeddableConfig: { testConfig: '' } }]
+    );
+    // assert
+    expect(mockSavedObjectClient.update).toHaveBeenCalledWith('dashboard', 'test-dashboard', {
+      title: 'ML Test',
+      hits: 0,
+      description: '',
+      panelsJSON: JSON.stringify([
+        {
+          version: '8.0.0',
+          type: 'ml_anomaly_swimlane',
+          gridData: { x: 0, y: 0, w: 24, h: 15, i: 'i63c960b1-ab1b-11ea-809d-f5c60c43347f' },
+          panelIndex: 'i63c960b1-ab1b-11ea-809d-f5c60c43347f',
+          embeddableConfig: {
+            title: 'Panel test!',
+            jobIds: ['cw_multi_1'],
+            swimlaneType: 'overall',
+          },
+          title: 'Panel test!',
+        },
+        {
+          version: '8.0.0',
+          type: 'ml_anomaly_swimlane',
+          gridData: { x: 24, y: 0, w: 24, h: 15, i: '0aa334bd-8308-4ded-9462-80dbd37680ee' },
+          panelIndex: '0aa334bd-8308-4ded-9462-80dbd37680ee',
+          embeddableConfig: {
+            title: 'ML anomaly swimlane for fb_population_1',
+            jobIds: ['fb_population_1'],
+            limit: 5,
+            swimlaneType: 'overall',
+          },
+          title: 'ML anomaly swimlane for fb_population_1',
+        },
+        {
+          version: '8.0.0',
+          gridData: { x: 0, y: 15, w: 24, h: 15, i: 'abd36eb7-4774-4216-891e-12100752b46d' },
+          panelIndex: 'abd36eb7-4774-4216-891e-12100752b46d',
+          embeddableConfig: {},
+          panelRefName: 'panel_2',
+        },
+        {
+          panelIndex: 'test-panel-id',
+          embeddableConfig: { testConfig: '' },
+          title: 'Test title',
+          type: 'test-panel',
+          version: '8.0.0',
+          gridData: { h: 15, i: 'test-panel-id', w: 24, x: 24, y: 15 },
+        },
+      ]),
+      optionsJSON: '{"hidePanelTitles":false,"useMargins":true}',
+      version: 1,
+      timeRestore: false,
+      kibanaSavedObjectMeta: {
+        searchSourceJSON: '{"query":{"language":"kuery","query":""},"filter":[]}',
+      },
+    });
+  });
+
+  test('should generate edit url to the dashboard', () => {
+    dashboardService.getDashboardEditUrl('test-id');
+    expect(dashboardUrlGenerator.createUrl).toHaveBeenCalledWith({
+      dashboardId: 'test-id',
+      useHash: false,
+      viewMode: 'edit',
+    });
+  });
+
+  test('should find the panel positioned at the end', () => {
+    expect(
+      dashboardService.getLastPanel([
+        { gridData: { y: 15, x: 7 } },
+        { gridData: { y: 17, x: 9 } },
+        { gridData: { y: 15, x: 1 } },
+        { gridData: { y: 17, x: 10 } },
+        { gridData: { y: 15, x: 22 } },
+        { gridData: { y: 17, x: 9 } },
+      ] as SavedDashboardPanel[])
+    ).toEqual({ gridData: { y: 17, x: 10 } });
+  });
+});
diff --git a/x-pack/plugins/ml/public/application/services/dashboard_service.ts b/x-pack/plugins/ml/public/application/services/dashboard_service.ts
new file mode 100644
index 00000000000000..7f2bb71d18eb98
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/services/dashboard_service.ts
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SavedObjectsClientContract } from 'kibana/public';
+import { htmlIdGenerator } from '@elastic/eui';
+import { useMemo } from 'react';
+import {
+  DASHBOARD_APP_URL_GENERATOR,
+  DashboardUrlGenerator,
+  SavedDashboardPanel,
+  SavedObjectDashboard,
+} from '../../../../../../src/plugins/dashboard/public';
+import { useMlKibana } from '../contexts/kibana';
+import { ViewMode } from '../../../../../../src/plugins/embeddable/public';
+
+export type DashboardService = ReturnType<typeof dashboardServiceProvider>;
+
+export function dashboardServiceProvider(
+  savedObjectClient: SavedObjectsClientContract,
+  kibanaVersion: string,
+  dashboardUrlGenerator: DashboardUrlGenerator
+) {
+  const generateId = htmlIdGenerator();
+  const DEFAULT_PANEL_WIDTH = 24;
+  const DEFAULT_PANEL_HEIGHT = 15;
+
+  return {
+    /**
+     * Fetches dashboards
+     */
+    async fetchDashboards(query?: string) {
+      return await savedObjectClient.find<SavedObjectDashboard>({
+        type: 'dashboard',
+        perPage: 10,
+        search: query ? `${query}*` : '',
+        searchFields: ['title^3', 'description'],
+      });
+    },
+    /**
+     * Resolves the last positioned panel from the collection.
+     */
+    getLastPanel(panels: SavedDashboardPanel[]): SavedDashboardPanel | null {
+      return panels.length > 0
+        ? panels.reduce((prev, current) =>
+            prev.gridData.y >= current.gridData.y
+              ? prev.gridData.y === current.gridData.y
+                ? prev.gridData.x > current.gridData.x
+                  ? prev
+                  : current
+                : prev
+              : current
+          )
+        : null;
+    },
+    /**
+     * Attaches embeddable panels to the dashboard
+     */
+    async attachPanels(
+      dashboardId: string,
+      dashboardAttributes: SavedObjectDashboard,
+      panelsData: Array<Pick<SavedDashboardPanel, 'title' | 'type' | 'embeddableConfig'>>
+    ) {
+      const panels = JSON.parse(dashboardAttributes.panelsJSON) as SavedDashboardPanel[];
+      const version = kibanaVersion;
+      const rowWidth = DEFAULT_PANEL_WIDTH * 2;
+
+      for (const panelData of panelsData) {
+        const panelIndex = generateId();
+        const lastPanel = this.getLastPanel(panels);
+
+        const xOffset = lastPanel ? lastPanel.gridData.w + lastPanel.gridData.x : 0;
+        const availableRowSpace = rowWidth - xOffset;
+        const xPosition = availableRowSpace - DEFAULT_PANEL_WIDTH >= 0 ? xOffset : 0;
+
+        panels.push({
+          panelIndex,
+          embeddableConfig: panelData.embeddableConfig as { [key: string]: any },
+          title: panelData.title,
+          type: panelData.type,
+          version,
+          gridData: {
+            h: DEFAULT_PANEL_HEIGHT,
+            i: panelIndex,
+            w: DEFAULT_PANEL_WIDTH,
+            x: xPosition,
+            y: lastPanel
+              ? xPosition > 0
+                ? lastPanel.gridData.y
+                : lastPanel.gridData.y + lastPanel.gridData.h
+              : 0,
+          },
+        });
+      }
+
+      await savedObjectClient.update('dashboard', dashboardId, {
+        ...dashboardAttributes,
+        panelsJSON: JSON.stringify(panels),
+      });
+    },
+    /**
+     * Generates dashboard url with edit mode
+     */
+    async getDashboardEditUrl(dashboardId: string) {
+      return await dashboardUrlGenerator.createUrl({
+        dashboardId,
+        useHash: false,
+        viewMode: ViewMode.EDIT,
+      });
+    },
+  };
+}
+
+/**
+ * Hook to use {@link DashboardService} in react components
+ */
+export function useDashboardService(): DashboardService {
+  const {
+    services: {
+      savedObjects: { client: savedObjectClient },
+      kibanaVersion,
+      share: { urlGenerators },
+    },
+  } = useMlKibana();
+  return useMemo(
+    () =>
+      dashboardServiceProvider(
+        savedObjectClient,
+        kibanaVersion,
+        urlGenerators.getUrlGenerator(DASHBOARD_APP_URL_GENERATOR)
+      ),
+    [savedObjectClient, kibanaVersion]
+  );
+}
diff --git a/x-pack/plugins/ml/public/application/services/http_service.ts b/x-pack/plugins/ml/public/application/services/http_service.ts
index 7144411c2885d2..bd927dc0e30111 100644
--- a/x-pack/plugins/ml/public/application/services/http_service.ts
+++ b/x-pack/plugins/ml/public/application/services/http_service.ts
@@ -37,6 +37,8 @@ function getFetchOptions(
 /**
  * Function for making HTTP requests to Kibana's backend.
  * Wrapper for Kibana's HttpHandler.
+ *
+ * @deprecated use {@link HttpService} instead
  */
 export async function http<T>(options: HttpFetchOptionsWithPath): Promise<T> {
   const { path, fetchOptions } = getFetchOptions(options);
@@ -46,6 +48,8 @@ export async function http<T>(options: HttpFetchOptionsWithPath): Promise<T> {
 /**
  * Function for making HTTP requests to Kibana's backend which returns an Observable
  * with request cancellation support.
+ *
+ * @deprecated use {@link HttpService} instead
  */
 export function http$<T>(options: HttpFetchOptionsWithPath): Observable<T> {
   const { path, fetchOptions } = getFetchOptions(options);
@@ -55,7 +59,7 @@ export function http$<T>(options: HttpFetchOptionsWithPath): Observable<T> {
 /**
  * Creates an Observable from Kibana's HttpHandler.
  */
-export function fromHttpHandler<T>(input: string, init?: RequestInit): Observable<T> {
+function fromHttpHandler<T>(input: string, init?: RequestInit): Observable<T> {
   return new Observable<T>((subscriber) => {
     const controller = new AbortController();
     const signal = controller.signal;
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
index fdaa3c2ffe79ec..6d32fca6a645c1 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
@@ -5,12 +5,13 @@
  */
 
 import { Observable } from 'rxjs';
-import { http, http$ } from '../http_service';
+import { HttpStart } from 'kibana/public';
+import { HttpService } from '../http_service';
 
 import { annotations } from './annotations';
 import { dataFrameAnalytics } from './data_frame_analytics';
 import { filters } from './filters';
-import { results } from './results';
+import { resultsApiProvider } from './results';
 import { jobs } from './jobs';
 import { fileDatavisualizer } from './datavisualizer';
 import { MlServerDefaults, MlServerLimits } from '../../../../common/types/ml_server_info';
@@ -28,6 +29,7 @@ import {
 import { ES_AGGREGATION } from '../../../../common/constants/aggregation_types';
 import { FieldRequestConfig } from '../../datavisualizer/index_based/common';
 import { DataRecognizerConfigResponse, Module } from '../../../../common/types/modules';
+import { getHttp } from '../../util/dependency_cache';
 
 export interface MlInfoResponse {
   defaults: MlServerDefaults;
@@ -87,327 +89,330 @@ export function basePath() {
   return '/api/ml';
 }
 
-export const ml = {
-  getJobs(obj?: { jobId?: string }) {
-    const jobId = obj && obj.jobId ? `/${obj.jobId}` : '';
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors${jobId}`,
-    });
-  },
-
-  getJobStats(obj: { jobId?: string }) {
-    const jobId = obj && obj.jobId ? `/${obj.jobId}` : '';
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors${jobId}/_stats`,
-    });
-  },
-
-  addJob({ jobId, job }: { jobId: string; job: Job }) {
-    const body = JSON.stringify(job);
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}`,
-      method: 'PUT',
-      body,
-    });
-  },
-
-  openJob({ jobId }: { jobId: string }) {
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/_open`,
-      method: 'POST',
-    });
-  },
-
-  closeJob({ jobId }: { jobId: string }) {
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/_close`,
-      method: 'POST',
-    });
-  },
-
-  forceCloseJob({ jobId }: { jobId: string }) {
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/_close?force=true`,
-      method: 'POST',
-    });
-  },
-
-  deleteJob({ jobId }: { jobId: string }) {
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}`,
-      method: 'DELETE',
-    });
-  },
-
-  forceDeleteJob({ jobId }: { jobId: string }) {
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}?force=true`,
-      method: 'DELETE',
-    });
-  },
-
-  updateJob({ jobId, job }: { jobId: string; job: Job }) {
-    const body = JSON.stringify(job);
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/_update`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  estimateBucketSpan(obj: BucketSpanEstimatorData) {
-    const body = JSON.stringify(obj);
-    return http<BucketSpanEstimatorResponse>({
-      path: `${basePath()}/validate/estimate_bucket_span`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  validateJob(payload: {
-    job: Job;
-    duration: {
-      start?: number;
-      end?: number;
-    };
-    fields?: any[];
-  }) {
-    const body = JSON.stringify(payload);
-    return http<any>({
-      path: `${basePath()}/validate/job`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  validateCardinality$(job: CombinedJob): Observable<CardinalityValidationResults> {
-    const body = JSON.stringify(job);
-    return http$({
-      path: `${basePath()}/validate/cardinality`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  getDatafeeds(obj: { datafeedId: string }) {
-    const datafeedId = obj && obj.datafeedId ? `/${obj.datafeedId}` : '';
-    return http<any>({
-      path: `${basePath()}/datafeeds${datafeedId}`,
-    });
-  },
-
-  getDatafeedStats(obj: { datafeedId: string }) {
-    const datafeedId = obj && obj.datafeedId ? `/${obj.datafeedId}` : '';
-    return http<any>({
-      path: `${basePath()}/datafeeds${datafeedId}/_stats`,
-    });
-  },
-
-  addDatafeed({ datafeedId, datafeedConfig }: { datafeedId: string; datafeedConfig: Datafeed }) {
-    const body = JSON.stringify(datafeedConfig);
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}`,
-      method: 'PUT',
-      body,
-    });
-  },
-
-  updateDatafeed({ datafeedId, datafeedConfig }: { datafeedId: string; datafeedConfig: Datafeed }) {
-    const body = JSON.stringify(datafeedConfig);
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}/_update`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  deleteDatafeed({ datafeedId }: { datafeedId: string }) {
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}`,
-      method: 'DELETE',
-    });
-  },
-
-  forceDeleteDatafeed({ datafeedId }: { datafeedId: string }) {
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}?force=true`,
-      method: 'DELETE',
-    });
-  },
-
-  startDatafeed({ datafeedId, start, end }: { datafeedId: string; start: number; end: number }) {
-    const body = JSON.stringify({
-      ...(start !== undefined ? { start } : {}),
-      ...(end !== undefined ? { end } : {}),
-    });
-
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}/_start`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  stopDatafeed({ datafeedId }: { datafeedId: string }) {
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}/_stop`,
-      method: 'POST',
-    });
-  },
-
-  forceStopDatafeed({ datafeedId }: { datafeedId: string }) {
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}/_stop?force=true`,
-      method: 'POST',
-    });
-  },
-
-  datafeedPreview({ datafeedId }: { datafeedId: string }) {
-    return http<any>({
-      path: `${basePath()}/datafeeds/${datafeedId}/_preview`,
-      method: 'GET',
-    });
-  },
-
-  validateDetector({ detector }: { detector: Detector }) {
-    const body = JSON.stringify(detector);
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/_validate/detector`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  forecast({ jobId, duration }: { jobId: string; duration?: string }) {
-    const body = JSON.stringify({
-      ...(duration !== undefined ? { duration } : {}),
-    });
-
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/_forecast`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  overallBuckets({
-    jobId,
-    topN,
-    bucketSpan,
-    start,
-    end,
-  }: {
-    jobId: string;
-    topN: string;
-    bucketSpan: string;
-    start: number;
-    end: number;
-  }) {
-    const body = JSON.stringify({ topN, bucketSpan, start, end });
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/results/overall_buckets`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  hasPrivileges(obj: any) {
-    const body = JSON.stringify(obj);
-    return http<any>({
-      path: `${basePath()}/_has_privileges`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  checkMlCapabilities() {
-    return http<MlCapabilitiesResponse>({
-      path: `${basePath()}/ml_capabilities`,
-      method: 'GET',
-    });
-  },
-
-  checkManageMLCapabilities() {
-    return http<MlCapabilitiesResponse>({
-      path: `${basePath()}/ml_capabilities`,
-      method: 'GET',
-    });
-  },
-
-  getNotificationSettings() {
-    return http<any>({
-      path: `${basePath()}/notification_settings`,
-      method: 'GET',
-    });
-  },
-
-  getFieldCaps({ index, fields }: { index: string; fields: string[] }) {
-    const body = JSON.stringify({
-      ...(index !== undefined ? { index } : {}),
-      ...(fields !== undefined ? { fields } : {}),
-    });
-
-    return http<any>({
-      path: `${basePath()}/indices/field_caps`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  recognizeIndex({ indexPatternTitle }: { indexPatternTitle: string }) {
-    return http<any>({
-      path: `${basePath()}/modules/recognize/${indexPatternTitle}`,
-      method: 'GET',
-    });
-  },
-
-  listDataRecognizerModules() {
-    return http<any>({
-      path: `${basePath()}/modules/get_module`,
-      method: 'GET',
-    });
-  },
-
-  getDataRecognizerModule({ moduleId }: { moduleId: string }) {
-    return http<Module>({
-      path: `${basePath()}/modules/get_module/${moduleId}`,
-      method: 'GET',
-    });
-  },
-
-  dataRecognizerModuleJobsExist({ moduleId }: { moduleId: string }) {
-    return http<any>({
-      path: `${basePath()}/modules/jobs_exist/${moduleId}`,
-      method: 'GET',
-    });
+/**
+ * Temp solution to allow {@link ml} service to use http from
+ * the dependency_cache.
+ */
+const proxyHttpStart = new Proxy<HttpStart>(({} as unknown) as HttpStart, {
+  get(obj, prop: keyof HttpStart) {
+    try {
+      return getHttp()[prop];
+    } catch (e) {
+      // eslint-disable-next-line no-console
+      console.error(e);
+    }
   },
-
-  setupDataRecognizerConfig({
-    moduleId,
-    prefix,
-    groups,
-    indexPatternName,
-    query,
-    useDedicatedIndex,
-    startDatafeed,
-    start,
-    end,
-    jobOverrides,
-    estimateModelMemory,
-  }: {
-    moduleId: string;
-    prefix?: string;
-    groups?: string[];
-    indexPatternName?: string;
-    query?: any;
-    useDedicatedIndex?: boolean;
-    startDatafeed?: boolean;
-    start?: number;
-    end?: number;
-    jobOverrides?: Array<Partial<Job>>;
-    estimateModelMemory?: boolean;
-  }) {
-    const body = JSON.stringify({
+});
+
+export type MlApiServices = ReturnType<typeof mlApiServicesProvider>;
+
+export const ml = mlApiServicesProvider(new HttpService(proxyHttpStart));
+
+export function mlApiServicesProvider(httpService: HttpService) {
+  const { http } = httpService;
+  return {
+    getJobs(obj?: { jobId?: string }) {
+      const jobId = obj && obj.jobId ? `/${obj.jobId}` : '';
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors${jobId}`,
+      });
+    },
+
+    getJobStats(obj: { jobId?: string }) {
+      const jobId = obj && obj.jobId ? `/${obj.jobId}` : '';
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors${jobId}/_stats`,
+      });
+    },
+
+    addJob({ jobId, job }: { jobId: string; job: Job }) {
+      const body = JSON.stringify(job);
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}`,
+        method: 'PUT',
+        body,
+      });
+    },
+
+    openJob({ jobId }: { jobId: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/_open`,
+        method: 'POST',
+      });
+    },
+
+    closeJob({ jobId }: { jobId: string }) {
+      return http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/_close`,
+        method: 'POST',
+      });
+    },
+
+    forceCloseJob({ jobId }: { jobId: string }) {
+      return http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/_close?force=true`,
+        method: 'POST',
+      });
+    },
+
+    deleteJob({ jobId }: { jobId: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}`,
+        method: 'DELETE',
+      });
+    },
+
+    forceDeleteJob({ jobId }: { jobId: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}?force=true`,
+        method: 'DELETE',
+      });
+    },
+
+    updateJob({ jobId, job }: { jobId: string; job: Job }) {
+      const body = JSON.stringify(job);
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/_update`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    estimateBucketSpan(obj: BucketSpanEstimatorData) {
+      const body = JSON.stringify(obj);
+      return httpService.http<BucketSpanEstimatorResponse>({
+        path: `${basePath()}/validate/estimate_bucket_span`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    validateJob(payload: {
+      job: Job;
+      duration: {
+        start?: number;
+        end?: number;
+      };
+      fields?: any[];
+    }) {
+      const body = JSON.stringify(payload);
+      return httpService.http<any>({
+        path: `${basePath()}/validate/job`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    validateCardinality$(job: CombinedJob): Observable<CardinalityValidationResults> {
+      const body = JSON.stringify(job);
+      return httpService.http$({
+        path: `${basePath()}/validate/cardinality`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    getDatafeeds(obj: { datafeedId: string }) {
+      const datafeedId = obj && obj.datafeedId ? `/${obj.datafeedId}` : '';
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds${datafeedId}`,
+      });
+    },
+
+    getDatafeedStats(obj: { datafeedId: string }) {
+      const datafeedId = obj && obj.datafeedId ? `/${obj.datafeedId}` : '';
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds${datafeedId}/_stats`,
+      });
+    },
+
+    addDatafeed({ datafeedId, datafeedConfig }: { datafeedId: string; datafeedConfig: Datafeed }) {
+      const body = JSON.stringify(datafeedConfig);
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}`,
+        method: 'PUT',
+        body,
+      });
+    },
+
+    updateDatafeed({
+      datafeedId,
+      datafeedConfig,
+    }: {
+      datafeedId: string;
+      datafeedConfig: Datafeed;
+    }) {
+      const body = JSON.stringify(datafeedConfig);
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}/_update`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    deleteDatafeed({ datafeedId }: { datafeedId: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}`,
+        method: 'DELETE',
+      });
+    },
+
+    forceDeleteDatafeed({ datafeedId }: { datafeedId: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}?force=true`,
+        method: 'DELETE',
+      });
+    },
+
+    startDatafeed({ datafeedId, start, end }: { datafeedId: string; start: number; end: number }) {
+      const body = JSON.stringify({
+        ...(start !== undefined ? { start } : {}),
+        ...(end !== undefined ? { end } : {}),
+      });
+
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}/_start`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    stopDatafeed({ datafeedId }: { datafeedId: string }) {
+      return http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}/_stop`,
+        method: 'POST',
+      });
+    },
+
+    forceStopDatafeed({ datafeedId }: { datafeedId: string }) {
+      return http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}/_stop?force=true`,
+        method: 'POST',
+      });
+    },
+
+    datafeedPreview({ datafeedId }: { datafeedId: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/datafeeds/${datafeedId}/_preview`,
+        method: 'GET',
+      });
+    },
+
+    validateDetector({ detector }: { detector: Detector }) {
+      const body = JSON.stringify(detector);
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/_validate/detector`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    forecast({ jobId, duration }: { jobId: string; duration?: string }) {
+      const body = JSON.stringify({
+        ...(duration !== undefined ? { duration } : {}),
+      });
+
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/_forecast`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    overallBuckets({
+      jobId,
+      topN,
+      bucketSpan,
+      start,
+      end,
+    }: {
+      jobId: string;
+      topN: string;
+      bucketSpan: string;
+      start: number;
+      end: number;
+    }) {
+      const body = JSON.stringify({ topN, bucketSpan, start, end });
+      return httpService.http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/results/overall_buckets`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    hasPrivileges(obj: any) {
+      const body = JSON.stringify(obj);
+      return httpService.http<any>({
+        path: `${basePath()}/_has_privileges`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    checkMlCapabilities() {
+      return httpService.http<MlCapabilitiesResponse>({
+        path: `${basePath()}/ml_capabilities`,
+        method: 'GET',
+      });
+    },
+
+    checkManageMLCapabilities() {
+      return httpService.http<MlCapabilitiesResponse>({
+        path: `${basePath()}/ml_capabilities`,
+        method: 'GET',
+      });
+    },
+
+    getNotificationSettings() {
+      return httpService.http<any>({
+        path: `${basePath()}/notification_settings`,
+        method: 'GET',
+      });
+    },
+
+    getFieldCaps({ index, fields }: { index: string; fields: string[] }) {
+      const body = JSON.stringify({
+        ...(index !== undefined ? { index } : {}),
+        ...(fields !== undefined ? { fields } : {}),
+      });
+
+      return httpService.http<any>({
+        path: `${basePath()}/indices/field_caps`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    recognizeIndex({ indexPatternTitle }: { indexPatternTitle: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/modules/recognize/${indexPatternTitle}`,
+        method: 'GET',
+      });
+    },
+
+    listDataRecognizerModules() {
+      return httpService.http<any>({
+        path: `${basePath()}/modules/get_module`,
+        method: 'GET',
+      });
+    },
+
+    getDataRecognizerModule({ moduleId }: { moduleId: string }) {
+      return httpService.http<Module>({
+        path: `${basePath()}/modules/get_module/${moduleId}`,
+        method: 'GET',
+      });
+    },
+
+    dataRecognizerModuleJobsExist({ moduleId }: { moduleId: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/modules/jobs_exist/${moduleId}`,
+        method: 'GET',
+      });
+    },
+
+    setupDataRecognizerConfig({
+      moduleId,
       prefix,
       groups,
       indexPatternName,
@@ -418,37 +423,41 @@ export const ml = {
       end,
       jobOverrides,
       estimateModelMemory,
-    });
-
-    return http<DataRecognizerConfigResponse>({
-      path: `${basePath()}/modules/setup/${moduleId}`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  getVisualizerFieldStats({
-    indexPatternTitle,
-    query,
-    timeFieldName,
-    earliest,
-    latest,
-    samplerShardSize,
-    interval,
-    fields,
-    maxExamples,
-  }: {
-    indexPatternTitle: string;
-    query: any;
-    timeFieldName?: string;
-    earliest?: number;
-    latest?: number;
-    samplerShardSize?: number;
-    interval?: string;
-    fields?: FieldRequestConfig[];
-    maxExamples?: number;
-  }) {
-    const body = JSON.stringify({
+    }: {
+      moduleId: string;
+      prefix?: string;
+      groups?: string[];
+      indexPatternName?: string;
+      query?: any;
+      useDedicatedIndex?: boolean;
+      startDatafeed?: boolean;
+      start?: number;
+      end?: number;
+      jobOverrides?: Array<Partial<Job>>;
+      estimateModelMemory?: boolean;
+    }) {
+      const body = JSON.stringify({
+        prefix,
+        groups,
+        indexPatternName,
+        query,
+        useDedicatedIndex,
+        startDatafeed,
+        start,
+        end,
+        jobOverrides,
+        estimateModelMemory,
+      });
+
+      return httpService.http<DataRecognizerConfigResponse>({
+        path: `${basePath()}/modules/setup/${moduleId}`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    getVisualizerFieldStats({
+      indexPatternTitle,
       query,
       timeFieldName,
       earliest,
@@ -457,35 +466,37 @@ export const ml = {
       interval,
       fields,
       maxExamples,
-    });
-
-    return http<any>({
-      path: `${basePath()}/data_visualizer/get_field_stats/${indexPatternTitle}`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  getVisualizerOverallStats({
-    indexPatternTitle,
-    query,
-    timeFieldName,
-    earliest,
-    latest,
-    samplerShardSize,
-    aggregatableFields,
-    nonAggregatableFields,
-  }: {
-    indexPatternTitle: string;
-    query: any;
-    timeFieldName?: string;
-    earliest?: number;
-    latest?: number;
-    samplerShardSize?: number;
-    aggregatableFields: string[];
-    nonAggregatableFields: string[];
-  }) {
-    const body = JSON.stringify({
+    }: {
+      indexPatternTitle: string;
+      query: any;
+      timeFieldName?: string;
+      earliest?: number;
+      latest?: number;
+      samplerShardSize?: number;
+      interval?: string;
+      fields?: FieldRequestConfig[];
+      maxExamples?: number;
+    }) {
+      const body = JSON.stringify({
+        query,
+        timeFieldName,
+        earliest,
+        latest,
+        samplerShardSize,
+        interval,
+        fields,
+        maxExamples,
+      });
+
+      return httpService.http<any>({
+        path: `${basePath()}/data_visualizer/get_field_stats/${indexPatternTitle}`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    getVisualizerOverallStats({
+      indexPatternTitle,
       query,
       timeFieldName,
       earliest,
@@ -493,204 +504,230 @@ export const ml = {
       samplerShardSize,
       aggregatableFields,
       nonAggregatableFields,
-    });
-
-    return http<any>({
-      path: `${basePath()}/data_visualizer/get_overall_stats/${indexPatternTitle}`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  /**
-   * Gets a list of calendars
-   * @param obj
-   * @returns {Promise<Calendar[]>}
-   */
-  calendars(obj?: { calendarId?: CalendarId; calendarIds?: CalendarId[] }) {
-    const { calendarId, calendarIds } = obj || {};
-    let calendarIdsPathComponent = '';
-    if (calendarId) {
-      calendarIdsPathComponent = `/${calendarId}`;
-    } else if (calendarIds) {
-      calendarIdsPathComponent = `/${calendarIds.join(',')}`;
-    }
-    return http<Calendar[]>({
-      path: `${basePath()}/calendars${calendarIdsPathComponent}`,
-      method: 'GET',
-    });
-  },
-
-  addCalendar(obj: Calendar) {
-    const body = JSON.stringify(obj);
-    return http<any>({
-      path: `${basePath()}/calendars`,
-      method: 'PUT',
-      body,
-    });
-  },
-
-  updateCalendar(obj: UpdateCalendar) {
-    const calendarId = obj && obj.calendarId ? `/${obj.calendarId}` : '';
-    const body = JSON.stringify(obj);
-    return http<any>({
-      path: `${basePath()}/calendars${calendarId}`,
-      method: 'PUT',
-      body,
-    });
-  },
-
-  deleteCalendar({ calendarId }: { calendarId?: string }) {
-    return http<any>({
-      path: `${basePath()}/calendars/${calendarId}`,
-      method: 'DELETE',
-    });
-  },
-
-  mlNodeCount() {
-    return http<{ count: number }>({
-      path: `${basePath()}/ml_node_count`,
-      method: 'GET',
-    });
-  },
-
-  mlInfo() {
-    return http<MlInfoResponse>({
-      path: `${basePath()}/info`,
-      method: 'GET',
-    });
-  },
-
-  calculateModelMemoryLimit$({
-    analysisConfig,
-    indexPattern,
-    query,
-    timeFieldName,
-    earliestMs,
-    latestMs,
-  }: {
-    analysisConfig: AnalysisConfig;
-    indexPattern: string;
-    query: any;
-    timeFieldName: string;
-    earliestMs: number;
-    latestMs: number;
-  }) {
-    const body = JSON.stringify({
+    }: {
+      indexPatternTitle: string;
+      query: any;
+      timeFieldName?: string;
+      earliest?: number;
+      latest?: number;
+      samplerShardSize?: number;
+      aggregatableFields: string[];
+      nonAggregatableFields: string[];
+    }) {
+      const body = JSON.stringify({
+        query,
+        timeFieldName,
+        earliest,
+        latest,
+        samplerShardSize,
+        aggregatableFields,
+        nonAggregatableFields,
+      });
+
+      return httpService.http<any>({
+        path: `${basePath()}/data_visualizer/get_overall_stats/${indexPatternTitle}`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    /**
+     * Gets a list of calendars
+     * @param obj
+     * @returns {Promise<Calendar[]>}
+     */
+    calendars(obj?: { calendarId?: CalendarId; calendarIds?: CalendarId[] }) {
+      const { calendarId, calendarIds } = obj || {};
+      let calendarIdsPathComponent = '';
+      if (calendarId) {
+        calendarIdsPathComponent = `/${calendarId}`;
+      } else if (calendarIds) {
+        calendarIdsPathComponent = `/${calendarIds.join(',')}`;
+      }
+      return httpService.http<Calendar[]>({
+        path: `${basePath()}/calendars${calendarIdsPathComponent}`,
+        method: 'GET',
+      });
+    },
+
+    addCalendar(obj: Calendar) {
+      const body = JSON.stringify(obj);
+      return httpService.http<any>({
+        path: `${basePath()}/calendars`,
+        method: 'PUT',
+        body,
+      });
+    },
+
+    updateCalendar(obj: UpdateCalendar) {
+      const calendarId = obj && obj.calendarId ? `/${obj.calendarId}` : '';
+      const body = JSON.stringify(obj);
+      return httpService.http<any>({
+        path: `${basePath()}/calendars${calendarId}`,
+        method: 'PUT',
+        body,
+      });
+    },
+
+    deleteCalendar({ calendarId }: { calendarId?: string }) {
+      return httpService.http<any>({
+        path: `${basePath()}/calendars/${calendarId}`,
+        method: 'DELETE',
+      });
+    },
+
+    mlNodeCount() {
+      return httpService.http<{ count: number }>({
+        path: `${basePath()}/ml_node_count`,
+        method: 'GET',
+      });
+    },
+
+    mlInfo() {
+      return httpService.http<MlInfoResponse>({
+        path: `${basePath()}/info`,
+        method: 'GET',
+      });
+    },
+
+    calculateModelMemoryLimit$({
       analysisConfig,
       indexPattern,
       query,
       timeFieldName,
       earliestMs,
       latestMs,
-    });
-
-    return http$<{ modelMemoryLimit: string }>({
-      path: `${basePath()}/validate/calculate_model_memory_limit`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  getCardinalityOfFields({
-    index,
-    fieldNames,
-    query,
-    timeFieldName,
-    earliestMs,
-    latestMs,
-  }: {
-    index: string;
-    fieldNames: string[];
-    query: any;
-    timeFieldName: string;
-    earliestMs: number;
-    latestMs: number;
-  }) {
-    const body = JSON.stringify({ index, fieldNames, query, timeFieldName, earliestMs, latestMs });
-
-    return http<any>({
-      path: `${basePath()}/fields_service/field_cardinality`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  getTimeFieldRange({
-    index,
-    timeFieldName,
-    query,
-  }: {
-    index: string;
-    timeFieldName?: string;
-    query: any;
-  }) {
-    const body = JSON.stringify({ index, timeFieldName, query });
-
-    return http<GetTimeFieldRangeResponse>({
-      path: `${basePath()}/fields_service/time_field_range`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  esSearch(obj: any) {
-    const body = JSON.stringify(obj);
-    return http<any>({
-      path: `${basePath()}/es_search`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  esSearch$(obj: any) {
-    const body = JSON.stringify(obj);
-    return http$<any>({
-      path: `${basePath()}/es_search`,
-      method: 'POST',
-      body,
-    });
-  },
-
-  getIndices() {
-    const tempBasePath = '/api';
-    return http<Array<{ name: string }>>({
-      path: `${tempBasePath}/index_management/indices`,
-      method: 'GET',
-    });
-  },
-
-  getModelSnapshots(jobId: string, snapshotId?: string) {
-    return http<GetModelSnapshotsResponse>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/model_snapshots${
-        snapshotId !== undefined ? `/${snapshotId}` : ''
-      }`,
-    });
-  },
-
-  updateModelSnapshot(
-    jobId: string,
-    snapshotId: string,
-    body: { description?: string; retain?: boolean }
-  ) {
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/model_snapshots/${snapshotId}/_update`,
-      method: 'POST',
-      body: JSON.stringify(body),
-    });
-  },
-
-  deleteModelSnapshot(jobId: string, snapshotId: string) {
-    return http<any>({
-      path: `${basePath()}/anomaly_detectors/${jobId}/model_snapshots/${snapshotId}`,
-      method: 'DELETE',
-    });
-  },
-
-  annotations,
-  dataFrameAnalytics,
-  filters,
-  results,
-  jobs,
-  fileDatavisualizer,
-};
+    }: {
+      analysisConfig: AnalysisConfig;
+      indexPattern: string;
+      query: any;
+      timeFieldName: string;
+      earliestMs: number;
+      latestMs: number;
+    }) {
+      const body = JSON.stringify({
+        analysisConfig,
+        indexPattern,
+        query,
+        timeFieldName,
+        earliestMs,
+        latestMs,
+      });
+
+      return httpService.http$<{ modelMemoryLimit: string }>({
+        path: `${basePath()}/validate/calculate_model_memory_limit`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    getCardinalityOfFields({
+      index,
+      fieldNames,
+      query,
+      timeFieldName,
+      earliestMs,
+      latestMs,
+    }: {
+      index: string;
+      fieldNames: string[];
+      query: any;
+      timeFieldName: string;
+      earliestMs: number;
+      latestMs: number;
+    }) {
+      const body = JSON.stringify({
+        index,
+        fieldNames,
+        query,
+        timeFieldName,
+        earliestMs,
+        latestMs,
+      });
+
+      return httpService.http<any>({
+        path: `${basePath()}/fields_service/field_cardinality`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    getTimeFieldRange({
+      index,
+      timeFieldName,
+      query,
+    }: {
+      index: string;
+      timeFieldName?: string;
+      query: any;
+    }) {
+      const body = JSON.stringify({ index, timeFieldName, query });
+
+      return httpService.http<GetTimeFieldRangeResponse>({
+        path: `${basePath()}/fields_service/time_field_range`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    esSearch(obj: any) {
+      const body = JSON.stringify(obj);
+      return httpService.http<any>({
+        path: `${basePath()}/es_search`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    esSearch$(obj: any) {
+      const body = JSON.stringify(obj);
+      return httpService.http$<any>({
+        path: `${basePath()}/es_search`,
+        method: 'POST',
+        body,
+      });
+    },
+
+    getIndices() {
+      const tempBasePath = '/api';
+      return httpService.http<Array<{ name: string }>>({
+        path: `${tempBasePath}/index_management/indices`,
+        method: 'GET',
+      });
+    },
+
+    getModelSnapshots(jobId: string, snapshotId?: string) {
+      return http<GetModelSnapshotsResponse>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/model_snapshots${
+          snapshotId !== undefined ? `/${snapshotId}` : ''
+        }`,
+      });
+    },
+
+    updateModelSnapshot(
+      jobId: string,
+      snapshotId: string,
+      body: { description?: string; retain?: boolean }
+    ) {
+      return http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/model_snapshots/${snapshotId}/_update`,
+        method: 'POST',
+        body: JSON.stringify(body),
+      });
+    },
+
+    deleteModelSnapshot(jobId: string, snapshotId: string) {
+      return http<any>({
+        path: `${basePath()}/anomaly_detectors/${jobId}/model_snapshots/${snapshotId}`,
+        method: 'DELETE',
+      });
+    },
+
+    annotations,
+    dataFrameAnalytics,
+    filters,
+    results: resultsApiProvider(httpService),
+    jobs,
+    fileDatavisualizer,
+  };
+}
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts
index 830e6fab4163a3..521fd306847eba 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/results.ts
@@ -5,14 +5,14 @@
  */
 
 // Service for obtaining data for the ML Results dashboards.
-import { http, http$ } from '../http_service';
+import { HttpService } from '../http_service';
 
 import { basePath } from './index';
 
 import { JobId } from '../../../../common/types/anomaly_detection_jobs';
 import { PartitionFieldsDefinition } from '../results_service/result_service_rx';
 
-export const results = {
+export const resultsApiProvider = (httpService: HttpService) => ({
   getAnomaliesTableData(
     jobIds: string[],
     criteriaFields: string[],
@@ -40,7 +40,7 @@ export const results = {
       influencersFilterQuery,
     });
 
-    return http$<any>({
+    return httpService.http$<any>({
       path: `${basePath()}/results/anomalies_table_data`,
       method: 'POST',
       body,
@@ -53,7 +53,7 @@ export const results = {
       earliestMs,
       latestMs,
     });
-    return http<any>({
+    return httpService.http<any>({
       path: `${basePath()}/results/max_anomaly_score`,
       method: 'POST',
       body,
@@ -62,7 +62,7 @@ export const results = {
 
   getCategoryDefinition(jobId: string, categoryId: string) {
     const body = JSON.stringify({ jobId, categoryId });
-    return http<any>({
+    return httpService.http<any>({
       path: `${basePath()}/results/category_definition`,
       method: 'POST',
       body,
@@ -75,7 +75,7 @@ export const results = {
       categoryIds,
       maxExamples,
     });
-    return http<any>({
+    return httpService.http<any>({
       path: `${basePath()}/results/category_examples`,
       method: 'POST',
       body,
@@ -90,10 +90,10 @@ export const results = {
     latestMs: number
   ) {
     const body = JSON.stringify({ jobId, searchTerm, criteriaFields, earliestMs, latestMs });
-    return http$<PartitionFieldsDefinition>({
+    return httpService.http$<PartitionFieldsDefinition>({
       path: `${basePath()}/results/partition_fields_values`,
       method: 'POST',
       body,
     });
   },
-};
+});
diff --git a/x-pack/plugins/ml/public/application/services/results_service/index.ts b/x-pack/plugins/ml/public/application/services/results_service/index.ts
index cc02248f4d5a9a..6c508422e70632 100644
--- a/x-pack/plugins/ml/public/application/services/results_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/results_service/index.ts
@@ -4,47 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  getMetricData,
-  getModelPlotOutput,
-  getRecordsForCriteria,
-  getScheduledEventsByBucket,
-  fetchPartitionFieldsValues,
-} from './result_service_rx';
-import {
-  getEventDistributionData,
-  getEventRateData,
-  getInfluencerValueMaxScoreByTime,
-  getOverallBucketScores,
-  getRecordInfluencers,
-  getRecordMaxScoreByTime,
-  getRecords,
-  getRecordsForDetector,
-  getRecordsForInfluencer,
-  getScoresByBucket,
-  getTopInfluencers,
-  getTopInfluencerValues,
-} from './results_service';
-
-export const mlResultsService = {
-  getScoresByBucket,
-  getScheduledEventsByBucket,
-  getTopInfluencers,
-  getTopInfluencerValues,
-  getOverallBucketScores,
-  getInfluencerValueMaxScoreByTime,
-  getRecordInfluencers,
-  getRecordsForInfluencer,
-  getRecordsForDetector,
-  getRecords,
-  getRecordsForCriteria,
-  getMetricData,
-  getEventRateData,
-  getEventDistributionData,
-  getModelPlotOutput,
-  getRecordMaxScoreByTime,
-  fetchPartitionFieldsValues,
-};
+import { resultsServiceRxProvider } from './result_service_rx';
+import { resultsServiceProvider } from './results_service';
+import { ml, MlApiServices } from '../ml_api_service';
 
 export type MlResultsService = typeof mlResultsService;
 
@@ -57,3 +19,12 @@ export interface CriteriaField {
   fieldName: string;
   fieldValue: any;
 }
+
+export const mlResultsService = mlResultsServiceProvider(ml);
+
+export function mlResultsServiceProvider(mlApiServices: MlApiServices) {
+  return {
+    ...resultsServiceProvider(mlApiServices),
+    ...resultsServiceRxProvider(mlApiServices),
+  };
+}
diff --git a/x-pack/plugins/ml/public/application/services/results_service/result_service_rx.ts b/x-pack/plugins/ml/public/application/services/results_service/result_service_rx.ts
index a21d0caaedd339..1bcbd8dbcdd639 100644
--- a/x-pack/plugins/ml/public/application/services/results_service/result_service_rx.ts
+++ b/x-pack/plugins/ml/public/application/services/results_service/result_service_rx.ts
@@ -17,7 +17,7 @@ import _ from 'lodash';
 import { Dictionary } from '../../../../common/types/common';
 import { ML_MEDIAN_PERCENTS } from '../../../../common/util/job_utils';
 import { JobId } from '../../../../common/types/anomaly_detection_jobs';
-import { ml } from '../ml_api_service';
+import { MlApiServices } from '../ml_api_service';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../../common/constants/index_patterns';
 import { CriteriaField } from './index';
 
@@ -46,524 +46,528 @@ export type PartitionFieldsDefinition = {
   [field in FieldTypes]: FieldDefinition;
 };
 
-export function getMetricData(
-  index: string,
-  entityFields: any[],
-  query: object | undefined,
-  metricFunction: string, // ES aggregation name
-  metricFieldName: string,
-  timeFieldName: string,
-  earliestMs: number,
-  latestMs: number,
-  interval: string
-): Observable<MetricData> {
-  // Build the criteria to use in the bool filter part of the request.
-  // Add criteria for the time range, entity fields,
-  // plus any additional supplied query.
-  const shouldCriteria: object[] = [];
-  const mustCriteria: object[] = [
-    {
-      range: {
-        [timeFieldName]: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
-        },
-      },
-    },
-    ...(query ? [query] : []),
-  ];
-
-  entityFields.forEach((entity) => {
-    if (entity.fieldValue.length !== 0) {
-      mustCriteria.push({
-        term: {
-          [entity.fieldName]: entity.fieldValue,
-        },
-      });
-    } else {
-      // Add special handling for blank entity field values, checking for either
-      // an empty string or the field not existing.
-      shouldCriteria.push({
-        bool: {
-          must: [
-            {
-              term: {
-                [entity.fieldName]: '',
-              },
-            },
-          ],
-        },
-      });
-      shouldCriteria.push({
-        bool: {
-          must_not: [
-            {
-              exists: { field: entity.fieldName },
-            },
-          ],
-        },
-      });
-    }
-  });
-
-  const body: any = {
-    query: {
-      bool: {
-        must: mustCriteria,
-      },
-    },
-    size: 0,
-    _source: {
-      excludes: [],
-    },
-    aggs: {
-      byTime: {
-        date_histogram: {
-          field: timeFieldName,
-          interval,
-          min_doc_count: 0,
-        },
-      },
-    },
-  };
-
-  if (shouldCriteria.length > 0) {
-    body.query.bool.should = shouldCriteria;
-    body.query.bool.minimum_should_match = shouldCriteria.length / 2;
-  }
-
-  if (metricFieldName !== undefined && metricFieldName !== '') {
-    body.aggs.byTime.aggs = {};
-
-    const metricAgg: any = {
-      [metricFunction]: {
-        field: metricFieldName,
-      },
-    };
-
-    if (metricFunction === 'percentiles') {
-      metricAgg[metricFunction].percents = [ML_MEDIAN_PERCENTS];
-    }
-    body.aggs.byTime.aggs.metric = metricAgg;
-  }
-
-  return ml.esSearch$({ index, body }).pipe(
-    map((resp: any) => {
-      const obj: MetricData = { success: true, results: {} };
-      const dataByTime = resp?.aggregations?.byTime?.buckets ?? [];
-      dataByTime.forEach((dataForTime: any) => {
-        if (metricFunction === 'count') {
-          obj.results[dataForTime.key] = dataForTime.doc_count;
-        } else {
-          const value = dataForTime?.metric?.value;
-          const values = dataForTime?.metric?.values;
-          if (dataForTime.doc_count === 0) {
-            obj.results[dataForTime.key] = null;
-          } else if (value !== undefined) {
-            obj.results[dataForTime.key] = value;
-          } else if (values !== undefined) {
-            // Percentiles agg currently returns NaN rather than null when none of the docs in the
-            // bucket contain the field used in the aggregation
-            // (see elasticsearch issue https://github.com/elastic/elasticsearch/issues/29066).
-            // Store as null, so values can be handled in the same manner downstream as other aggs
-            // (min, mean, max) which return null.
-            const medianValues = values[ML_MEDIAN_PERCENTS];
-            obj.results[dataForTime.key] = !isNaN(medianValues) ? medianValues : null;
-          } else {
-            obj.results[dataForTime.key] = null;
-          }
-        }
-      });
-
-      return obj;
-    })
-  );
-}
-
 export interface ModelPlotOutput extends ResultResponse {
   results: Record<string, any>;
 }
 
-export function getModelPlotOutput(
-  jobId: string,
-  detectorIndex: number,
-  criteriaFields: any[],
-  earliestMs: number,
-  latestMs: number,
-  interval: string,
-  aggType?: { min: any; max: any }
-): Observable<ModelPlotOutput> {
-  const obj: ModelPlotOutput = {
-    success: true,
-    results: {},
-  };
+export interface RecordsForCriteria extends ResultResponse {
+  records: any[];
+}
 
-  // if an aggType object has been passed in, use it.
-  // otherwise default to min and max aggs for the upper and lower bounds
-  const modelAggs =
-    aggType === undefined
-      ? { max: 'max', min: 'min' }
-      : {
-          max: aggType.max,
-          min: aggType.min,
-        };
+export interface ScheduledEventsByBucket extends ResultResponse {
+  events: Record<string, any>;
+}
 
-  // Build the criteria to use in the bool filter part of the request.
-  // Add criteria for the job ID and time range.
-  const mustCriteria: object[] = [
-    {
-      term: { job_id: jobId },
-    },
-    {
-      range: {
-        timestamp: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
-        },
-      },
-    },
-  ];
-
-  // Add in term queries for each of the specified criteria.
-  _.each(criteriaFields, (criteria) => {
-    mustCriteria.push({
-      term: {
-        [criteria.fieldName]: criteria.fieldValue,
-      },
-    });
-  });
-
-  // Add criteria for the detector index. Results from jobs created before 6.1 will not
-  // contain a detector_index field, so use a should criteria with a 'not exists' check.
-  const shouldCriteria = [
-    {
-      term: { detector_index: detectorIndex },
-    },
-    {
-      bool: {
-        must_not: [
-          {
-            exists: { field: 'detector_index' },
+export function resultsServiceRxProvider(mlApiServices: MlApiServices) {
+  return {
+    getMetricData(
+      index: string,
+      entityFields: any[],
+      query: object | undefined,
+      metricFunction: string, // ES aggregation name
+      metricFieldName: string,
+      timeFieldName: string,
+      earliestMs: number,
+      latestMs: number,
+      interval: string
+    ): Observable<MetricData> {
+      // Build the criteria to use in the bool filter part of the request.
+      // Add criteria for the time range, entity fields,
+      // plus any additional supplied query.
+      const shouldCriteria: object[] = [];
+      const mustCriteria: object[] = [
+        {
+          range: {
+            [timeFieldName]: {
+              gte: earliestMs,
+              lte: latestMs,
+              format: 'epoch_millis',
+            },
           },
-        ],
-      },
-    },
-  ];
+        },
+        ...(query ? [query] : []),
+      ];
+
+      entityFields.forEach((entity) => {
+        if (entity.fieldValue.length !== 0) {
+          mustCriteria.push({
+            term: {
+              [entity.fieldName]: entity.fieldValue,
+            },
+          });
+        } else {
+          // Add special handling for blank entity field values, checking for either
+          // an empty string or the field not existing.
+          shouldCriteria.push({
+            bool: {
+              must: [
+                {
+                  term: {
+                    [entity.fieldName]: '',
+                  },
+                },
+              ],
+            },
+          });
+          shouldCriteria.push({
+            bool: {
+              must_not: [
+                {
+                  exists: { field: entity.fieldName },
+                },
+              ],
+            },
+          });
+        }
+      });
 
-  return ml
-    .esSearch$({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: 0,
-      body: {
+      const body: any = {
         query: {
           bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:model_plot',
-                  analyze_wildcard: true,
-                },
-              },
-              {
-                bool: {
-                  must: mustCriteria,
-                  should: shouldCriteria,
-                  minimum_should_match: 1,
-                },
-              },
-            ],
+            must: mustCriteria,
           },
         },
+        size: 0,
+        _source: {
+          excludes: [],
+        },
         aggs: {
-          times: {
+          byTime: {
             date_histogram: {
-              field: 'timestamp',
+              field: timeFieldName,
               interval,
               min_doc_count: 0,
             },
-            aggs: {
-              actual: {
-                avg: {
-                  field: 'actual',
-                },
-              },
-              modelUpper: {
-                [modelAggs.max]: {
-                  field: 'model_upper',
-                },
-              },
-              modelLower: {
-                [modelAggs.min]: {
-                  field: 'model_lower',
-                },
-              },
-            },
           },
         },
-      },
-    })
-    .pipe(
-      map((resp) => {
-        const aggregationsByTime = _.get(resp, ['aggregations', 'times', 'buckets'], []);
-        _.each(aggregationsByTime, (dataForTime: any) => {
-          const time = dataForTime.key;
-          const modelUpper: number | undefined = _.get(dataForTime, ['modelUpper', 'value']);
-          const modelLower: number | undefined = _.get(dataForTime, ['modelLower', 'value']);
-          const actual = _.get(dataForTime, ['actual', 'value']);
-
-          obj.results[time] = {
-            actual,
-            modelUpper:
-              modelUpper === undefined || isFinite(modelUpper) === false ? null : modelUpper,
-            modelLower:
-              modelLower === undefined || isFinite(modelLower) === false ? null : modelLower,
-          };
-        });
+      };
 
-        return obj;
-      })
-    );
-}
+      if (shouldCriteria.length > 0) {
+        body.query.bool.should = shouldCriteria;
+        body.query.bool.minimum_should_match = shouldCriteria.length / 2;
+      }
 
-export interface RecordsForCriteria extends ResultResponse {
-  records: any[];
-}
+      if (metricFieldName !== undefined && metricFieldName !== '') {
+        body.aggs.byTime.aggs = {};
 
-// Queries Elasticsearch to obtain the record level results matching the given criteria,
-// for the specified job(s), time range, and record score threshold.
-// criteriaFields parameter must be an array, with each object in the array having 'fieldName'
-// 'fieldValue' properties.
-// Pass an empty array or ['*'] to search over all job IDs.
-export function getRecordsForCriteria(
-  jobIds: string[] | undefined,
-  criteriaFields: CriteriaField[],
-  threshold: any,
-  earliestMs: number,
-  latestMs: number,
-  maxResults: number | undefined
-): Observable<RecordsForCriteria> {
-  const obj: RecordsForCriteria = { success: true, records: [] };
-
-  // Build the criteria to use in the bool filter part of the request.
-  // Add criteria for the time range, record score, plus any specified job IDs.
-  const boolCriteria: any[] = [
-    {
-      range: {
-        timestamp: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
-        },
-      },
-    },
-    {
-      range: {
-        record_score: {
-          gte: threshold,
-        },
-      },
-    },
-  ];
+        const metricAgg: any = {
+          [metricFunction]: {
+            field: metricFieldName,
+          },
+        };
 
-  if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-    let jobIdFilterStr = '';
-    _.each(jobIds, (jobId, i) => {
-      if (i > 0) {
-        jobIdFilterStr += ' OR ';
+        if (metricFunction === 'percentiles') {
+          metricAgg[metricFunction].percents = [ML_MEDIAN_PERCENTS];
+        }
+        body.aggs.byTime.aggs.metric = metricAgg;
       }
-      jobIdFilterStr += 'job_id:';
-      jobIdFilterStr += jobId;
-    });
-    boolCriteria.push({
-      query_string: {
-        analyze_wildcard: false,
-        query: jobIdFilterStr,
-      },
-    });
-  }
-
-  // Add in term queries for each of the specified criteria.
-  _.each(criteriaFields, (criteria) => {
-    boolCriteria.push({
-      term: {
-        [criteria.fieldName]: criteria.fieldValue,
-      },
-    });
-  });
-
-  return ml
-    .esSearch$({
-      index: ML_RESULTS_INDEX_PATTERN,
-      rest_total_hits_as_int: true,
-      size: maxResults !== undefined ? maxResults : 100,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:record',
-                  analyze_wildcard: false,
-                },
-              },
-              {
-                bool: {
-                  must: boolCriteria,
-                },
-              },
-            ],
-          },
-        },
-        sort: [{ record_score: { order: 'desc' } }],
-      },
-    })
-    .pipe(
-      map((resp) => {
-        if (resp.hits.total !== 0) {
-          _.each(resp.hits.hits, (hit: any) => {
-            obj.records.push(hit._source);
+
+      return mlApiServices.esSearch$({ index, body }).pipe(
+        map((resp: any) => {
+          const obj: MetricData = { success: true, results: {} };
+          const dataByTime = resp?.aggregations?.byTime?.buckets ?? [];
+          dataByTime.forEach((dataForTime: any) => {
+            if (metricFunction === 'count') {
+              obj.results[dataForTime.key] = dataForTime.doc_count;
+            } else {
+              const value = dataForTime?.metric?.value;
+              const values = dataForTime?.metric?.values;
+              if (dataForTime.doc_count === 0) {
+                obj.results[dataForTime.key] = null;
+              } else if (value !== undefined) {
+                obj.results[dataForTime.key] = value;
+              } else if (values !== undefined) {
+                // Percentiles agg currently returns NaN rather than null when none of the docs in the
+                // bucket contain the field used in the aggregation
+                // (see elasticsearch issue https://github.com/elastic/elasticsearch/issues/29066).
+                // Store as null, so values can be handled in the same manner downstream as other aggs
+                // (min, mean, max) which return null.
+                const medianValues = values[ML_MEDIAN_PERCENTS];
+                obj.results[dataForTime.key] = !isNaN(medianValues) ? medianValues : null;
+              } else {
+                obj.results[dataForTime.key] = null;
+              }
+            }
           });
-        }
-        return obj;
-      })
-    );
-}
 
-export interface ScheduledEventsByBucket extends ResultResponse {
-  events: Record<string, any>;
-}
+          return obj;
+        })
+      );
+    },
 
-// Obtains a list of scheduled events by job ID and time.
-// Pass an empty array or ['*'] to search over all job IDs.
-// Returned response contains a events property, which will only
-// contains keys for jobs which have scheduled events for the specified time range.
-export function getScheduledEventsByBucket(
-  jobIds: string[] | undefined,
-  earliestMs: number,
-  latestMs: number,
-  interval: string,
-  maxJobs: number,
-  maxEvents: number
-): Observable<ScheduledEventsByBucket> {
-  const obj: ScheduledEventsByBucket = {
-    success: true,
-    events: {},
-  };
+    getModelPlotOutput(
+      jobId: string,
+      detectorIndex: number,
+      criteriaFields: any[],
+      earliestMs: number,
+      latestMs: number,
+      interval: string,
+      aggType?: { min: any; max: any }
+    ): Observable<ModelPlotOutput> {
+      const obj: ModelPlotOutput = {
+        success: true,
+        results: {},
+      };
+
+      // if an aggType object has been passed in, use it.
+      // otherwise default to min and max aggs for the upper and lower bounds
+      const modelAggs =
+        aggType === undefined
+          ? { max: 'max', min: 'min' }
+          : {
+              max: aggType.max,
+              min: aggType.min,
+            };
+
+      // Build the criteria to use in the bool filter part of the request.
+      // Add criteria for the job ID and time range.
+      const mustCriteria: object[] = [
+        {
+          term: { job_id: jobId },
+        },
+        {
+          range: {
+            timestamp: {
+              gte: earliestMs,
+              lte: latestMs,
+              format: 'epoch_millis',
+            },
+          },
+        },
+      ];
 
-  // Build the criteria to use in the bool filter part of the request.
-  // Adds criteria for the time range plus any specified job IDs.
-  const boolCriteria: any[] = [
-    {
-      range: {
-        timestamp: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
+      // Add in term queries for each of the specified criteria.
+      _.each(criteriaFields, (criteria) => {
+        mustCriteria.push({
+          term: {
+            [criteria.fieldName]: criteria.fieldValue,
+          },
+        });
+      });
+
+      // Add criteria for the detector index. Results from jobs created before 6.1 will not
+      // contain a detector_index field, so use a should criteria with a 'not exists' check.
+      const shouldCriteria = [
+        {
+          term: { detector_index: detectorIndex },
         },
-      },
-    },
-    {
-      exists: { field: 'scheduled_events' },
-    },
-  ];
-
-  if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-    let jobIdFilterStr = '';
-    _.each(jobIds, (jobId, i) => {
-      jobIdFilterStr += `${i > 0 ? ' OR ' : ''}job_id:${jobId}`;
-    });
-    boolCriteria.push({
-      query_string: {
-        analyze_wildcard: false,
-        query: jobIdFilterStr,
-      },
-    });
-  }
-
-  return ml
-    .esSearch$({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: 0,
-      body: {
-        query: {
+        {
           bool: {
-            filter: [
+            must_not: [
               {
-                query_string: {
-                  query: 'result_type:bucket',
-                  analyze_wildcard: false,
-                },
-              },
-              {
-                bool: {
-                  must: boolCriteria,
-                },
+                exists: { field: 'detector_index' },
               },
             ],
           },
         },
-        aggs: {
-          jobs: {
-            terms: {
-              field: 'job_id',
-              min_doc_count: 1,
-              size: maxJobs,
+      ];
+
+      return mlApiServices
+        .esSearch$({
+          index: ML_RESULTS_INDEX_PATTERN,
+          size: 0,
+          body: {
+            query: {
+              bool: {
+                filter: [
+                  {
+                    query_string: {
+                      query: 'result_type:model_plot',
+                      analyze_wildcard: true,
+                    },
+                  },
+                  {
+                    bool: {
+                      must: mustCriteria,
+                      should: shouldCriteria,
+                      minimum_should_match: 1,
+                    },
+                  },
+                ],
+              },
             },
             aggs: {
               times: {
                 date_histogram: {
                   field: 'timestamp',
                   interval,
-                  min_doc_count: 1,
+                  min_doc_count: 0,
                 },
                 aggs: {
-                  events: {
-                    terms: {
-                      field: 'scheduled_events',
-                      size: maxEvents,
+                  actual: {
+                    avg: {
+                      field: 'actual',
+                    },
+                  },
+                  modelUpper: {
+                    [modelAggs.max]: {
+                      field: 'model_upper',
+                    },
+                  },
+                  modelLower: {
+                    [modelAggs.min]: {
+                      field: 'model_lower',
                     },
                   },
                 },
               },
             },
           },
+        })
+        .pipe(
+          map((resp) => {
+            const aggregationsByTime = _.get(resp, ['aggregations', 'times', 'buckets'], []);
+            _.each(aggregationsByTime, (dataForTime: any) => {
+              const time = dataForTime.key;
+              const modelUpper: number | undefined = _.get(dataForTime, ['modelUpper', 'value']);
+              const modelLower: number | undefined = _.get(dataForTime, ['modelLower', 'value']);
+              const actual = _.get(dataForTime, ['actual', 'value']);
+
+              obj.results[time] = {
+                actual,
+                modelUpper:
+                  modelUpper === undefined || isFinite(modelUpper) === false ? null : modelUpper,
+                modelLower:
+                  modelLower === undefined || isFinite(modelLower) === false ? null : modelLower,
+              };
+            });
+
+            return obj;
+          })
+        );
+    },
+
+    // Queries Elasticsearch to obtain the record level results matching the given criteria,
+    // for the specified job(s), time range, and record score threshold.
+    // criteriaFields parameter must be an array, with each object in the array having 'fieldName'
+    // 'fieldValue' properties.
+    // Pass an empty array or ['*'] to search over all job IDs.
+    getRecordsForCriteria(
+      jobIds: string[] | undefined,
+      criteriaFields: CriteriaField[],
+      threshold: any,
+      earliestMs: number,
+      latestMs: number,
+      maxResults: number | undefined
+    ): Observable<RecordsForCriteria> {
+      const obj: RecordsForCriteria = { success: true, records: [] };
+
+      // Build the criteria to use in the bool filter part of the request.
+      // Add criteria for the time range, record score, plus any specified job IDs.
+      const boolCriteria: any[] = [
+        {
+          range: {
+            timestamp: {
+              gte: earliestMs,
+              lte: latestMs,
+              format: 'epoch_millis',
+            },
+          },
         },
-      },
-    })
-    .pipe(
-      map((resp) => {
-        const dataByJobId = _.get(resp, ['aggregations', 'jobs', 'buckets'], []);
-        _.each(dataByJobId, (dataForJob: any) => {
-          const jobId: string = dataForJob.key;
-          const resultsForTime: Record<string, any> = {};
-          const dataByTime = _.get(dataForJob, ['times', 'buckets'], []);
-          _.each(dataByTime, (dataForTime: any) => {
-            const time: string = dataForTime.key;
-            const events: object[] = _.get(dataForTime, ['events', 'buckets']);
-            resultsForTime[time] = _.map(events, 'key');
-          });
-          obj.events[jobId] = resultsForTime;
+        {
+          range: {
+            record_score: {
+              gte: threshold,
+            },
+          },
+        },
+      ];
+
+      if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+        let jobIdFilterStr = '';
+        _.each(jobIds, (jobId, i) => {
+          if (i > 0) {
+            jobIdFilterStr += ' OR ';
+          }
+          jobIdFilterStr += 'job_id:';
+          jobIdFilterStr += jobId;
+        });
+        boolCriteria.push({
+          query_string: {
+            analyze_wildcard: false,
+            query: jobIdFilterStr,
+          },
         });
+      }
 
-        return obj;
-      })
-    );
-}
+      // Add in term queries for each of the specified criteria.
+      _.each(criteriaFields, (criteria) => {
+        boolCriteria.push({
+          term: {
+            [criteria.fieldName]: criteria.fieldValue,
+          },
+        });
+      });
 
-export function fetchPartitionFieldsValues(
-  jobId: JobId,
-  searchTerm: Dictionary<string>,
-  criteriaFields: Array<{ fieldName: string; fieldValue: any }>,
-  earliestMs: number,
-  latestMs: number
-) {
-  return ml.results.fetchPartitionFieldsValues(
-    jobId,
-    searchTerm,
-    criteriaFields,
-    earliestMs,
-    latestMs
-  );
+      return mlApiServices
+        .esSearch$({
+          index: ML_RESULTS_INDEX_PATTERN,
+          rest_total_hits_as_int: true,
+          size: maxResults !== undefined ? maxResults : 100,
+          body: {
+            query: {
+              bool: {
+                filter: [
+                  {
+                    query_string: {
+                      query: 'result_type:record',
+                      analyze_wildcard: false,
+                    },
+                  },
+                  {
+                    bool: {
+                      must: boolCriteria,
+                    },
+                  },
+                ],
+              },
+            },
+            sort: [{ record_score: { order: 'desc' } }],
+          },
+        })
+        .pipe(
+          map((resp) => {
+            if (resp.hits.total !== 0) {
+              _.each(resp.hits.hits, (hit: any) => {
+                obj.records.push(hit._source);
+              });
+            }
+            return obj;
+          })
+        );
+    },
+
+    // Obtains a list of scheduled events by job ID and time.
+    // Pass an empty array or ['*'] to search over all job IDs.
+    // Returned response contains a events property, which will only
+    // contains keys for jobs which have scheduled events for the specified time range.
+    getScheduledEventsByBucket(
+      jobIds: string[] | undefined,
+      earliestMs: number,
+      latestMs: number,
+      interval: string,
+      maxJobs: number,
+      maxEvents: number
+    ): Observable<ScheduledEventsByBucket> {
+      const obj: ScheduledEventsByBucket = {
+        success: true,
+        events: {},
+      };
+
+      // Build the criteria to use in the bool filter part of the request.
+      // Adds criteria for the time range plus any specified job IDs.
+      const boolCriteria: any[] = [
+        {
+          range: {
+            timestamp: {
+              gte: earliestMs,
+              lte: latestMs,
+              format: 'epoch_millis',
+            },
+          },
+        },
+        {
+          exists: { field: 'scheduled_events' },
+        },
+      ];
+
+      if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+        let jobIdFilterStr = '';
+        _.each(jobIds, (jobId, i) => {
+          jobIdFilterStr += `${i > 0 ? ' OR ' : ''}job_id:${jobId}`;
+        });
+        boolCriteria.push({
+          query_string: {
+            analyze_wildcard: false,
+            query: jobIdFilterStr,
+          },
+        });
+      }
+
+      return mlApiServices
+        .esSearch$({
+          index: ML_RESULTS_INDEX_PATTERN,
+          size: 0,
+          body: {
+            query: {
+              bool: {
+                filter: [
+                  {
+                    query_string: {
+                      query: 'result_type:bucket',
+                      analyze_wildcard: false,
+                    },
+                  },
+                  {
+                    bool: {
+                      must: boolCriteria,
+                    },
+                  },
+                ],
+              },
+            },
+            aggs: {
+              jobs: {
+                terms: {
+                  field: 'job_id',
+                  min_doc_count: 1,
+                  size: maxJobs,
+                },
+                aggs: {
+                  times: {
+                    date_histogram: {
+                      field: 'timestamp',
+                      interval,
+                      min_doc_count: 1,
+                    },
+                    aggs: {
+                      events: {
+                        terms: {
+                          field: 'scheduled_events',
+                          size: maxEvents,
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        })
+        .pipe(
+          map((resp) => {
+            const dataByJobId = _.get(resp, ['aggregations', 'jobs', 'buckets'], []);
+            _.each(dataByJobId, (dataForJob: any) => {
+              const jobId: string = dataForJob.key;
+              const resultsForTime: Record<string, any> = {};
+              const dataByTime = _.get(dataForJob, ['times', 'buckets'], []);
+              _.each(dataByTime, (dataForTime: any) => {
+                const time: string = dataForTime.key;
+                const events: object[] = _.get(dataForTime, ['events', 'buckets']);
+                resultsForTime[time] = _.map(events, 'key');
+              });
+              obj.events[jobId] = resultsForTime;
+            });
+
+            return obj;
+          })
+        );
+    },
+
+    fetchPartitionFieldsValues(
+      jobId: JobId,
+      searchTerm: Dictionary<string>,
+      criteriaFields: Array<{ fieldName: string; fieldValue: any }>,
+      earliestMs: number,
+      latestMs: number
+    ) {
+      return mlApiServices.results.fetchPartitionFieldsValues(
+        jobId,
+        searchTerm,
+        criteriaFields,
+        earliestMs,
+        latestMs
+      );
+    },
+  };
 }
diff --git a/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts b/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts
index 4af08994432bdb..1b2c01ab73fcef 100644
--- a/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts
+++ b/x-pack/plugins/ml/public/application/services/results_service/results_service.d.ts
@@ -4,43 +4,49 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export function getScoresByBucket(
-  jobIds: string[],
-  earliestMs: number,
-  latestMs: number,
-  interval: string | number,
-  maxResults: number
-): Promise<any>;
-export function getTopInfluencers(): Promise<any>;
-export function getTopInfluencerValues(): Promise<any>;
-export function getOverallBucketScores(
-  jobIds: any,
-  topN: any,
-  earliestMs: any,
-  latestMs: any,
-  interval?: any
-): Promise<any>;
-export function getInfluencerValueMaxScoreByTime(
-  jobIds: string[],
-  influencerFieldName: string,
-  influencerFieldValues: string[],
-  earliestMs: number,
-  latestMs: number,
-  interval: string,
-  maxResults: number,
-  influencersFilterQuery: any
-): Promise<any>;
-export function getRecordInfluencers(): Promise<any>;
-export function getRecordsForInfluencer(): Promise<any>;
-export function getRecordsForDetector(): Promise<any>;
-export function getRecords(): Promise<any>;
-export function getEventRateData(
-  index: string,
-  query: any,
-  timeFieldName: string,
-  earliestMs: number,
-  latestMs: number,
-  interval: string | number
-): Promise<any>;
-export function getEventDistributionData(): Promise<any>;
-export function getRecordMaxScoreByTime(): Promise<any>;
+import { MlApiServices } from '../ml_api_service';
+
+export function resultsServiceProvider(
+  mlApiServices: MlApiServices
+): {
+  getScoresByBucket(
+    jobIds: string[],
+    earliestMs: number,
+    latestMs: number,
+    interval: string | number,
+    maxResults: number
+  ): Promise<any>;
+  getTopInfluencers(): Promise<any>;
+  getTopInfluencerValues(): Promise<any>;
+  getOverallBucketScores(
+    jobIds: any,
+    topN: any,
+    earliestMs: any,
+    latestMs: any,
+    interval?: any
+  ): Promise<any>;
+  getInfluencerValueMaxScoreByTime(
+    jobIds: string[],
+    influencerFieldName: string,
+    influencerFieldValues: string[],
+    earliestMs: number,
+    latestMs: number,
+    interval: string,
+    maxResults: number,
+    influencersFilterQuery: any
+  ): Promise<any>;
+  getRecordInfluencers(): Promise<any>;
+  getRecordsForInfluencer(): Promise<any>;
+  getRecordsForDetector(): Promise<any>;
+  getRecords(): Promise<any>;
+  getEventRateData(
+    index: string,
+    query: any,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number,
+    interval: string | number
+  ): Promise<any>;
+  getEventDistributionData(): Promise<any>;
+  getRecordMaxScoreByTime(): Promise<any>;
+};
diff --git a/x-pack/plugins/ml/public/application/services/results_service/results_service.js b/x-pack/plugins/ml/public/application/services/results_service/results_service.js
index 4fccc4d789370c..9e3fed189b6f48 100644
--- a/x-pack/plugins/ml/public/application/services/results_service/results_service.js
+++ b/x-pack/plugins/ml/public/application/services/results_service/results_service.js
@@ -4,1322 +4,1331 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-// Service for carrying out Elasticsearch queries to obtain data for the
-// Ml Results dashboards.
 import _ from 'lodash';
-// import d3 from 'd3';
 
 import { ML_MEDIAN_PERCENTS } from '../../../../common/util/job_utils';
 import { escapeForElasticsearchQuery } from '../../util/string_utils';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../../common/constants/index_patterns';
 
-import { ml } from '../ml_api_service';
-
-// Obtains the maximum bucket anomaly scores by job ID and time.
-// Pass an empty array or ['*'] to search over all job IDs.
-// Returned response contains a results property, with a key for job
-// which has results for the specified time range.
-export function getScoresByBucket(jobIds, earliestMs, latestMs, interval, maxResults) {
-  return new Promise((resolve, reject) => {
-    const obj = {
-      success: true,
-      results: {},
-    };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Adds criteria for the time range plus any specified job IDs.
-    const boolCriteria = [
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
-          },
-        },
-      },
-    ];
-
-    if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-      let jobIdFilterStr = '';
-      _.each(jobIds, (jobId, i) => {
-        if (i > 0) {
-          jobIdFilterStr += ' OR ';
-        }
-        jobIdFilterStr += 'job_id:';
-        jobIdFilterStr += jobId;
-      });
-      boolCriteria.push({
-        query_string: {
-          analyze_wildcard: false,
-          query: jobIdFilterStr,
-        },
-      });
-    }
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: 0,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:bucket',
-                  analyze_wildcard: false,
-                },
-              },
-              {
-                bool: {
-                  must: boolCriteria,
-                },
+/**
+ * Service for carrying out Elasticsearch queries to obtain data for the Ml Results dashboards.
+ */
+export function resultsServiceProvider(mlApiServices) {
+  const SAMPLER_TOP_TERMS_SHARD_SIZE = 20000;
+  const ENTITY_AGGREGATION_SIZE = 10;
+  const AGGREGATION_MIN_DOC_COUNT = 1;
+  const CARDINALITY_PRECISION_THRESHOLD = 100;
+
+  return {
+    // Obtains the maximum bucket anomaly scores by job ID and time.
+    // Pass an empty array or ['*'] to search over all job IDs.
+    // Returned response contains a results property, with a key for job
+    // which has results for the specified time range.
+    getScoresByBucket(jobIds, earliestMs, latestMs, interval, maxResults) {
+      return new Promise((resolve, reject) => {
+        const obj = {
+          success: true,
+          results: {},
+        };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Adds criteria for the time range plus any specified job IDs.
+        const boolCriteria = [
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
               },
-            ],
+            },
           },
-        },
-        aggs: {
-          jobId: {
-            terms: {
-              field: 'job_id',
-              size: maxResults !== undefined ? maxResults : 5,
-              order: {
-                anomalyScore: 'desc',
-              },
+        ];
+
+        if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+          let jobIdFilterStr = '';
+          _.each(jobIds, (jobId, i) => {
+            if (i > 0) {
+              jobIdFilterStr += ' OR ';
+            }
+            jobIdFilterStr += 'job_id:';
+            jobIdFilterStr += jobId;
+          });
+          boolCriteria.push({
+            query_string: {
+              analyze_wildcard: false,
+              query: jobIdFilterStr,
             },
-            aggs: {
-              anomalyScore: {
-                max: {
-                  field: 'anomaly_score',
+          });
+        }
+
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: 0,
+            body: {
+              query: {
+                bool: {
+                  filter: [
+                    {
+                      query_string: {
+                        query: 'result_type:bucket',
+                        analyze_wildcard: false,
+                      },
+                    },
+                    {
+                      bool: {
+                        must: boolCriteria,
+                      },
+                    },
+                  ],
                 },
               },
-              byTime: {
-                date_histogram: {
-                  field: 'timestamp',
-                  interval: interval,
-                  min_doc_count: 1,
-                  extended_bounds: {
-                    min: earliestMs,
-                    max: latestMs,
+              aggs: {
+                jobId: {
+                  terms: {
+                    field: 'job_id',
+                    size: maxResults !== undefined ? maxResults : 5,
+                    order: {
+                      anomalyScore: 'desc',
+                    },
                   },
-                },
-                aggs: {
-                  anomalyScore: {
-                    max: {
-                      field: 'anomaly_score',
+                  aggs: {
+                    anomalyScore: {
+                      max: {
+                        field: 'anomaly_score',
+                      },
+                    },
+                    byTime: {
+                      date_histogram: {
+                        field: 'timestamp',
+                        interval: interval,
+                        min_doc_count: 1,
+                        extended_bounds: {
+                          min: earliestMs,
+                          max: latestMs,
+                        },
+                      },
+                      aggs: {
+                        anomalyScore: {
+                          max: {
+                            field: 'anomaly_score',
+                          },
+                        },
+                      },
                     },
                   },
                 },
               },
             },
+          })
+          .then((resp) => {
+            const dataByJobId = _.get(resp, ['aggregations', 'jobId', 'buckets'], []);
+            _.each(dataByJobId, (dataForJob) => {
+              const jobId = dataForJob.key;
+
+              const resultsForTime = {};
+
+              const dataByTime = _.get(dataForJob, ['byTime', 'buckets'], []);
+              _.each(dataByTime, (dataForTime) => {
+                const value = _.get(dataForTime, ['anomalyScore', 'value']);
+                if (value !== undefined) {
+                  const time = dataForTime.key;
+                  resultsForTime[time] = _.get(dataForTime, ['anomalyScore', 'value']);
+                }
+              });
+              obj.results[jobId] = resultsForTime;
+            });
+
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
+      });
+    },
+
+    // Obtains the top influencers, by maximum influencer score, for the specified index, time range and job ID(s).
+    // Pass an empty array or ['*'] to search over all job IDs.
+    // An optional array of influencers may be supplied, with each object in the array having 'fieldName'
+    // and 'fieldValue' properties, to limit data to the supplied list of influencers.
+    // Returned response contains an influencers property, with a key for each of the influencer field names,
+    // whose value is an array of objects containing influencerFieldValue, maxAnomalyScore and sumAnomalyScore keys.
+    getTopInfluencers(
+      jobIds,
+      earliestMs,
+      latestMs,
+      maxFieldValues = 10,
+      influencers = [],
+      influencersFilterQuery
+    ) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, influencers: {} };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Adds criteria for the time range plus any specified job IDs.
+        const boolCriteria = [
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
+              },
+            },
           },
-        },
-      },
-    })
-      .then((resp) => {
-        const dataByJobId = _.get(resp, ['aggregations', 'jobId', 'buckets'], []);
-        _.each(dataByJobId, (dataForJob) => {
-          const jobId = dataForJob.key;
-
-          const resultsForTime = {};
-
-          const dataByTime = _.get(dataForJob, ['byTime', 'buckets'], []);
-          _.each(dataByTime, (dataForTime) => {
-            const value = _.get(dataForTime, ['anomalyScore', 'value']);
-            if (value !== undefined) {
-              const time = dataForTime.key;
-              resultsForTime[time] = _.get(dataForTime, ['anomalyScore', 'value']);
+          {
+            range: {
+              influencer_score: {
+                gt: 0,
+              },
+            },
+          },
+        ];
+
+        if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+          let jobIdFilterStr = '';
+          _.each(jobIds, (jobId, i) => {
+            if (i > 0) {
+              jobIdFilterStr += ' OR ';
             }
+            jobIdFilterStr += 'job_id:';
+            jobIdFilterStr += jobId;
           });
-          obj.results[jobId] = resultsForTime;
-        });
+          boolCriteria.push({
+            query_string: {
+              analyze_wildcard: false,
+              query: jobIdFilterStr,
+            },
+          });
+        }
 
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
-      });
-  });
-}
+        if (influencersFilterQuery !== undefined) {
+          boolCriteria.push(influencersFilterQuery);
+        }
 
-// Obtains the top influencers, by maximum influencer score, for the specified index, time range and job ID(s).
-// Pass an empty array or ['*'] to search over all job IDs.
-// An optional array of influencers may be supplied, with each object in the array having 'fieldName'
-// and 'fieldValue' properties, to limit data to the supplied list of influencers.
-// Returned response contains an influencers property, with a key for each of the influencer field names,
-// whose value is an array of objects containing influencerFieldValue, maxAnomalyScore and sumAnomalyScore keys.
-export function getTopInfluencers(
-  jobIds,
-  earliestMs,
-  latestMs,
-  maxFieldValues = 10,
-  influencers = [],
-  influencersFilterQuery
-) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, influencers: {} };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Adds criteria for the time range plus any specified job IDs.
-    const boolCriteria = [
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
-          },
-        },
-      },
-      {
-        range: {
-          influencer_score: {
-            gt: 0,
-          },
-        },
-      },
-    ];
-
-    if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-      let jobIdFilterStr = '';
-      _.each(jobIds, (jobId, i) => {
-        if (i > 0) {
-          jobIdFilterStr += ' OR ';
+        // Add a should query to filter for each of the specified influencers.
+        if (influencers.length > 0) {
+          boolCriteria.push({
+            bool: {
+              should: influencers.map((influencer) => {
+                return {
+                  bool: {
+                    must: [
+                      { term: { influencer_field_name: influencer.fieldName } },
+                      { term: { influencer_field_value: influencer.fieldValue } },
+                    ],
+                  },
+                };
+              }),
+              minimum_should_match: 1,
+            },
+          });
         }
-        jobIdFilterStr += 'job_id:';
-        jobIdFilterStr += jobId;
-      });
-      boolCriteria.push({
-        query_string: {
-          analyze_wildcard: false,
-          query: jobIdFilterStr,
-        },
-      });
-    }
-
-    if (influencersFilterQuery !== undefined) {
-      boolCriteria.push(influencersFilterQuery);
-    }
-
-    // Add a should query to filter for each of the specified influencers.
-    if (influencers.length > 0) {
-      boolCriteria.push({
-        bool: {
-          should: influencers.map((influencer) => {
-            return {
-              bool: {
-                must: [
-                  { term: { influencer_field_name: influencer.fieldName } },
-                  { term: { influencer_field_value: influencer.fieldValue } },
-                ],
-              },
-            };
-          }),
-          minimum_should_match: 1,
-        },
-      });
-    }
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: 0,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:influencer',
-                  analyze_wildcard: false,
-                },
-              },
-              {
+
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: 0,
+            body: {
+              query: {
                 bool: {
-                  must: boolCriteria,
-                },
-              },
-            ],
-          },
-        },
-        aggs: {
-          influencerFieldNames: {
-            terms: {
-              field: 'influencer_field_name',
-              size: 5,
-              order: {
-                maxAnomalyScore: 'desc',
-              },
-            },
-            aggs: {
-              maxAnomalyScore: {
-                max: {
-                  field: 'influencer_score',
+                  filter: [
+                    {
+                      query_string: {
+                        query: 'result_type:influencer',
+                        analyze_wildcard: false,
+                      },
+                    },
+                    {
+                      bool: {
+                        must: boolCriteria,
+                      },
+                    },
+                  ],
                 },
               },
-              influencerFieldValues: {
-                terms: {
-                  field: 'influencer_field_value',
-                  size: maxFieldValues,
-                  order: {
-                    maxAnomalyScore: 'desc',
-                  },
-                },
-                aggs: {
-                  maxAnomalyScore: {
-                    max: {
-                      field: 'influencer_score',
+              aggs: {
+                influencerFieldNames: {
+                  terms: {
+                    field: 'influencer_field_name',
+                    size: 5,
+                    order: {
+                      maxAnomalyScore: 'desc',
                     },
                   },
-                  sumAnomalyScore: {
-                    sum: {
-                      field: 'influencer_score',
+                  aggs: {
+                    maxAnomalyScore: {
+                      max: {
+                        field: 'influencer_score',
+                      },
+                    },
+                    influencerFieldValues: {
+                      terms: {
+                        field: 'influencer_field_value',
+                        size: maxFieldValues,
+                        order: {
+                          maxAnomalyScore: 'desc',
+                        },
+                      },
+                      aggs: {
+                        maxAnomalyScore: {
+                          max: {
+                            field: 'influencer_score',
+                          },
+                        },
+                        sumAnomalyScore: {
+                          sum: {
+                            field: 'influencer_score',
+                          },
+                        },
+                      },
                     },
                   },
                 },
               },
             },
-          },
-        },
-      },
-    })
-      .then((resp) => {
-        const fieldNameBuckets = _.get(
-          resp,
-          ['aggregations', 'influencerFieldNames', 'buckets'],
-          []
-        );
-        _.each(fieldNameBuckets, (nameBucket) => {
-          const fieldName = nameBucket.key;
-          const fieldValues = [];
-
-          const fieldValueBuckets = _.get(nameBucket, ['influencerFieldValues', 'buckets'], []);
-          _.each(fieldValueBuckets, (valueBucket) => {
-            const fieldValueResult = {
-              influencerFieldValue: valueBucket.key,
-              maxAnomalyScore: valueBucket.maxAnomalyScore.value,
-              sumAnomalyScore: valueBucket.sumAnomalyScore.value,
-            };
-            fieldValues.push(fieldValueResult);
-          });
-
-          obj.influencers[fieldName] = fieldValues;
-        });
-
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
-      });
-  });
-}
+          })
+          .then((resp) => {
+            const fieldNameBuckets = _.get(
+              resp,
+              ['aggregations', 'influencerFieldNames', 'buckets'],
+              []
+            );
+            _.each(fieldNameBuckets, (nameBucket) => {
+              const fieldName = nameBucket.key;
+              const fieldValues = [];
+
+              const fieldValueBuckets = _.get(nameBucket, ['influencerFieldValues', 'buckets'], []);
+              _.each(fieldValueBuckets, (valueBucket) => {
+                const fieldValueResult = {
+                  influencerFieldValue: valueBucket.key,
+                  maxAnomalyScore: valueBucket.maxAnomalyScore.value,
+                  sumAnomalyScore: valueBucket.sumAnomalyScore.value,
+                };
+                fieldValues.push(fieldValueResult);
+              });
+
+              obj.influencers[fieldName] = fieldValues;
+            });
 
-// Obtains the top influencer field values, by maximum anomaly score, for a
-// particular index, field name and job ID(s).
-// Pass an empty array or ['*'] to search over all job IDs.
-// Returned response contains a results property, which is an array of objects
-// containing influencerFieldValue, maxAnomalyScore and sumAnomalyScore keys.
-export function getTopInfluencerValues(
-  jobIds,
-  influencerFieldName,
-  earliestMs,
-  latestMs,
-  maxResults
-) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, results: [] };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Adds criteria for the time range plus any specified job IDs.
-    const boolCriteria = [
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
-          },
-        },
-      },
-    ];
-
-    if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-      let jobIdFilterStr = '';
-      _.each(jobIds, (jobId, i) => {
-        if (i > 0) {
-          jobIdFilterStr += ' OR ';
-        }
-        jobIdFilterStr += 'job_id:';
-        jobIdFilterStr += jobId;
-      });
-      boolCriteria.push({
-        query_string: {
-          analyze_wildcard: false,
-          query: jobIdFilterStr,
-        },
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
       });
-    }
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: 0,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: `result_type:influencer AND influencer_field_name: ${escapeForElasticsearchQuery(
-                    influencerFieldName
-                  )}`,
-                  analyze_wildcard: false,
-                },
+    },
+
+    // Obtains the top influencer field values, by maximum anomaly score, for a
+    // particular index, field name and job ID(s).
+    // Pass an empty array or ['*'] to search over all job IDs.
+    // Returned response contains a results property, which is an array of objects
+    // containing influencerFieldValue, maxAnomalyScore and sumAnomalyScore keys.
+    getTopInfluencerValues(jobIds, influencerFieldName, earliestMs, latestMs, maxResults) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, results: [] };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Adds criteria for the time range plus any specified job IDs.
+        const boolCriteria = [
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
               },
-              {
-                bool: {
-                  must: boolCriteria,
-                },
-              },
-            ],
+            },
           },
-        },
-        aggs: {
-          influencerFieldValues: {
-            terms: {
-              field: 'influencer_field_value',
-              size: maxResults !== undefined ? maxResults : 2,
-              order: {
-                maxAnomalyScore: 'desc',
-              },
+        ];
+
+        if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+          let jobIdFilterStr = '';
+          _.each(jobIds, (jobId, i) => {
+            if (i > 0) {
+              jobIdFilterStr += ' OR ';
+            }
+            jobIdFilterStr += 'job_id:';
+            jobIdFilterStr += jobId;
+          });
+          boolCriteria.push({
+            query_string: {
+              analyze_wildcard: false,
+              query: jobIdFilterStr,
             },
-            aggs: {
-              maxAnomalyScore: {
-                max: {
-                  field: 'influencer_score',
+          });
+        }
+
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: 0,
+            body: {
+              query: {
+                bool: {
+                  filter: [
+                    {
+                      query_string: {
+                        query: `result_type:influencer AND influencer_field_name: ${escapeForElasticsearchQuery(
+                          influencerFieldName
+                        )}`,
+                        analyze_wildcard: false,
+                      },
+                    },
+                    {
+                      bool: {
+                        must: boolCriteria,
+                      },
+                    },
+                  ],
                 },
               },
-              sumAnomalyScore: {
-                sum: {
-                  field: 'influencer_score',
+              aggs: {
+                influencerFieldValues: {
+                  terms: {
+                    field: 'influencer_field_value',
+                    size: maxResults !== undefined ? maxResults : 2,
+                    order: {
+                      maxAnomalyScore: 'desc',
+                    },
+                  },
+                  aggs: {
+                    maxAnomalyScore: {
+                      max: {
+                        field: 'influencer_score',
+                      },
+                    },
+                    sumAnomalyScore: {
+                      sum: {
+                        field: 'influencer_score',
+                      },
+                    },
+                  },
                 },
               },
             },
-          },
-        },
-      },
-    })
-      .then((resp) => {
-        const buckets = _.get(resp, ['aggregations', 'influencerFieldValues', 'buckets'], []);
-        _.each(buckets, (bucket) => {
-          const result = {
-            influencerFieldValue: bucket.key,
-            maxAnomalyScore: bucket.maxAnomalyScore.value,
-            sumAnomalyScore: bucket.sumAnomalyScore.value,
-          };
-          obj.results.push(result);
-        });
+          })
+          .then((resp) => {
+            const buckets = _.get(resp, ['aggregations', 'influencerFieldValues', 'buckets'], []);
+            _.each(buckets, (bucket) => {
+              const result = {
+                influencerFieldValue: bucket.key,
+                maxAnomalyScore: bucket.maxAnomalyScore.value,
+                sumAnomalyScore: bucket.sumAnomalyScore.value,
+              };
+              obj.results.push(result);
+            });
 
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
       });
-  });
-}
-
-// Obtains the overall bucket scores for the specified job ID(s).
-// Pass ['*'] to search over all job IDs.
-// Returned response contains a results property as an object of max score by time.
-export function getOverallBucketScores(jobIds, topN, earliestMs, latestMs, interval) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, results: {} };
-
-    ml.overallBuckets({
-      jobId: jobIds,
-      topN: topN,
-      bucketSpan: interval,
-      start: earliestMs,
-      end: latestMs,
-    })
-      .then((resp) => {
-        const dataByTime = _.get(resp, ['overall_buckets'], []);
-        _.each(dataByTime, (dataForTime) => {
-          const value = _.get(dataForTime, ['overall_score']);
-          if (value !== undefined) {
-            obj.results[dataForTime.timestamp] = value;
-          }
-        });
+    },
+
+    // Obtains the overall bucket scores for the specified job ID(s).
+    // Pass ['*'] to search over all job IDs.
+    // Returned response contains a results property as an object of max score by time.
+    getOverallBucketScores(jobIds, topN, earliestMs, latestMs, interval) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, results: {} };
+
+        mlApiServices
+          .overallBuckets({
+            jobId: jobIds,
+            topN: topN,
+            bucketSpan: interval,
+            start: earliestMs,
+            end: latestMs,
+          })
+          .then((resp) => {
+            const dataByTime = _.get(resp, ['overall_buckets'], []);
+            _.each(dataByTime, (dataForTime) => {
+              const value = _.get(dataForTime, ['overall_score']);
+              if (value !== undefined) {
+                obj.results[dataForTime.timestamp] = value;
+              }
+            });
 
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
       });
-  });
-}
-
-// Obtains the maximum score by influencer_field_value and by time for the specified job ID(s)
-// (pass an empty array or ['*'] to search over all job IDs), and specified influencer field
-// values (pass an empty array to search over all field values).
-// Returned response contains a results property with influencer field values keyed
-// against max score by time.
-export function getInfluencerValueMaxScoreByTime(
-  jobIds,
-  influencerFieldName,
-  influencerFieldValues,
-  earliestMs,
-  latestMs,
-  interval,
-  maxResults,
-  influencersFilterQuery
-) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, results: {} };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Adds criteria for the time range plus any specified job IDs.
-    const boolCriteria = [
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
+    },
+
+    // Obtains the maximum score by influencer_field_value and by time for the specified job ID(s)
+    // (pass an empty array or ['*'] to search over all job IDs), and specified influencer field
+    // values (pass an empty array to search over all field values).
+    // Returned response contains a results property with influencer field values keyed
+    // against max score by time.
+    getInfluencerValueMaxScoreByTime(
+      jobIds,
+      influencerFieldName,
+      influencerFieldValues,
+      earliestMs,
+      latestMs,
+      interval,
+      maxResults,
+      influencersFilterQuery
+    ) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, results: {} };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Adds criteria for the time range plus any specified job IDs.
+        const boolCriteria = [
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
+              },
+            },
           },
-        },
-      },
-      {
-        range: {
-          influencer_score: {
-            gt: 0,
+          {
+            range: {
+              influencer_score: {
+                gt: 0,
+              },
+            },
           },
-        },
-      },
-    ];
-
-    if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-      let jobIdFilterStr = '';
-      _.each(jobIds, (jobId, i) => {
-        if (i > 0) {
-          jobIdFilterStr += ' OR ';
-        }
-        jobIdFilterStr += `job_id:${jobId}`;
-      });
-      boolCriteria.push({
-        query_string: {
-          analyze_wildcard: false,
-          query: jobIdFilterStr,
-        },
-      });
-    }
+        ];
 
-    if (influencersFilterQuery !== undefined) {
-      boolCriteria.push(influencersFilterQuery);
-    }
+        if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+          let jobIdFilterStr = '';
+          _.each(jobIds, (jobId, i) => {
+            if (i > 0) {
+              jobIdFilterStr += ' OR ';
+            }
+            jobIdFilterStr += `job_id:${jobId}`;
+          });
+          boolCriteria.push({
+            query_string: {
+              analyze_wildcard: false,
+              query: jobIdFilterStr,
+            },
+          });
+        }
 
-    if (influencerFieldValues && influencerFieldValues.length > 0) {
-      let influencerFilterStr = '';
-      _.each(influencerFieldValues, (value, i) => {
-        if (i > 0) {
-          influencerFilterStr += ' OR ';
+        if (influencersFilterQuery !== undefined) {
+          boolCriteria.push(influencersFilterQuery);
         }
-        if (value.trim().length > 0) {
-          influencerFilterStr += `influencer_field_value:${escapeForElasticsearchQuery(value)}`;
-        } else {
-          // Wrap whitespace influencer field values in quotes for the query_string query.
-          influencerFilterStr += `influencer_field_value:"${value}"`;
+
+        if (influencerFieldValues && influencerFieldValues.length > 0) {
+          let influencerFilterStr = '';
+          _.each(influencerFieldValues, (value, i) => {
+            if (i > 0) {
+              influencerFilterStr += ' OR ';
+            }
+            if (value.trim().length > 0) {
+              influencerFilterStr += `influencer_field_value:${escapeForElasticsearchQuery(value)}`;
+            } else {
+              // Wrap whitespace influencer field values in quotes for the query_string query.
+              influencerFilterStr += `influencer_field_value:"${value}"`;
+            }
+          });
+          boolCriteria.push({
+            query_string: {
+              analyze_wildcard: false,
+              query: influencerFilterStr,
+            },
+          });
         }
-      });
-      boolCriteria.push({
-        query_string: {
-          analyze_wildcard: false,
-          query: influencerFilterStr,
-        },
-      });
-    }
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: 0,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: `result_type:influencer AND influencer_field_name: ${escapeForElasticsearchQuery(
-                    influencerFieldName
-                  )}`,
-                  analyze_wildcard: false,
+
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: 0,
+            body: {
+              query: {
+                bool: {
+                  filter: [
+                    {
+                      query_string: {
+                        query: `result_type:influencer AND influencer_field_name: ${escapeForElasticsearchQuery(
+                          influencerFieldName
+                        )}`,
+                        analyze_wildcard: false,
+                      },
+                    },
+                    {
+                      bool: {
+                        must: boolCriteria,
+                      },
+                    },
+                  ],
+                },
+              },
+              aggs: {
+                influencerFieldValues: {
+                  terms: {
+                    field: 'influencer_field_value',
+                    size: maxResults !== undefined ? maxResults : 10,
+                    order: {
+                      maxAnomalyScore: 'desc',
+                    },
+                  },
+                  aggs: {
+                    maxAnomalyScore: {
+                      max: {
+                        field: 'influencer_score',
+                      },
+                    },
+                    byTime: {
+                      date_histogram: {
+                        field: 'timestamp',
+                        interval,
+                        min_doc_count: 1,
+                      },
+                      aggs: {
+                        maxAnomalyScore: {
+                          max: {
+                            field: 'influencer_score',
+                          },
+                        },
+                      },
+                    },
+                  },
                 },
               },
-              {
+            },
+          })
+          .then((resp) => {
+            const fieldValueBuckets = _.get(
+              resp,
+              ['aggregations', 'influencerFieldValues', 'buckets'],
+              []
+            );
+            _.each(fieldValueBuckets, (valueBucket) => {
+              const fieldValue = valueBucket.key;
+              const fieldValues = {};
+
+              const timeBuckets = _.get(valueBucket, ['byTime', 'buckets'], []);
+              _.each(timeBuckets, (timeBucket) => {
+                const time = timeBucket.key;
+                const score = timeBucket.maxAnomalyScore.value;
+                fieldValues[time] = score;
+              });
+
+              obj.results[fieldValue] = fieldValues;
+            });
+
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
+      });
+    },
+
+    // Queries Elasticsearch to obtain record level results containing the influencers
+    // for the specified job(s), record score threshold, and time range.
+    // Pass an empty array or ['*'] to search over all job IDs.
+    // Returned response contains a records property, with each record containing
+    // only the fields job_id, detector_index, record_score and influencers.
+    getRecordInfluencers(jobIds, threshold, earliestMs, latestMs, maxResults) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, records: [] };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Adds criteria for the existence of the nested influencers field, time range,
+        // record score, plus any specified job IDs.
+        const boolCriteria = [
+          {
+            nested: {
+              path: 'influencers',
+              query: {
                 bool: {
-                  must: boolCriteria,
+                  must: [
+                    {
+                      exists: { field: 'influencers' },
+                    },
+                  ],
                 },
               },
-            ],
+            },
           },
-        },
-        aggs: {
-          influencerFieldValues: {
-            terms: {
-              field: 'influencer_field_value',
-              size: maxResults !== undefined ? maxResults : 10,
-              order: {
-                maxAnomalyScore: 'desc',
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
               },
             },
-            aggs: {
-              maxAnomalyScore: {
-                max: {
-                  field: 'influencer_score',
-                },
+          },
+          {
+            range: {
+              record_score: {
+                gte: threshold,
               },
-              byTime: {
-                date_histogram: {
-                  field: 'timestamp',
-                  interval,
-                  min_doc_count: 1,
-                },
-                aggs: {
-                  maxAnomalyScore: {
-                    max: {
-                      field: 'influencer_score',
+            },
+          },
+        ];
+
+        if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+          let jobIdFilterStr = '';
+          _.each(jobIds, (jobId, i) => {
+            if (i > 0) {
+              jobIdFilterStr += ' OR ';
+            }
+            jobIdFilterStr += 'job_id:';
+            jobIdFilterStr += jobId;
+          });
+          boolCriteria.push({
+            query_string: {
+              analyze_wildcard: false,
+              query: jobIdFilterStr,
+            },
+          });
+        }
+
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: maxResults !== undefined ? maxResults : 100,
+            rest_total_hits_as_int: true,
+            body: {
+              _source: ['job_id', 'detector_index', 'influencers', 'record_score'],
+              query: {
+                bool: {
+                  filter: [
+                    {
+                      query_string: {
+                        query: 'result_type:record',
+                        analyze_wildcard: false,
+                      },
                     },
-                  },
+                    {
+                      bool: {
+                        must: boolCriteria,
+                      },
+                    },
+                  ],
                 },
               },
+              sort: [{ record_score: { order: 'desc' } }],
             },
-          },
-        },
-      },
-    })
-      .then((resp) => {
-        const fieldValueBuckets = _.get(
-          resp,
-          ['aggregations', 'influencerFieldValues', 'buckets'],
-          []
-        );
-        _.each(fieldValueBuckets, (valueBucket) => {
-          const fieldValue = valueBucket.key;
-          const fieldValues = {};
-
-          const timeBuckets = _.get(valueBucket, ['byTime', 'buckets'], []);
-          _.each(timeBuckets, (timeBucket) => {
-            const time = timeBucket.key;
-            const score = timeBucket.maxAnomalyScore.value;
-            fieldValues[time] = score;
+          })
+          .then((resp) => {
+            if (resp.hits.total !== 0) {
+              _.each(resp.hits.hits, (hit) => {
+                obj.records.push(hit._source);
+              });
+            }
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
           });
+      });
+    },
+
+    // Queries Elasticsearch to obtain the record level results containing the specified influencer(s),
+    // for the specified job(s), time range, and record score threshold.
+    // influencers parameter must be an array, with each object in the array having 'fieldName'
+    // 'fieldValue' properties. The influencer array uses 'should' for the nested bool query,
+    // so this returns record level results which have at least one of the influencers.
+    // Pass an empty array or ['*'] to search over all job IDs.
+    getRecordsForInfluencer(
+      jobIds,
+      influencers,
+      threshold,
+      earliestMs,
+      latestMs,
+      maxResults,
+      influencersFilterQuery
+    ) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, records: [] };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Add criteria for the time range, record score, plus any specified job IDs.
+        const boolCriteria = [
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
+              },
+            },
+          },
+          {
+            range: {
+              record_score: {
+                gte: threshold,
+              },
+            },
+          },
+        ];
 
-          obj.results[fieldValue] = fieldValues;
-        });
+        if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
+          let jobIdFilterStr = '';
+          _.each(jobIds, (jobId, i) => {
+            if (i > 0) {
+              jobIdFilterStr += ' OR ';
+            }
+            jobIdFilterStr += 'job_id:';
+            jobIdFilterStr += jobId;
+          });
+          boolCriteria.push({
+            query_string: {
+              analyze_wildcard: false,
+              query: jobIdFilterStr,
+            },
+          });
+        }
 
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
-      });
-  });
-}
+        if (influencersFilterQuery !== undefined) {
+          boolCriteria.push(influencersFilterQuery);
+        }
 
-// Queries Elasticsearch to obtain record level results containing the influencers
-// for the specified job(s), record score threshold, and time range.
-// Pass an empty array or ['*'] to search over all job IDs.
-// Returned response contains a records property, with each record containing
-// only the fields job_id, detector_index, record_score and influencers.
-export function getRecordInfluencers(jobIds, threshold, earliestMs, latestMs, maxResults) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, records: [] };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Adds criteria for the existence of the nested influencers field, time range,
-    // record score, plus any specified job IDs.
-    const boolCriteria = [
-      {
-        nested: {
-          path: 'influencers',
-          query: {
+        // Add a nested query to filter for each of the specified influencers.
+        if (influencers.length > 0) {
+          boolCriteria.push({
             bool: {
-              must: [
-                {
-                  exists: { field: 'influencers' },
+              should: influencers.map((influencer) => {
+                return {
+                  nested: {
+                    path: 'influencers',
+                    query: {
+                      bool: {
+                        must: [
+                          {
+                            match: {
+                              'influencers.influencer_field_name': influencer.fieldName,
+                            },
+                          },
+                          {
+                            match: {
+                              'influencers.influencer_field_values': influencer.fieldValue,
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  },
+                };
+              }),
+              minimum_should_match: 1,
+            },
+          });
+        }
+
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: maxResults !== undefined ? maxResults : 100,
+            rest_total_hits_as_int: true,
+            body: {
+              query: {
+                bool: {
+                  filter: [
+                    {
+                      query_string: {
+                        query: 'result_type:record',
+                        analyze_wildcard: false,
+                      },
+                    },
+                    {
+                      bool: {
+                        must: boolCriteria,
+                      },
+                    },
+                  ],
                 },
-              ],
+              },
+              sort: [{ record_score: { order: 'desc' } }],
+            },
+          })
+          .then((resp) => {
+            if (resp.hits.total !== 0) {
+              _.each(resp.hits.hits, (hit) => {
+                obj.records.push(hit._source);
+              });
+            }
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
+      });
+    },
+
+    // Queries Elasticsearch to obtain the record level results for the specified job and detector,
+    // time range, record score threshold, and whether to only return results containing influencers.
+    // An additional, optional influencer field name and value may also be provided.
+    getRecordsForDetector(
+      jobId,
+      detectorIndex,
+      checkForInfluencers,
+      influencerFieldName,
+      influencerFieldValue,
+      threshold,
+      earliestMs,
+      latestMs,
+      maxResults
+    ) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, records: [] };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Add criteria for the time range, record score, plus any specified job IDs.
+        const boolCriteria = [
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
+              },
             },
           },
-        },
-      },
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
+          {
+            term: { job_id: jobId },
           },
-        },
-      },
-      {
-        range: {
-          record_score: {
-            gte: threshold,
+          {
+            term: { detector_index: detectorIndex },
           },
-        },
-      },
-    ];
-
-    if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-      let jobIdFilterStr = '';
-      _.each(jobIds, (jobId, i) => {
-        if (i > 0) {
-          jobIdFilterStr += ' OR ';
-        }
-        jobIdFilterStr += 'job_id:';
-        jobIdFilterStr += jobId;
-      });
-      boolCriteria.push({
-        query_string: {
-          analyze_wildcard: false,
-          query: jobIdFilterStr,
-        },
-      });
-    }
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: maxResults !== undefined ? maxResults : 100,
-      rest_total_hits_as_int: true,
-      body: {
-        _source: ['job_id', 'detector_index', 'influencers', 'record_score'],
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:record',
-                  analyze_wildcard: false,
-                },
+          {
+            range: {
+              record_score: {
+                gte: threshold,
               },
-              {
+            },
+          },
+        ];
+
+        // Add a nested query to filter for the specified influencer field name and value.
+        if (influencerFieldName && influencerFieldValue) {
+          boolCriteria.push({
+            nested: {
+              path: 'influencers',
+              query: {
                 bool: {
-                  must: boolCriteria,
+                  must: [
+                    {
+                      match: {
+                        'influencers.influencer_field_name': influencerFieldName,
+                      },
+                    },
+                    {
+                      match: {
+                        'influencers.influencer_field_values': influencerFieldValue,
+                      },
+                    },
+                  ],
                 },
               },
-            ],
-          },
-        },
-        sort: [{ record_score: { order: 'desc' } }],
-      },
-    })
-      .then((resp) => {
-        if (resp.hits.total !== 0) {
-          _.each(resp.hits.hits, (hit) => {
-            obj.records.push(hit._source);
+            },
           });
-        }
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
-      });
-  });
-}
-
-// Queries Elasticsearch to obtain the record level results containing the specified influencer(s),
-// for the specified job(s), time range, and record score threshold.
-// influencers parameter must be an array, with each object in the array having 'fieldName'
-// 'fieldValue' properties. The influencer array uses 'should' for the nested bool query,
-// so this returns record level results which have at least one of the influencers.
-// Pass an empty array or ['*'] to search over all job IDs.
-export function getRecordsForInfluencer(
-  jobIds,
-  influencers,
-  threshold,
-  earliestMs,
-  latestMs,
-  maxResults,
-  influencersFilterQuery
-) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, records: [] };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Add criteria for the time range, record score, plus any specified job IDs.
-    const boolCriteria = [
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
-          },
-        },
-      },
-      {
-        range: {
-          record_score: {
-            gte: threshold,
-          },
-        },
-      },
-    ];
-
-    if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
-      let jobIdFilterStr = '';
-      _.each(jobIds, (jobId, i) => {
-        if (i > 0) {
-          jobIdFilterStr += ' OR ';
-        }
-        jobIdFilterStr += 'job_id:';
-        jobIdFilterStr += jobId;
-      });
-      boolCriteria.push({
-        query_string: {
-          analyze_wildcard: false,
-          query: jobIdFilterStr,
-        },
-      });
-    }
-
-    if (influencersFilterQuery !== undefined) {
-      boolCriteria.push(influencersFilterQuery);
-    }
-
-    // Add a nested query to filter for each of the specified influencers.
-    if (influencers.length > 0) {
-      boolCriteria.push({
-        bool: {
-          should: influencers.map((influencer) => {
-            return {
+        } else {
+          if (checkForInfluencers === true) {
+            boolCriteria.push({
               nested: {
                 path: 'influencers',
                 query: {
                   bool: {
                     must: [
                       {
-                        match: {
-                          'influencers.influencer_field_name': influencer.fieldName,
-                        },
-                      },
-                      {
-                        match: {
-                          'influencers.influencer_field_values': influencer.fieldValue,
-                        },
+                        exists: { field: 'influencers' },
                       },
                     ],
                   },
                 },
               },
-            };
-          }),
-          minimum_should_match: 1,
-        },
-      });
-    }
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: maxResults !== undefined ? maxResults : 100,
-      rest_total_hits_as_int: true,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:record',
-                  analyze_wildcard: false,
-                },
-              },
-              {
-                bool: {
-                  must: boolCriteria,
-                },
-              },
-            ],
-          },
-        },
-        sort: [{ record_score: { order: 'desc' } }],
-      },
-    })
-      .then((resp) => {
-        if (resp.hits.total !== 0) {
-          _.each(resp.hits.hits, (hit) => {
-            obj.records.push(hit._source);
-          });
+            });
+          }
         }
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
-      });
-  });
-}
 
-// Queries Elasticsearch to obtain the record level results for the specified job and detector,
-// time range, record score threshold, and whether to only return results containing influencers.
-// An additional, optional influencer field name and value may also be provided.
-export function getRecordsForDetector(
-  jobId,
-  detectorIndex,
-  checkForInfluencers,
-  influencerFieldName,
-  influencerFieldValue,
-  threshold,
-  earliestMs,
-  latestMs,
-  maxResults
-) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, records: [] };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Add criteria for the time range, record score, plus any specified job IDs.
-    const boolCriteria = [
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
-          },
-        },
-      },
-      {
-        term: { job_id: jobId },
-      },
-      {
-        term: { detector_index: detectorIndex },
-      },
-      {
-        range: {
-          record_score: {
-            gte: threshold,
-          },
-        },
-      },
-    ];
-
-    // Add a nested query to filter for the specified influencer field name and value.
-    if (influencerFieldName && influencerFieldValue) {
-      boolCriteria.push({
-        nested: {
-          path: 'influencers',
-          query: {
-            bool: {
-              must: [
-                {
-                  match: {
-                    'influencers.influencer_field_name': influencerFieldName,
-                  },
-                },
-                {
-                  match: {
-                    'influencers.influencer_field_values': influencerFieldValue,
-                  },
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: maxResults !== undefined ? maxResults : 100,
+            rest_total_hits_as_int: true,
+            body: {
+              query: {
+                bool: {
+                  filter: [
+                    {
+                      query_string: {
+                        query: 'result_type:record',
+                        analyze_wildcard: false,
+                      },
+                    },
+                    {
+                      bool: {
+                        must: boolCriteria,
+                      },
+                    },
+                  ],
                 },
-              ],
+              },
+              sort: [{ record_score: { order: 'desc' } }],
             },
-          },
-        },
+          })
+          .then((resp) => {
+            if (resp.hits.total !== 0) {
+              _.each(resp.hits.hits, (hit) => {
+                obj.records.push(hit._source);
+              });
+            }
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
       });
-    } else {
-      if (checkForInfluencers === true) {
-        boolCriteria.push({
-          nested: {
-            path: 'influencers',
-            query: {
-              bool: {
-                must: [
-                  {
-                    exists: { field: 'influencers' },
-                  },
-                ],
+    },
+
+    // Queries Elasticsearch to obtain all the record level results for the specified job(s), time range,
+    // and record score threshold.
+    // Pass an empty array or ['*'] to search over all job IDs.
+    // Returned response contains a records property, which is an array of the matching results.
+    getRecords(jobIds, threshold, earliestMs, latestMs, maxResults) {
+      return this.getRecordsForInfluencer(jobIds, [], threshold, earliestMs, latestMs, maxResults);
+    },
+
+    // Queries Elasticsearch to obtain event rate data i.e. the count
+    // of documents over time.
+    // index can be a String, or String[], of index names to search.
+    // Extra query object can be supplied, or pass null if no additional query.
+    // Returned response contains a results property, which is an object
+    // of document counts against time (epoch millis).
+    getEventRateData(index, query, timeFieldName, earliestMs, latestMs, interval) {
+      return new Promise((resolve, reject) => {
+        const obj = { success: true, results: {} };
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Add criteria for the time range, entity fields,
+        // plus any additional supplied query.
+        const mustCriteria = [
+          {
+            range: {
+              [timeFieldName]: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
               },
             },
           },
-        });
-      }
-    }
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: maxResults !== undefined ? maxResults : 100,
-      rest_total_hits_as_int: true,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:record',
-                  analyze_wildcard: false,
+        ];
+
+        if (query) {
+          mustCriteria.push(query);
+        }
+
+        mlApiServices
+          .esSearch({
+            index,
+            rest_total_hits_as_int: true,
+            size: 0,
+            body: {
+              query: {
+                bool: {
+                  must: mustCriteria,
                 },
               },
-              {
-                bool: {
-                  must: boolCriteria,
+              _source: {
+                excludes: [],
+              },
+              aggs: {
+                eventRate: {
+                  date_histogram: {
+                    field: timeFieldName,
+                    interval: interval,
+                    min_doc_count: 0,
+                    extended_bounds: {
+                      min: earliestMs,
+                      max: latestMs,
+                    },
+                  },
                 },
               },
-            ],
-          },
-        },
-        sort: [{ record_score: { order: 'desc' } }],
-      },
-    })
-      .then((resp) => {
-        if (resp.hits.total !== 0) {
-          _.each(resp.hits.hits, (hit) => {
-            obj.records.push(hit._source);
+            },
+          })
+          .then((resp) => {
+            const dataByTimeBucket = _.get(resp, ['aggregations', 'eventRate', 'buckets'], []);
+            _.each(dataByTimeBucket, (dataForTime) => {
+              const time = dataForTime.key;
+              obj.results[time] = dataForTime.doc_count;
+            });
+            obj.total = resp.hits.total;
+
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
           });
-        }
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
       });
-  });
-}
-
-// Queries Elasticsearch to obtain all the record level results for the specified job(s), time range,
-// and record score threshold.
-// Pass an empty array or ['*'] to search over all job IDs.
-// Returned response contains a records property, which is an array of the matching results.
-export function getRecords(jobIds, threshold, earliestMs, latestMs, maxResults) {
-  return this.getRecordsForInfluencer(jobIds, [], threshold, earliestMs, latestMs, maxResults);
-}
+    },
 
-// Queries Elasticsearch to obtain event rate data i.e. the count
-// of documents over time.
-// index can be a String, or String[], of index names to search.
-// Extra query object can be supplied, or pass null if no additional query.
-// Returned response contains a results property, which is an object
-// of document counts against time (epoch millis).
-export function getEventRateData(index, query, timeFieldName, earliestMs, latestMs, interval) {
-  return new Promise((resolve, reject) => {
-    const obj = { success: true, results: {} };
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Add criteria for the time range, entity fields,
-    // plus any additional supplied query.
-    const mustCriteria = [
-      {
-        range: {
-          [timeFieldName]: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
-          },
-        },
-      },
-    ];
-
-    if (query) {
-      mustCriteria.push(query);
-    }
+    // Queries Elasticsearch to obtain event distribution i.e. the count
+    // of entities over time.
+    // index can be a String, or String[], of index names to search.
+    // Extra query object can be supplied, or pass null if no additional query.
+    // Returned response contains a results property, which is an object
+    // of document counts against time (epoch millis).
 
-    ml.esSearch({
+    getEventDistributionData(
       index,
-      rest_total_hits_as_int: true,
-      size: 0,
-      body: {
-        query: {
-          bool: {
-            must: mustCriteria,
-          },
-        },
-        _source: {
-          excludes: [],
-        },
-        aggs: {
-          eventRate: {
-            date_histogram: {
-              field: timeFieldName,
-              interval: interval,
-              min_doc_count: 0,
-              extended_bounds: {
-                min: earliestMs,
-                max: latestMs,
-              },
+      splitField,
+      filterField = null,
+      query,
+      metricFunction, // ES aggregation name
+      metricFieldName,
+      timeFieldName,
+      earliestMs,
+      latestMs,
+      interval
+    ) {
+      return new Promise((resolve, reject) => {
+        if (splitField === undefined) {
+          return resolve([]);
+        }
+
+        // Build the criteria to use in the bool filter part of the request.
+        // Add criteria for the time range, entity fields,
+        // plus any additional supplied query.
+        const mustCriteria = [];
+
+        mustCriteria.push({
+          range: {
+            [timeFieldName]: {
+              gte: earliestMs,
+              lte: latestMs,
+              format: 'epoch_millis',
             },
           },
-        },
-      },
-    })
-      .then((resp) => {
-        const dataByTimeBucket = _.get(resp, ['aggregations', 'eventRate', 'buckets'], []);
-        _.each(dataByTimeBucket, (dataForTime) => {
-          const time = dataForTime.key;
-          obj.results[time] = dataForTime.doc_count;
         });
-        obj.total = resp.hits.total;
 
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
-      });
-  });
-}
+        if (query) {
+          mustCriteria.push(query);
+        }
 
-// Queries Elasticsearch to obtain event distribution i.e. the count
-// of entities over time.
-// index can be a String, or String[], of index names to search.
-// Extra query object can be supplied, or pass null if no additional query.
-// Returned response contains a results property, which is an object
-// of document counts against time (epoch millis).
-const SAMPLER_TOP_TERMS_SHARD_SIZE = 20000;
-const ENTITY_AGGREGATION_SIZE = 10;
-const AGGREGATION_MIN_DOC_COUNT = 1;
-const CARDINALITY_PRECISION_THRESHOLD = 100;
-export function getEventDistributionData(
-  index,
-  splitField,
-  filterField = null,
-  query,
-  metricFunction, // ES aggregation name
-  metricFieldName,
-  timeFieldName,
-  earliestMs,
-  latestMs,
-  interval
-) {
-  return new Promise((resolve, reject) => {
-    if (splitField === undefined) {
-      return resolve([]);
-    }
-
-    // Build the criteria to use in the bool filter part of the request.
-    // Add criteria for the time range, entity fields,
-    // plus any additional supplied query.
-    const mustCriteria = [];
-
-    mustCriteria.push({
-      range: {
-        [timeFieldName]: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
-        },
-      },
-    });
-
-    if (query) {
-      mustCriteria.push(query);
-    }
-
-    if (filterField !== null) {
-      mustCriteria.push({
-        term: {
-          [filterField.fieldName]: filterField.fieldValue,
-        },
-      });
-    }
-
-    const body = {
-      query: {
-        // using function_score and random_score to get a random sample of documents.
-        // otherwise all documents would have the same score and the sampler aggregation
-        // would pick the first N documents instead of a random set.
-        function_score: {
-          query: {
-            bool: {
-              must: mustCriteria,
+        if (filterField !== null) {
+          mustCriteria.push({
+            term: {
+              [filterField.fieldName]: filterField.fieldValue,
             },
-          },
-          functions: [
-            {
-              random_score: {
-                // static seed to get same randomized results on every request
-                seed: 10,
-                field: '_seq_no',
+          });
+        }
+
+        const body = {
+          query: {
+            // using function_score and random_score to get a random sample of documents.
+            // otherwise all documents would have the same score and the sampler aggregation
+            // would pick the first N documents instead of a random set.
+            function_score: {
+              query: {
+                bool: {
+                  must: mustCriteria,
+                },
               },
+              functions: [
+                {
+                  random_score: {
+                    // static seed to get same randomized results on every request
+                    seed: 10,
+                    field: '_seq_no',
+                  },
+                },
+              ],
             },
-          ],
-        },
-      },
-      size: 0,
-      _source: {
-        excludes: [],
-      },
-      aggs: {
-        sample: {
-          sampler: {
-            shard_size: SAMPLER_TOP_TERMS_SHARD_SIZE,
+          },
+          size: 0,
+          _source: {
+            excludes: [],
           },
           aggs: {
-            byTime: {
-              date_histogram: {
-                field: timeFieldName,
-                interval: interval,
-                min_doc_count: AGGREGATION_MIN_DOC_COUNT,
+            sample: {
+              sampler: {
+                shard_size: SAMPLER_TOP_TERMS_SHARD_SIZE,
               },
               aggs: {
-                entities: {
-                  terms: {
-                    field: splitField.fieldName,
-                    size: ENTITY_AGGREGATION_SIZE,
+                byTime: {
+                  date_histogram: {
+                    field: timeFieldName,
+                    interval: interval,
                     min_doc_count: AGGREGATION_MIN_DOC_COUNT,
                   },
+                  aggs: {
+                    entities: {
+                      terms: {
+                        field: splitField.fieldName,
+                        size: ENTITY_AGGREGATION_SIZE,
+                        min_doc_count: AGGREGATION_MIN_DOC_COUNT,
+                      },
+                    },
+                  },
                 },
               },
             },
           },
-        },
-      },
-    };
-
-    if (metricFieldName !== undefined && metricFieldName !== '') {
-      body.aggs.sample.aggs.byTime.aggs.entities.aggs = {};
-
-      const metricAgg = {
-        [metricFunction]: {
-          field: metricFieldName,
-        },
-      };
-
-      if (metricFunction === 'percentiles') {
-        metricAgg[metricFunction].percents = [ML_MEDIAN_PERCENTS];
-      }
-
-      if (metricFunction === 'cardinality') {
-        metricAgg[metricFunction].precision_threshold = CARDINALITY_PRECISION_THRESHOLD;
-      }
-      body.aggs.sample.aggs.byTime.aggs.entities.aggs.metric = metricAgg;
-    }
-
-    ml.esSearch({
-      index,
-      body,
-      rest_total_hits_as_int: true,
-    })
-      .then((resp) => {
-        // Because of the sampling, results of metricFunctions which use sum or count
-        // can be significantly skewed. Taking into account totalHits we calculate a
-        // a factor to normalize results for these metricFunctions.
-        const totalHits = _.get(resp, ['hits', 'total'], 0);
-        const successfulShards = _.get(resp, ['_shards', 'successful'], 0);
-
-        let normalizeFactor = 1;
-        if (totalHits > successfulShards * SAMPLER_TOP_TERMS_SHARD_SIZE) {
-          normalizeFactor = totalHits / (successfulShards * SAMPLER_TOP_TERMS_SHARD_SIZE);
+        };
+
+        if (metricFieldName !== undefined && metricFieldName !== '') {
+          body.aggs.sample.aggs.byTime.aggs.entities.aggs = {};
+
+          const metricAgg = {
+            [metricFunction]: {
+              field: metricFieldName,
+            },
+          };
+
+          if (metricFunction === 'percentiles') {
+            metricAgg[metricFunction].percents = [ML_MEDIAN_PERCENTS];
+          }
+
+          if (metricFunction === 'cardinality') {
+            metricAgg[metricFunction].precision_threshold = CARDINALITY_PRECISION_THRESHOLD;
+          }
+          body.aggs.sample.aggs.byTime.aggs.entities.aggs.metric = metricAgg;
         }
 
-        const dataByTime = _.get(resp, ['aggregations', 'sample', 'byTime', 'buckets'], []);
-        const data = dataByTime.reduce((d, dataForTime) => {
-          const date = +dataForTime.key;
-          const entities = _.get(dataForTime, ['entities', 'buckets'], []);
-          entities.forEach((entity) => {
-            let value = metricFunction === 'count' ? entity.doc_count : entity.metric.value;
-
-            if (
-              metricFunction === 'count' ||
-              metricFunction === 'cardinality' ||
-              metricFunction === 'sum'
-            ) {
-              value = value * normalizeFactor;
+        mlApiServices
+          .esSearch({
+            index,
+            body,
+            rest_total_hits_as_int: true,
+          })
+          .then((resp) => {
+            // Because of the sampling, results of metricFunctions which use sum or count
+            // can be significantly skewed. Taking into account totalHits we calculate a
+            // a factor to normalize results for these metricFunctions.
+            const totalHits = _.get(resp, ['hits', 'total'], 0);
+            const successfulShards = _.get(resp, ['_shards', 'successful'], 0);
+
+            let normalizeFactor = 1;
+            if (totalHits > successfulShards * SAMPLER_TOP_TERMS_SHARD_SIZE) {
+              normalizeFactor = totalHits / (successfulShards * SAMPLER_TOP_TERMS_SHARD_SIZE);
             }
 
-            d.push({
-              date,
-              entity: entity.key,
-              value,
-            });
+            const dataByTime = _.get(resp, ['aggregations', 'sample', 'byTime', 'buckets'], []);
+            const data = dataByTime.reduce((d, dataForTime) => {
+              const date = +dataForTime.key;
+              const entities = _.get(dataForTime, ['entities', 'buckets'], []);
+              entities.forEach((entity) => {
+                let value = metricFunction === 'count' ? entity.doc_count : entity.metric.value;
+
+                if (
+                  metricFunction === 'count' ||
+                  metricFunction === 'cardinality' ||
+                  metricFunction === 'sum'
+                ) {
+                  value = value * normalizeFactor;
+                }
+
+                d.push({
+                  date,
+                  entity: entity.key,
+                  value,
+                });
+              });
+              return d;
+            }, []);
+            resolve(data);
+          })
+          .catch((resp) => {
+            reject(resp);
           });
-          return d;
-        }, []);
-        resolve(data);
-      })
-      .catch((resp) => {
-        reject(resp);
       });
-  });
-}
-
-// Queries Elasticsearch to obtain the max record score over time for the specified job,
-// criteria, time range, and aggregation interval.
-// criteriaFields parameter must be an array, with each object in the array having 'fieldName'
-// 'fieldValue' properties.
-export function getRecordMaxScoreByTime(jobId, criteriaFields, earliestMs, latestMs, interval) {
-  return new Promise((resolve, reject) => {
-    const obj = {
-      success: true,
-      results: {},
-    };
-
-    // Build the criteria to use in the bool filter part of the request.
-    const mustCriteria = [
-      {
-        range: {
-          timestamp: {
-            gte: earliestMs,
-            lte: latestMs,
-            format: 'epoch_millis',
-          },
-        },
-      },
-      { term: { job_id: jobId } },
-    ];
-
-    _.each(criteriaFields, (criteria) => {
-      mustCriteria.push({
-        term: {
-          [criteria.fieldName]: criteria.fieldValue,
-        },
-      });
-    });
-
-    ml.esSearch({
-      index: ML_RESULTS_INDEX_PATTERN,
-      size: 0,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                query_string: {
-                  query: 'result_type:record',
-                  analyze_wildcard: true,
-                },
+    },
+
+    // Queries Elasticsearch to obtain the max record score over time for the specified job,
+    // criteria, time range, and aggregation interval.
+    // criteriaFields parameter must be an array, with each object in the array having 'fieldName'
+    // 'fieldValue' properties.
+    getRecordMaxScoreByTime(jobId, criteriaFields, earliestMs, latestMs, interval) {
+      return new Promise((resolve, reject) => {
+        const obj = {
+          success: true,
+          results: {},
+        };
+
+        // Build the criteria to use in the bool filter part of the request.
+        const mustCriteria = [
+          {
+            range: {
+              timestamp: {
+                gte: earliestMs,
+                lte: latestMs,
+                format: 'epoch_millis',
               },
-              {
+            },
+          },
+          { term: { job_id: jobId } },
+        ];
+
+        _.each(criteriaFields, (criteria) => {
+          mustCriteria.push({
+            term: {
+              [criteria.fieldName]: criteria.fieldValue,
+            },
+          });
+        });
+
+        mlApiServices
+          .esSearch({
+            index: ML_RESULTS_INDEX_PATTERN,
+            size: 0,
+            body: {
+              query: {
                 bool: {
-                  must: mustCriteria,
+                  filter: [
+                    {
+                      query_string: {
+                        query: 'result_type:record',
+                        analyze_wildcard: true,
+                      },
+                    },
+                    {
+                      bool: {
+                        must: mustCriteria,
+                      },
+                    },
+                  ],
                 },
               },
-            ],
-          },
-        },
-        aggs: {
-          times: {
-            date_histogram: {
-              field: 'timestamp',
-              interval: interval,
-              min_doc_count: 1,
-            },
-            aggs: {
-              recordScore: {
-                max: {
-                  field: 'record_score',
+              aggs: {
+                times: {
+                  date_histogram: {
+                    field: 'timestamp',
+                    interval: interval,
+                    min_doc_count: 1,
+                  },
+                  aggs: {
+                    recordScore: {
+                      max: {
+                        field: 'record_score',
+                      },
+                    },
+                  },
                 },
               },
             },
-          },
-        },
-      },
-    })
-      .then((resp) => {
-        const aggregationsByTime = _.get(resp, ['aggregations', 'times', 'buckets'], []);
-        _.each(aggregationsByTime, (dataForTime) => {
-          const time = dataForTime.key;
-          obj.results[time] = {
-            score: _.get(dataForTime, ['recordScore', 'value']),
-          };
-        });
+          })
+          .then((resp) => {
+            const aggregationsByTime = _.get(resp, ['aggregations', 'times', 'buckets'], []);
+            _.each(aggregationsByTime, (dataForTime) => {
+              const time = dataForTime.key;
+              obj.results[time] = {
+                score: _.get(dataForTime, ['recordScore', 'value']),
+              };
+            });
 
-        resolve(obj);
-      })
-      .catch((resp) => {
-        reject(resp);
+            resolve(obj);
+          })
+          .catch((resp) => {
+            reject(resp);
+          });
       });
-  });
+    },
+  };
 }
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable.tsx
index b53b08e5f6146f..b4b25db452bdb7 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable.tsx
@@ -7,6 +7,7 @@
 import React from 'react';
 import ReactDOM from 'react-dom';
 import { CoreStart } from 'kibana/public';
+import { i18n } from '@kbn/i18n';
 import { Subject } from 'rxjs';
 import {
   Embeddable,
@@ -25,12 +26,19 @@ import {
   RefreshInterval,
   TimeRange,
 } from '../../../../../../src/plugins/data/common';
+import { SwimlaneType } from '../../application/explorer/explorer_constants';
 
 export const ANOMALY_SWIMLANE_EMBEDDABLE_TYPE = 'ml_anomaly_swimlane';
 
+export const getDefaultPanelTitle = (jobIds: JobId[]) =>
+  i18n.translate('xpack.ml.swimlaneEmbeddable.title', {
+    defaultMessage: 'ML anomaly swimlane for {jobIds}',
+    values: { jobIds: jobIds.join(', ') },
+  });
+
 export interface AnomalySwimlaneEmbeddableCustomInput {
   jobIds: JobId[];
-  swimlaneType: string;
+  swimlaneType: SwimlaneType;
   viewBy?: string;
   limit?: number;
 
@@ -43,9 +51,12 @@ export interface AnomalySwimlaneEmbeddableCustomInput {
 
 export type AnomalySwimlaneEmbeddableInput = EmbeddableInput & AnomalySwimlaneEmbeddableCustomInput;
 
-export interface AnomalySwimlaneEmbeddableOutput extends EmbeddableOutput {
+export type AnomalySwimlaneEmbeddableOutput = EmbeddableOutput &
+  AnomalySwimlaneEmbeddableCustomOutput;
+
+export interface AnomalySwimlaneEmbeddableCustomOutput {
   jobIds: JobId[];
-  swimlaneType: string;
+  swimlaneType: SwimlaneType;
   viewBy?: string;
   limit?: number;
 }
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts
index e86d738d8b8093..09091b21e49b6d 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_embeddable_factory.ts
@@ -23,8 +23,9 @@ import { MlStartDependencies } from '../../plugin';
 import { HttpService } from '../../application/services/http_service';
 import { AnomalyDetectorService } from '../../application/services/anomaly_detector_service';
 import { ExplorerService } from '../../application/services/explorer_service';
-import { mlResultsService } from '../../application/services/results_service';
+import { mlResultsServiceProvider } from '../../application/services/results_service';
 import { resolveAnomalySwimlaneUserInput } from './anomaly_swimlane_setup_flyout';
+import { mlApiServicesProvider } from '../../application/services/ml_api_service';
 
 export class AnomalySwimlaneEmbeddableFactory
   implements EmbeddableFactoryDefinition<AnomalySwimlaneEmbeddableInput> {
@@ -64,8 +65,7 @@ export class AnomalySwimlaneEmbeddableFactory
     const explorerService = new ExplorerService(
       pluginsStart.data.query.timefilter.timefilter,
       coreStart.uiSettings,
-      // TODO mlResultsService to use DI
-      mlResultsService
+      mlResultsServiceProvider(mlApiServicesProvider(httpService))
     );
 
     return [coreStart, pluginsStart, { anomalyDetectorService, explorerService }];
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx
index 00d47c0d897c74..4c93b9ef232391 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_initializer.tsx
@@ -20,7 +20,7 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import { SWIMLANE_TYPE } from '../../application/explorer/explorer_constants';
+import { SWIMLANE_TYPE, SwimlaneType } from '../../application/explorer/explorer_constants';
 import { AnomalySwimlaneEmbeddableInput } from './anomaly_swimlane_embeddable';
 
 export interface AnomalySwimlaneInitializerProps {
@@ -31,7 +31,7 @@ export interface AnomalySwimlaneInitializerProps {
   >;
   onCreate: (swimlaneProps: {
     panelTitle: string;
-    swimlaneType: string;
+    swimlaneType: SwimlaneType;
     viewBy?: string;
     limit?: number;
   }) => void;
@@ -51,8 +51,8 @@ export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = (
   initialInput,
 }) => {
   const [panelTitle, setPanelTitle] = useState(defaultTitle);
-  const [swimlaneType, setSwimlaneType] = useState<SWIMLANE_TYPE>(
-    (initialInput?.swimlaneType ?? SWIMLANE_TYPE.OVERALL) as SWIMLANE_TYPE
+  const [swimlaneType, setSwimlaneType] = useState(
+    initialInput?.swimlaneType ?? SWIMLANE_TYPE.OVERALL
   );
   const [viewBySwimlaneFieldName, setViewBySwimlaneFieldName] = useState(initialInput?.viewBy);
   const [limit, setLimit] = useState(initialInput?.limit ?? 5);
@@ -135,7 +135,7 @@ export const AnomalySwimlaneInitializer: FC<AnomalySwimlaneInitializerProps> = (
               })}
               options={swimlaneTypeOptions}
               idSelected={swimlaneType}
-              onChange={(id) => setSwimlaneType(id as SWIMLANE_TYPE)}
+              onChange={(id) => setSwimlaneType(id as SwimlaneType)}
             />
           </EuiFormRow>
 
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx
index 83f9833109bf45..54f50d2d3da326 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/anomaly_swimlane_setup_flyout.tsx
@@ -6,7 +6,6 @@
 
 import React from 'react';
 import { IUiSettingsClient, OverlayStart } from 'kibana/public';
-import { i18n } from '@kbn/i18n';
 import moment from 'moment';
 import { VIEW_BY_JOB_LABEL } from '../../application/explorer/explorer_constants';
 import { toMountPoint } from '../../../../../../src/plugins/kibana_react/public';
@@ -14,7 +13,10 @@ import { AnomalySwimlaneInitializer } from './anomaly_swimlane_initializer';
 import { JobSelectorFlyout } from '../../application/components/job_selector/job_selector_flyout';
 import { AnomalyDetectorService } from '../../application/services/anomaly_detector_service';
 import { getInitialGroupsMap } from '../../application/components/job_selector/job_selector';
-import { AnomalySwimlaneEmbeddableInput } from './anomaly_swimlane_embeddable';
+import {
+  AnomalySwimlaneEmbeddableInput,
+  getDefaultPanelTitle,
+} from './anomaly_swimlane_embeddable';
 
 export async function resolveAnomalySwimlaneUserInput(
   {
@@ -52,12 +54,7 @@ export async function resolveAnomalySwimlaneUserInput(
             reject();
           }}
           onSelectionConfirmed={async ({ jobIds, groups }) => {
-            const title =
-              input?.title ??
-              i18n.translate('xpack.ml.swimlaneEmbeddable.title', {
-                defaultMessage: 'ML anomaly swimlane for {jobIds}',
-                values: { jobIds: jobIds.join(', ') },
-              });
+            const title = input?.title ?? getDefaultPanelTitle(jobIds);
 
             const jobs = await anomalyDetectorService.getJobs$(jobIds).toPromise();
 
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/explorer_swimlane_container.tsx b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/explorer_swimlane_container.tsx
index e5d8584683c55b..0bba9b59f7bf73 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/explorer_swimlane_container.tsx
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/explorer_swimlane_container.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { FC, useState } from 'react';
+import React, { FC, useCallback, useState } from 'react';
 import {
   EuiCallOut,
   EuiFlexGroup,
@@ -28,6 +28,7 @@ import {
 } from './anomaly_swimlane_embeddable';
 import { MlTooltipComponent } from '../../application/components/chart_tooltip';
 import { useSwimlaneInputResolver } from './swimlane_input_resolver';
+import { SwimlaneType } from '../../application/explorer/explorer_constants';
 
 const RESIZE_THROTTLE_TIME_MS = 500;
 
@@ -54,10 +55,13 @@ export const ExplorerSwimlaneContainer: FC<ExplorerSwimlaneContainerProps> = ({
     chartWidth
   );
 
-  const onResize = throttle((e: { width: number; height: number }) => {
-    const labelWidth = 200;
-    setChartWidth(e.width - labelWidth);
-  }, RESIZE_THROTTLE_TIME_MS);
+  const onResize = useCallback(
+    throttle((e: { width: number; height: number }) => {
+      const labelWidth = 200;
+      setChartWidth(e.width - labelWidth);
+    }, RESIZE_THROTTLE_TIME_MS),
+    []
+  );
 
   if (error) {
     return (
@@ -91,14 +95,14 @@ export const ExplorerSwimlaneContainer: FC<ExplorerSwimlaneContainerProps> = ({
             <EuiSpacer size="m" />
 
             {chartWidth > 0 && swimlaneData && swimlaneType ? (
-              <EuiText color="subdued" size="s">
+              <EuiText color="subdued" size="s" data-test-subj="mlAnomalySwimlaneEmbeddableWrapper">
                 <MlTooltipComponent>
                   {(tooltipService) => (
                     <ExplorerSwimlane
                       chartWidth={chartWidth}
                       timeBuckets={timeBuckets}
                       swimlaneData={swimlaneData}
-                      swimlaneType={swimlaneType}
+                      swimlaneType={swimlaneType as SwimlaneType}
                       tooltipService={tooltipService}
                     />
                   )}
diff --git a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/swimlane_input_resolver.ts b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/swimlane_input_resolver.ts
index e704582d5d61ab..3829bbce5e5c96 100644
--- a/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/swimlane_input_resolver.ts
+++ b/x-pack/plugins/ml/public/embeddables/anomaly_swimlane/swimlane_input_resolver.ts
@@ -24,7 +24,7 @@ import {
   AnomalySwimlaneServices,
 } from './anomaly_swimlane_embeddable';
 import { MlStartDependencies } from '../../plugin';
-import { SWIMLANE_TYPE } from '../../application/explorer/explorer_constants';
+import { SWIMLANE_TYPE, SwimlaneType } from '../../application/explorer/explorer_constants';
 import { Filter } from '../../../../../../src/plugins/data/common/es_query/filters';
 import { Query } from '../../../../../../src/plugins/data/common/query';
 import { esKuery, UI_SETTINGS } from '../../../../../../src/plugins/data/public';
@@ -55,7 +55,7 @@ export function useSwimlaneInputResolver(
   const [{ uiSettings }, , { explorerService, anomalyDetectorService }] = services;
 
   const [swimlaneData, setSwimlaneData] = useState<OverallSwimlaneData>();
-  const [swimlaneType, setSwimlaneType] = useState<string>();
+  const [swimlaneType, setSwimlaneType] = useState<SwimlaneType>();
   const [error, setError] = useState<Error | null>();
 
   const chartWidth$ = useMemo(() => new Subject<number>(), []);
diff --git a/x-pack/plugins/ml/public/index.ts b/x-pack/plugins/ml/public/index.ts
index a9ffb1a5bf5792..5a956651c86d8b 100755
--- a/x-pack/plugins/ml/public/index.ts
+++ b/x-pack/plugins/ml/public/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginInitializer } from 'kibana/public';
+import { PluginInitializer, PluginInitializerContext } from 'kibana/public';
 import './index.scss';
 import {
   MlPlugin,
@@ -19,7 +19,7 @@ export const plugin: PluginInitializer<
   MlPluginStart,
   MlSetupDependencies,
   MlStartDependencies
-> = () => new MlPlugin();
+> = (initializerContext: PluginInitializerContext) => new MlPlugin(initializerContext);
 
 export { MlPluginSetup, MlPluginStart };
 export * from './shared';
diff --git a/x-pack/plugins/ml/public/plugin.ts b/x-pack/plugins/ml/public/plugin.ts
index fe9f602bc3637e..be2ebb3caa4161 100644
--- a/x-pack/plugins/ml/public/plugin.ts
+++ b/x-pack/plugins/ml/public/plugin.ts
@@ -5,7 +5,13 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { Plugin, CoreStart, CoreSetup, AppMountParameters } from 'kibana/public';
+import {
+  Plugin,
+  CoreStart,
+  CoreSetup,
+  AppMountParameters,
+  PluginInitializerContext,
+} from 'kibana/public';
 import { ManagementSetup } from 'src/plugins/management/public';
 import { SharePluginStart } from 'src/plugins/share/public';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
@@ -38,9 +44,13 @@ export interface MlSetupDependencies {
   home: HomePublicPluginSetup;
   embeddable: EmbeddableSetup;
   uiActions: UiActionsSetup;
+  kibanaVersion: string;
+  share: SharePluginStart;
 }
 
 export class MlPlugin implements Plugin<MlPluginSetup, MlPluginStart> {
+  constructor(private initializerContext: PluginInitializerContext) {}
+
   setup(core: CoreSetup<MlStartDependencies, MlPluginStart>, pluginsSetup: MlSetupDependencies) {
     core.application.register({
       id: PLUGIN_ID,
@@ -53,6 +63,7 @@ export class MlPlugin implements Plugin<MlPluginSetup, MlPluginStart> {
       category: DEFAULT_APP_CATEGORIES.kibana,
       mount: async (params: AppMountParameters) => {
         const [coreStart, pluginsStart] = await core.getStartServices();
+        const kibanaVersion = this.initializerContext.env.packageInfo.version;
         const { renderApp } = await import('./application/app');
         return renderApp(
           coreStart,
@@ -67,6 +78,7 @@ export class MlPlugin implements Plugin<MlPluginSetup, MlPluginStart> {
             home: pluginsSetup.home,
             embeddable: pluginsSetup.embeddable,
             uiActions: pluginsSetup.uiActions,
+            kibanaVersion,
           },
           {
             element: params.element,
diff --git a/x-pack/plugins/security_solution/common/types/timeline/index.ts b/x-pack/plugins/security_solution/common/types/timeline/index.ts
index e67eb3182ffa99..4f255bb6d68341 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/index.ts
@@ -197,6 +197,32 @@ export interface SavedTimeline extends runtimeTypes.TypeOf<typeof SavedTimelineR
 
 export interface SavedTimelineNote extends runtimeTypes.TypeOf<typeof SavedTimelineRuntimeType> {}
 
+/*
+ *  Timeline IDs
+ */
+
+export enum TimelineId {
+  hostsPageEvents = 'hosts-page-events',
+  hostsPageExternalAlerts = 'hosts-page-external-alerts',
+  alertsRulesDetailsPage = 'alerts-rules-details-page',
+  alertsPage = 'alerts-page',
+  networkPageExternalAlerts = 'network-page-external-alerts',
+  active = 'timeline-1',
+  test = 'test', // Reserved for testing purposes
+}
+
+export const TimelineIdLiteralRt = runtimeTypes.union([
+  runtimeTypes.literal(TimelineId.hostsPageEvents),
+  runtimeTypes.literal(TimelineId.hostsPageExternalAlerts),
+  runtimeTypes.literal(TimelineId.alertsRulesDetailsPage),
+  runtimeTypes.literal(TimelineId.alertsPage),
+  runtimeTypes.literal(TimelineId.networkPageExternalAlerts),
+  runtimeTypes.literal(TimelineId.active),
+  runtimeTypes.literal(TimelineId.test),
+]);
+
+export type TimelineIdLiteral = runtimeTypes.TypeOf<typeof TimelineIdLiteralRt>;
+
 /**
  * Timeline Saved object type with metadata
  */
diff --git a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
index 82395de91abfa9..b2d35f3f0c3361 100644
--- a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
@@ -29,12 +29,12 @@ import {
   dragAndDropColumn,
   openEventsViewerFieldsBrowser,
   opensInspectQueryModal,
-  resetFields,
   waitsForEventsToBeLoaded,
 } from '../tasks/hosts/events';
 import { clearSearchBar, kqlSearch } from '../tasks/security_header';
 
 import { HOSTS_PAGE } from '../urls/navigation';
+import { resetFields } from '../tasks/timeline';
 
 const defaultHeadersInDefaultEcsCategory = [
   { id: '@timestamp' },
diff --git a/x-pack/plugins/security_solution/cypress/integration/timeline_local_storage.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timeline_local_storage.spec.ts
new file mode 100644
index 00000000000000..a4352f58e6fc74
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/integration/timeline_local_storage.spec.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { reload } from '../tasks/common';
+import { loginAndWaitForPage } from '../tasks/login';
+import { HOSTS_PAGE } from '../urls/navigation';
+import { openEvents } from '../tasks/hosts/main';
+import { DRAGGABLE_HEADER } from '../screens/timeline';
+import { TABLE_COLUMN_EVENTS_MESSAGE } from '../screens/hosts/external_events';
+import { waitsForEventsToBeLoaded, openEventsViewerFieldsBrowser } from '../tasks/hosts/events';
+import { removeColumn, resetFields } from '../tasks/timeline';
+
+describe('persistent timeline', () => {
+  before(() => {
+    loginAndWaitForPage(HOSTS_PAGE);
+    openEvents();
+    waitsForEventsToBeLoaded();
+  });
+
+  afterEach(() => {
+    openEventsViewerFieldsBrowser();
+    resetFields();
+  });
+
+  it('persist the deletion of a column', () => {
+    cy.get(DRAGGABLE_HEADER).then((header) => {
+      const currentNumberOfTimelineColumns = header.length;
+      const expectedNumberOfTimelineColumns = currentNumberOfTimelineColumns - 1;
+
+      cy.wrap(header).eq(TABLE_COLUMN_EVENTS_MESSAGE).invoke('text').should('equal', 'message');
+      removeColumn(TABLE_COLUMN_EVENTS_MESSAGE);
+
+      cy.get(DRAGGABLE_HEADER).should('have.length', expectedNumberOfTimelineColumns);
+
+      reload(waitsForEventsToBeLoaded);
+
+      cy.get(DRAGGABLE_HEADER).should('have.length', expectedNumberOfTimelineColumns);
+      cy.get(DRAGGABLE_HEADER).each(($el) => {
+        expect($el.text()).not.equal('message');
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts b/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts
index ed46a90c872c8f..a946fefe273e10 100644
--- a/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/hosts/events.ts
@@ -36,7 +36,4 @@ export const LOCAL_EVENTS_COUNT =
 export const LOAD_MORE =
   '[data-test-subj="events-viewer-panel"] [data-test-subj="TimelineMoreButton"';
 
-export const RESET_FIELDS =
-  '[data-test-subj="events-viewer-panel"] [data-test-subj="reset-fields"]';
-
 export const SERVER_SIDE_EVENT_COUNT = '[data-test-subj="server-side-event-count"]';
diff --git a/x-pack/plugins/security_solution/cypress/screens/hosts/external_events.ts b/x-pack/plugins/security_solution/cypress/screens/hosts/external_events.ts
new file mode 100644
index 00000000000000..982e1ea378e703
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/screens/hosts/external_events.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const TABLE_COLUMN_EVENTS_MESSAGE = 1;
diff --git a/x-pack/plugins/security_solution/cypress/screens/timeline.ts b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
index bb232b752994ae..c673cf34b6daeb 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
@@ -21,6 +21,11 @@ export const ID_TOGGLE_FIELD = '[data-test-subj="toggle-field-_id"]';
 
 export const PROVIDER_BADGE = '[data-test-subj="providerBadge"]';
 
+export const REMOVE_COLUMN = '[data-test-subj="remove-column"]';
+
+export const RESET_FIELDS =
+  '[data-test-subj="events-viewer-panel"] [data-test-subj="reset-fields"]';
+
 export const SEARCH_OR_FILTER_CONTAINER =
   '[data-test-subj="timeline-search-or-filter-search-container"]';
 
@@ -30,6 +35,8 @@ export const TIMELINE = (id: string) => {
   return `[data-test-subj="title-${id}"]`;
 };
 
+export const TIMELINE_COLUMN_SPINNER = '[data-test-subj="timeline-loading-spinner"]';
+
 export const TIMELINE_DATA_PROVIDERS = '[data-test-subj="dataProviders"]';
 
 export const TIMELINE_DATA_PROVIDERS_EMPTY =
diff --git a/x-pack/plugins/security_solution/cypress/tasks/common.ts b/x-pack/plugins/security_solution/cypress/tasks/common.ts
index b0c64214459f0b..a385ad78f63b7b 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/common.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/common.ts
@@ -48,3 +48,9 @@ export const drop = (dropTarget: JQuery<HTMLElement>) => {
     .trigger('mouseup', { force: true })
     .wait(1000);
 };
+
+export const reload = (afterReload: () => void) => {
+  cy.reload();
+  cy.contains('a', 'Security');
+  afterReload();
+};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts b/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts
index a5936509892596..57c819d9678835 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/hosts/events.ts
@@ -13,7 +13,6 @@ import {
   HOST_GEO_COUNTRY_NAME_CHECKBOX,
   INSPECT_QUERY,
   LOAD_MORE,
-  RESET_FIELDS,
   SERVER_SIDE_EVENT_COUNT,
 } from '../../screens/hosts/events';
 import { DRAGGABLE_HEADER } from '../../screens/timeline';
@@ -53,10 +52,6 @@ export const opensInspectQueryModal = () => {
     .click({ force: true });
 };
 
-export const resetFields = () => {
-  cy.get(RESET_FIELDS).click({ force: true });
-};
-
 export const waitsForEventsToBeLoaded = () => {
   cy.get(SERVER_SIDE_EVENT_COUNT).should('exist').invoke('text').should('not.equal', '0');
 };
diff --git a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
index 38da611428b2ef..9e17433090c2bb 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/timeline.ts
@@ -21,6 +21,8 @@ import {
   TIMELINE_TITLE,
   TIMESTAMP_TOGGLE_FIELD,
   TOGGLE_TIMELINE_EXPAND_EVENT,
+  REMOVE_COLUMN,
+  RESET_FIELDS,
 } from '../screens/timeline';
 
 import { drag, drop } from '../tasks/common';
@@ -101,3 +103,12 @@ export const dragAndDropIdToggleFieldToTimeline = () => {
     drop(headersDropArea)
   );
 };
+
+export const removeColumn = (column: number) => {
+  cy.get(REMOVE_COLUMN).first().should('exist');
+  cy.get(REMOVE_COLUMN).eq(column).click({ force: true });
+};
+
+export const resetFields = () => {
+  cy.get(RESET_FIELDS).click({ force: true });
+};
diff --git a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx
index 51fdd828bcddb3..f843bf68818465 100644
--- a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.test.tsx
@@ -7,12 +7,14 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 
+import { TimelineId } from '../../../../common/types/timeline';
 import { AlertsTableComponent } from './index';
 
 describe('AlertsTableComponent', () => {
   it('renders correctly', () => {
     const wrapper = shallow(
       <AlertsTableComponent
+        timelineId={TimelineId.test}
         canUserCRUD
         hasIndexWrite
         from={0}
diff --git a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx
index 0765d860618669..ba6102312fef67 100644
--- a/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/components/alerts_table/index.tsx
@@ -12,6 +12,7 @@ import { Dispatch } from 'redux';
 
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
 import { Filter, esQuery } from '../../../../../../../src/plugins/data/public';
+import { TimelineIdLiteral } from '../../../../common/types/timeline';
 import { useFetchIndexPatterns } from '../../../alerts/containers/detection_engine/rules/fetch_index_patterns';
 import { StatefulEventsViewer } from '../../../common/components/events_viewer';
 import { HeaderSection } from '../../../common/components/header_section';
@@ -48,9 +49,8 @@ import {
   displayErrorToast,
 } from '../../../common/components/toasters';
 
-export const ALERTS_TABLE_TIMELINE_ID = 'alerts-table';
-
 interface OwnProps {
+  timelineId: TimelineIdLiteral;
   canUserCRUD: boolean;
   defaultFilters?: Filter[];
   hasIndexWrite: boolean;
@@ -63,6 +63,7 @@ interface OwnProps {
 type AlertsTableComponentProps = OwnProps & PropsFromRedux;
 
 export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
+  timelineId,
   canUserCRUD,
   clearEventsDeleted,
   clearEventsLoading,
@@ -140,18 +141,16 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
 
   const setEventsLoadingCallback = useCallback(
     ({ eventIds, isLoading }: SetEventsLoadingProps) => {
-      setEventsLoading!({ id: ALERTS_TABLE_TIMELINE_ID, eventIds, isLoading });
+      setEventsLoading!({ id: timelineId, eventIds, isLoading });
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [setEventsLoading, ALERTS_TABLE_TIMELINE_ID]
+    [setEventsLoading, timelineId]
   );
 
   const setEventsDeletedCallback = useCallback(
     ({ eventIds, isDeleted }: SetEventsDeletedProps) => {
-      setEventsDeleted!({ id: ALERTS_TABLE_TIMELINE_ID, eventIds, isDeleted });
+      setEventsDeleted!({ id: timelineId, eventIds, isDeleted });
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [setEventsDeleted, ALERTS_TABLE_TIMELINE_ID]
+    [setEventsDeleted, timelineId]
   );
 
   const onAlertStatusUpdateSuccess = useCallback(
@@ -202,20 +201,20 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   // Callback for when open/closed filter changes
   const onFilterGroupChangedCallback = useCallback(
     (newFilterGroup: Status) => {
-      clearEventsLoading!({ id: ALERTS_TABLE_TIMELINE_ID });
-      clearEventsDeleted!({ id: ALERTS_TABLE_TIMELINE_ID });
-      clearSelected!({ id: ALERTS_TABLE_TIMELINE_ID });
+      clearEventsLoading!({ id: timelineId });
+      clearEventsDeleted!({ id: timelineId });
+      clearSelected!({ id: timelineId });
       setFilterGroup(newFilterGroup);
     },
-    [clearEventsLoading, clearEventsDeleted, clearSelected, setFilterGroup]
+    [clearEventsLoading, clearEventsDeleted, clearSelected, setFilterGroup, timelineId]
   );
 
   // Callback for clearing entire selection from utility bar
   const clearSelectionCallback = useCallback(() => {
-    clearSelected!({ id: ALERTS_TABLE_TIMELINE_ID });
+    clearSelected!({ id: timelineId });
     setSelectAll(false);
     setShowClearSelectionAction(false);
-  }, [clearSelected, setSelectAll, setShowClearSelectionAction]);
+  }, [clearSelected, setSelectAll, setShowClearSelectionAction, timelineId]);
 
   // Callback for selecting all events on all pages from utility bar
   // Dispatches to stateful_body's selectAll via TimelineTypeContext props
@@ -327,7 +326,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
 
   useEffect(() => {
     initializeTimeline({
-      id: ALERTS_TABLE_TIMELINE_ID,
+      id: timelineId,
       documentType: i18n.ALERTS_DOCUMENT_TYPE,
       footerText: i18n.TOTAL_COUNT_OF_ALERTS,
       loadingText: i18n.LOADING_ALERTS,
@@ -338,7 +337,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   }, []);
   useEffect(() => {
     setTimelineRowActions({
-      id: ALERTS_TABLE_TIMELINE_ID,
+      id: timelineId,
       queryFields: requiredFieldsForActions,
       timelineRowActions: additionalActions,
     });
@@ -365,7 +364,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
       defaultModel={alertsDefaultModel}
       end={to}
       headerFilterGroup={headerFilterGroup}
-      id={ALERTS_TABLE_TIMELINE_ID}
+      id={timelineId}
       start={from}
       utilityBar={utilityBarCallback}
     />
@@ -375,9 +374,9 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
 const makeMapStateToProps = () => {
   const getTimeline = timelineSelectors.getTimelineByIdSelector();
   const getGlobalInputs = inputsSelectors.globalSelector();
-  const mapStateToProps = (state: State) => {
-    const timeline: TimelineModel =
-      getTimeline(state, ALERTS_TABLE_TIMELINE_ID) ?? timelineDefaults;
+  const mapStateToProps = (state: State, ownProps: OwnProps) => {
+    const { timelineId } = ownProps;
+    const timeline: TimelineModel = getTimeline(state, timelineId) ?? timelineDefaults;
     const { deletedEventIds, isSelectAllChecked, loadingEventIds, selectedEventIds } = timeline;
 
     const globalInputs: inputsModel.InputsRange = getGlobalInputs(state);
diff --git a/x-pack/plugins/security_solution/public/alerts/index.ts b/x-pack/plugins/security_solution/public/alerts/index.ts
index c1501419a1cf6f..1409ad4f54696c 100644
--- a/x-pack/plugins/security_solution/public/alerts/index.ts
+++ b/x-pack/plugins/security_solution/public/alerts/index.ts
@@ -4,15 +4,26 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Storage } from '../../../../../src/plugins/kibana_utils/public';
+import { getTimelinesInStorageByIds } from '../timelines/containers/local_storage';
+import { TimelineIdLiteral, TimelineId } from '../../common/types/timeline';
 import { getAlertsRoutes } from './routes';
 import { SecuritySubPlugin } from '../app/types';
 
+const ALERTS_TIMELINE_IDS: TimelineIdLiteral[] = [
+  TimelineId.alertsRulesDetailsPage,
+  TimelineId.alertsPage,
+];
+
 export class Alerts {
   public setup() {}
 
-  public start(): SecuritySubPlugin {
+  public start(storage: Storage): SecuritySubPlugin {
     return {
       routes: getAlertsRoutes(),
+      storageTimelines: {
+        timelineById: getTimelinesInStorageByIds(storage, ALERTS_TIMELINE_IDS),
+      },
     };
   }
 }
diff --git a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx
index e3eb4666522ad6..9e1c9db168bdaf 100644
--- a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/detection_engine.tsx
@@ -9,6 +9,7 @@ import React, { useCallback, useMemo } from 'react';
 import { StickyContainer } from 'react-sticky';
 import { connect, ConnectedProps } from 'react-redux';
 
+import { TimelineId } from '../../../../common/types/timeline';
 import { GlobalTime } from '../../../common/containers/global_time';
 import {
   indicesExistOrDataTemporarilyUnavailable,
@@ -138,6 +139,7 @@ export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
                         />
                         <EuiSpacer size="l" />
                         <AlertsTable
+                          timelineId={TimelineId.alertsPage}
                           loading={loading}
                           hasIndexWrite={hasIndexWrite ?? false}
                           canUserCRUD={(canUserCRUD ?? false) && (hasEncryptionKey ?? false)}
diff --git a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx
index 0021cd2f20a4bc..d06103bd887f75 100644
--- a/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx
@@ -24,6 +24,7 @@ import { Redirect, useParams } from 'react-router-dom';
 import { StickyContainer } from 'react-sticky';
 import { connect, ConnectedProps } from 'react-redux';
 
+import { TimelineId } from '../../../../../../common/types/timeline';
 import { UpdateDateRange } from '../../../../../common/components/charts/common';
 import { FiltersGlobal } from '../../../../../common/components/filters_global';
 import { FormattedDate } from '../../../../../common/components/formatted_date';
@@ -386,6 +387,7 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
                         <EuiSpacer />
                         {ruleId != null && (
                           <AlertsTable
+                            timelineId={TimelineId.alertsRulesDetailsPage}
                             canUserCRUD={canUserCRUD ?? false}
                             defaultFilters={alertDefaultFilters}
                             hasIndexWrite={hasIndexWrite ?? false}
diff --git a/x-pack/plugins/security_solution/public/app/app.tsx b/x-pack/plugins/security_solution/public/app/app.tsx
index 50a24ef012b8b9..b5696c889d16e8 100644
--- a/x-pack/plugins/security_solution/public/app/app.tsx
+++ b/x-pack/plugins/security_solution/public/app/app.tsx
@@ -72,9 +72,10 @@ const AppPluginRoot = memo(AppPluginRootComponent);
 
 interface StartAppComponent extends AppFrontendLibs {
   subPlugins: SecuritySubPlugins;
+  storage: Storage;
 }
 
-const StartAppComponent: FC<StartAppComponent> = ({ subPlugins, ...libs }) => {
+const StartAppComponent: FC<StartAppComponent> = ({ subPlugins, storage, ...libs }) => {
   const { routes: subPluginRoutes, store: subPluginsStore } = subPlugins;
   const { i18n } = useKibana().services;
   const history = createHashHistory();
@@ -84,6 +85,7 @@ const StartAppComponent: FC<StartAppComponent> = ({ subPlugins, ...libs }) => {
     createInitialState(subPluginsStore.initialState),
     subPluginsStore.reducer,
     libs$.pipe(pluck('apolloClient')),
+    storage,
     subPluginsStore.middlewares
   );
 
@@ -118,16 +120,17 @@ interface SiemAppComponentProps {
   subPlugins: SecuritySubPlugins;
 }
 
-const SiemAppComponent: React.FC<SiemAppComponentProps> = ({ services, subPlugins }) => (
-  <KibanaContextProvider
-    services={{
-      appName: 'siem',
-      storage: new Storage(localStorage),
-      ...services,
-    }}
-  >
-    <StartApp subPlugins={subPlugins} {...compose(services)} />
-  </KibanaContextProvider>
-);
+const SiemAppComponent: React.FC<SiemAppComponentProps> = ({ services, subPlugins }) => {
+  return (
+    <KibanaContextProvider
+      services={{
+        appName: 'siem',
+        ...services,
+      }}
+    >
+      <StartApp subPlugins={subPlugins} storage={services.storage} {...compose(services)} />
+    </KibanaContextProvider>
+  );
+};
 
 export const SiemApp = memo(SiemAppComponent);
diff --git a/x-pack/plugins/security_solution/public/app/types.ts b/x-pack/plugins/security_solution/public/app/types.ts
index 4b00dee3b75108..7a905b35710c99 100644
--- a/x-pack/plugins/security_solution/public/app/types.ts
+++ b/x-pack/plugins/security_solution/public/app/types.ts
@@ -18,6 +18,7 @@ import { NavTab } from '../common/components/navigation/types';
 import { State, SubPluginsInitReducer } from '../common/store';
 import { Immutable } from '../../common/endpoint/types';
 import { AppAction } from '../common/store/actions';
+import { TimelineState } from '../timelines/store/timeline/types';
 
 export enum SiemPageName {
   overview = 'overview',
@@ -48,6 +49,7 @@ export interface SecuritySubPluginStore<K extends SecuritySubPluginKeyStore, T>
 
 export interface SecuritySubPlugin {
   routes: React.ReactElement[];
+  storageTimelines?: Pick<TimelineState, 'timelineById'>;
 }
 
 type SecuritySubPluginKeyStore =
diff --git a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
index 18c0032f58c3c3..c7015ed81701ef 100644
--- a/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/add_filter_to_global_search_bar/index.test.tsx
@@ -12,6 +12,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createStore, State } from '../../store';
 import { AddFilterToGlobalSearchBar } from '.';
@@ -33,10 +34,11 @@ jest.mock('../../lib/kibana', () => ({
 
 describe('AddFilterToGlobalSearchBar Component', () => {
   const state: State = mockGlobalState;
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     mockAddFilters.mockClear();
   });
 
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
index bb6ba018218351..251e0278b11bab 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
@@ -7,6 +7,7 @@
 import React, { useEffect, useMemo } from 'react';
 
 import { Filter } from '../../../../../../../src/plugins/data/public';
+import { TimelineIdLiteral } from '../../../../common/types/timeline';
 import { StatefulEventsViewer } from '../events_viewer';
 import { alertsDefaultModel } from './default_headers';
 import { useManageTimeline } from '../../../timelines/components/manage_timeline';
@@ -17,7 +18,6 @@ export interface OwnProps {
   start: number;
 }
 
-const ALERTS_TABLE_ID = 'alerts-table';
 const defaultAlertsFilters: Filter[] = [
   {
     meta: {
@@ -52,18 +52,24 @@ const defaultAlertsFilters: Filter[] = [
 ];
 
 interface Props {
+  timelineId: TimelineIdLiteral;
   endDate: number;
   startDate: number;
   pageFilters?: Filter[];
 }
 
-const AlertsTableComponent: React.FC<Props> = ({ endDate, startDate, pageFilters = [] }) => {
+const AlertsTableComponent: React.FC<Props> = ({
+  timelineId,
+  endDate,
+  startDate,
+  pageFilters = [],
+}) => {
   const alertsFilter = useMemo(() => [...defaultAlertsFilters, ...pageFilters], [pageFilters]);
   const { initializeTimeline } = useManageTimeline();
 
   useEffect(() => {
     initializeTimeline({
-      id: ALERTS_TABLE_ID,
+      id: timelineId,
       documentType: i18n.ALERTS_DOCUMENT_TYPE,
       footerText: i18n.TOTAL_COUNT_OF_ALERTS,
       title: i18n.ALERTS_TABLE_TITLE,
@@ -76,7 +82,7 @@ const AlertsTableComponent: React.FC<Props> = ({ endDate, startDate, pageFilters
       pageFilters={alertsFilter}
       defaultModel={alertsDefaultModel}
       end={endDate}
-      id={ALERTS_TABLE_ID}
+      id={timelineId}
       start={startDate}
     />
   );
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx
index 8a62a05ecc2da8..a31cb4f2a8bfd8 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/index.tsx
@@ -7,7 +7,7 @@ import React, { useEffect, useCallback, useMemo } from 'react';
 import numeral from '@elastic/numeral';
 
 import { DEFAULT_NUMBER_FORMAT } from '../../../../common/constants';
-import { AlertsComponentsQueryProps } from './types';
+import { AlertsComponentsProps } from './types';
 import { AlertsTable } from './alerts_table';
 import * as i18n from './translations';
 import { useUiSetting$ } from '../../lib/kibana';
@@ -17,6 +17,7 @@ import { MatrixHisrogramConfigs } from '../matrix_histogram/types';
 const ID = 'alertsOverTimeQuery';
 
 export const AlertsView = ({
+  timelineId,
   deleteQuery,
   endDate,
   filterQuery,
@@ -24,7 +25,7 @@ export const AlertsView = ({
   setQuery,
   startDate,
   type,
-}: AlertsComponentsQueryProps) => {
+}: AlertsComponentsProps) => {
   const [defaultNumberFormat] = useUiSetting$<string>(DEFAULT_NUMBER_FORMAT);
   const getSubtitle = useCallback(
     (totalCount: number) =>
@@ -61,7 +62,12 @@ export const AlertsView = ({
         type={type}
         {...alertsHistogramConfigs}
       />
-      <AlertsTable endDate={endDate} startDate={startDate} pageFilters={pageFilters} />
+      <AlertsTable
+        timelineId={timelineId}
+        endDate={endDate}
+        startDate={startDate}
+        pageFilters={pageFilters}
+      />
     </>
   );
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts
index 2bc33aaf1bae77..78a6332c90fbca 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/types.ts
@@ -5,16 +5,19 @@
  */
 
 import { Filter } from '../../../../../../../src/plugins/data/public';
+import { TimelineIdLiteral } from '../../../../common/types/timeline';
 import { HostsComponentsQueryProps } from '../../../hosts/pages/navigation/types';
 import { NetworkComponentQueryProps } from '../../../network/pages/navigation/types';
 import { MatrixHistogramOption } from '../matrix_histogram/types';
 
 type CommonQueryProps = HostsComponentsQueryProps | NetworkComponentQueryProps;
-export interface AlertsComponentsQueryProps
+
+export interface AlertsComponentsProps
   extends Pick<
     CommonQueryProps,
     'deleteQuery' | 'endDate' | 'filterQuery' | 'skip' | 'setQuery' | 'startDate' | 'type'
   > {
+  timelineId: TimelineIdLiteral;
   pageFilters: Filter[];
   stackByOptions?: MatrixHistogramOption[];
   defaultFilters?: Filter[];
diff --git a/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
index 39b17f7008e64b..4bc77555f09bdd 100644
--- a/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/error_toast_dispatcher/index.test.tsx
@@ -8,7 +8,12 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import { Provider } from 'react-redux';
 
-import { apolloClientObservable, mockGlobalState, SUB_PLUGINS_REDUCER } from '../../mock';
+import {
+  apolloClientObservable,
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
+} from '../../mock';
 import { createStore } from '../../store/store';
 
 import { ErrorToastDispatcher } from '.';
@@ -16,10 +21,11 @@ import { State } from '../../store/types';
 
 describe('Error Toast Dispatcher', () => {
   const state: State = mockGlobalState;
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
index d147f0224fdb65..45397921a6651d 100644
--- a/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/inspect/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createStore, State } from '../../store';
 import { UpdateQueryParams, upsertQuery } from '../../store/inputs/helpers';
@@ -25,6 +26,7 @@ describe('Inspect Button', () => {
   const theme = () => ({ eui: euiDarkVars, darkMode: true });
   const refetch = jest.fn();
   const state: State = mockGlobalState;
+  const { storage } = createSecuritySolutionStorageMock();
   const newQuery: UpdateQueryParams = {
     inputId: 'global',
     id: 'myQuery',
@@ -34,13 +36,13 @@ describe('Inspect Button', () => {
     state: state.inputs,
   };
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   describe('Render', () => {
     beforeEach(() => {
       const myState = cloneDeep(state);
       myState.inputs = upsertQuery(newQuery);
-      store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable);
+      store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     });
     test('Eui Empty Button', () => {
       const wrapper = mount(
@@ -144,7 +146,7 @@ describe('Inspect Button', () => {
         response: ['my response'],
       };
       myState.inputs = upsertQuery(myQuery);
-      store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable);
+      store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     });
     test('Open Inspect Modal', () => {
       const wrapper = mount(
diff --git a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
index d81d23438bfd20..50721ef3b26ad7 100644
--- a/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/stat_items/index.test.tsx
@@ -30,7 +30,12 @@ import {
   mockNoChartMappings,
   mockNarrowDateRange,
 } from '../../../network/components/kpi_network/mock';
-import { mockGlobalState, apolloClientObservable, SUB_PLUGINS_REDUCER } from '../../mock';
+import {
+  mockGlobalState,
+  apolloClientObservable,
+  SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
+} from '../../mock';
 import { State, createStore } from '../../store';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 import { KpiNetworkData, KpiHostsData } from '../../../graphql/types';
@@ -49,7 +54,8 @@ jest.mock('../charts/barchart', () => {
 describe('Stat Items Component', () => {
   const theme = () => ({ eui: euiDarkVars, darkMode: true });
   const state: State = mockGlobalState;
-  const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   describe.each([
     [
diff --git a/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
index 04cb348c3f9cd7..99510a1b4b42ef 100644
--- a/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/super_date_picker/index.test.tsx
@@ -10,7 +10,12 @@ import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import { DEFAULT_TIMEPICKER_QUICK_RANGES } from '../../../../common/constants';
 import { useUiSetting$ } from '../../lib/kibana';
-import { apolloClientObservable, mockGlobalState, SUB_PLUGINS_REDUCER } from '../../mock';
+import {
+  apolloClientObservable,
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
+} from '../../mock';
 import { createUseUiSetting$Mock } from '../../mock/kibana_react';
 import { createStore, State } from '../../store';
 
@@ -75,11 +80,12 @@ const timepickerRanges = [
 describe('SIEM Super Date Picker', () => {
   describe('#SuperDatePicker', () => {
     const state: State = mockGlobalState;
-    let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    const { storage } = createSecuritySolutionStorageMock();
+    let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
     beforeEach(() => {
       jest.clearAllMocks();
-      store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+      store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
       mockUseUiSetting$.mockImplementation((key, defaultValue) => {
         const useUiSetting$Mock = createUseUiSetting$Mock();
 
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
index aa310d63ab2836..1c24c325dc9ec5 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/index.test.tsx
@@ -13,6 +13,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../mock';
 import { createKibanaCoreStartMock } from '../../mock/kibana_core';
 import { FilterManager } from '../../../../../../../src/plugins/data/public';
@@ -141,7 +142,9 @@ const state: State = {
     },
   },
 };
-const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+
+const { storage } = createSecuritySolutionStorageMock();
+const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
 describe('StatefulTopN', () => {
   // Suppress warnings about "react-beautiful-dnd"
diff --git a/x-pack/plugins/security_solution/public/common/hooks/endpoint/use_navigate_to_app_event_handler.ts b/x-pack/plugins/security_solution/public/common/hooks/endpoint/use_navigate_to_app_event_handler.ts
index 759d72419e42eb..cb4de29802e541 100644
--- a/x-pack/plugins/security_solution/public/common/hooks/endpoint/use_navigate_to_app_event_handler.ts
+++ b/x-pack/plugins/security_solution/public/common/hooks/endpoint/use_navigate_to_app_event_handler.ts
@@ -5,10 +5,13 @@
  */
 
 import { MouseEventHandler, useCallback } from 'react';
-import { ApplicationStart } from 'kibana/public';
-import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+import { ApplicationStart, NavigateToAppOptions } from 'kibana/public';
+import { useKibana } from '../../lib/kibana';
 
-type NavigateToAppHandlerProps = Parameters<ApplicationStart['navigateToApp']>;
+type NavigateToAppHandlerOptions<S = unknown> = NavigateToAppOptions & {
+  state?: S;
+  onClick?: EventHandlerCallback;
+};
 type EventHandlerCallback = MouseEventHandler<HTMLButtonElement | HTMLAnchorElement>;
 
 /**
@@ -25,14 +28,12 @@ type EventHandlerCallback = MouseEventHandler<HTMLButtonElement | HTMLAnchorElem
  * const handleOnClick = useNavigateToAppEventHandler('ingestManager', {path: '#/configs'})
  * return <EuiLink onClick={handleOnClick}>See configs</EuiLink>
  */
-export const useNavigateToAppEventHandler = (
+export const useNavigateToAppEventHandler = <S = unknown>(
   /** the app id - normally the value of the `id` in that plugin's `kibana.json`  */
-  appId: NavigateToAppHandlerProps[0],
+  appId: Parameters<ApplicationStart['navigateToApp']>[0],
 
   /** Options, some of which are passed along to the app route */
-  options?: NavigateToAppHandlerProps[1] & {
-    onClick?: EventHandlerCallback;
-  }
+  options?: NavigateToAppHandlerOptions<S>
 ): EventHandlerCallback => {
   const { services } = useKibana();
   const { path, state, onClick } = options || {};
diff --git a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
index d930136b3c0c46..1db63897a88633 100644
--- a/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx
@@ -19,7 +19,7 @@ import { alertMiddlewareFactory } from '../../../endpoint_alerts/store/middlewar
 import { AppRootProvider } from './app_root_provider';
 import { managementMiddlewareFactory } from '../../../management/store/middleware';
 import { createKibanaContextProviderMock } from '../kibana_react';
-import { SUB_PLUGINS_REDUCER, mockGlobalState } from '..';
+import { SUB_PLUGINS_REDUCER, mockGlobalState, createSecuritySolutionStorageMock } from '..';
 
 type UiRender = (ui: React.ReactElement, options?: RenderOptions) => RenderResult;
 
@@ -56,7 +56,9 @@ export const createAppRootMockRenderer = (): AppContextTestRender => {
   const coreStart = coreMock.createStart({ basePath: '/mock' });
   const depsStart = depsStartMock();
   const middlewareSpy = createSpyMiddleware();
-  const store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, apolloClientObservable, [
+  const { storage } = createSecuritySolutionStorageMock();
+
+  const store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage, [
     substateMiddlewareFactory(
       (globalState) => globalState.alertList,
       alertMiddlewareFactory(coreStart, depsStart)
@@ -64,6 +66,7 @@ export const createAppRootMockRenderer = (): AppContextTestRender => {
     ...managementMiddlewareFactory(coreStart, depsStart),
     middlewareSpy.actionSpyMiddleware,
   ]);
+
   const MockKibanaContextProvider = createKibanaContextProviderMock();
 
   const AppWrapper: React.FC<{ children: React.ReactElement }> = ({ children }) => (
diff --git a/x-pack/plugins/security_solution/public/common/mock/index.ts b/x-pack/plugins/security_solution/public/common/mock/index.ts
index 30eb4c63f40b85..678ad4d84b5862 100644
--- a/x-pack/plugins/security_solution/public/common/mock/index.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/index.ts
@@ -10,6 +10,7 @@ export * from './hook_wrapper';
 export * from './index_pattern';
 export * from './mock_timeline_data';
 export * from './mock_detail_item';
+export * from './mock_local_storage';
 export * from './netflow';
 export * from './test_providers';
 export * from './utils';
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_local_storage.ts b/x-pack/plugins/security_solution/public/common/mock/mock_local_storage.ts
new file mode 100644
index 00000000000000..ca44295b758891
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_local_storage.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IStorage, Storage } from '../../../../../../src/plugins/kibana_utils/public';
+
+export const localStorageMock = (): IStorage => {
+  let store: Record<string, unknown> = {};
+
+  return {
+    getItem: (key: string) => {
+      return store[key] || null;
+    },
+    setItem: (key: string, value: unknown) => {
+      store[key] = value;
+    },
+    clear() {
+      store = {};
+    },
+    removeItem(key: string) {
+      delete store[key];
+    },
+  };
+};
+
+export const createSecuritySolutionStorageMock = () => {
+  const localStorage = localStorageMock();
+  return {
+    localStorage,
+    storage: new Storage(localStorage),
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
index 679e0bdc14cd5a..0573f049c35c53 100644
--- a/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
+++ b/x-pack/plugins/security_solution/public/common/mock/test_providers.tsx
@@ -22,6 +22,7 @@ import { mockGlobalState } from './global_state';
 import { createKibanaContextProviderMock } from './kibana_react';
 import { FieldHook, useForm } from '../../shared_imports';
 import { SUB_PLUGINS_REDUCER } from './utils';
+import { createSecuritySolutionStorageMock, localStorageMock } from './mock_local_storage';
 
 const state: State = mockGlobalState;
 
@@ -38,32 +39,17 @@ export const apolloClient = new ApolloClient({
 
 export const apolloClientObservable = new BehaviorSubject(apolloClient);
 
-const localStorageMock = () => {
-  let store: Record<string, unknown> = {};
-
-  return {
-    getItem: (key: string) => {
-      return store[key] || null;
-    },
-    setItem: (key: string, value: unknown) => {
-      store[key] = value;
-    },
-    clear() {
-      store = {};
-    },
-  };
-};
-
 Object.defineProperty(window, 'localStorage', {
   value: localStorageMock(),
 });
 
 const MockKibanaContextProvider = createKibanaContextProviderMock();
+const { storage } = createSecuritySolutionStorageMock();
 
 /** A utility for wrapping children in the providers required to run most tests */
 const TestProvidersComponent: React.FC<Props> = ({
   children,
-  store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable),
+  store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage),
   onDragEnd = jest.fn(),
 }) => (
   <I18nProvider>
@@ -83,7 +69,7 @@ export const TestProviders = React.memo(TestProvidersComponent);
 
 const TestProviderWithoutDragAndDropComponent: React.FC<Props> = ({
   children,
-  store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable),
+  store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage),
 }) => (
   <I18nProvider>
     <ReduxStoreProvider store={store}>{children}</ReduxStoreProvider>
diff --git a/x-pack/plugins/security_solution/public/common/store/epic.ts b/x-pack/plugins/security_solution/public/common/store/epic.ts
index b9e8e7d88c202a..d9de7951a86f4e 100644
--- a/x-pack/plugins/security_solution/public/common/store/epic.ts
+++ b/x-pack/plugins/security_solution/public/common/store/epic.ts
@@ -9,11 +9,13 @@ import { createTimelineEpic } from '../../timelines/store/timeline/epic';
 import { createTimelineFavoriteEpic } from '../../timelines/store/timeline/epic_favorite';
 import { createTimelineNoteEpic } from '../../timelines/store/timeline/epic_note';
 import { createTimelinePinnedEventEpic } from '../../timelines/store/timeline/epic_pinned_event';
+import { createTimelineLocalStorageEpic } from '../../timelines/store/timeline/epic_local_storage';
 
 export const createRootEpic = <State>() =>
   combineEpics(
     createTimelineEpic<State>(),
     createTimelineFavoriteEpic<State>(),
     createTimelineNoteEpic<State>(),
-    createTimelinePinnedEventEpic<State>()
+    createTimelinePinnedEventEpic<State>(),
+    createTimelineLocalStorageEpic<State>()
   );
diff --git a/x-pack/plugins/security_solution/public/common/store/store.ts b/x-pack/plugins/security_solution/public/common/store/store.ts
index 276dcdcaedb854..5f53724b287df8 100644
--- a/x-pack/plugins/security_solution/public/common/store/store.ts
+++ b/x-pack/plugins/security_solution/public/common/store/store.ts
@@ -28,6 +28,7 @@ import { AppApolloClient } from '../lib/lib';
 import { AppAction } from './actions';
 import { Immutable } from '../../../common/endpoint/types';
 import { State } from './types';
+import { Storage } from '../../../../../../src/plugins/kibana_utils/public';
 
 type ComposeType = typeof compose;
 declare global {
@@ -48,6 +49,7 @@ export const createStore = (
   state: PreloadedState<State>,
   pluginsReducer: SubPluginsInitReducer,
   apolloClient: Observable<AppApolloClient>,
+  storage: Storage,
   additionalMiddleware?: Array<Middleware<{}, State, Dispatch<AppAction | Immutable<AppAction>>>>
 ): Store<State, Action> => {
   const composeEnhancers = window.__REDUX_DEVTOOLS_EXTENSION_COMPOSE__ || compose;
@@ -58,6 +60,7 @@ export const createStore = (
     selectNotesByIdSelector: appSelectors.selectNotesByIdSelector,
     timelineByIdSelector: timelineSelectors.timelineByIdSelector,
     timelineTimeRangeSelector: inputsSelectors.timelineTimeRangeSelector,
+    storage,
   };
 
   const epicMiddleware = createEpicMiddleware<Action, Action, State, typeof middlewareDependencies>(
diff --git a/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx b/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx
index 11ddc1f2529723..acfe3f228c21fb 100644
--- a/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx
+++ b/x-pack/plugins/security_solution/public/endpoint_alerts/view/test_helpers/render_alert_page.tsx
@@ -15,7 +15,12 @@ import { AlertIndex } from '../index';
 import { RouteCapture } from '../../../common/components/endpoint/route_capture';
 import { depsStartMock } from '../../../common/mock/endpoint';
 import { createStore } from '../../../common/store';
-import { SUB_PLUGINS_REDUCER, mockGlobalState, apolloClientObservable } from '../../../common/mock';
+import {
+  SUB_PLUGINS_REDUCER,
+  mockGlobalState,
+  apolloClientObservable,
+  createSecuritySolutionStorageMock,
+} from '../../../common/mock';
 
 export const alertPageTestRender = () => {
   /**
@@ -25,7 +30,8 @@ export const alertPageTestRender = () => {
   /**
    * Create a store, with the middleware disabled. We don't want side effects being created by our code in this test.
    */
-  const store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  const store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   const depsStart = depsStartMock();
   depsStart.data.ui.SearchBar.mockImplementation(() => <div />);
diff --git a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
index a38b25661cd5e1..3809d848759cc3 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/index.test.tsx
@@ -9,7 +9,12 @@ import { getOr } from 'lodash/fp';
 import React from 'react';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
-import { apolloClientObservable, mockGlobalState, SUB_PLUGINS_REDUCER } from '../../../common/mock';
+import {
+  apolloClientObservable,
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
+} from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
 import { hostsModel } from '../../store';
 import { mockData } from './mock';
@@ -20,10 +25,11 @@ describe('Authentication Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
index 45779bf37c77f3..1168f4f7454c81 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
@@ -35,12 +36,13 @@ jest.mock('../../../common/components/query_bar', () => ({
 describe('Hosts Table', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
+  const { storage } = createSecuritySolutionStorageMock();
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/hosts/index.ts b/x-pack/plugins/security_solution/public/hosts/index.ts
index 6f27428e71c27c..90d5f54a027d7f 100644
--- a/x-pack/plugins/security_solution/public/hosts/index.ts
+++ b/x-pack/plugins/security_solution/public/hosts/index.ts
@@ -4,16 +4,27 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Storage } from '../../../../../src/plugins/kibana_utils/public';
+import { TimelineIdLiteral, TimelineId } from '../../common/types/timeline';
 import { SecuritySubPluginWithStore } from '../app/types';
+import { getTimelinesInStorageByIds } from '../timelines/containers/local_storage';
 import { getHostsRoutes } from './routes';
 import { initialHostsState, hostsReducer, HostsState } from './store';
 
+const HOST_TIMELINE_IDS: TimelineIdLiteral[] = [
+  TimelineId.hostsPageEvents,
+  TimelineId.hostsPageExternalAlerts,
+];
+
 export class Hosts {
   public setup() {}
 
-  public start(): SecuritySubPluginWithStore<'hosts', HostsState> {
+  public start(storage: Storage): SecuritySubPluginWithStore<'hosts', HostsState> {
     return {
       routes: getHostsRoutes(),
+      storageTimelines: {
+        timelineById: getTimelinesInStorageByIds(storage, HOST_TIMELINE_IDS),
+      },
       store: {
         initialState: { hosts: initialHostsState },
         reducer: { hosts: hostsReducer },
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
index d2ccbd76fac10a..85db3b4e159f12 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
@@ -19,6 +19,7 @@ import {
   TestProviders,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../common/mock';
 import { SiemNavigation } from '../../common/components/navigation';
 import { inputsActions } from '../../common/store/inputs';
@@ -171,7 +172,8 @@ describe('Hosts - rendering', () => {
     ];
     localSource[0].result.data.source.status.indicesExist = true;
     const myState: State = mockGlobalState;
-    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    const { storage } = createSecuritySolutionStorageMock();
+    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     const wrapper = mount(
       <TestProviders store={myStore}>
         <MockedProvider mocks={localSource} addTypename={false}>
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx
index a0d8df6b87514b..3023670f8051a0 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/alerts_query_tab_body.tsx
@@ -7,6 +7,7 @@
 import React, { useMemo } from 'react';
 
 import { Filter } from '../../../../../../../src/plugins/data/public';
+import { TimelineId } from '../../../../common/types/timeline';
 import { AlertsView } from '../../../common/components/alerts_viewer';
 import { AlertsComponentQueryProps } from './types';
 
@@ -48,7 +49,13 @@ export const HostAlertsQueryTabBody = React.memo((alertsProps: AlertsComponentQu
     [pageFilters]
   );
 
-  return <AlertsView {...rest} pageFilters={hostPageFilters} />;
+  return (
+    <AlertsView
+      timelineId={TimelineId.hostsPageExternalAlerts}
+      {...rest}
+      pageFilters={hostPageFilters}
+    />
+  );
 });
 
 HostAlertsQueryTabBody.displayName = 'HostAlertsQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
index b8ec269508442b..574e2ec4ae250a 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
@@ -5,6 +5,7 @@
  */
 
 import React, { useEffect } from 'react';
+import { TimelineId } from '../../../../common/types/timeline';
 import { StatefulEventsViewer } from '../../../common/components/events_viewer';
 import { HostsComponentsQueryProps } from './types';
 import { hostsModel } from '../../store';
@@ -17,7 +18,6 @@ import { MatrixHistogramContainer } from '../../../common/components/matrix_hist
 import * as i18n from '../translations';
 import { HistogramType } from '../../../graphql/types';
 
-const HOSTS_PAGE_TIMELINE_ID = 'hosts-page';
 const EVENTS_HISTOGRAM_ID = 'eventsOverTimeQuery';
 
 export const eventsStackByOptions: MatrixHistogramOption[] = [
@@ -78,7 +78,7 @@ export const EventsQueryTabBody = ({
       <StatefulEventsViewer
         defaultModel={eventsDefaultModel}
         end={endDate}
-        id={HOSTS_PAGE_TIMELINE_ID}
+        id={TimelineId.hostsPageEvents}
         start={startDate}
         pageFilters={pageFilters}
       />
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/host_details.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/host_details.tsx
index b191bfe4effeaf..9ec65a5d17898c 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/host_details.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/host_details.tsx
@@ -93,13 +93,40 @@ export const HostDetails = memo(({ details }: { details: HostMetadata }) => {
 
   const policyStatusClickHandler = useNavigateByRouterEventHandler(policyResponseRoutePath);
 
+  const [policyDetailsRoutePath, policyDetailsRouteUrl] = useMemo(() => {
+    return [
+      getManagementUrl({
+        name: 'policyDetails',
+        policyId: details.endpoint.policy.applied.id,
+        excludePrefix: true,
+      }),
+      getManagementUrl({
+        name: 'policyDetails',
+        policyId: details.endpoint.policy.applied.id,
+      }),
+    ];
+  }, [details.endpoint.policy.applied.id]);
+
+  const policyDetailsClickHandler = useNavigateByRouterEventHandler(policyDetailsRoutePath);
+
   const detailsResultsPolicy = useMemo(() => {
     return [
       {
         title: i18n.translate('xpack.securitySolution.endpoint.host.details.policy', {
           defaultMessage: 'Policy',
         }),
-        description: details.endpoint.policy.applied.id,
+        description: (
+          <>
+            {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
+            <EuiLink
+              data-test-subj="policyDetailsValue"
+              href={policyDetailsRouteUrl}
+              onClick={policyDetailsClickHandler}
+            >
+              {details.endpoint.policy.applied.name}
+            </EuiLink>
+          </>
+        ),
       },
       {
         title: i18n.translate('xpack.securitySolution.endpoint.host.details.policyStatus', {
@@ -128,7 +155,14 @@ export const HostDetails = memo(({ details }: { details: HostMetadata }) => {
         ),
       },
     ];
-  }, [details, policyResponseUri, policyStatus, policyStatusClickHandler]);
+  }, [
+    details,
+    policyResponseUri,
+    policyStatus,
+    policyStatusClickHandler,
+    policyDetailsRouteUrl,
+    policyDetailsClickHandler,
+  ]);
   const detailsResultsLower = useMemo(() => {
     return [
       {
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts
index 645a4896770eee..790bbd3cb98dac 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/host_constants.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { HostStatus, HostPolicyResponseActionStatus } from '../../../../../common/endpoint/types';
 
 export const HOST_STATUS_TO_HEALTH_COLOR = Object.freeze<
@@ -23,3 +24,17 @@ export const POLICY_STATUS_TO_HEALTH_COLOR = Object.freeze<
   warning: 'warning',
   failure: 'danger',
 });
+
+export const POLICY_STATUS_TO_TEXT = Object.freeze<
+  { [key in keyof typeof HostPolicyResponseActionStatus]: string }
+>({
+  success: i18n.translate('xpack.securitySolution.policyStatusText.success', {
+    defaultMessage: 'Success',
+  }),
+  warning: i18n.translate('xpack.securitySolution.policyStatusText.warning', {
+    defaultMessage: 'Warning',
+  }),
+  failure: i18n.translate('xpack.securitySolution.policyStatusText.failure', {
+    defaultMessage: 'Failure',
+  }),
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
index 7d84bb52238a2e..e0f797b1430551 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.test.tsx
@@ -9,6 +9,7 @@ import * as reactTestingLibrary from '@testing-library/react';
 
 import { HostList } from './index';
 import { mockHostDetailsApiResult, mockHostResultList } from '../store/mock_host_result_list';
+import { mockPolicyResultList } from '../../policy/store/policy_list/mock_policy_result_list';
 import { AppContextTestRender, createAppRootMockRenderer } from '../../../../common/mock/endpoint';
 import {
   HostInfo,
@@ -17,6 +18,7 @@ import {
 } from '../../../../../common/endpoint/types';
 import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data';
 import { AppAction } from '../../../../common/store/actions';
+import { POLICY_STATUS_TO_HEALTH_COLOR, POLICY_STATUS_TO_TEXT } from './host_constants';
 
 describe('when on the hosts page', () => {
   const docGenerator = new EndpointDocGenerator();
@@ -47,15 +49,23 @@ describe('when on the hosts page', () => {
       });
     });
     describe('when list data loads', () => {
+      const generatedPolicyStatuses: Array<
+        HostInfo['metadata']['endpoint']['policy']['applied']['status']
+      > = [];
+      let firstPolicyID: string;
       beforeEach(() => {
         reactTestingLibrary.act(() => {
           const hostListData = mockHostResultList({ total: 3 });
+          firstPolicyID = hostListData.hosts[0].metadata.endpoint.policy.applied.id;
           [HostStatus.ERROR, HostStatus.ONLINE, HostStatus.OFFLINE].forEach((status, index) => {
             hostListData.hosts[index] = {
               metadata: hostListData.hosts[index].metadata,
               host_status: status,
             };
           });
+          hostListData.hosts.forEach((item, index) => {
+            generatedPolicyStatuses[index] = item.metadata.endpoint.policy.applied.status;
+          });
           const action: AppAction = {
             type: 'serverReturnedHostList',
             payload: hostListData,
@@ -92,6 +102,29 @@ describe('when on the hosts page', () => {
         ).not.toBeNull();
       });
 
+      it('should display correct policy status', async () => {
+        const renderResult = render();
+        const policyStatuses = await renderResult.findAllByTestId('rowPolicyStatus');
+
+        policyStatuses.forEach((status, index) => {
+          expect(status.textContent).toEqual(POLICY_STATUS_TO_TEXT[generatedPolicyStatuses[index]]);
+          expect(
+            status.querySelector(
+              `[data-euiicon-type][color=${
+                POLICY_STATUS_TO_HEALTH_COLOR[generatedPolicyStatuses[index]]
+              }]`
+            )
+          ).not.toBeNull();
+        });
+      });
+
+      it('should display policy name as a link', async () => {
+        const renderResult = render();
+        const firstPolicyName = (await renderResult.findAllByTestId('policyNameCellLink'))[0];
+        expect(firstPolicyName).not.toBeNull();
+        expect(firstPolicyName.getAttribute('href')).toContain(`policy/${firstPolicyID}`);
+      });
+
       describe('when the user clicks the first hostname in the table', () => {
         let renderResult: reactTestingLibrary.RenderResult;
         beforeEach(async () => {
@@ -197,6 +230,32 @@ describe('when on the hosts page', () => {
         expect(flyout).not.toBeNull();
       });
     });
+
+    it('should display policy name value as a link', async () => {
+      const renderResult = render();
+      const policyDetailsLink = await renderResult.findByTestId('policyDetailsValue');
+      expect(policyDetailsLink).not.toBeNull();
+      expect(policyDetailsLink.getAttribute('href')).toEqual(
+        `#/management/policy/${hostDetails.metadata.endpoint.policy.applied.id}`
+      );
+    });
+
+    it('should update the URL when policy name link is clicked', async () => {
+      const policyItem = mockPolicyResultList({ total: 1 }).items[0];
+      coreStart.http.get.mockReturnValue(Promise.resolve({ item: policyItem }));
+
+      const renderResult = render();
+      const policyDetailsLink = await renderResult.findByTestId('policyDetailsValue');
+      const userChangedUrlChecker = middlewareSpy.waitForAction('userChangedUrl');
+      reactTestingLibrary.act(() => {
+        reactTestingLibrary.fireEvent.click(policyDetailsLink);
+      });
+      const changedUrlAction = await userChangedUrlChecker;
+      expect(changedUrlAction.payload.pathname).toEqual(
+        `/management/policy/${hostDetails.metadata.endpoint.policy.applied.id}`
+      );
+    });
+
     it('should display policy status value as a link', async () => {
       const renderResult = render();
       const policyStatusLink = await renderResult.findByTestId('policyStatusValue');
@@ -205,6 +264,7 @@ describe('when on the hosts page', () => {
         '#/management/endpoints?page_index=0&page_size=10&selected_host=1&show=policy_response'
       );
     });
+
     it('should update the URL when policy status link is clicked', async () => {
       const renderResult = render();
       const policyStatusLink = await renderResult.findByTestId('policyStatusValue');
@@ -217,6 +277,7 @@ describe('when on the hosts page', () => {
         '?page_index=0&page_size=10&selected_host=1&show=policy_response'
       );
     });
+
     it('should display Success overall policy status', async () => {
       const renderResult = render();
       reactTestingLibrary.act(() => {
@@ -230,6 +291,7 @@ describe('when on the hosts page', () => {
         policyStatusHealth.querySelector('[data-euiicon-type][color="success"]')
       ).not.toBeNull();
     });
+
     it('should display Warning overall policy status', async () => {
       const renderResult = render();
       reactTestingLibrary.act(() => {
@@ -243,6 +305,7 @@ describe('when on the hosts page', () => {
         policyStatusHealth.querySelector('[data-euiicon-type][color="warning"]')
       ).not.toBeNull();
     });
+
     it('should display Failed overall policy status', async () => {
       const renderResult = render();
       reactTestingLibrary.act(() => {
@@ -256,6 +319,7 @@ describe('when on the hosts page', () => {
         policyStatusHealth.querySelector('[data-euiicon-type][color="danger"]')
       ).not.toBeNull();
     });
+
     it('should display Unknown overall policy status', async () => {
       const renderResult = render();
       reactTestingLibrary.act(() => {
@@ -269,6 +333,7 @@ describe('when on the hosts page', () => {
         policyStatusHealth.querySelector('[data-euiicon-type][color="subdued"]')
       ).not.toBeNull();
     });
+
     it('should include the link to logs', async () => {
       const renderResult = render();
       const linkToLogs = await renderResult.findByTestId('hostDetailsLinkToLogs');
@@ -278,6 +343,7 @@ describe('when on the hosts page', () => {
         "/app/logs/stream?logFilter=(expression:'host.id:1',kind:kuery)"
       );
     });
+
     describe('when link to logs is clicked', () => {
       beforeEach(async () => {
         const renderResult = render();
@@ -291,6 +357,7 @@ describe('when on the hosts page', () => {
         expect(coreStart.application.navigateToApp.mock.calls).toHaveLength(1);
       });
     });
+
     describe('when showing host Policy Response panel', () => {
       let renderResult: ReturnType<typeof render>;
       beforeEach(async () => {
@@ -305,10 +372,12 @@ describe('when on the hosts page', () => {
           dispatchServerReturnedHostPolicyResponse();
         });
       });
+
       it('should hide the host details panel', async () => {
         const hostDetailsFlyout = await renderResult.queryByTestId('hostDetailsFlyoutBody');
         expect(hostDetailsFlyout).toBeNull();
       });
+
       it('should display policy response sub-panel', async () => {
         expect(
           await renderResult.findByTestId('hostDetailsPolicyResponseFlyoutHeader')
@@ -317,17 +386,20 @@ describe('when on the hosts page', () => {
           await renderResult.findByTestId('hostDetailsPolicyResponseFlyoutBody')
         ).not.toBeNull();
       });
+
       it('should include the sub-panel title', async () => {
         expect(
           (await renderResult.findByTestId('hostDetailsPolicyResponseFlyoutTitle')).textContent
         ).toBe('Policy Response');
       });
+
       it('should show a configuration section for each protection', async () => {
         const configAccordions = await renderResult.findAllByTestId(
           'hostDetailsPolicyResponseConfigAccordion'
         );
         expect(configAccordions).not.toBeNull();
       });
+
       it('should show an actions section for each configuration', async () => {
         const actionAccordions = await renderResult.findAllByTestId(
           'hostDetailsPolicyResponseActionsAccordion'
@@ -340,6 +412,7 @@ describe('when on the hosts page', () => {
         expect(statusHealth).not.toBeNull();
         expect(message).not.toBeNull();
       });
+
       it('should not show any numbered badges if all actions are successful', () => {
         const policyResponse = docGenerator.generatePolicyResponse(
           new Date().getTime(),
@@ -359,6 +432,7 @@ describe('when on the hosts page', () => {
             expect(e).not.toBeNull();
           });
       });
+
       it('should show a numbered badge if at least one action failed', () => {
         reactTestingLibrary.act(() => {
           dispatchServerReturnedHostPolicyResponse(HostPolicyResponseActionStatus.failure);
@@ -368,6 +442,7 @@ describe('when on the hosts page', () => {
         );
         expect(attentionBadge).not.toBeNull();
       });
+
       it('should show a numbered badge if at least one action has a warning', () => {
         reactTestingLibrary.act(() => {
           dispatchServerReturnedHostPolicyResponse(HostPolicyResponseActionStatus.warning);
@@ -377,6 +452,7 @@ describe('when on the hosts page', () => {
         );
         expect(attentionBadge).not.toBeNull();
       });
+
       it('should include the back to details link', async () => {
         const subHeaderBackLink = await renderResult.findByTestId('flyoutSubHeaderBackButton');
         expect(subHeaderBackLink.textContent).toBe('Endpoint Details');
@@ -384,6 +460,7 @@ describe('when on the hosts page', () => {
           '#/management/endpoints?page_index=0&page_size=10&selected_host=1'
         );
       });
+
       it('should update URL when back to details link is clicked', async () => {
         const subHeaderBackLink = await renderResult.findByTestId('flyoutSubHeaderBackButton');
         const userChangedUrlChecker = middlewareSpy.waitForAction('userChangedUrl');
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
index 125723e9bcea66..c67c29fbc73a90 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/index.tsx
@@ -22,7 +22,11 @@ import { createStructuredSelector } from 'reselect';
 import { HostDetailsFlyout } from './details';
 import * as selectors from '../store/selectors';
 import { useHostSelector } from './hooks';
-import { HOST_STATUS_TO_HEALTH_COLOR } from './host_constants';
+import {
+  HOST_STATUS_TO_HEALTH_COLOR,
+  POLICY_STATUS_TO_HEALTH_COLOR,
+  POLICY_STATUS_TO_TEXT,
+} from './host_constants';
 import { useNavigateByRouterEventHandler } from '../../../../common/hooks/endpoint/use_navigate_by_router_event_handler';
 import { CreateStructuredSelector } from '../../../../common/store';
 import { Immutable, HostInfo } from '../../../../../common/endpoint/types';
@@ -31,17 +35,18 @@ import { ManagementPageView } from '../../../components/management_page_view';
 import { getManagementUrl } from '../../..';
 import { FormattedDate } from '../../../../common/components/formatted_date';
 
-const HostLink = memo<{
+const HostListNavLink = memo<{
   name: string;
   href: string;
   route: string;
-}>(({ name, href, route }) => {
+  dataTestSubj: string;
+}>(({ name, href, route, dataTestSubj }) => {
   const clickHandler = useNavigateByRouterEventHandler(route);
 
   return (
     // eslint-disable-next-line @elastic/eui/href-or-on-click
     <EuiLink
-      data-test-subj="hostnameCellLink"
+      data-test-subj={dataTestSubj}
       className="eui-textTruncate"
       href={href}
       onClick={clickHandler}
@@ -50,7 +55,7 @@ const HostLink = memo<{
     </EuiLink>
   );
 });
-HostLink.displayName = 'HostLink';
+HostListNavLink.displayName = 'HostListNavLink';
 
 const selector = (createStructuredSelector as CreateStructuredSelector)(selectors);
 export const HostList = () => {
@@ -116,7 +121,14 @@ export const HostList = () => {
             name: 'endpointDetails',
             selected_host: id,
           });
-          return <HostLink name={hostname} href={toRouteUrl} route={toRoutePath} />;
+          return (
+            <HostListNavLink
+              name={hostname}
+              href={toRouteUrl}
+              route={toRoutePath}
+              dataTestSubj="hostnameCellLink"
+            />
+          );
         },
       },
       {
@@ -142,43 +154,64 @@ export const HostList = () => {
         },
       },
       {
-        field: '',
+        field: 'metadata.endpoint.policy.applied',
         name: i18n.translate('xpack.securitySolution.endpointList.policy', {
           defaultMessage: 'Policy',
         }),
         truncateText: true,
         // eslint-disable-next-line react/display-name
-        render: () => {
-          return <span className="eui-textTruncate">{'Policy Name'}</span>;
+        render: (policy: HostInfo['metadata']['endpoint']['policy']['applied']) => {
+          const toRoutePath = getManagementUrl({
+            name: 'policyDetails',
+            policyId: policy.id,
+            excludePrefix: true,
+          });
+          const toRouteUrl = getManagementUrl({
+            name: 'policyDetails',
+            policyId: policy.id,
+          });
+          return (
+            <HostListNavLink
+              name={policy.name}
+              href={toRouteUrl}
+              route={toRoutePath}
+              dataTestSubj="policyNameCellLink"
+            />
+          );
         },
       },
       {
-        field: '',
+        field: 'metadata.endpoint.policy.applied',
         name: i18n.translate('xpack.securitySolution.endpointList.policyStatus', {
           defaultMessage: 'Policy Status',
         }),
         // eslint-disable-next-line react/display-name
-        render: () => {
+        render: (policy: HostInfo['metadata']['endpoint']['policy']['applied'], item: HostInfo) => {
+          const toRoutePath = getManagementUrl({
+            name: 'endpointPolicyResponse',
+            selected_host: item.metadata.host.id,
+            excludePrefix: true,
+          });
+          const toRouteUrl = getManagementUrl({
+            name: 'endpointPolicyResponse',
+            selected_host: item.metadata.host.id,
+          });
           return (
-            <EuiHealth color="success" className="eui-textTruncate">
-              <FormattedMessage
-                id="xpack.securitySolution.endpointList.policyStatus"
-                defaultMessage="Policy Status"
+            <EuiHealth
+              color={POLICY_STATUS_TO_HEALTH_COLOR[policy.status]}
+              className="eui-textTruncate"
+              data-test-subj="rowPolicyStatus"
+            >
+              <HostListNavLink
+                name={POLICY_STATUS_TO_TEXT[policy.status]}
+                href={toRouteUrl}
+                route={toRoutePath}
+                dataTestSubj="policyStatusCellLink"
               />
             </EuiHealth>
           );
         },
       },
-      {
-        field: '',
-        name: i18n.translate('xpack.securitySolution.endpointList.alerts', {
-          defaultMessage: 'Alerts',
-        }),
-        dataType: 'number',
-        render: () => {
-          return '0';
-        },
-      },
       {
         field: 'metadata.host.os.name',
         name: i18n.translate('xpack.securitySolution.endpointList.os', {
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts
index cece3f1b4c8f2b..66e98aa51601e7 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_list/services/ingest.ts
@@ -11,6 +11,7 @@ import {
   DeleteDatasourcesResponse,
   DeleteDatasourcesRequest,
   DATASOURCE_SAVED_OBJECT_TYPE,
+  GetPackagesResponse,
 } from '../../../../../../../../ingest_manager/common';
 import { GetPolicyListResponse, GetPolicyResponse, UpdatePolicyResponse } from '../../../types';
 import { NewPolicyData } from '../../../../../../../common/endpoint/types';
@@ -19,6 +20,7 @@ const INGEST_API_ROOT = `/api/ingest_manager`;
 export const INGEST_API_DATASOURCES = `${INGEST_API_ROOT}/datasources`;
 const INGEST_API_FLEET = `${INGEST_API_ROOT}/fleet`;
 const INGEST_API_FLEET_AGENT_STATUS = `${INGEST_API_FLEET}/agent-status`;
+const INGEST_API_EPM_PACKAGES = `${INGEST_API_ROOT}/epm/packages`;
 const INGEST_API_DELETE_DATASOURCE = `${INGEST_API_DATASOURCES}/delete`;
 
 /**
@@ -113,3 +115,20 @@ export const sendGetFleetAgentStatusForConfig = (
     },
   });
 };
+
+/**
+ * Get Endpoint Security Package information
+ */
+export const sendGetEndpointSecurityPackage = async (
+  http: HttpStart
+): Promise<GetPackagesResponse['response'][0]> => {
+  const options = { query: { category: 'security' } };
+  const securityPackages = await http.get<GetPackagesResponse>(INGEST_API_EPM_PACKAGES, options);
+  const endpointPackageInfo = securityPackages.response.find(
+    (epmPackage) => epmPackage.name === 'endpoint'
+  );
+  if (!endpointPackageInfo) {
+    throw new Error('Endpoint package was not found.');
+  }
+  return endpointPackageInfo;
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_hooks.ts b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_hooks.ts
new file mode 100644
index 00000000000000..75e1556ff0bb08
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_hooks.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useEffect, useState } from 'react';
+import { Immutable } from '../../../../../common/endpoint/types';
+import { GetPackagesResponse } from '../../../../../../ingest_manager/common/types/rest_spec';
+import { sendGetEndpointSecurityPackage } from '../store/policy_list/services/ingest';
+import { useKibana } from '../../../../common/lib/kibana';
+
+type UseEndpointPackageInfo = [
+  /** The Package Info. will be undefined while it is being fetched */
+  Immutable<GetPackagesResponse['response'][0]> | undefined,
+  /** Boolean indicating if fetching is underway */
+  boolean,
+  /** Any error encountered during fetch */
+  Error | undefined
+];
+
+/**
+ * Hook that fetches the endpoint package info
+ *
+ * @example
+ * const [packageInfo, isFetching, fetchError] = useEndpointPackageInfo();
+ */
+export const useEndpointPackageInfo = (): UseEndpointPackageInfo => {
+  const {
+    services: { http },
+  } = useKibana();
+  const [endpointPackage, setEndpointPackage] = useState<UseEndpointPackageInfo[0]>();
+  const [isFetching, setIsFetching] = useState<UseEndpointPackageInfo[1]>(true);
+  const [error, setError] = useState<UseEndpointPackageInfo[2]>();
+
+  useEffect(() => {
+    sendGetEndpointSecurityPackage(http)
+      .then((packageInfo) => setEndpointPackage(packageInfo))
+      .catch((apiError) => setError(apiError))
+      .finally(() => setIsFetching(false));
+  }, [http]);
+
+  return [endpointPackage, isFetching, error];
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
index e80856f35081bf..5e721cadfa8234 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/ingest_manager_integration/configure_datasource.tsx
@@ -32,6 +32,7 @@ export const ConfigureEndpointDatasource = memo<CustomConfigureDatasourceContent
 
     return (
       <EuiEmptyPrompt
+        data-test-subj={`endpointDatasourceConfig_${from === 'edit' ? 'edit' : 'create'}`}
         body={
           <EuiText>
             <p>
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
index 24254530f75dbb..090a16a7636645 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_list.tsx
@@ -21,6 +21,7 @@ import {
   EuiConfirmModal,
   EuiCallOut,
   EuiSpacer,
+  EuiButton,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -40,6 +41,9 @@ import { ManagementPageView } from '../../../components/management_page_view';
 import { SpyRoute } from '../../../../common/utils/route/spy_routes';
 import { getManagementUrl } from '../../../common/routing';
 import { FormattedDateAndTime } from '../../../../common/components/endpoint/formatted_date_time';
+import { useNavigateToAppEventHandler } from '../../../../common/hooks/endpoint/use_navigate_to_app_event_handler';
+import { CreateDatasourceRouteState } from '../../../../../../ingest_manager/public';
+import { useEndpointPackageInfo } from './ingest_hooks';
 
 interface TableChangeCallbackArguments {
   page: { index: number; size: number };
@@ -121,6 +125,7 @@ export const PolicyList = React.memo(() => {
   const [policyIdToDelete, setPolicyIdToDelete] = useState<string>('');
 
   const dispatch = useDispatch<(action: PolicyListAction) => void>();
+  const [packageInfo, isFetchingPackageInfo] = useEndpointPackageInfo();
   const {
     selectPolicyItems: policyItems,
     selectPageIndex: pageIndex,
@@ -133,6 +138,28 @@ export const PolicyList = React.memo(() => {
     selectAgentStatusSummary: agentStatusSummary,
   } = usePolicyListSelector(selector);
 
+  const handleCreatePolicyClick = useNavigateToAppEventHandler<CreateDatasourceRouteState>(
+    'ingestManager',
+    {
+      // We redirect to Ingest's Integaration page if we can't get the package version, and
+      // to the Integration Endpoint Package Add Datasource if we have package information.
+      // Also,
+      // We pass along soem state information so that the Ingest page can change the behaviour
+      // of the cancel and submit buttons and redirect the user back to endpoint policy
+      path: `#/integrations${packageInfo ? `/endpoint-${packageInfo.version}/add-datasource` : ''}`,
+      state: {
+        onCancelNavigateTo: [
+          'securitySolution',
+          { path: getManagementUrl({ name: 'policyList' }) },
+        ],
+        onCancelUrl: services.application?.getUrlForApp('securitySolution', {
+          path: getManagementUrl({ name: 'policyList' }),
+        }),
+        onSaveNavigateTo: ['securitySolution', { path: getManagementUrl({ name: 'policyList' }) }],
+      },
+    }
+  );
+
   useEffect(() => {
     if (apiError) {
       notifications.toasts.danger({
@@ -369,6 +396,19 @@ export const PolicyList = React.memo(() => {
         headerLeft={i18n.translate('xpack.securitySolution.endpoint.policyList.viewTitle', {
           defaultMessage: 'Policies',
         })}
+        headerRight={
+          <EuiButton
+            iconType="plusInCircle"
+            onClick={handleCreatePolicyClick}
+            isDisabled={isFetchingPackageInfo}
+            data-test-subj="headerCreateNewPolicyButton"
+          >
+            <FormattedMessage
+              id="xpack.securitySolution.endpoint.policyList.createNewButton"
+              defaultMessage="Create new policy"
+            />
+          </EuiButton>
+        }
         bodyHeader={
           <EuiText color="subdued" data-test-subj="policyTotalCount">
             <FormattedMessage
diff --git a/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx
index bce811c58e4367..553cb8c63db987 100644
--- a/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/ip_overview/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
 import { networkModel } from '../../store';
@@ -26,10 +27,11 @@ import { NarrowDateRange } from '../../../common/components/ml/types';
 describe('IP Overview Component', () => {
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
index 70c952b1107451..580a5420f1c345 100644
--- a/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/kpi_network/index.test.tsx
@@ -8,7 +8,12 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
-import { apolloClientObservable, mockGlobalState, SUB_PLUGINS_REDUCER } from '../../../common/mock';
+import {
+  apolloClientObservable,
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
+} from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
 import { KpiNetworkComponent } from '.';
 import { mockData } from './mock';
@@ -19,10 +24,11 @@ describe('KpiNetwork Component', () => {
   const to = new Date('2019-06-18T06:00:00.000Z').valueOf();
   const narrowDateRange = jest.fn();
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
index 25449214b6e773..036ebedd6b88ef 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_dns_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { State, createStore } from '../../../common/store';
 import { networkModel } from '../../store';
@@ -26,11 +27,12 @@ import { mockData } from './mock';
 describe('NetworkTopNFlow Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
index e9020421a411e6..39fad58ca3528b 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_http_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
@@ -27,11 +28,12 @@ describe('NetworkHttp Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
index 8552d3184fcc2d..8b1dbc8c558b6e 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.test.tsx
@@ -17,6 +17,7 @@ import {
   mockIndexPattern,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
@@ -30,10 +31,11 @@ describe('NetworkTopCountries Table Component', () => {
   const state: State = mockGlobalState;
   const mount = useMountAppended();
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
index e40bbd40f4cd28..4de04f673d879f 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_n_flow_table/index.test.tsx
@@ -16,6 +16,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
@@ -27,11 +28,12 @@ describe('NetworkTopNFlow Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
index ffb68f4df82029..acbe974f914d7e 100644
--- a/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/tls_table/index.test.tsx
@@ -15,6 +15,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
@@ -26,11 +27,12 @@ describe('Tls Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('Rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx b/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
index 981e182154c5e7..f0d4d7fbeefc60 100644
--- a/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/users_table/index.test.tsx
@@ -16,6 +16,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
@@ -28,11 +29,12 @@ describe('Users Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   const mount = useMountAppended();
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   describe('Rendering', () => {
diff --git a/x-pack/plugins/security_solution/public/network/index.ts b/x-pack/plugins/security_solution/public/network/index.ts
index 6590e5ee5161c1..63291ad2d2396a 100644
--- a/x-pack/plugins/security_solution/public/network/index.ts
+++ b/x-pack/plugins/security_solution/public/network/index.ts
@@ -4,16 +4,22 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Storage } from '../../../../../src/plugins/kibana_utils/public';
 import { SecuritySubPluginWithStore } from '../app/types';
 import { getNetworkRoutes } from './routes';
 import { initialNetworkState, networkReducer, NetworkState } from './store';
+import { TimelineId } from '../../common/types/timeline';
+import { getTimelinesInStorageByIds } from '../timelines/containers/local_storage';
 
 export class Network {
   public setup() {}
 
-  public start(): SecuritySubPluginWithStore<'network', NetworkState> {
+  public start(storage: Storage): SecuritySubPluginWithStore<'network', NetworkState> {
     return {
       routes: getNetworkRoutes(),
+      storageTimelines: {
+        timelineById: getTimelinesInStorageByIds(storage, [TimelineId.networkPageExternalAlerts]),
+      },
       store: {
         initialState: { network: initialNetworkState },
         reducer: { network: networkReducer },
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
index 22a5d7af88eb89..bbb964ae17b9f0 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/index.test.tsx
@@ -20,6 +20,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { useMountAppended } from '../../../common/utils/use_mount_appended';
 import { createStore, State } from '../../../common/store';
@@ -118,10 +119,11 @@ describe('Ip Details', () => {
   });
 
   const state: State = mockGlobalState;
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     localSource = cloneDeep(mocksSource);
   });
 
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/alerts_query_tab_body.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/alerts_query_tab_body.tsx
index c5f59e751ca9ae..0c9f8c194bf2b4 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/alerts_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/alerts_query_tab_body.tsx
@@ -7,6 +7,7 @@
 import React from 'react';
 
 import { Filter } from '../../../../../../../src/plugins/data/common/es_query';
+import { TimelineId } from '../../../../common/types/timeline';
 import { AlertsView } from '../../../common/components/alerts_viewer';
 import { NetworkComponentQueryProps } from './types';
 
@@ -62,7 +63,11 @@ export const filterNetworkData: Filter[] = [
 ];
 
 export const NetworkAlertsQueryTabBody = React.memo((alertsProps: NetworkComponentQueryProps) => (
-  <AlertsView {...alertsProps} pageFilters={filterNetworkData} />
+  <AlertsView
+    timelineId={TimelineId.networkPageExternalAlerts}
+    {...alertsProps}
+    pageFilters={filterNetworkData}
+  />
 ));
 
 NetworkAlertsQueryTabBody.displayName = 'NetworkAlertsQueryTabBody';
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
index 23948209fccfe7..e1078dee3eb0d7 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
@@ -18,6 +18,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../common/mock';
 import { State, createStore } from '../../common/store';
 import { inputsActions } from '../../common/store/inputs';
@@ -155,7 +156,8 @@ describe('rendering - rendering', () => {
     ];
     localSource[0].result.data.source.status.indicesExist = true;
     const myState: State = mockGlobalState;
-    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    const { storage } = createSecuritySolutionStorageMock();
+    const myStore = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     const wrapper = mount(
       <TestProviders store={myStore}>
         <MockedProvider mocks={localSource} addTypename={false}>
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
index 49347ab8105479..8b04c329731ab8 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 
 import { OverviewHost } from '.';
@@ -92,11 +93,12 @@ const mockOpenTimelineQueryResults: MockedProvidedQuery[] = [
 describe('OverviewHost', () => {
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
     const myState = cloneDeep(state);
-    store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   test('it renders the expected widget title', () => {
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
index 4451135c608ced..2fcf6f83f0ae0e 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
@@ -13,6 +13,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 
 import { OverviewNetwork } from '.';
@@ -83,11 +84,12 @@ const mockOpenTimelineQueryResults: MockedProvidedQuery[] = [
 describe('OverviewNetwork', () => {
   const state: State = mockGlobalState;
 
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
     const myState = cloneDeep(state);
-    store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(myState, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   });
 
   test('it renders the expected widget title', () => {
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index e3d3062ee9cf7f..b9eef9f799d3b9 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -14,6 +14,7 @@ import {
   Plugin as IPlugin,
   DEFAULT_APP_CATEGORIES,
 } from '../../../../src/core/public';
+import { Storage } from '../../../../src/plugins/kibana_utils/public';
 import { FeatureCatalogueCategory } from '../../../../src/plugins/home/public';
 import { initTelemetry } from './common/lib/telemetry';
 import { KibanaServices } from './common/lib/kibana/services';
@@ -50,12 +51,14 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     plugins.triggers_actions_ui.actionTypeRegistry.register(jiraActionType());
 
     const mountSecurityApp = async (params: AppMountParameters) => {
+      const storage = new Storage(localStorage);
       const [coreStart, startPlugins] = await core.getStartServices();
       const { renderApp } = await import('./app');
       const services = {
         ...coreStart,
         ...startPlugins,
         security: plugins.security,
+        storage,
       } as StartServices;
 
       const alertsSubPlugin = new (await import('./alerts')).Alerts();
@@ -67,15 +70,27 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       const endpointAlertsSubPlugin = new (await import('./endpoint_alerts')).EndpointAlerts();
       const managementSubPlugin = new (await import('./management')).Management();
 
-      const alertsStart = alertsSubPlugin.start();
+      const alertsStart = alertsSubPlugin.start(storage);
       const casesStart = casesSubPlugin.start();
-      const hostsStart = hostsSubPlugin.start();
-      const networkStart = networkSubPlugin.start();
+      const hostsStart = hostsSubPlugin.start(storage);
+      const networkStart = networkSubPlugin.start(storage);
       const overviewStart = overviewSubPlugin.start();
       const timelinesStart = timelinesSubPlugin.start();
       const endpointAlertsStart = endpointAlertsSubPlugin.start(coreStart, startPlugins);
       const managementSubPluginStart = managementSubPlugin.start(coreStart, startPlugins);
 
+      const timelineInitialState = {
+        timeline: {
+          ...timelinesStart.store.initialState.timeline!,
+          timelineById: {
+            ...timelinesStart.store.initialState.timeline!.timelineById,
+            ...alertsStart.storageTimelines!.timelineById,
+            ...hostsStart.storageTimelines!.timelineById,
+            ...networkStart.storageTimelines!.timelineById,
+          },
+        },
+      };
+
       return renderApp(services, params, {
         routes: [
           ...alertsStart.routes,
@@ -91,7 +106,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
           initialState: {
             ...hostsStart.store.initialState,
             ...networkStart.store.initialState,
-            ...timelinesStart.store.initialState,
+            ...timelineInitialState,
             ...endpointAlertsStart.store.initialState,
             ...managementSubPluginStart.store.initialState,
           },
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
index d86c20d1e44504..932cde32f3d43c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/index.test.tsx
@@ -14,6 +14,7 @@ import {
   mockGlobalState,
   TestProviders,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../common/mock';
 import { createStore, State } from '../../../common/store';
 import { mockDataProviders } from '../timeline/data_providers/mock/mock_data_providers';
@@ -31,6 +32,7 @@ const usersViewing = ['elastic'];
 
 describe('Flyout', () => {
   const state: State = mockGlobalState;
+  const { storage } = createSecuritySolutionStorageMock();
 
   describe('rendering', () => {
     test('it renders correctly against snapshot', () => {
@@ -59,7 +61,8 @@ describe('Flyout', () => {
       const storeShowIsTrue = createStore(
         stateShowIsTrue,
         SUB_PLUGINS_REDUCER,
-        apolloClientObservable
+        apolloClientObservable,
+        storage
       );
 
       const wrapper = mount(
@@ -82,7 +85,8 @@ describe('Flyout', () => {
       const storeWithDataProviders = createStore(
         stateWithDataProviders,
         SUB_PLUGINS_REDUCER,
-        apolloClientObservable
+        apolloClientObservable,
+        storage
       );
 
       const wrapper = mount(
@@ -103,7 +107,8 @@ describe('Flyout', () => {
       const storeWithDataProviders = createStore(
         stateWithDataProviders,
         SUB_PLUGINS_REDUCER,
-        apolloClientObservable
+        apolloClientObservable,
+        storage
       );
 
       const wrapper = mount(
@@ -136,7 +141,8 @@ describe('Flyout', () => {
       const storeWithDataProviders = createStore(
         stateWithDataProviders,
         SUB_PLUGINS_REDUCER,
-        apolloClientObservable
+        apolloClientObservable,
+        storage
       );
 
       const wrapper = mount(
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/actions/index.tsx
index 02ebfd7f752b55..3352639fa95f82 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/actions/index.tsx
@@ -48,7 +48,7 @@ export const Actions = React.memo<Props>(({ header, onColumnRemoved, sort, isLoa
     <>
       {sort.columnId === header.id && isLoading ? (
         <EventsHeadingExtra className="siemEventsHeading__extra--loading">
-          <EventsLoading />
+          <EventsLoading data-test-subj="timeline-loading-spinner" />
         </EventsHeadingExtra>
       ) : (
         <EventsHeadingExtra className="siemEventsHeading__extra--close">
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap
index fcf0f1019e67ac..f155b379227f0e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/__snapshots__/index.test.tsx.snap
@@ -33,24 +33,28 @@ exports[`Footer Timeline Component rendering it renders the default timeline foo
           items={
             Array [
               <EuiContextMenuItem
+                data-test-subj="items-per-page-option-1"
                 icon="empty"
                 onClick={[Function]}
               >
                 1 rows
               </EuiContextMenuItem>,
               <EuiContextMenuItem
+                data-test-subj="items-per-page-option-5"
                 icon="empty"
                 onClick={[Function]}
               >
                 5 rows
               </EuiContextMenuItem>,
               <EuiContextMenuItem
+                data-test-subj="items-per-page-option-10"
                 icon="empty"
                 onClick={[Function]}
               >
                 10 rows
               </EuiContextMenuItem>,
               <EuiContextMenuItem
+                data-test-subj="items-per-page-option-20"
                 icon="empty"
                 onClick={[Function]}
               >
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
index 594bf6d43e2851..4e1595eef984c0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/footer/index.tsx
@@ -144,6 +144,7 @@ export const EventsCountComponent = ({
                 iconType="arrowDown"
                 iconSide="right"
                 onClick={onClick}
+                data-test-subj="local-events-count-button"
               />
             </EuiBadge>
             {` ${i18n.OF} `}
@@ -289,6 +290,7 @@ export const FooterComponent = ({
       <EuiContextMenuItem
         key={item}
         icon={itemsPerPage === item ? 'check' : 'empty'}
+        data-test-subj={`items-per-page-option-${item}`}
         onClick={() => {
           closePopover();
           onChangeItemsPerPage(item);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
index 660beffd9a0893..c67efe204eb0e2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/index.test.tsx
@@ -11,6 +11,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
   TestProviders,
 } from '../../../../common/mock';
 import { createStore, State } from '../../../../common/store';
@@ -97,12 +98,14 @@ const defaultProps = {
 };
 describe('Properties', () => {
   const state: State = mockGlobalState;
+  const { storage } = createSecuritySolutionStorageMock();
   let mockedWidth = 1000;
-  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
 
   beforeEach(() => {
     jest.clearAllMocks();
-    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
     (useThrottledResizeObserver as jest.Mock).mockReturnValue({ width: mockedWidth });
   });
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
index 879302d4a92c1f..cd6233334c5de0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/new_template_timeline.test.tsx
@@ -11,6 +11,7 @@ import {
   mockGlobalState,
   apolloClientObservable,
   SUB_PLUGINS_REDUCER,
+  createSecuritySolutionStorageMock,
 } from '../../../../common/mock';
 import { createStore, State } from '../../../../common/store';
 import { useKibana } from '../../../../common/lib/kibana';
@@ -24,7 +25,8 @@ jest.mock('../../../../common/lib/kibana', () => {
 
 describe('NewTemplateTimeline', () => {
   const state: State = mockGlobalState;
-  const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable);
+  const { storage } = createSecuritySolutionStorageMock();
+  const store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
   const mockClosePopover = jest.fn();
   const mockTitle = 'NEW_TIMELINE';
   let wrapper: ReactWrapper;
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
index 7363a609742754..6a6d74cc91508a 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
@@ -11,6 +11,7 @@ import { Query } from 'react-apollo';
 import { compose, Dispatch } from 'redux';
 import { connect, ConnectedProps } from 'react-redux';
 
+import { TimelineId } from '../../../common/types/timeline';
 import { DEFAULT_INDEX_KEY } from '../../../common/constants';
 import { IIndexPattern } from '../../../../../../src/plugins/data/common/index_patterns';
 import {
@@ -27,7 +28,8 @@ import { QueryTemplate, QueryTemplateProps } from '../../common/containers/query
 import { EventType } from '../../timelines/store/timeline/model';
 import { timelineQuery } from './index.gql_query';
 import { timelineActions } from '../../timelines/store/timeline';
-import { ALERTS_TABLE_TIMELINE_ID } from '../../alerts/components/alerts_table';
+
+const timelineIds = [TimelineId.alertsPage, TimelineId.alertsRulesDetailsPage];
 
 export interface TimelineArgs {
   events: TimelineItem[];
@@ -182,7 +184,7 @@ const makeMapStateToProps = () => {
 
 const mapDispatchToProps = (dispatch: Dispatch) => ({
   clearSignalsState: ({ id }: { id?: string }) => {
-    if (id != null && id === ALERTS_TABLE_TIMELINE_ID) {
+    if (id != null && timelineIds.some((timelineId) => timelineId === id)) {
       dispatch(timelineActions.clearEventsLoading({ id }));
       dispatch(timelineActions.clearEventsDeleted({ id }));
     }
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.test.ts b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.test.ts
new file mode 100644
index 00000000000000..e1bccbdff48899
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.test.ts
@@ -0,0 +1,168 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  LOCAL_STORAGE_TIMELINE_KEY,
+  useTimelinesStorage,
+  getTimelinesInStorageByIds,
+  getAllTimelinesInStorage,
+  addTimelineInStorage,
+} from '.';
+
+import { TimelineId } from '../../../../common/types/timeline';
+import { mockTimelineModel, createSecuritySolutionStorageMock } from '../../../common/mock';
+import { useKibana } from '../../../common/lib/kibana';
+import { createUseKibanaMock } from '../../../common/mock/kibana_react';
+
+jest.mock('../../../common/lib/kibana');
+
+const useKibanaMock = useKibana as jest.Mock;
+
+describe('SiemLocalStorage', () => {
+  const { localStorage, storage } = createSecuritySolutionStorageMock();
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    useKibanaMock.mockImplementation(() => ({
+      services: {
+        ...createUseKibanaMock()().services,
+        storage,
+      },
+    }));
+    localStorage.clear();
+  });
+
+  describe('addTimeline', () => {
+    it('adds a timeline when storage is empty', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      expect(JSON.parse(localStorage.getItem(LOCAL_STORAGE_TIMELINE_KEY))).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+      });
+    });
+
+    it('adds a timeline when storage contains another timelines', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      timelineStorage.addTimeline(TimelineId.hostsPageExternalAlerts, mockTimelineModel);
+      expect(JSON.parse(localStorage.getItem(LOCAL_STORAGE_TIMELINE_KEY))).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+        [TimelineId.hostsPageExternalAlerts]: mockTimelineModel,
+      });
+    });
+  });
+
+  describe('getAllTimelines', () => {
+    it('gets all timelines correctly', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      timelineStorage.addTimeline(TimelineId.hostsPageExternalAlerts, mockTimelineModel);
+      const timelines = timelineStorage.getAllTimelines();
+      expect(timelines).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+        [TimelineId.hostsPageExternalAlerts]: mockTimelineModel,
+      });
+    });
+
+    it('returns an empty object if there is no timelines', () => {
+      const timelineStorage = useTimelinesStorage();
+      const timelines = timelineStorage.getAllTimelines();
+      expect(timelines).toEqual({});
+    });
+  });
+
+  describe('getTimelineById', () => {
+    it('gets a timeline by id', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      const timeline = timelineStorage.getTimelineById(TimelineId.hostsPageEvents);
+      expect(timeline).toEqual(mockTimelineModel);
+    });
+  });
+
+  describe('getTimelinesInStorageByIds', () => {
+    it('gets timelines correctly', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      timelineStorage.addTimeline(TimelineId.hostsPageExternalAlerts, mockTimelineModel);
+      const timelines = getTimelinesInStorageByIds(storage, [
+        TimelineId.hostsPageEvents,
+        TimelineId.hostsPageExternalAlerts,
+      ]);
+      expect(timelines).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+        [TimelineId.hostsPageExternalAlerts]: mockTimelineModel,
+      });
+    });
+
+    it('gets an empty timelime when there is no timelines', () => {
+      const timelines = getTimelinesInStorageByIds(storage, [TimelineId.hostsPageEvents]);
+      expect(timelines).toEqual({});
+    });
+
+    it('returns empty timelime when there is no ids', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      const timelines = getTimelinesInStorageByIds(storage, []);
+      expect(timelines).toEqual({});
+    });
+
+    it('returns empty timelime when a specific timeline does not exists', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      const timelines = getTimelinesInStorageByIds(storage, [TimelineId.hostsPageExternalAlerts]);
+      expect(timelines).toEqual({});
+    });
+
+    it('returns timelines correctly when one exist and another not', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      const timelines = getTimelinesInStorageByIds(storage, [
+        TimelineId.hostsPageEvents,
+        TimelineId.hostsPageExternalAlerts,
+      ]);
+      expect(timelines).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+      });
+    });
+  });
+
+  describe('getAllTimelinesInStorage', () => {
+    it('gets timelines correctly', () => {
+      const timelineStorage = useTimelinesStorage();
+      timelineStorage.addTimeline(TimelineId.hostsPageEvents, mockTimelineModel);
+      timelineStorage.addTimeline(TimelineId.hostsPageExternalAlerts, mockTimelineModel);
+      const timelines = getAllTimelinesInStorage(storage);
+      expect(timelines).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+        [TimelineId.hostsPageExternalAlerts]: mockTimelineModel,
+      });
+    });
+
+    it('gets an empty timeline when there is no timelines', () => {
+      const timelines = getAllTimelinesInStorage(storage);
+      expect(timelines).toEqual({});
+    });
+  });
+
+  describe('addTimelineInStorage', () => {
+    it('adds a timeline when storage is empty', () => {
+      addTimelineInStorage(storage, TimelineId.hostsPageEvents, mockTimelineModel);
+      expect(JSON.parse(localStorage.getItem(LOCAL_STORAGE_TIMELINE_KEY))).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+      });
+    });
+
+    it('adds a timeline when storage contains another timelines', () => {
+      addTimelineInStorage(storage, TimelineId.hostsPageEvents, mockTimelineModel);
+      addTimelineInStorage(storage, TimelineId.hostsPageExternalAlerts, mockTimelineModel);
+      expect(JSON.parse(localStorage.getItem(LOCAL_STORAGE_TIMELINE_KEY))).toEqual({
+        [TimelineId.hostsPageEvents]: mockTimelineModel,
+        [TimelineId.hostsPageExternalAlerts]: mockTimelineModel,
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
new file mode 100644
index 00000000000000..1a09868da77716
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Storage } from '../../../../../../../src/plugins/kibana_utils/public';
+import { TimelinesStorage } from './types';
+import { useKibana } from '../../../common/lib/kibana';
+import { TimelineModel } from '../../store/timeline/model';
+import { TimelineIdLiteral } from '../../../../common/types/timeline';
+
+export const LOCAL_STORAGE_TIMELINE_KEY = 'timelines';
+const EMPTY_TIMELINE = {} as {
+  [K in TimelineIdLiteral]: TimelineModel;
+};
+
+export const getTimelinesInStorageByIds = (storage: Storage, timelineIds: TimelineIdLiteral[]) => {
+  const allTimelines = storage.get(LOCAL_STORAGE_TIMELINE_KEY);
+
+  if (!allTimelines) {
+    return EMPTY_TIMELINE;
+  }
+
+  return timelineIds.reduce((acc, timelineId) => {
+    const timelineModel = allTimelines[timelineId];
+    if (!timelineModel) {
+      return {
+        ...acc,
+      };
+    }
+
+    return {
+      ...acc,
+      [timelineId]: timelineModel,
+    };
+  }, {} as { [K in TimelineIdLiteral]: TimelineModel });
+};
+
+export const getAllTimelinesInStorage = (storage: Storage) =>
+  storage.get(LOCAL_STORAGE_TIMELINE_KEY) ?? {};
+
+export const addTimelineInStorage = (
+  storage: Storage,
+  id: TimelineIdLiteral,
+  timeline: TimelineModel
+) => {
+  const timelines = getAllTimelinesInStorage(storage);
+  storage.set(LOCAL_STORAGE_TIMELINE_KEY, {
+    ...timelines,
+    [id]: timeline,
+  });
+};
+
+export const useTimelinesStorage = (): TimelinesStorage => {
+  const { storage } = useKibana().services;
+
+  const getAllTimelines: TimelinesStorage['getAllTimelines'] = () =>
+    getAllTimelinesInStorage(storage);
+
+  const getTimelineById: TimelinesStorage['getTimelineById'] = (id: TimelineIdLiteral) =>
+    getTimelinesInStorageByIds(storage, [id])[id] ?? null;
+
+  const addTimeline: TimelinesStorage['addTimeline'] = (id, timeline) =>
+    addTimelineInStorage(storage, id, timeline);
+
+  return { getAllTimelines, getTimelineById, addTimeline };
+};
+
+export { TimelinesStorage };
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/types.ts b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/types.ts
new file mode 100644
index 00000000000000..d888f3bb8b332e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/types.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { TimelineModel } from '../../../timelines/store/timeline/model';
+import { TimelineIdLiteral } from '../../../../common/types/timeline';
+
+export interface TimelinesStorage {
+  getAllTimelines: () => Record<TimelineIdLiteral, TimelineModel>;
+  getTimelineById: (id: TimelineIdLiteral) => TimelineModel | null;
+  addTimeline: (id: TimelineIdLiteral, timeline: TimelineModel) => void;
+}
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
index 5a7e5e078c7994..2155dc804aa7ed 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
@@ -15,7 +15,7 @@ import {
 } from 'lodash/fp';
 import { Action } from 'redux';
 import { Epic } from 'redux-observable';
-import { from, Observable, empty, merge } from 'rxjs';
+import { from, empty, merge } from 'rxjs';
 import {
   filter,
   map,
@@ -34,16 +34,14 @@ import {
   MatchAllFilter,
 } from '../../../../../../.../../../src/plugins/data/public';
 import { TimelineStatus } from '../../../../common/types/timeline';
+import { inputsModel } from '../../../common/store/inputs';
 import {
   TimelineType,
   TimelineInput,
   ResponseTimeline,
   TimelineResult,
 } from '../../../graphql/types';
-import { AppApolloClient } from '../../../common/lib/lib';
 import { addError } from '../../../common/store/app/actions';
-import { NotesById } from '../../../common/store/app/model';
-import { inputsModel } from '../../../common/store/inputs';
 
 import {
   applyKqlFilterQuery,
@@ -80,18 +78,10 @@ import { epicPersistTimelineFavorite, timelineFavoriteActionsType } from './epic
 import { isNotNull } from './helpers';
 import { dispatcherTimelinePersistQueue } from './epic_dispatcher_timeline_persistence_queue';
 import { myEpicTimelineId } from './my_epic_timeline_id';
-import { ActionTimeline, TimelineById } from './types';
+import { ActionTimeline, TimelineEpicDependencies } from './types';
 import { persistTimeline } from '../../containers/api';
 import { ALL_TIMELINE_QUERY_ID } from '../../containers/all';
 
-interface TimelineEpicDependencies<State> {
-  timelineByIdSelector: (state: State) => TimelineById;
-  timelineTimeRangeSelector: (state: State) => inputsModel.TimeRange;
-  selectAllTimelineQuery: () => (state: State, id: string) => inputsModel.GlobalQuery;
-  selectNotesByIdSelector: (state: State) => NotesById;
-  apolloClient$: Observable<AppApolloClient>;
-}
-
 const timelineActionsType = [
   applyKqlFilterQuery.type,
   addProvider.type,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
new file mode 100644
index 00000000000000..34778aba7873cc
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.test.tsx
@@ -0,0 +1,176 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import {
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+  apolloClientObservable,
+  TestProviders,
+  defaultHeaders,
+  createSecuritySolutionStorageMock,
+  mockIndexPattern,
+} from '../../../common/mock';
+
+import { createStore, State } from '../../../common/store';
+import {
+  removeColumn,
+  upsertColumn,
+  applyDeltaToColumnWidth,
+  updateColumns,
+  updateItemsPerPage,
+  updateSort,
+} from './actions';
+
+import {
+  TimelineComponent,
+  Props as TimelineComponentProps,
+} from '../../components/timeline/timeline';
+import { mockBrowserFields } from '../../../common/containers/source/mock';
+import { mockDataProviders } from '../../components/timeline/data_providers/mock/mock_data_providers';
+import { Sort } from '../../components/timeline/body/sort';
+import { Direction } from '../../../graphql/types';
+
+import { addTimelineInStorage } from '../../containers/local_storage';
+import { isPageTimeline } from './epic_local_storage';
+
+jest.mock('../../containers/local_storage');
+
+const wait = (ms: number = 500): Promise<void> => {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+};
+
+const addTimelineInStorageMock = addTimelineInStorage as jest.Mock;
+
+describe('epicLocalStorage', () => {
+  const state: State = mockGlobalState;
+  const { storage } = createSecuritySolutionStorageMock();
+  let store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+
+  let props = {} as TimelineComponentProps;
+  const sort: Sort = {
+    columnId: '@timestamp',
+    sortDirection: Direction.desc,
+  };
+  const startDate = new Date('2018-03-23T18:49:23.132Z').valueOf();
+  const endDate = new Date('2018-03-24T03:33:52.253Z').valueOf();
+
+  const indexPattern = mockIndexPattern;
+
+  beforeEach(() => {
+    store = createStore(state, SUB_PLUGINS_REDUCER, apolloClientObservable, storage);
+    props = {
+      browserFields: mockBrowserFields,
+      columns: defaultHeaders,
+      id: 'foo',
+      dataProviders: mockDataProviders,
+      end: endDate,
+      eventType: 'raw' as TimelineComponentProps['eventType'],
+      filters: [],
+      indexPattern,
+      indexToAdd: [],
+      isLive: false,
+      itemsPerPage: 5,
+      itemsPerPageOptions: [5, 10, 20],
+      kqlMode: 'search' as TimelineComponentProps['kqlMode'],
+      kqlQueryExpression: '',
+      loadingIndexName: false,
+      onChangeItemsPerPage: jest.fn(),
+      onClose: jest.fn(),
+      onDataProviderEdited: jest.fn(),
+      onDataProviderRemoved: jest.fn(),
+      onToggleDataProviderEnabled: jest.fn(),
+      onToggleDataProviderExcluded: jest.fn(),
+      show: true,
+      showCallOutUnauthorizedMsg: false,
+      start: startDate,
+      sort,
+      toggleColumn: jest.fn(),
+      usersViewing: ['elastic'],
+    };
+  });
+
+  it('filters correctly page timelines', () => {
+    expect(isPageTimeline('timeline-1')).toBe(false);
+    expect(isPageTimeline('hosts-page-alerts')).toBe(true);
+  });
+
+  it('persist adding / reordering of a column correctly', async () => {
+    shallow(
+      <TestProviders store={store}>
+        <TimelineComponent {...props} />
+      </TestProviders>
+    );
+    store.dispatch(upsertColumn({ id: 'test', index: 1, column: defaultHeaders[0] }));
+    await wait();
+    expect(addTimelineInStorageMock).toHaveBeenCalled();
+  });
+
+  it('persist timeline when removing a column ', async () => {
+    shallow(
+      <TestProviders store={store}>
+        <TimelineComponent {...props} />
+      </TestProviders>
+    );
+    store.dispatch(removeColumn({ id: 'test', columnId: '@timestamp' }));
+    await wait();
+    expect(addTimelineInStorageMock).toHaveBeenCalled();
+  });
+
+  it('persists resizing of a column', async () => {
+    shallow(
+      <TestProviders store={store}>
+        <TimelineComponent {...props} />
+      </TestProviders>
+    );
+    store.dispatch(applyDeltaToColumnWidth({ id: 'test', columnId: '@timestamp', delta: 80 }));
+    await wait();
+    expect(addTimelineInStorageMock).toHaveBeenCalled();
+  });
+
+  it('persist the resetting of the fields', async () => {
+    shallow(
+      <TestProviders store={store}>
+        <TimelineComponent {...props} />
+      </TestProviders>
+    );
+    store.dispatch(updateColumns({ id: 'test', columns: defaultHeaders }));
+    await wait();
+    expect(addTimelineInStorageMock).toHaveBeenCalled();
+  });
+
+  it('persist items per page', async () => {
+    shallow(
+      <TestProviders store={store}>
+        <TimelineComponent {...props} />
+      </TestProviders>
+    );
+    store.dispatch(updateItemsPerPage({ id: 'test', itemsPerPage: 50 }));
+    await wait();
+    expect(addTimelineInStorageMock).toHaveBeenCalled();
+  });
+
+  it('persist the sorting of a column', async () => {
+    shallow(
+      <TestProviders store={store}>
+        <TimelineComponent {...props} />
+      </TestProviders>
+    );
+    store.dispatch(
+      updateSort({
+        id: 'test',
+        sort: {
+          columnId: 'event.severity',
+          sortDirection: Direction.desc,
+        },
+      })
+    );
+    await wait();
+    expect(addTimelineInStorageMock).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.ts
new file mode 100644
index 00000000000000..b3d1db23ffae8a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic_local_storage.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Action } from 'redux';
+import { map, filter, ignoreElements, tap, withLatestFrom, delay } from 'rxjs/operators';
+import { Epic } from 'redux-observable';
+import { get } from 'lodash/fp';
+
+import { TimelineIdLiteral } from '../../../../common/types/timeline';
+import { addTimelineInStorage } from '../../containers/local_storage';
+
+import {
+  removeColumn,
+  upsertColumn,
+  applyDeltaToColumnWidth,
+  updateColumns,
+  updateItemsPerPage,
+  updateSort,
+} from './actions';
+import { TimelineEpicDependencies } from './types';
+import { isNotNull } from './helpers';
+
+const timelineActionTypes = [
+  removeColumn.type,
+  upsertColumn.type,
+  applyDeltaToColumnWidth.type,
+  updateColumns.type,
+  updateItemsPerPage.type,
+  updateSort.type,
+];
+
+export const isPageTimeline = (timelineId: string | undefined): boolean =>
+  // Is not a flyout timeline
+  !(timelineId && timelineId.toLowerCase().startsWith('timeline'));
+
+export const createTimelineLocalStorageEpic = <State>(): Epic<
+  Action,
+  Action,
+  State,
+  TimelineEpicDependencies<State>
+> => (action$, state$, { timelineByIdSelector, storage }) => {
+  const timeline$ = state$.pipe(map(timelineByIdSelector), filter(isNotNull));
+  return action$.pipe(
+    delay(500),
+    withLatestFrom(timeline$),
+    filter(([action]) => isPageTimeline(get('payload.id', action))),
+    tap(([action, timelineById]) => {
+      if (timelineActionTypes.includes(action.type)) {
+        if (storage) {
+          const timelineId: TimelineIdLiteral = get('payload.id', action);
+          addTimelineInStorage(storage, timelineId, timelineById[timelineId]);
+        }
+      }
+    }),
+    ignoreElements()
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
index 03e9ca176ee821..15f956fa79d3cc 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/helpers.ts
@@ -23,22 +23,10 @@ import { TimelineTypeLiteral } from '../../../../common/types/timeline';
 
 import { timelineDefaults } from './defaults';
 import { ColumnHeaderOptions, KqlMode, TimelineModel, EventType } from './model';
-import { TimelineById, TimelineState } from './types';
-
-const EMPTY_TIMELINE_BY_ID: TimelineById = {}; // stable reference
+import { TimelineById } from './types';
 
 export const isNotNull = <T>(value: T | null): value is T => value !== null;
 
-export const initialTimelineState: TimelineState = {
-  timelineById: EMPTY_TIMELINE_BY_ID,
-  autoSavedWarningMsg: {
-    timelineId: null,
-    newTimelineModel: null,
-  },
-  showCallOutUnauthorizedMsg: false,
-  insertTimeline: null,
-};
-
 interface AddTimelineHistoryParams {
   id: string;
   historyId: string;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
index aa6c3086142872..5262c72a6140c9 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/types.ts
@@ -4,6 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { Action } from 'redux';
+import { Observable } from 'rxjs';
+
+import { Storage } from '../../../../../../../src/plugins/kibana_utils/public';
+import { AppApolloClient } from '../../../common/lib/lib';
+import { inputsModel } from '../../../common/store/inputs';
+import { NotesById } from '../../../common/store/app/model';
 import { TimelineModel } from './model';
 
 export interface AutoSavedWarningMsg {
@@ -39,3 +45,12 @@ export interface ActionTimeline extends Action<string> {
     noteId: string;
   };
 }
+
+export interface TimelineEpicDependencies<State> {
+  timelineByIdSelector: (state: State) => TimelineById;
+  timelineTimeRangeSelector: (state: State) => inputsModel.TimeRange;
+  selectAllTimelineQuery: () => (state: State, id: string) => inputsModel.GlobalQuery;
+  selectNotesByIdSelector: (state: State) => NotesById;
+  apolloClient$: Observable<AppApolloClient>;
+  storage: Storage;
+}
diff --git a/x-pack/plugins/security_solution/public/types.ts b/x-pack/plugins/security_solution/public/types.ts
index 6c338d47cf63ce..6d59824702cfa9 100644
--- a/x-pack/plugins/security_solution/public/types.ts
+++ b/x-pack/plugins/security_solution/public/types.ts
@@ -12,6 +12,7 @@ import { Start as NewsfeedStart } from '../../../../src/plugins/newsfeed/public'
 import { Start as InspectorStart } from '../../../../src/plugins/inspector/public';
 import { UiActionsStart } from '../../../../src/plugins/ui_actions/public';
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
+import { Storage } from '../../../../src/plugins/kibana_utils/public';
 import { IngestManagerStart } from '../../ingest_manager/public';
 import {
   TriggersAndActionsUIPublicPluginSetup as TriggersActionsSetup,
@@ -39,6 +40,7 @@ export interface StartPlugins {
 export type StartServices = CoreStart &
   StartPlugins & {
     security: SecurityPluginSetup;
+    storage: Storage;
   };
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
diff --git a/x-pack/plugins/ui_actions_enhanced/README.md b/x-pack/plugins/ui_actions_enhanced/README.md
new file mode 100644
index 00000000000000..1a72a431e39753
--- /dev/null
+++ b/x-pack/plugins/ui_actions_enhanced/README.md
@@ -0,0 +1,3 @@
+# `ui_actions_enhanced`
+
+- [__Dashboard drilldown user docs__](https://www.elastic.co/guide/en/kibana/master/drilldowns.html)
diff --git a/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/monitor_bar_series.test.tsx.snap b/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/monitor_bar_series.test.tsx.snap
index b389139d71dbfe..1db4a87b1c37b0 100644
--- a/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/monitor_bar_series.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/monitor_bar_series.test.tsx.snap
@@ -7,6 +7,10 @@ exports[`MonitorBarSeries component renders if the data series is present 1`] =
   <div
     class="echChart"
   >
+    <div
+      class="echChartBackground"
+      style="background-color:transparent"
+    />
     <div
       class="echChartStatus"
       data-ech-render-complete="false"
@@ -17,15 +21,7 @@ exports[`MonitorBarSeries component renders if the data series is present 1`] =
     />
     <div
       class="echContainer"
-    >
-      <div
-        class="echReactiveChart_unavailable"
-      >
-        <p>
-          No data to display
-        </p>
-      </div>
-    </div>
+    />
   </div>
 </div>
 `;
diff --git a/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/ping_histogram.test.tsx.snap b/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/ping_histogram.test.tsx.snap
index db07faae442729..668e4e0c064a8b 100644
--- a/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/ping_histogram.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/common/charts/__tests__/__snapshots__/ping_histogram.test.tsx.snap
@@ -14,6 +14,10 @@ Array [
     <div
       class="echChart"
     >
+      <div
+        class="echChartBackground"
+        style="background-color:transparent"
+      />
       <div
         class="echChartStatus"
         data-ech-render-complete="false"
@@ -24,15 +28,7 @@ Array [
       />
       <div
         class="echContainer"
-      >
-        <div
-          class="echReactiveChart_unavailable"
-        >
-          <p>
-            No data to display
-          </p>
-        </div>
-      </div>
+      />
     </div>
   </div>,
 ]
diff --git a/x-pack/plugins/uptime/public/pages/__tests__/__snapshots__/page_header.test.tsx.snap b/x-pack/plugins/uptime/public/pages/__tests__/__snapshots__/page_header.test.tsx.snap
index dbdfd6b27e69f5..fcf68ad97c8cec 100644
--- a/x-pack/plugins/uptime/public/pages/__tests__/__snapshots__/page_header.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/pages/__tests__/__snapshots__/page_header.test.tsx.snap
@@ -104,6 +104,29 @@ Array [
             </button>
           </a>
         </div>
+        <div
+          class="euiFlexItem euiFlexItem--flexGrowZero"
+        >
+          <button
+            class="euiButtonEmpty euiButtonEmpty--primary"
+            type="button"
+          >
+            <span
+              class="euiButtonEmpty__content"
+            >
+              <div
+                aria-hidden="true"
+                class="euiButtonEmpty__icon"
+                data-euiicon-type="plusInCircle"
+              />
+              <span
+                class="euiButtonEmpty__text"
+              >
+                Add data
+              </span>
+            </span>
+          </button>
+        </div>
       </div>
     </div>
     <div
diff --git a/x-pack/plugins/uptime/public/pages/page_header.tsx b/x-pack/plugins/uptime/public/pages/page_header.tsx
index 3b228afe904f45..421e0e3a4ebdef 100644
--- a/x-pack/plugins/uptime/public/pages/page_header.tsx
+++ b/x-pack/plugins/uptime/public/pages/page_header.tsx
@@ -12,6 +12,7 @@ import styled from 'styled-components';
 import { UptimeDatePicker } from '../components/common/uptime_date_picker';
 import { SETTINGS_ROUTE } from '../../common/constants';
 import { ToggleAlertFlyoutButton } from '../components/overview/alerts/alerts_containers';
+import { useKibana } from '../../../../../src/plugins/kibana_react/public';
 
 interface PageHeaderProps {
   headingText: string | JSX.Element;
@@ -23,6 +24,10 @@ const SETTINGS_LINK_TEXT = i18n.translate('xpack.uptime.page_header.settingsLink
   defaultMessage: 'Settings',
 });
 
+const ADD_DATA_LABEL = i18n.translate('xpack.uptime.addDataButtonLabel', {
+  defaultMessage: 'Add data',
+});
+
 const StyledPicker = styled(EuiFlexItem)`
   &&& {
     @media only screen and (max-width: 1024px) and (min-width: 868px) {
@@ -52,6 +57,8 @@ export const PageHeader = React.memo(
         </StyledPicker>
       ) : null;
 
+    const kibana = useKibana();
+
     const extraLinkComponents = !extraLinks ? null : (
       <EuiFlexGroup alignItems="flexEnd" responsive={false}>
         <EuiFlexItem grow={false}>
@@ -64,6 +71,15 @@ export const PageHeader = React.memo(
             </EuiButtonEmpty>
           </Link>
         </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty
+            href={kibana.services?.application?.getUrlForApp('/home#/tutorial/uptimeMonitors')}
+            color="primary"
+            iconType="plusInCircle"
+          >
+            {ADD_DATA_LABEL}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
       </EuiFlexGroup>
     );
 
diff --git a/x-pack/test/accessibility/apps/home.ts b/x-pack/test/accessibility/apps/home.ts
index fe698acec322a8..1f05ff676e3a04 100644
--- a/x-pack/test/accessibility/apps/home.ts
+++ b/x-pack/test/accessibility/apps/home.ts
@@ -12,8 +12,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const retry = getService('retry');
   const globalNav = getService('globalNav');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/66976
-  describe.skip('Kibana Home', () => {
+  describe('Kibana Home', () => {
     before(async () => {
       await PageObjects.common.navigateToApp('home');
     });
diff --git a/x-pack/test/accessibility/apps/search_profiler.ts b/x-pack/test/accessibility/apps/search_profiler.ts
index 138231d3cf025d..8a13940695f9e1 100644
--- a/x-pack/test/accessibility/apps/search_profiler.ts
+++ b/x-pack/test/accessibility/apps/search_profiler.ts
@@ -14,8 +14,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const a11y = getService('a11y');
   const flyout = getService('flyout');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/67821
-  describe.skip('Accessibility Search Profiler Editor', () => {
+  describe('Accessibility Search Profiler Editor', () => {
     before(async () => {
       await PageObjects.common.navigateToApp('searchProfiler');
       await a11y.testAppSnapshot();
diff --git a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
index dc0ccfdc53a18a..2a39bc14fbb7fa 100644
--- a/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
+++ b/x-pack/test/api_integration/apis/ml/data_frame_analytics/delete.ts
@@ -35,7 +35,7 @@ export default ({ getService }: FtrProviderContext) => {
       includes: [],
       excludes: [],
     },
-    model_memory_limit: '350mb',
+    model_memory_limit: '60mb',
   };
 
   const testJobConfigs: Array<DeepPartial<DataFrameAnalyticsConfig>> = [
@@ -162,7 +162,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         after(async () => {
-          await ml.testResources.deleteIndexPattern(destinationIndex);
+          await ml.testResources.deleteIndexPatternByTitle(destinationIndex);
         });
 
         it('should delete job and index pattern by id', async () => {
@@ -194,7 +194,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         after(async () => {
           await ml.api.deleteIndices(destinationIndex);
-          await ml.testResources.deleteIndexPattern(destinationIndex);
+          await ml.testResources.deleteIndexPatternByTitle(destinationIndex);
         });
 
         it('should delete job, target index, and index pattern by id', async () => {
diff --git a/x-pack/test/api_integration/apis/ml/data_frame_analytics/get.ts b/x-pack/test/api_integration/apis/ml/data_frame_analytics/get.ts
index c5761c5dab4cb7..d3e4788ee41dab 100644
--- a/x-pack/test/api_integration/apis/ml/data_frame_analytics/get.ts
+++ b/x-pack/test/api_integration/apis/ml/data_frame_analytics/get.ts
@@ -44,7 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
           includes: [],
           excludes: [],
         },
-        model_memory_limit: '350mb',
+        model_memory_limit: '60mb',
       },
       {
         id: `${jobId}_2`,
@@ -70,7 +70,7 @@ export default ({ getService }: FtrProviderContext) => {
           includes: [],
           excludes: [],
         },
-        model_memory_limit: '350mb',
+        model_memory_limit: '60mb',
       },
     ];
 
diff --git a/x-pack/test/api_integration/apis/ml/index.ts b/x-pack/test/api_integration/apis/ml/index.ts
index 403179ec4ac28c..5c2e7a6c4b2f71 100644
--- a/x-pack/test/api_integration/apis/ml/index.ts
+++ b/x-pack/test/api_integration/apis/ml/index.ts
@@ -22,12 +22,28 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
       await ml.securityCommon.cleanMlUsers();
       await ml.securityCommon.cleanMlRoles();
 
-      await ml.testResources.deleteIndexPattern('kibana_sample_data_logs');
-      await ml.testResources.deleteIndexPattern('ft_farequote');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_apache');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_apm');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_logs');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_nginx');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_sample_ecommerce');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_sample_logs');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_siem_auditbeat');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_siem_packetbeat');
+      await ml.testResources.deleteIndexPatternByTitle('ft_module_siem_winlogbeat');
+      await ml.testResources.deleteIndexPatternByTitle('ft_farequote');
 
       await esArchiver.unload('ml/ecommerce');
       await esArchiver.unload('ml/categorization');
-      await esArchiver.unload('ml/sample_logs');
+      await esArchiver.unload('ml/module_apache');
+      await esArchiver.unload('ml/module_apm');
+      await esArchiver.unload('ml/module_logs');
+      await esArchiver.unload('ml/module_nginx');
+      await esArchiver.unload('ml/module_sample_ecommerce');
+      await esArchiver.unload('ml/module_sample_logs');
+      await esArchiver.unload('ml/module_siem_auditbeat');
+      await esArchiver.unload('ml/module_siem_packetbeat');
+      await esArchiver.unload('ml/module_siem_winlogbeat');
       await esArchiver.unload('ml/farequote');
       await esArchiver.unload('ml/bm_classification');
 
diff --git a/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts b/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts
index fda5d1e92e1a64..d217a83efe948f 100644
--- a/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts
+++ b/x-pack/test/api_integration/apis/ml/modules/recognize_module.ts
@@ -19,14 +19,94 @@ export default ({ getService }: FtrProviderContext) => {
   const testDataList = [
     {
       testTitleSuffix: 'for sample logs dataset',
-      sourceDataArchive: 'ml/sample_logs',
-      indexPattern: 'kibana_sample_data_logs',
+      sourceDataArchive: 'ml/module_sample_logs',
+      indexPattern: 'ft_module_sample_logs',
       user: USER.ML_POWERUSER,
       expected: {
         responseCode: 200,
         moduleIds: ['sample_data_weblogs'],
       },
     },
+    {
+      testTitleSuffix: 'for apache dataset',
+      sourceDataArchive: 'ml/module_apache',
+      indexPattern: 'ft_module_apache',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: ['apache_ecs'],
+      },
+    },
+    {
+      testTitleSuffix: 'for apm dataset',
+      sourceDataArchive: 'ml/module_apm',
+      indexPattern: 'ft_module_apm',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: ['apm_jsbase', 'apm_transaction', 'apm_nodejs'],
+      },
+    },
+    {
+      testTitleSuffix: 'for logs dataset',
+      sourceDataArchive: 'ml/module_logs',
+      indexPattern: 'ft_module_logs',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: [], // the logs modules don't define a query and can't be recognized
+      },
+    },
+    {
+      testTitleSuffix: 'for nginx dataset',
+      sourceDataArchive: 'ml/module_nginx',
+      indexPattern: 'ft_module_nginx',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: ['nginx_ecs'],
+      },
+    },
+    {
+      testTitleSuffix: 'for sample ecommerce dataset',
+      sourceDataArchive: 'ml/module_sample_ecommerce',
+      indexPattern: 'ft_module_sample_ecommerce',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: ['sample_data_ecommerce'],
+      },
+    },
+    {
+      testTitleSuffix: 'for siem auditbeat dataset',
+      sourceDataArchive: 'ml/module_siem_auditbeat',
+      indexPattern: 'ft_module_siem_auditbeat',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: ['siem_auditbeat', 'siem_auditbeat_auth'],
+      },
+    },
+    {
+      testTitleSuffix: 'for siem packetbeat dataset',
+      sourceDataArchive: 'ml/module_siem_packetbeat',
+      indexPattern: 'ft_module_siem_packetbeat',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: ['siem_packetbeat'],
+      },
+    },
+    {
+      testTitleSuffix: 'for siem winlogbeat dataset',
+      sourceDataArchive: 'ml/module_siem_winlogbeat',
+      indexPattern: 'ft_module_siem_winlogbeat',
+      user: USER.ML_POWERUSER,
+      expected: {
+        responseCode: 200,
+        moduleIds: ['siem_winlogbeat'],
+      },
+    },
     {
       testTitleSuffix: 'for non existent index pattern',
       indexPattern: 'non-existent-index-pattern',
@@ -69,8 +149,13 @@ export default ({ getService }: FtrProviderContext) => {
           );
           expect(rspBody).to.be.an(Array);
 
-          const responseModuleIds = rspBody.map((module: { id: string }) => module.id);
-          expect(responseModuleIds).to.eql(testData.expected.moduleIds);
+          const responseModuleIds = rspBody.map((module: { id: string }) => module.id).sort();
+          expect(responseModuleIds).to.eql(
+            testData.expected.moduleIds.sort(),
+            `Expected matching module ids for index '${
+              testData.indexPattern
+            }' to be '${testData.expected.moduleIds.sort()}' (got '${responseModuleIds}')`
+          );
         });
       });
     }
diff --git a/x-pack/test/api_integration/apis/ml/modules/setup_module.ts b/x-pack/test/api_integration/apis/ml/modules/setup_module.ts
index 981f4b7b24ef2b..1c98cd3a4e379b 100644
--- a/x-pack/test/api_integration/apis/ml/modules/setup_module.ts
+++ b/x-pack/test/api_integration/apis/ml/modules/setup_module.ts
@@ -5,6 +5,7 @@
  */
 
 import expect from '@kbn/expect';
+import { isEmpty } from 'lodash';
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
@@ -22,14 +23,14 @@ export default ({ getService }: FtrProviderContext) => {
   const testDataListPositive = [
     {
       testTitleSuffix:
-        'for sample logs dataset with prefix, startDatafeed false and estimateModelMemory false',
-      sourceDataArchive: 'ml/sample_logs',
-      indexPattern: { name: 'kibana_sample_data_logs', timeField: '@timestamp' },
+        'for sample_data_weblogs with prefix, startDatafeed false and estimateModelMemory false',
+      sourceDataArchive: 'ml/module_sample_logs',
+      indexPattern: { name: 'ft_module_sample_logs', timeField: '@timestamp' },
       module: 'sample_data_weblogs',
       user: USER.ML_POWERUSER,
       requestBody: {
         prefix: 'pf1_',
-        indexPatternName: 'kibana_sample_data_logs',
+        indexPatternName: 'ft_module_sample_logs',
         startDatafeed: false,
         estimateModelMemory: false,
       },
@@ -55,19 +56,23 @@ export default ({ getService }: FtrProviderContext) => {
             modelMemoryLimit: '10mb',
           },
         ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
       },
     },
     {
       testTitleSuffix:
-        'for sample logs dataset with prefix, startDatafeed false and estimateModelMemory true',
-      sourceDataArchive: 'ml/sample_logs',
-      indexPattern: { name: 'kibana_sample_data_logs', timeField: '@timestamp' },
+        'for sample_data_weblogs with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_sample_logs',
+      indexPattern: { name: 'ft_module_sample_logs', timeField: '@timestamp' },
       module: 'sample_data_weblogs',
       user: USER.ML_POWERUSER,
       requestBody: {
         prefix: 'pf2_',
-        indexPatternName: 'kibana_sample_data_logs',
-        startDatafeed: false,
+        indexPatternName: 'ft_module_sample_logs',
+        startDatafeed: true,
+        end: Date.now(),
       },
       expected: {
         responseCode: 200,
@@ -91,6 +96,360 @@ export default ({ getService }: FtrProviderContext) => {
             modelMemoryLimit: '16mb',
           },
         ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for apache_ecs with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_apache',
+      indexPattern: { name: 'ft_module_apache', timeField: '@timestamp' },
+      module: 'apache_ecs',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf3_',
+        indexPatternName: 'ft_module_apache',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf3_low_request_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf3_source_ip_request_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf3_source_ip_url_count_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '16mb',
+          },
+          {
+            jobId: 'pf3_status_code_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf3_visitor_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: ['ml_http_access_filebeat_ecs'] as string[],
+        visualizations: [
+          'ml_http_access_map_ecs',
+          'ml_http_access_source_ip_timechart_ecs',
+          'ml_http_access_status_code_timechart_ecs',
+          'ml_http_access_top_source_ips_table_ecs',
+          'ml_http_access_top_urls_table_ecs',
+          'ml_http_access_unique_count_url_timechart_ecs',
+          'ml_http_access_events_timechart_ecs',
+        ] as string[],
+        dashboards: ['ml_http_access_explorer_ecs'] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for apm_nodejs with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_apm',
+      indexPattern: { name: 'ft_module_apm', timeField: '@timestamp' },
+      module: 'apm_nodejs',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf4_',
+        indexPatternName: 'ft_module_apm',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf4_abnormal_span_durations_nodejs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf4_abnormal_trace_durations_nodejs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf4_decreased_throughput_nodejs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for apm_transaction with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_apm',
+      indexPattern: { name: 'ft_module_apm', timeField: '@timestamp' },
+      module: 'apm_transaction',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf5_',
+        indexPatternName: 'ft_module_apm',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf5_high_mean_response_time',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for logs_ui_analysis with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_logs',
+      indexPattern: { name: 'ft_module_logs', timeField: '@timestamp' },
+      module: 'logs_ui_analysis',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf6_',
+        indexPatternName: 'ft_module_logs',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf6_log-entry-rate',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for logs_ui_categories with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_logs',
+      indexPattern: { name: 'ft_module_logs', timeField: '@timestamp' },
+      module: 'logs_ui_categories',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf7_',
+        indexPatternName: 'ft_module_logs',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf7_log-entry-categories-count',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '26mb',
+          },
+        ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
+      },
+    },
+    {
+      testTitleSuffix: 'for nginx_ecs with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_nginx',
+      indexPattern: { name: 'ft_module_nginx', timeField: '@timestamp' },
+      module: 'nginx_ecs',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf8_',
+        indexPatternName: 'ft_module_nginx',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf8_visitor_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf8_status_code_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf8_source_ip_url_count_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '16mb',
+          },
+          {
+            jobId: 'pf8_source_ip_request_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf8_low_request_rate_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: ['ml_http_access_filebeat_ecs'] as string[],
+        visualizations: [
+          'ml_http_access_map_ecs',
+          'ml_http_access_source_ip_timechart_ecs',
+          'ml_http_access_status_code_timechart_ecs',
+          'ml_http_access_top_source_ips_table_ecs',
+          'ml_http_access_top_urls_table_ecs',
+          'ml_http_access_unique_count_url_timechart_ecs',
+          'ml_http_access_events_timechart_ecs',
+        ] as string[],
+        dashboards: ['ml_http_access_explorer_ecs'] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for sample_data_ecommerce with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_sample_ecommerce',
+      indexPattern: { name: 'ft_module_sample_ecommerce', timeField: 'order_date' },
+      module: 'sample_data_ecommerce',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf9_',
+        indexPatternName: 'ft_module_sample_ecommerce',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf9_high_sum_total_sales',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for siem_auditbeat_auth with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_siem_auditbeat',
+      indexPattern: { name: 'ft_module_siem_auditbeat', timeField: '@timestamp' },
+      module: 'siem_auditbeat_auth',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf11_',
+        indexPatternName: 'ft_module_siem_auditbeat',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf11_suspicious_login_activity_ecs',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
+      },
+    },
+    {
+      testTitleSuffix:
+        'for siem_packetbeat with prefix, startDatafeed true and estimateModelMemory true',
+      sourceDataArchive: 'ml/module_siem_packetbeat',
+      indexPattern: { name: 'ft_module_siem_packetbeat', timeField: '@timestamp' },
+      module: 'siem_packetbeat',
+      user: USER.ML_POWERUSER,
+      requestBody: {
+        prefix: 'pf12_',
+        indexPatternName: 'ft_module_siem_packetbeat',
+        startDatafeed: true,
+        end: Date.now(),
+      },
+      expected: {
+        responseCode: 200,
+        jobs: [
+          {
+            jobId: 'pf12_packetbeat_dns_tunneling',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '16mb',
+          },
+          {
+            jobId: 'pf12_packetbeat_rare_dns_question',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf12_packetbeat_rare_server_domain',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf12_packetbeat_rare_urls',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+          {
+            jobId: 'pf12_packetbeat_rare_user_agent',
+            jobState: JOB_STATE.CLOSED,
+            datafeedState: DATAFEED_STATE.STOPPED,
+            modelMemoryLimit: '11mb',
+          },
+        ],
+        searches: [] as string[],
+        visualizations: [] as string[],
+        dashboards: [] as string[],
       },
     },
   ];
@@ -113,13 +472,13 @@ export default ({ getService }: FtrProviderContext) => {
     },
     {
       testTitleSuffix: 'for unauthorized user',
-      sourceDataArchive: 'ml/sample_logs',
-      indexPattern: { name: 'kibana_sample_data_logs', timeField: '@timestamp' },
+      sourceDataArchive: 'ml/module_sample_logs',
+      indexPattern: { name: 'ft_module_sample_logs', timeField: '@timestamp' },
       module: 'sample_data_weblogs',
       user: USER.ML_UNAUTHORIZED,
       requestBody: {
-        prefix: 'pf1_',
-        indexPatternName: 'kibana_sample_data_logs',
+        prefix: 'pfn1_',
+        indexPatternName: 'ft_module_sample_logs',
         startDatafeed: false,
       },
       expected: {
@@ -156,6 +515,16 @@ export default ({ getService }: FtrProviderContext) => {
     return 0;
   }
 
+  function mapIdsToSuccessObjects(ids: string[]) {
+    const successObjects = ids
+      .map((id) => {
+        return { id, success: true };
+      })
+      .sort(compareById);
+
+    return successObjects;
+  }
+
   describe('module setup', function () {
     before(async () => {
       await ml.testResources.setKibanaTimeZoneToUTC();
@@ -172,6 +541,15 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         after(async () => {
+          for (const search of testData.expected.searches) {
+            await ml.testResources.deleteSavedSearchById(search);
+          }
+          for (const visualization of testData.expected.visualizations) {
+            await ml.testResources.deleteVisualizationById(visualization);
+          }
+          for (const dashboard of testData.expected.dashboards) {
+            await ml.testResources.deleteDashboardById(dashboard);
+          }
           await ml.api.cleanMlIndices();
         });
 
@@ -188,11 +566,8 @@ export default ({ getService }: FtrProviderContext) => {
             // jobs
             expect(rspBody).to.have.property('jobs');
 
-            const expectedRspJobs = testData.expected.jobs
-              .map((job) => {
-                return { id: job.jobId, success: true };
-              })
-              .sort(compareById);
+            const expectedJobIds = testData.expected.jobs.map((job) => job.jobId);
+            const expectedRspJobs = mapIdsToSuccessObjects(expectedJobIds);
 
             const actualRspJobs = rspBody.jobs.sort(compareById);
 
@@ -225,7 +600,42 @@ export default ({ getService }: FtrProviderContext) => {
               )}' (got '${JSON.stringify(actualRspDatafeeds)}')`
             );
 
-            // TODO in future updates: add response validations for created saved objects
+            // saved objects
+            const rspKibana: object = rspBody.kibana;
+            let actualSearches = [];
+            let actualVisualizations = [];
+            let actualDashboards = [];
+
+            if (isEmpty(rspKibana) === false) {
+              actualSearches = rspBody.kibana.search.sort(compareById);
+              actualVisualizations = rspBody.kibana.visualization.sort(compareById);
+              actualDashboards = rspBody.kibana.dashboard.sort(compareById);
+            }
+
+            const expectedSearches = mapIdsToSuccessObjects(testData.expected.searches);
+            const expectedVisualizations = mapIdsToSuccessObjects(testData.expected.visualizations);
+            const expectedDashboards = mapIdsToSuccessObjects(testData.expected.dashboards);
+
+            expect(actualSearches).to.eql(
+              expectedSearches,
+              `Expected setup module response searches to be '${JSON.stringify(
+                expectedSearches
+              )}' (got '${JSON.stringify(actualSearches)}')`
+            );
+
+            expect(actualVisualizations).to.eql(
+              expectedVisualizations,
+              `Expected setup module response visualizations to be '${JSON.stringify(
+                expectedVisualizations
+              )}' (got '${JSON.stringify(actualVisualizations)}')`
+            );
+
+            expect(actualDashboards).to.eql(
+              expectedDashboards,
+              `Expected setup module response dashboards to be '${JSON.stringify(
+                expectedDashboards
+              )}' (got '${JSON.stringify(actualDashboards)}')`
+            );
           }
 
           // verify job and datafeed creation + states
@@ -271,9 +681,18 @@ export default ({ getService }: FtrProviderContext) => {
               expectedModelMemoryLimits
             )}' (got '${JSON.stringify(actualModelMemoryLimits)}')`
           );
-        });
 
-        // TODO in future updates: add creation validations for created saved objects
+          // verify saved objects creation
+          for (const search of testData.expected.searches) {
+            await ml.testResources.assertSavedSearchExistById(search);
+          }
+          for (const visualization of testData.expected.visualizations) {
+            await ml.testResources.assertVisualizationExistById(visualization);
+          }
+          for (const dashboard of testData.expected.dashboards) {
+            await ml.testResources.assertDashboardExistById(dashboard);
+          }
+        });
       });
     }
 
diff --git a/x-pack/test/api_integration/apis/transform/delete_transforms.ts b/x-pack/test/api_integration/apis/transform/delete_transforms.ts
index 40300c981ee2e4..8e5d7354bcaf41 100644
--- a/x-pack/test/api_integration/apis/transform/delete_transforms.ts
+++ b/x-pack/test/api_integration/apis/transform/delete_transforms.ts
@@ -247,7 +247,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       after(async () => {
         await transform.api.deleteIndices(destinationIndex);
-        await transform.testResources.deleteIndexPattern(destinationIndex);
+        await transform.testResources.deleteIndexPatternByTitle(destinationIndex);
       });
 
       it('should delete transform and destination index pattern', async () => {
@@ -287,7 +287,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       after(async () => {
         await transform.api.deleteIndices(destinationIndex);
-        await transform.testResources.deleteIndexPattern(destinationIndex);
+        await transform.testResources.deleteIndexPatternByTitle(destinationIndex);
       });
 
       it('should delete transform, destination index, & destination index pattern', async () => {
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts b/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts
index 56d00a4e11390a..c23abead458f17 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/anomaly_explorer.ts
@@ -61,6 +61,7 @@ export default function ({ getService }: FtrProviderContext) {
     before(async () => {
       await esArchiver.loadIfNeeded('ml/farequote');
       await ml.testResources.createIndexPatternIfNeeded('ft_farequote', '@timestamp');
+      await ml.testResources.createMLTestDashboardIfNeeded();
       await ml.testResources.setKibanaTimeZoneToUTC();
 
       await ml.securityUI.loginAsMlPowerUser();
@@ -125,6 +126,12 @@ export default function ({ getService }: FtrProviderContext) {
         it('anomalies table is not empty', async () => {
           await ml.anomaliesTable.assertTableNotEmpty();
         });
+
+        // should be the last step because it navigates away from the Anomaly Explorer page
+        it('should allow to attach anomaly swimlane embeddable to the dashboard', async () => {
+          await ml.anomalyExplorer.openAddToDashboardControl();
+          await ml.anomalyExplorer.addAndEditSwimlaneInDashboard('ML Test');
+        });
       });
     }
   });
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
index b0376b35ebd2fd..578d7eada554e0 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/classification_creation.ts
@@ -37,7 +37,7 @@ export default function ({ getService }: FtrProviderContext) {
         },
         dependentVariable: 'y',
         trainingPercent: '20',
-        modelMemory: '200mb',
+        modelMemory: '60mb',
         createIndexPattern: true,
         expected: {
           row: {
@@ -52,7 +52,7 @@ export default function ({ getService }: FtrProviderContext) {
       describe(`${testData.suiteTitle}`, function () {
         after(async () => {
           await ml.api.deleteIndices(testData.destinationIndex);
-          await ml.testResources.deleteIndexPattern(testData.destinationIndex);
+          await ml.testResources.deleteIndexPatternByTitle(testData.destinationIndex);
         });
 
         it('loads the data frame analytics page', async () => {
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts
index b3e47db8267878..357ea362135213 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/cloning.ts
@@ -53,7 +53,7 @@ export default function ({ getService }: FtrProviderContext) {
               includes: [],
               excludes: [],
             },
-            model_memory_limit: '350mb',
+            model_memory_limit: '60mb',
             allow_lazy_start: false,
           },
         },
@@ -83,7 +83,7 @@ export default function ({ getService }: FtrProviderContext) {
               includes: [],
               excludes: [],
             },
-            model_memory_limit: '55mb',
+            model_memory_limit: '5mb',
           },
         },
         {
@@ -115,7 +115,7 @@ export default function ({ getService }: FtrProviderContext) {
               includes: [],
               excludes: [],
             },
-            model_memory_limit: '105mb',
+            model_memory_limit: '20mb',
           },
         },
       ];
@@ -153,7 +153,7 @@ export default function ({ getService }: FtrProviderContext) {
         after(async () => {
           await ml.api.deleteIndices(cloneDestIndex);
           await ml.api.deleteIndices(testData.job.dest!.index as string);
-          await ml.testResources.deleteIndexPattern(testData.job.dest!.index as string);
+          await ml.testResources.deleteIndexPatternByTitle(testData.job.dest!.index as string);
         });
 
         it('should open the flyout with a proper header', async () => {
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
index 2daae60b0ad209..582b19f5e18a8c 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/outlier_detection_creation.ts
@@ -34,7 +34,7 @@ export default function ({ getService }: FtrProviderContext) {
         get destinationIndex(): string {
           return `user-${this.jobId}`;
         },
-        modelMemory: '55mb',
+        modelMemory: '5mb',
         createIndexPattern: true,
         expected: {
           row: {
@@ -50,7 +50,7 @@ export default function ({ getService }: FtrProviderContext) {
       describe(`${testData.suiteTitle}`, function () {
         after(async () => {
           await ml.api.deleteIndices(testData.destinationIndex);
-          await ml.testResources.deleteIndexPattern(testData.destinationIndex);
+          await ml.testResources.deleteIndexPatternByTitle(testData.destinationIndex);
         });
 
         it('loads the data frame analytics page', async () => {
diff --git a/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts b/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
index 35425e47526dd8..fea87e70eb0148 100644
--- a/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
+++ b/x-pack/test/functional/apps/ml/data_frame_analytics/regression_creation.ts
@@ -36,7 +36,7 @@ export default function ({ getService }: FtrProviderContext) {
         },
         dependentVariable: 'stab',
         trainingPercent: '20',
-        modelMemory: '105mb',
+        modelMemory: '20mb',
         createIndexPattern: true,
         expected: {
           row: {
@@ -52,7 +52,7 @@ export default function ({ getService }: FtrProviderContext) {
       describe(`${testData.suiteTitle}`, function () {
         after(async () => {
           await ml.api.deleteIndices(testData.destinationIndex);
-          await ml.testResources.deleteIndexPattern(testData.destinationIndex);
+          await ml.testResources.deleteIndexPatternByTitle(testData.destinationIndex);
         });
 
         it('loads the data frame analytics page', async () => {
diff --git a/x-pack/test/functional/apps/ml/index.ts b/x-pack/test/functional/apps/ml/index.ts
index 685fff45061558..2d8aac3b8dddf8 100644
--- a/x-pack/test/functional/apps/ml/index.ts
+++ b/x-pack/test/functional/apps/ml/index.ts
@@ -22,14 +22,15 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
       await ml.securityCommon.cleanMlRoles();
 
       await ml.testResources.deleteSavedSearches();
-
-      await ml.testResources.deleteIndexPattern('ft_farequote');
-      await ml.testResources.deleteIndexPattern('ft_ecommerce');
-      await ml.testResources.deleteIndexPattern('ft_categorization');
-      await ml.testResources.deleteIndexPattern('ft_event_rate_gen_trend_nanos');
-      await ml.testResources.deleteIndexPattern('ft_bank_marketing');
-      await ml.testResources.deleteIndexPattern('ft_ihp_outlier');
-      await ml.testResources.deleteIndexPattern('ft_egs_regression');
+      await ml.testResources.deleteDashboards();
+
+      await ml.testResources.deleteIndexPatternByTitle('ft_farequote');
+      await ml.testResources.deleteIndexPatternByTitle('ft_ecommerce');
+      await ml.testResources.deleteIndexPatternByTitle('ft_categorization');
+      await ml.testResources.deleteIndexPatternByTitle('ft_event_rate_gen_trend_nanos');
+      await ml.testResources.deleteIndexPatternByTitle('ft_bank_marketing');
+      await ml.testResources.deleteIndexPatternByTitle('ft_ihp_outlier');
+      await ml.testResources.deleteIndexPatternByTitle('ft_egs_regression');
 
       await esArchiver.unload('ml/farequote');
       await esArchiver.unload('ml/ecommerce');
diff --git a/x-pack/test/functional/apps/transform/cloning.ts b/x-pack/test/functional/apps/transform/cloning.ts
index d28ac50eefe95b..b7e71860bcb56b 100644
--- a/x-pack/test/functional/apps/transform/cloning.ts
+++ b/x-pack/test/functional/apps/transform/cloning.ts
@@ -39,7 +39,7 @@ export default function ({ getService }: FtrProviderContext) {
     });
 
     after(async () => {
-      await transform.testResources.deleteIndexPattern(transformConfig.dest.index);
+      await transform.testResources.deleteIndexPatternByTitle(transformConfig.dest.index);
       await transform.api.deleteIndices(transformConfig.dest.index);
       await transform.api.cleanTransformIndices();
     });
diff --git a/x-pack/test/functional/apps/transform/creation_index_pattern.ts b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
index d6dbcde436dccd..61c4776e204045 100644
--- a/x-pack/test/functional/apps/transform/creation_index_pattern.ts
+++ b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
@@ -240,7 +240,7 @@ export default function ({ getService }: FtrProviderContext) {
       describe(`${testData.suiteTitle}`, function () {
         after(async () => {
           await transform.api.deleteIndices(testData.destinationIndex);
-          await transform.testResources.deleteIndexPattern(testData.destinationIndex);
+          await transform.testResources.deleteIndexPatternByTitle(testData.destinationIndex);
         });
 
         it('loads the home page', async () => {
diff --git a/x-pack/test/functional/apps/transform/creation_saved_search.ts b/x-pack/test/functional/apps/transform/creation_saved_search.ts
index f8de38a1e3afd2..ad62f06d1f3cde 100644
--- a/x-pack/test/functional/apps/transform/creation_saved_search.ts
+++ b/x-pack/test/functional/apps/transform/creation_saved_search.ts
@@ -76,7 +76,7 @@ export default function ({ getService }: FtrProviderContext) {
       describe(`${testData.suiteTitle}`, function () {
         after(async () => {
           await transform.api.deleteIndices(testData.destinationIndex);
-          await transform.testResources.deleteIndexPattern(testData.destinationIndex);
+          await transform.testResources.deleteIndexPatternByTitle(testData.destinationIndex);
         });
 
         it('loads the home page', async () => {
diff --git a/x-pack/test/functional/apps/transform/index.ts b/x-pack/test/functional/apps/transform/index.ts
index dcca156454f35c..a7859be6923d5a 100644
--- a/x-pack/test/functional/apps/transform/index.ts
+++ b/x-pack/test/functional/apps/transform/index.ts
@@ -23,8 +23,8 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
 
       await transform.testResources.deleteSavedSearches();
 
-      await transform.testResources.deleteIndexPattern('ft_farequote');
-      await transform.testResources.deleteIndexPattern('ft_ecommerce');
+      await transform.testResources.deleteIndexPatternByTitle('ft_farequote');
+      await transform.testResources.deleteIndexPatternByTitle('ft_ecommerce');
 
       await esArchiver.unload('ml/farequote');
       await esArchiver.unload('ml/ecommerce');
diff --git a/x-pack/test/functional/es_archives/ml/module_apache/data.json.gz b/x-pack/test/functional/es_archives/ml/module_apache/data.json.gz
new file mode 100644
index 00000000000000..ac72c6e06eabcf
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_apache/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_apache/mappings.json b/x-pack/test/functional/es_archives/ml/module_apache/mappings.json
new file mode 100644
index 00000000000000..5fe0d5f221b4ec
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_apache/mappings.json
@@ -0,0 +1,2671 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_apache",
+    "mappings": {
+      "_meta": {
+        "beat": "filebeat",
+        "version": "7.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kibana.log.meta": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "kibana.log.meta.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "apache": {
+          "properties": {
+            "access": {
+              "properties": {
+                "agent": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ssl": {
+                  "properties": {
+                    "cipher": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "protocol": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apache2": {
+          "properties": {
+            "access": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "type": "object"
+            }
+          }
+        },
+        "auditd": {
+          "properties": {
+            "log": {
+              "properties": {
+                "a0": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "addr": {
+                  "type": "ip"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "item": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "items": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "laddr": {
+                  "type": "ip"
+                },
+                "lport": {
+                  "type": "long"
+                },
+                "new_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rport": {
+                  "type": "long"
+                },
+                "sequence": {
+                  "type": "long"
+                },
+                "tty": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "certificate": {
+          "properties": {
+            "common_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "elasticsearch": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "indices": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "layer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "origin": {
+                  "properties": {
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "realm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "request": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "url": {
+                  "properties": {
+                    "params": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "realm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "roles": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "cluster": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "component": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "deprecation": {
+              "type": "object"
+            },
+            "gc": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "jvm_runtime_sec": {
+                  "type": "float"
+                },
+                "old_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "phase": {
+                  "properties": {
+                    "class_unload_time_sec": {
+                      "type": "float"
+                    },
+                    "cpu_time": {
+                      "properties": {
+                        "real_sec": {
+                          "type": "float"
+                        },
+                        "sys_sec": {
+                          "type": "float"
+                        },
+                        "user_sec": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "duration_sec": {
+                      "type": "float"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "parallel_rescan_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_string_table_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_symbol_table_time_sec": {
+                      "type": "float"
+                    },
+                    "weak_refs_processing_time_sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "stopping_threads_time_sec": {
+                  "type": "float"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "threads_total_stop_time_sec": {
+                  "type": "float"
+                },
+                "young_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "index": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "node": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "server": {
+              "properties": {
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "gc": {
+                  "properties": {
+                    "collection_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "observation_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "overhead_seq": {
+                      "type": "long"
+                    },
+                    "young": {
+                      "properties": {
+                        "one": {
+                          "type": "long"
+                        },
+                        "two": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "shard": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "extra_source": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "routing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "search_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source_query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "stats": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_hits": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_shards": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fileset": {
+          "properties": {
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "haproxy": {
+          "properties": {
+            "backend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "backend_queue": {
+              "type": "long"
+            },
+            "bind_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes_read": {
+              "type": "long"
+            },
+            "client": {
+              "type": "object"
+            },
+            "connection_wait_time_ms": {
+              "type": "long"
+            },
+            "connections": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                },
+                "backend": {
+                  "type": "long"
+                },
+                "frontend": {
+                  "type": "long"
+                },
+                "retries": {
+                  "type": "long"
+                },
+                "server": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "type": "object"
+            },
+            "error_message": {
+              "norms": false,
+              "type": "text"
+            },
+            "frontend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geoip": {
+              "type": "object"
+            },
+            "http": {
+              "properties": {
+                "request": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_request_line": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "time_wait_ms": {
+                      "type": "long"
+                    },
+                    "time_wait_without_data_ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "response": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_queue": {
+              "type": "long"
+            },
+            "source": {
+              "norms": false,
+              "type": "text"
+            },
+            "tcp": {
+              "properties": {
+                "connection_waiting_time_ms": {
+                  "type": "long"
+                }
+              }
+            },
+            "termination_state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "time_backend_connect": {
+              "type": "long"
+            },
+            "time_queue": {
+              "type": "long"
+            },
+            "total_waiting_time_ms": {
+              "type": "long"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "icinga": {
+          "properties": {
+            "debug": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "main": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "startup": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "iis": {
+          "properties": {
+            "access": {
+              "properties": {
+                "cookie": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "site_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sub_status": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "type": "object"
+                },
+                "win32_status": {
+                  "type": "long"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "queue_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reason_phrase": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "input": {
+          "properties": {
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kafka": {
+          "properties": {
+            "log": {
+              "properties": {
+                "class": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trace": {
+                  "properties": {
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "full": {
+                      "norms": false,
+                      "type": "text"
+                    },
+                    "message": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "kibana": {
+          "properties": {
+            "log": {
+              "properties": {
+                "meta": {
+                  "type": "object"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "file": {
+              "properties": {
+                "path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "offset": {
+              "type": "long"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "source": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "logstash": {
+          "properties": {
+            "log": {
+              "properties": {
+                "log_event": {
+                  "type": "object"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "event": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params_object": {
+                  "type": "object"
+                },
+                "plugin_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took_in_millis": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "mongodb": {
+          "properties": {
+            "log": {
+              "properties": {
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "mysql": {
+          "properties": {
+            "error": {
+              "type": "object"
+            },
+            "slowlog": {
+              "properties": {
+                "bytes_sent": {
+                  "type": "long"
+                },
+                "current_user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "filesort": {
+                  "type": "boolean"
+                },
+                "filesort_on_disk": {
+                  "type": "boolean"
+                },
+                "full_join": {
+                  "type": "boolean"
+                },
+                "full_scan": {
+                  "type": "boolean"
+                },
+                "innodb": {
+                  "properties": {
+                    "io_r_bytes": {
+                      "type": "long"
+                    },
+                    "io_r_ops": {
+                      "type": "long"
+                    },
+                    "io_r_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "pages_distinct": {
+                      "type": "long"
+                    },
+                    "queue_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "rec_lock_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "trx_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "killed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "last_errno": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "lock_time": {
+                  "properties": {
+                    "sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "log_slow_rate_limit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "log_slow_rate_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "merge_passes": {
+                  "type": "long"
+                },
+                "priority_queue": {
+                  "type": "boolean"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query_cache_hit": {
+                  "type": "boolean"
+                },
+                "rows_affected": {
+                  "type": "long"
+                },
+                "rows_examined": {
+                  "type": "long"
+                },
+                "rows_sent": {
+                  "type": "long"
+                },
+                "schema": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tmp_disk_tables": {
+                  "type": "long"
+                },
+                "tmp_table": {
+                  "type": "boolean"
+                },
+                "tmp_table_on_disk": {
+                  "type": "boolean"
+                },
+                "tmp_table_sizes": {
+                  "type": "long"
+                },
+                "tmp_tables": {
+                  "type": "long"
+                }
+              }
+            },
+            "thread_id": {
+              "type": "long"
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "nginx": {
+          "properties": {
+            "access": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "connection_id": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "osquery": {
+          "properties": {
+            "result": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "calendar_time": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "host_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unix_time": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "postgresql": {
+          "properties": {
+            "log": {
+              "properties": {
+                "core_id": {
+                  "type": "long"
+                },
+                "database": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "program": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "working_directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "redis": {
+          "properties": {
+            "log": {
+              "properties": {
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "duration": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "id": {
+                  "type": "long"
+                },
+                "key": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            }
+          }
+        },
+        "santa": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "decision": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "disk": {
+              "properties": {
+                "bsdname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bus": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "model": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mount": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "volume": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reason": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "stream": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "syslog": {
+          "properties": {
+            "facility": {
+              "type": "long"
+            },
+            "facility_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "priority": {
+              "type": "long"
+            },
+            "severity_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "auth": {
+              "properties": {
+                "groupadd": {
+                  "type": "object"
+                },
+                "ssh": {
+                  "properties": {
+                    "dropped_ip": {
+                      "type": "ip"
+                    },
+                    "geoip": {
+                      "type": "object"
+                    },
+                    "method": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "sudo": {
+                  "properties": {
+                    "command": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "error": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pwd": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tty": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "useradd": {
+                  "properties": {
+                    "home": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "shell": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "syslog": {
+              "type": "object"
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "traefik": {
+          "properties": {
+            "access": {
+              "properties": {
+                "backend_url": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "frontend_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "properties": {
+                    "city_name": {
+                      "path": "source.geo.city_name",
+                      "type": "alias"
+                    },
+                    "continent_name": {
+                      "path": "source.geo.continent_name",
+                      "type": "alias"
+                    },
+                    "country_iso_code": {
+                      "path": "source.geo.country_iso_code",
+                      "type": "alias"
+                    },
+                    "location": {
+                      "path": "source.geo.location",
+                      "type": "alias"
+                    },
+                    "region_iso_code": {
+                      "path": "source.geo.region_iso_code",
+                      "type": "alias"
+                    },
+                    "region_name": {
+                      "path": "source.geo.region_name",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "request_count": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "properties": {
+                    "device": {
+                      "path": "user_agent.device.name",
+                      "type": "alias"
+                    },
+                    "major": {
+                      "path": "user_agent.major",
+                      "type": "alias"
+                    },
+                    "minor": {
+                      "path": "user_agent.minor",
+                      "type": "alias"
+                    },
+                    "name": {
+                      "path": "user_agent.name",
+                      "type": "alias"
+                    },
+                    "original": {
+                      "path": "user_agent.original",
+                      "type": "alias"
+                    },
+                    "os": {
+                      "path": "user_agent.os.full_name",
+                      "type": "alias"
+                    },
+                    "os_major": {
+                      "path": "user_agent.os.major",
+                      "type": "alias"
+                    },
+                    "os_minor": {
+                      "path": "user_agent.os.minor",
+                      "type": "alias"
+                    },
+                    "os_name": {
+                      "path": "user_agent.os.name",
+                      "type": "alias"
+                    },
+                    "patch": {
+                      "path": "user_agent.patch",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "user_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "major": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "minor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "major": {
+                  "type": "long"
+                },
+                "minor": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "patch": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_apm/data.json.gz b/x-pack/test/functional/es_archives/ml/module_apm/data.json.gz
new file mode 100644
index 00000000000000..72edb0e071e1ca
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_apm/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_apm/mappings.json b/x-pack/test/functional/es_archives/ml/module_apm/mappings.json
new file mode 100644
index 00000000000000..872b3e1ddd83df
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_apm/mappings.json
@@ -0,0 +1,379 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_apm",
+    "mappings": {
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_logs/data.json.gz b/x-pack/test/functional/es_archives/ml/module_logs/data.json.gz
new file mode 100644
index 00000000000000..761f57c999626d
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_logs/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_logs/mappings.json b/x-pack/test/functional/es_archives/ml/module_logs/mappings.json
new file mode 100644
index 00000000000000..b727ef2b3c48dd
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_logs/mappings.json
@@ -0,0 +1,5584 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_logs",
+    "mappings": {
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "apache": {
+          "properties": {
+            "access": {
+              "properties": {
+                "ssl": {
+                  "properties": {
+                    "cipher": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "protocol": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apache2": {
+          "properties": {
+            "access": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "type": "object"
+            }
+          }
+        },
+        "auditd": {
+          "properties": {
+            "log": {
+              "properties": {
+                "a0": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "addr": {
+                  "type": "ip"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "item": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "items": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "laddr": {
+                  "type": "ip"
+                },
+                "lport": {
+                  "type": "long"
+                },
+                "new_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rport": {
+                  "type": "long"
+                },
+                "sequence": {
+                  "type": "long"
+                },
+                "tty": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "certificate": {
+          "properties": {
+            "common_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "elasticsearch": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "event_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "indices": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "layer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "origin": {
+                  "properties": {
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "realm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "request": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "url": {
+                  "properties": {
+                    "params": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "realm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "roles": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "cluster": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "component": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "deprecation": {
+              "type": "object"
+            },
+            "gc": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "jvm_runtime_sec": {
+                  "type": "float"
+                },
+                "old_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "phase": {
+                  "properties": {
+                    "class_unload_time_sec": {
+                      "type": "float"
+                    },
+                    "cpu_time": {
+                      "properties": {
+                        "real_sec": {
+                          "type": "float"
+                        },
+                        "sys_sec": {
+                          "type": "float"
+                        },
+                        "user_sec": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "duration_sec": {
+                      "type": "float"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "parallel_rescan_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_string_table_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_symbol_table_time_sec": {
+                      "type": "float"
+                    },
+                    "weak_refs_processing_time_sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "stopping_threads_time_sec": {
+                  "type": "float"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "threads_total_stop_time_sec": {
+                  "type": "float"
+                },
+                "young_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "index": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "node": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "server": {
+              "properties": {
+                "gc": {
+                  "properties": {
+                    "collection_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "observation_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "overhead_seq": {
+                      "type": "long"
+                    },
+                    "young": {
+                      "properties": {
+                        "one": {
+                          "type": "long"
+                        },
+                        "two": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "stacktrace": {
+                  "ignore_above": 1024,
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "shard": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "extra_source": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "routing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "search_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source_query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "stats": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_hits": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_shards": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fileset": {
+          "properties": {
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "haproxy": {
+          "properties": {
+            "backend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "backend_queue": {
+              "type": "long"
+            },
+            "bind_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes_read": {
+              "type": "long"
+            },
+            "client": {
+              "type": "object"
+            },
+            "connection_wait_time_ms": {
+              "type": "long"
+            },
+            "connections": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                },
+                "backend": {
+                  "type": "long"
+                },
+                "frontend": {
+                  "type": "long"
+                },
+                "retries": {
+                  "type": "long"
+                },
+                "server": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "type": "object"
+            },
+            "error_message": {
+              "norms": false,
+              "type": "text"
+            },
+            "frontend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geoip": {
+              "type": "object"
+            },
+            "http": {
+              "properties": {
+                "request": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_request_line": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "time_wait_ms": {
+                      "type": "long"
+                    },
+                    "time_wait_without_data_ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "response": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_queue": {
+              "type": "long"
+            },
+            "source": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tcp": {
+              "properties": {
+                "connection_waiting_time_ms": {
+                  "type": "long"
+                }
+              }
+            },
+            "termination_state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "time_backend_connect": {
+              "type": "long"
+            },
+            "time_queue": {
+              "type": "long"
+            },
+            "total_waiting_time_ms": {
+              "type": "long"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "icinga": {
+          "properties": {
+            "debug": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "main": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "startup": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "iis": {
+          "properties": {
+            "access": {
+              "properties": {
+                "cookie": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "site_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sub_status": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "type": "object"
+                },
+                "win32_status": {
+                  "type": "long"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "queue_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reason_phrase": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "input": {
+          "properties": {
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "iptables": {
+          "properties": {
+            "ether_type": {
+              "type": "long"
+            },
+            "flow_label": {
+              "type": "long"
+            },
+            "fragment_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment_offset": {
+              "type": "long"
+            },
+            "icmp": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "long"
+                },
+                "parameter": {
+                  "type": "long"
+                },
+                "redirect": {
+                  "type": "ip"
+                },
+                "seq": {
+                  "type": "long"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "type": "long"
+            },
+            "incomplete_bytes": {
+              "type": "long"
+            },
+            "input_device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "length": {
+              "type": "long"
+            },
+            "output_device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "precedence_bits": {
+              "type": "short"
+            },
+            "tcp": {
+              "properties": {
+                "ack": {
+                  "type": "long"
+                },
+                "flags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reserved_bits": {
+                  "type": "short"
+                },
+                "seq": {
+                  "type": "long"
+                },
+                "window": {
+                  "type": "long"
+                }
+              }
+            },
+            "tos": {
+              "type": "long"
+            },
+            "ttl": {
+              "type": "long"
+            },
+            "ubiquiti": {
+              "properties": {
+                "input_zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "output_zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rule_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rule_set": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "udp": {
+              "properties": {
+                "length": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "kafka": {
+          "properties": {
+            "log": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trace": {
+                  "properties": {
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "message": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "kibana": {
+          "properties": {
+            "log": {
+              "properties": {
+                "meta": {
+                  "type": "object"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "file": {
+              "properties": {
+                "path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "offset": {
+              "type": "long"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "source": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "logstash": {
+          "properties": {
+            "log": {
+              "properties": {
+                "log_event": {
+                  "type": "object"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "event": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params_object": {
+                  "type": "object"
+                },
+                "plugin_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took_in_millis": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "mongodb": {
+          "properties": {
+            "log": {
+              "properties": {
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "mysql": {
+          "properties": {
+            "error": {
+              "type": "object"
+            },
+            "slowlog": {
+              "properties": {
+                "bytes_sent": {
+                  "type": "long"
+                },
+                "current_user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "filesort": {
+                  "type": "boolean"
+                },
+                "filesort_on_disk": {
+                  "type": "boolean"
+                },
+                "full_join": {
+                  "type": "boolean"
+                },
+                "full_scan": {
+                  "type": "boolean"
+                },
+                "innodb": {
+                  "properties": {
+                    "io_r_bytes": {
+                      "type": "long"
+                    },
+                    "io_r_ops": {
+                      "type": "long"
+                    },
+                    "io_r_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "pages_distinct": {
+                      "type": "long"
+                    },
+                    "queue_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "rec_lock_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "trx_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "killed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "last_errno": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "lock_time": {
+                  "properties": {
+                    "sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "log_slow_rate_limit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "log_slow_rate_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "merge_passes": {
+                  "type": "long"
+                },
+                "priority_queue": {
+                  "type": "boolean"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query_cache_hit": {
+                  "type": "boolean"
+                },
+                "rows_affected": {
+                  "type": "long"
+                },
+                "rows_examined": {
+                  "type": "long"
+                },
+                "rows_sent": {
+                  "type": "long"
+                },
+                "schema": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tmp_disk_tables": {
+                  "type": "long"
+                },
+                "tmp_table": {
+                  "type": "boolean"
+                },
+                "tmp_table_on_disk": {
+                  "type": "boolean"
+                },
+                "tmp_table_sizes": {
+                  "type": "long"
+                },
+                "tmp_tables": {
+                  "type": "long"
+                }
+              }
+            },
+            "thread_id": {
+              "type": "long"
+            }
+          }
+        },
+        "netflow": {
+          "properties": {
+            "absolute_error": {
+              "type": "double"
+            },
+            "address_pool_high_threshold": {
+              "type": "long"
+            },
+            "address_pool_low_threshold": {
+              "type": "long"
+            },
+            "address_port_mapping_high_threshold": {
+              "type": "long"
+            },
+            "address_port_mapping_low_threshold": {
+              "type": "long"
+            },
+            "address_port_mapping_per_user_high_threshold": {
+              "type": "long"
+            },
+            "anonymization_flags": {
+              "type": "long"
+            },
+            "anonymization_technique": {
+              "type": "long"
+            },
+            "application_category_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_group_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_id": {
+              "type": "short"
+            },
+            "application_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "application_sub_category_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bgp_destination_as_number": {
+              "type": "long"
+            },
+            "bgp_next_adjacent_as_number": {
+              "type": "long"
+            },
+            "bgp_next_hop_ipv4_address": {
+              "type": "ip"
+            },
+            "bgp_next_hop_ipv6_address": {
+              "type": "ip"
+            },
+            "bgp_prev_adjacent_as_number": {
+              "type": "long"
+            },
+            "bgp_source_as_number": {
+              "type": "long"
+            },
+            "bgp_validity_state": {
+              "type": "short"
+            },
+            "biflow_direction": {
+              "type": "short"
+            },
+            "class_id": {
+              "type": "short"
+            },
+            "class_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification_engine_id": {
+              "type": "short"
+            },
+            "collection_time_milliseconds": {
+              "type": "date"
+            },
+            "collector_certificate": {
+              "type": "short"
+            },
+            "collector_ipv4_address": {
+              "type": "ip"
+            },
+            "collector_ipv6_address": {
+              "type": "ip"
+            },
+            "collector_transport_port": {
+              "type": "long"
+            },
+            "common_properties_id": {
+              "type": "long"
+            },
+            "confidence_level": {
+              "type": "double"
+            },
+            "connection_sum_duration_seconds": {
+              "type": "long"
+            },
+            "connection_transaction_id": {
+              "type": "long"
+            },
+            "data_link_frame_section": {
+              "type": "short"
+            },
+            "data_link_frame_size": {
+              "type": "long"
+            },
+            "data_link_frame_type": {
+              "type": "long"
+            },
+            "data_records_reliability": {
+              "type": "boolean"
+            },
+            "delta_flow_count": {
+              "type": "long"
+            },
+            "destination_ipv4_address": {
+              "type": "ip"
+            },
+            "destination_ipv4_prefix": {
+              "type": "ip"
+            },
+            "destination_ipv4_prefix_length": {
+              "type": "short"
+            },
+            "destination_ipv6_address": {
+              "type": "ip"
+            },
+            "destination_ipv6_prefix": {
+              "type": "ip"
+            },
+            "destination_ipv6_prefix_length": {
+              "type": "short"
+            },
+            "destination_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "destination_transport_port": {
+              "type": "long"
+            },
+            "digest_hash_value": {
+              "type": "long"
+            },
+            "distinct_count_of_destinatio_nipa_ddress": {
+              "type": "long"
+            },
+            "distinct_count_of_destination_ipv4_address": {
+              "type": "long"
+            },
+            "distinct_count_of_destination_ipv6_address": {
+              "type": "long"
+            },
+            "distinct_count_of_sourc_eipa_ddress": {
+              "type": "long"
+            },
+            "distinct_count_of_source_ipv4_address": {
+              "type": "long"
+            },
+            "distinct_count_of_source_ipv6_address": {
+              "type": "long"
+            },
+            "dot1q_customer_dei": {
+              "type": "boolean"
+            },
+            "dot1q_customer_destination_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "dot1q_customer_priority": {
+              "type": "short"
+            },
+            "dot1q_customer_source_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "dot1q_customer_vlan_id": {
+              "type": "long"
+            },
+            "dot1q_dei": {
+              "type": "boolean"
+            },
+            "dot1q_priority": {
+              "type": "short"
+            },
+            "dot1q_service_instance_id": {
+              "type": "long"
+            },
+            "dot1q_service_instance_priority": {
+              "type": "short"
+            },
+            "dot1q_service_instance_tag": {
+              "type": "short"
+            },
+            "dot1q_vlan_id": {
+              "type": "long"
+            },
+            "dropped_layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "dropped_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "dropped_octet_delta_count": {
+              "type": "long"
+            },
+            "dropped_octet_total_count": {
+              "type": "long"
+            },
+            "dropped_packet_delta_count": {
+              "type": "long"
+            },
+            "dropped_packet_total_count": {
+              "type": "long"
+            },
+            "dst_traffic_index": {
+              "type": "long"
+            },
+            "egress_broadcast_packet_total_count": {
+              "type": "long"
+            },
+            "egress_interface": {
+              "type": "long"
+            },
+            "egress_interface_type": {
+              "type": "long"
+            },
+            "egress_physical_interface": {
+              "type": "long"
+            },
+            "egress_unicast_packet_total_count": {
+              "type": "long"
+            },
+            "egress_vrfid": {
+              "type": "long"
+            },
+            "encrypted_technology": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "engine_id": {
+              "type": "short"
+            },
+            "engine_type": {
+              "type": "short"
+            },
+            "ethernet_header_length": {
+              "type": "short"
+            },
+            "ethernet_payload_length": {
+              "type": "long"
+            },
+            "ethernet_total_length": {
+              "type": "long"
+            },
+            "ethernet_type": {
+              "type": "long"
+            },
+            "export_interface": {
+              "type": "long"
+            },
+            "export_protocol_version": {
+              "type": "short"
+            },
+            "export_sctp_stream_id": {
+              "type": "long"
+            },
+            "export_transport_protocol": {
+              "type": "short"
+            },
+            "exported_flow_record_total_count": {
+              "type": "long"
+            },
+            "exported_message_total_count": {
+              "type": "long"
+            },
+            "exported_octet_total_count": {
+              "type": "long"
+            },
+            "exporter": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source_id": {
+                  "type": "long"
+                },
+                "timestamp": {
+                  "type": "date"
+                },
+                "uptime_millis": {
+                  "type": "long"
+                },
+                "version": {
+                  "type": "long"
+                }
+              }
+            },
+            "exporter_certificate": {
+              "type": "short"
+            },
+            "exporter_ipv4_address": {
+              "type": "ip"
+            },
+            "exporter_ipv6_address": {
+              "type": "ip"
+            },
+            "exporter_transport_port": {
+              "type": "long"
+            },
+            "exporting_process_id": {
+              "type": "long"
+            },
+            "external_address_realm": {
+              "type": "short"
+            },
+            "firewall_event": {
+              "type": "short"
+            },
+            "flags_and_sampler_id": {
+              "type": "long"
+            },
+            "flow_active_timeout": {
+              "type": "long"
+            },
+            "flow_direction": {
+              "type": "short"
+            },
+            "flow_duration_microseconds": {
+              "type": "long"
+            },
+            "flow_duration_milliseconds": {
+              "type": "long"
+            },
+            "flow_end_delta_microseconds": {
+              "type": "long"
+            },
+            "flow_end_microseconds": {
+              "type": "date"
+            },
+            "flow_end_milliseconds": {
+              "type": "date"
+            },
+            "flow_end_nanoseconds": {
+              "type": "date"
+            },
+            "flow_end_reason": {
+              "type": "short"
+            },
+            "flow_end_seconds": {
+              "type": "date"
+            },
+            "flow_end_sys_up_time": {
+              "type": "long"
+            },
+            "flow_id": {
+              "type": "long"
+            },
+            "flow_idle_timeout": {
+              "type": "long"
+            },
+            "flow_key_indicator": {
+              "type": "long"
+            },
+            "flow_label_ipv6": {
+              "type": "long"
+            },
+            "flow_sampling_time_interval": {
+              "type": "long"
+            },
+            "flow_sampling_time_spacing": {
+              "type": "long"
+            },
+            "flow_selected_flow_delta_count": {
+              "type": "long"
+            },
+            "flow_selected_octet_delta_count": {
+              "type": "long"
+            },
+            "flow_selected_packet_delta_count": {
+              "type": "long"
+            },
+            "flow_selector_algorithm": {
+              "type": "long"
+            },
+            "flow_start_delta_microseconds": {
+              "type": "long"
+            },
+            "flow_start_microseconds": {
+              "type": "date"
+            },
+            "flow_start_milliseconds": {
+              "type": "date"
+            },
+            "flow_start_nanoseconds": {
+              "type": "date"
+            },
+            "flow_start_seconds": {
+              "type": "date"
+            },
+            "flow_start_sys_up_time": {
+              "type": "long"
+            },
+            "forwarding_status": {
+              "type": "short"
+            },
+            "fragment_flags": {
+              "type": "short"
+            },
+            "fragment_identification": {
+              "type": "long"
+            },
+            "fragment_offset": {
+              "type": "long"
+            },
+            "global_address_mapping_high_threshold": {
+              "type": "long"
+            },
+            "gre_key": {
+              "type": "long"
+            },
+            "hash_digest_output": {
+              "type": "boolean"
+            },
+            "hash_flow_domain": {
+              "type": "long"
+            },
+            "hash_initialiser_value": {
+              "type": "long"
+            },
+            "hash_ipp_ayload_offset": {
+              "type": "long"
+            },
+            "hash_ipp_ayload_size": {
+              "type": "long"
+            },
+            "hash_output_range_max": {
+              "type": "long"
+            },
+            "hash_output_range_min": {
+              "type": "long"
+            },
+            "hash_selected_range_max": {
+              "type": "long"
+            },
+            "hash_selected_range_min": {
+              "type": "long"
+            },
+            "http_content_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_message_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_reason_phrase": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_request_host": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_request_method": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_request_target": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "http_status_code": {
+              "type": "long"
+            },
+            "http_user_agent": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "icmp_code_ipv4": {
+              "type": "short"
+            },
+            "icmp_code_ipv6": {
+              "type": "short"
+            },
+            "icmp_type_code_ipv4": {
+              "type": "long"
+            },
+            "icmp_type_code_ipv6": {
+              "type": "long"
+            },
+            "icmp_type_ipv4": {
+              "type": "short"
+            },
+            "icmp_type_ipv6": {
+              "type": "short"
+            },
+            "igmp_type": {
+              "type": "short"
+            },
+            "ignored_data_record_total_count": {
+              "type": "long"
+            },
+            "ignored_layer2_frame_total_count": {
+              "type": "long"
+            },
+            "ignored_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "ignored_octet_total_count": {
+              "type": "long"
+            },
+            "ignored_packet_total_count": {
+              "type": "long"
+            },
+            "information_element_data_type": {
+              "type": "short"
+            },
+            "information_element_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "information_element_id": {
+              "type": "long"
+            },
+            "information_element_index": {
+              "type": "long"
+            },
+            "information_element_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "information_element_range_begin": {
+              "type": "long"
+            },
+            "information_element_range_end": {
+              "type": "long"
+            },
+            "information_element_semantics": {
+              "type": "short"
+            },
+            "information_element_units": {
+              "type": "long"
+            },
+            "ingress_broadcast_packet_total_count": {
+              "type": "long"
+            },
+            "ingress_interface": {
+              "type": "long"
+            },
+            "ingress_interface_type": {
+              "type": "long"
+            },
+            "ingress_multicast_packet_total_count": {
+              "type": "long"
+            },
+            "ingress_physical_interface": {
+              "type": "long"
+            },
+            "ingress_unicast_packet_total_count": {
+              "type": "long"
+            },
+            "ingress_vrfid": {
+              "type": "long"
+            },
+            "initiator_octets": {
+              "type": "long"
+            },
+            "initiator_packets": {
+              "type": "long"
+            },
+            "interface_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "interface_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "intermediate_process_id": {
+              "type": "long"
+            },
+            "internal_address_realm": {
+              "type": "short"
+            },
+            "ip_class_of_service": {
+              "type": "short"
+            },
+            "ip_diff_serv_code_point": {
+              "type": "short"
+            },
+            "ip_header_length": {
+              "type": "short"
+            },
+            "ip_header_packet_section": {
+              "type": "short"
+            },
+            "ip_next_hop_ipv4_address": {
+              "type": "ip"
+            },
+            "ip_next_hop_ipv6_address": {
+              "type": "ip"
+            },
+            "ip_payload_length": {
+              "type": "long"
+            },
+            "ip_payload_packet_section": {
+              "type": "short"
+            },
+            "ip_precedence": {
+              "type": "short"
+            },
+            "ip_sec_spi": {
+              "type": "long"
+            },
+            "ip_total_length": {
+              "type": "long"
+            },
+            "ip_ttl": {
+              "type": "short"
+            },
+            "ip_version": {
+              "type": "short"
+            },
+            "ipv4_ihl": {
+              "type": "short"
+            },
+            "ipv4_options": {
+              "type": "long"
+            },
+            "ipv4_router_sc": {
+              "type": "ip"
+            },
+            "ipv6_extension_headers": {
+              "type": "long"
+            },
+            "is_multicast": {
+              "type": "short"
+            },
+            "layer2_frame_delta_count": {
+              "type": "long"
+            },
+            "layer2_frame_total_count": {
+              "type": "long"
+            },
+            "layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "layer2_octet_delta_sum_of_squares": {
+              "type": "long"
+            },
+            "layer2_octet_total_count": {
+              "type": "long"
+            },
+            "layer2_octet_total_sum_of_squares": {
+              "type": "long"
+            },
+            "layer2_segment_id": {
+              "type": "long"
+            },
+            "layer2packet_section_data": {
+              "type": "short"
+            },
+            "layer2packet_section_offset": {
+              "type": "long"
+            },
+            "layer2packet_section_size": {
+              "type": "long"
+            },
+            "line_card_id": {
+              "type": "long"
+            },
+            "lower_cli_imit": {
+              "type": "double"
+            },
+            "max_bieb_ntries": {
+              "type": "long"
+            },
+            "max_entries_per_user": {
+              "type": "long"
+            },
+            "max_export_seconds": {
+              "type": "date"
+            },
+            "max_flow_end_microseconds": {
+              "type": "date"
+            },
+            "max_flow_end_milliseconds": {
+              "type": "date"
+            },
+            "max_flow_end_nanoseconds": {
+              "type": "date"
+            },
+            "max_flow_end_seconds": {
+              "type": "date"
+            },
+            "max_fragments_pending_reassembly": {
+              "type": "long"
+            },
+            "max_session_entries": {
+              "type": "long"
+            },
+            "max_subscribers": {
+              "type": "long"
+            },
+            "maximum_ip_total_length": {
+              "type": "long"
+            },
+            "maximum_layer2_total_length": {
+              "type": "long"
+            },
+            "maximum_ttl": {
+              "type": "short"
+            },
+            "message_md5_checksum": {
+              "type": "short"
+            },
+            "message_scope": {
+              "type": "short"
+            },
+            "metering_process_id": {
+              "type": "long"
+            },
+            "metro_evc_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "metro_evc_type": {
+              "type": "short"
+            },
+            "mib_capture_time_semantics": {
+              "type": "short"
+            },
+            "mib_context_engine_id": {
+              "type": "short"
+            },
+            "mib_context_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_index_indicator": {
+              "type": "long"
+            },
+            "mib_module_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_identifier": {
+              "type": "short"
+            },
+            "mib_object_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_syntax": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mib_object_value_bits": {
+              "type": "short"
+            },
+            "mib_object_value_counter": {
+              "type": "long"
+            },
+            "mib_object_value_gauge": {
+              "type": "long"
+            },
+            "mib_object_value_integer": {
+              "type": "long"
+            },
+            "mib_object_value_octet_string": {
+              "type": "short"
+            },
+            "mib_object_value_oid": {
+              "type": "short"
+            },
+            "mib_object_value_time_ticks": {
+              "type": "long"
+            },
+            "mib_object_value_unsigned": {
+              "type": "long"
+            },
+            "mib_object_valuei_pa_ddress": {
+              "type": "ip"
+            },
+            "mib_sub_identifier": {
+              "type": "long"
+            },
+            "min_export_seconds": {
+              "type": "date"
+            },
+            "min_flow_start_microseconds": {
+              "type": "date"
+            },
+            "min_flow_start_milliseconds": {
+              "type": "date"
+            },
+            "min_flow_start_nanoseconds": {
+              "type": "date"
+            },
+            "min_flow_start_seconds": {
+              "type": "date"
+            },
+            "minimum_ip_total_length": {
+              "type": "long"
+            },
+            "minimum_layer2_total_length": {
+              "type": "long"
+            },
+            "minimum_ttl": {
+              "type": "short"
+            },
+            "mobile_imsi": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mobile_msisdn": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "monitoring_interval_end_milli_seconds": {
+              "type": "date"
+            },
+            "monitoring_interval_start_milli_seconds": {
+              "type": "date"
+            },
+            "mpls_label_stack_depth": {
+              "type": "long"
+            },
+            "mpls_label_stack_length": {
+              "type": "long"
+            },
+            "mpls_label_stack_section": {
+              "type": "short"
+            },
+            "mpls_label_stack_section10": {
+              "type": "short"
+            },
+            "mpls_label_stack_section2": {
+              "type": "short"
+            },
+            "mpls_label_stack_section3": {
+              "type": "short"
+            },
+            "mpls_label_stack_section4": {
+              "type": "short"
+            },
+            "mpls_label_stack_section5": {
+              "type": "short"
+            },
+            "mpls_label_stack_section6": {
+              "type": "short"
+            },
+            "mpls_label_stack_section7": {
+              "type": "short"
+            },
+            "mpls_label_stack_section8": {
+              "type": "short"
+            },
+            "mpls_label_stack_section9": {
+              "type": "short"
+            },
+            "mpls_payload_length": {
+              "type": "long"
+            },
+            "mpls_payload_packet_section": {
+              "type": "short"
+            },
+            "mpls_top_label_exp": {
+              "type": "short"
+            },
+            "mpls_top_label_ipv4_address": {
+              "type": "ip"
+            },
+            "mpls_top_label_ipv6_address": {
+              "type": "ip"
+            },
+            "mpls_top_label_prefix_length": {
+              "type": "short"
+            },
+            "mpls_top_label_stack_section": {
+              "type": "short"
+            },
+            "mpls_top_label_ttl": {
+              "type": "short"
+            },
+            "mpls_top_label_type": {
+              "type": "short"
+            },
+            "mpls_vpn_route_distinguisher": {
+              "type": "short"
+            },
+            "multicast_replication_factor": {
+              "type": "long"
+            },
+            "nat_event": {
+              "type": "short"
+            },
+            "nat_instance_id": {
+              "type": "long"
+            },
+            "nat_originating_address_realm": {
+              "type": "short"
+            },
+            "nat_pool_id": {
+              "type": "long"
+            },
+            "nat_pool_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat_quota_exceeded_event": {
+              "type": "long"
+            },
+            "nat_threshold_event": {
+              "type": "long"
+            },
+            "nat_type": {
+              "type": "short"
+            },
+            "new_connection_delta_count": {
+              "type": "long"
+            },
+            "next_header_ipv6": {
+              "type": "short"
+            },
+            "not_sent_flow_total_count": {
+              "type": "long"
+            },
+            "not_sent_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "not_sent_octet_total_count": {
+              "type": "long"
+            },
+            "not_sent_packet_total_count": {
+              "type": "long"
+            },
+            "observation_domain_id": {
+              "type": "long"
+            },
+            "observation_domain_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "observation_point_id": {
+              "type": "long"
+            },
+            "observation_point_type": {
+              "type": "short"
+            },
+            "observation_time_microseconds": {
+              "type": "date"
+            },
+            "observation_time_milliseconds": {
+              "type": "date"
+            },
+            "observation_time_nanoseconds": {
+              "type": "date"
+            },
+            "observation_time_seconds": {
+              "type": "date"
+            },
+            "observed_flow_total_count": {
+              "type": "long"
+            },
+            "octet_delta_count": {
+              "type": "long"
+            },
+            "octet_delta_sum_of_squares": {
+              "type": "long"
+            },
+            "octet_total_count": {
+              "type": "long"
+            },
+            "octet_total_sum_of_squares": {
+              "type": "long"
+            },
+            "opaque_octets": {
+              "type": "short"
+            },
+            "original_exporter_ipv4_address": {
+              "type": "ip"
+            },
+            "original_exporter_ipv6_address": {
+              "type": "ip"
+            },
+            "original_flows_completed": {
+              "type": "long"
+            },
+            "original_flows_initiated": {
+              "type": "long"
+            },
+            "original_flows_present": {
+              "type": "long"
+            },
+            "original_observation_domain_id": {
+              "type": "long"
+            },
+            "p2p_technology": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packet_delta_count": {
+              "type": "long"
+            },
+            "packet_total_count": {
+              "type": "long"
+            },
+            "padding_octets": {
+              "type": "short"
+            },
+            "payload_length_ipv6": {
+              "type": "long"
+            },
+            "port_id": {
+              "type": "long"
+            },
+            "port_range_end": {
+              "type": "long"
+            },
+            "port_range_num_ports": {
+              "type": "long"
+            },
+            "port_range_start": {
+              "type": "long"
+            },
+            "port_range_step_size": {
+              "type": "long"
+            },
+            "post_destination_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "post_dot1q_customer_vlan_id": {
+              "type": "long"
+            },
+            "post_dot1q_vlan_id": {
+              "type": "long"
+            },
+            "post_ip_class_of_service": {
+              "type": "short"
+            },
+            "post_ip_diff_serv_code_point": {
+              "type": "short"
+            },
+            "post_ip_precedence": {
+              "type": "short"
+            },
+            "post_layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "post_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "post_mcast_layer2_octet_delta_count": {
+              "type": "long"
+            },
+            "post_mcast_layer2_octet_total_count": {
+              "type": "long"
+            },
+            "post_mcast_octet_delta_count": {
+              "type": "long"
+            },
+            "post_mcast_octet_total_count": {
+              "type": "long"
+            },
+            "post_mcast_packet_delta_count": {
+              "type": "long"
+            },
+            "post_mcast_packet_total_count": {
+              "type": "long"
+            },
+            "post_mpls_top_label_exp": {
+              "type": "short"
+            },
+            "post_nadt_estination_ipv4_address": {
+              "type": "ip"
+            },
+            "post_nadt_estination_ipv6_address": {
+              "type": "ip"
+            },
+            "post_napdt_estination_transport_port": {
+              "type": "long"
+            },
+            "post_napst_ource_transport_port": {
+              "type": "long"
+            },
+            "post_nast_ource_ipv4_address": {
+              "type": "ip"
+            },
+            "post_nast_ource_ipv6_address": {
+              "type": "ip"
+            },
+            "post_octet_delta_count": {
+              "type": "long"
+            },
+            "post_octet_total_count": {
+              "type": "long"
+            },
+            "post_packet_delta_count": {
+              "type": "long"
+            },
+            "post_packet_total_count": {
+              "type": "long"
+            },
+            "post_source_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "post_vlan_id": {
+              "type": "long"
+            },
+            "private_enterprise_number": {
+              "type": "long"
+            },
+            "protocol_identifier": {
+              "type": "short"
+            },
+            "pseudo_wire_control_word": {
+              "type": "long"
+            },
+            "pseudo_wire_destination_ipv4_address": {
+              "type": "ip"
+            },
+            "pseudo_wire_id": {
+              "type": "long"
+            },
+            "pseudo_wire_type": {
+              "type": "long"
+            },
+            "relative_error": {
+              "type": "double"
+            },
+            "responder_octets": {
+              "type": "long"
+            },
+            "responder_packets": {
+              "type": "long"
+            },
+            "rfc3550_jitter_microseconds": {
+              "type": "long"
+            },
+            "rfc3550_jitter_milliseconds": {
+              "type": "long"
+            },
+            "rfc3550_jitter_nanoseconds": {
+              "type": "long"
+            },
+            "rtp_sequence_number": {
+              "type": "long"
+            },
+            "sampler_id": {
+              "type": "short"
+            },
+            "sampler_mode": {
+              "type": "short"
+            },
+            "sampler_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sampler_random_interval": {
+              "type": "long"
+            },
+            "sampling_algorithm": {
+              "type": "short"
+            },
+            "sampling_flow_interval": {
+              "type": "long"
+            },
+            "sampling_flow_spacing": {
+              "type": "long"
+            },
+            "sampling_interval": {
+              "type": "long"
+            },
+            "sampling_packet_interval": {
+              "type": "long"
+            },
+            "sampling_packet_space": {
+              "type": "long"
+            },
+            "sampling_population": {
+              "type": "long"
+            },
+            "sampling_probability": {
+              "type": "double"
+            },
+            "sampling_size": {
+              "type": "long"
+            },
+            "sampling_time_interval": {
+              "type": "long"
+            },
+            "sampling_time_space": {
+              "type": "long"
+            },
+            "section_exported_octets": {
+              "type": "long"
+            },
+            "section_offset": {
+              "type": "long"
+            },
+            "selection_sequence_id": {
+              "type": "long"
+            },
+            "selector_algorithm": {
+              "type": "long"
+            },
+            "selector_id": {
+              "type": "long"
+            },
+            "selector_id_total_pkts_observed": {
+              "type": "long"
+            },
+            "selector_id_total_pkts_selected": {
+              "type": "long"
+            },
+            "selector_itd_otal_flows_observed": {
+              "type": "long"
+            },
+            "selector_itd_otal_flows_selected": {
+              "type": "long"
+            },
+            "selector_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "session_scope": {
+              "type": "short"
+            },
+            "source_ipv4_address": {
+              "type": "ip"
+            },
+            "source_ipv4_prefix": {
+              "type": "ip"
+            },
+            "source_ipv4_prefix_length": {
+              "type": "short"
+            },
+            "source_ipv6_address": {
+              "type": "ip"
+            },
+            "source_ipv6_prefix": {
+              "type": "ip"
+            },
+            "source_ipv6_prefix_length": {
+              "type": "short"
+            },
+            "source_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "source_transport_port": {
+              "type": "long"
+            },
+            "source_transport_ports_limit": {
+              "type": "long"
+            },
+            "src_traffic_index": {
+              "type": "long"
+            },
+            "sta_ipv4_address": {
+              "type": "ip"
+            },
+            "sta_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "system_init_time_milliseconds": {
+              "type": "date"
+            },
+            "tcp_ack_total_count": {
+              "type": "long"
+            },
+            "tcp_acknowledgement_number": {
+              "type": "long"
+            },
+            "tcp_control_bits": {
+              "type": "long"
+            },
+            "tcp_destination_port": {
+              "type": "long"
+            },
+            "tcp_fin_total_count": {
+              "type": "long"
+            },
+            "tcp_header_length": {
+              "type": "short"
+            },
+            "tcp_options": {
+              "type": "long"
+            },
+            "tcp_psh_total_count": {
+              "type": "long"
+            },
+            "tcp_rst_total_count": {
+              "type": "long"
+            },
+            "tcp_sequence_number": {
+              "type": "long"
+            },
+            "tcp_source_port": {
+              "type": "long"
+            },
+            "tcp_syn_total_count": {
+              "type": "long"
+            },
+            "tcp_urg_total_count": {
+              "type": "long"
+            },
+            "tcp_urgent_pointer": {
+              "type": "long"
+            },
+            "tcp_window_scale": {
+              "type": "long"
+            },
+            "tcp_window_size": {
+              "type": "long"
+            },
+            "template_id": {
+              "type": "long"
+            },
+            "total_length_ipv4": {
+              "type": "long"
+            },
+            "transport_octet_delta_count": {
+              "type": "long"
+            },
+            "transport_packet_delta_count": {
+              "type": "long"
+            },
+            "tunnel_technology": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "udp_destination_port": {
+              "type": "long"
+            },
+            "udp_message_length": {
+              "type": "long"
+            },
+            "udp_source_port": {
+              "type": "long"
+            },
+            "upper_cli_imit": {
+              "type": "double"
+            },
+            "user_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value_distribution_method": {
+              "type": "short"
+            },
+            "virtual_station_interface_id": {
+              "type": "short"
+            },
+            "virtual_station_interface_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "virtual_station_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "virtual_station_uuid": {
+              "type": "short"
+            },
+            "vlan_id": {
+              "type": "long"
+            },
+            "vpn_identifier": {
+              "type": "short"
+            },
+            "vr_fname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "wlan_channel_id": {
+              "type": "short"
+            },
+            "wlan_ssid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "wtp_mac_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "nginx": {
+          "properties": {
+            "access": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "connection_id": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "osquery": {
+          "properties": {
+            "result": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "calendar_time": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "host_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unix_time": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "postgresql": {
+          "properties": {
+            "log": {
+              "properties": {
+                "core_id": {
+                  "type": "long"
+                },
+                "database": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "program": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "working_directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "redis": {
+          "properties": {
+            "log": {
+              "properties": {
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "duration": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "id": {
+                  "type": "long"
+                },
+                "key": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            }
+          }
+        },
+        "santa": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "decision": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "disk": {
+              "properties": {
+                "bsdname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bus": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "model": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mount": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "volume": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reason": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "stream": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "suricata": {
+          "properties": {
+            "eve": {
+              "properties": {
+                "alert": {
+                  "properties": {
+                    "action": {
+                      "path": "event.outcome",
+                      "type": "alias"
+                    },
+                    "category": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "gid": {
+                      "type": "long"
+                    },
+                    "rev": {
+                      "type": "long"
+                    },
+                    "severity": {
+                      "path": "event.severity",
+                      "type": "alias"
+                    },
+                    "signature": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_id": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "app_proto": {
+                  "path": "network.protocol",
+                  "type": "alias"
+                },
+                "app_proto_expected": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "app_proto_orig": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "app_proto_tc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "app_proto_ts": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dest_ip": {
+                  "path": "destination.ip",
+                  "type": "alias"
+                },
+                "dest_port": {
+                  "path": "destination.port",
+                  "type": "alias"
+                },
+                "dns": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "rcode": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rdata": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rrname": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rrtype": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ttl": {
+                      "type": "long"
+                    },
+                    "tx_id": {
+                      "type": "long"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "email": {
+                  "properties": {
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "event_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fileinfo": {
+                  "properties": {
+                    "filename": {
+                      "path": "file.path",
+                      "type": "alias"
+                    },
+                    "gaps": {
+                      "type": "boolean"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "size": {
+                      "path": "file.size",
+                      "type": "alias"
+                    },
+                    "state": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stored": {
+                      "type": "boolean"
+                    },
+                    "tx_id": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "flags": {
+                  "type": "object"
+                },
+                "flow": {
+                  "properties": {
+                    "age": {
+                      "type": "long"
+                    },
+                    "alerted": {
+                      "type": "boolean"
+                    },
+                    "bytes_toclient": {
+                      "path": "destination.bytes",
+                      "type": "alias"
+                    },
+                    "bytes_toserver": {
+                      "path": "source.bytes",
+                      "type": "alias"
+                    },
+                    "end": {
+                      "type": "date"
+                    },
+                    "pkts_toclient": {
+                      "path": "destination.packets",
+                      "type": "alias"
+                    },
+                    "pkts_toserver": {
+                      "path": "source.packets",
+                      "type": "alias"
+                    },
+                    "reason": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "start": {
+                      "path": "event.start",
+                      "type": "alias"
+                    },
+                    "state": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "flow_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "http": {
+                  "properties": {
+                    "hostname": {
+                      "path": "url.domain",
+                      "type": "alias"
+                    },
+                    "http_content_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "http_method": {
+                      "path": "http.request.method",
+                      "type": "alias"
+                    },
+                    "http_refer": {
+                      "path": "http.request.referrer",
+                      "type": "alias"
+                    },
+                    "http_user_agent": {
+                      "path": "user_agent.original",
+                      "type": "alias"
+                    },
+                    "length": {
+                      "path": "http.response.body.bytes",
+                      "type": "alias"
+                    },
+                    "protocol": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "redirect": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "status": {
+                      "path": "http.response.status_code",
+                      "type": "alias"
+                    },
+                    "url": {
+                      "path": "url.original",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "icmp_code": {
+                  "type": "long"
+                },
+                "icmp_type": {
+                  "type": "long"
+                },
+                "in_iface": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pcap_cnt": {
+                  "type": "long"
+                },
+                "proto": {
+                  "path": "network.transport",
+                  "type": "alias"
+                },
+                "smtp": {
+                  "properties": {
+                    "helo": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "mail_from": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rcpt_to": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "src_ip": {
+                  "path": "source.ip",
+                  "type": "alias"
+                },
+                "src_port": {
+                  "path": "source.port",
+                  "type": "alias"
+                },
+                "ssh": {
+                  "properties": {
+                    "client": {
+                      "properties": {
+                        "proto_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "software_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "server": {
+                      "properties": {
+                        "proto_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "software_version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "stats": {
+                  "properties": {
+                    "app_layer": {
+                      "properties": {
+                        "flow": {
+                          "properties": {
+                            "dcerpc_tcp": {
+                              "type": "long"
+                            },
+                            "dcerpc_udp": {
+                              "type": "long"
+                            },
+                            "dns_tcp": {
+                              "type": "long"
+                            },
+                            "dns_udp": {
+                              "type": "long"
+                            },
+                            "failed_tcp": {
+                              "type": "long"
+                            },
+                            "failed_udp": {
+                              "type": "long"
+                            },
+                            "ftp": {
+                              "type": "long"
+                            },
+                            "http": {
+                              "type": "long"
+                            },
+                            "imap": {
+                              "type": "long"
+                            },
+                            "msn": {
+                              "type": "long"
+                            },
+                            "smb": {
+                              "type": "long"
+                            },
+                            "smtp": {
+                              "type": "long"
+                            },
+                            "ssh": {
+                              "type": "long"
+                            },
+                            "tls": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "tx": {
+                          "properties": {
+                            "dcerpc_tcp": {
+                              "type": "long"
+                            },
+                            "dcerpc_udp": {
+                              "type": "long"
+                            },
+                            "dns_tcp": {
+                              "type": "long"
+                            },
+                            "dns_udp": {
+                              "type": "long"
+                            },
+                            "ftp": {
+                              "type": "long"
+                            },
+                            "http": {
+                              "type": "long"
+                            },
+                            "smb": {
+                              "type": "long"
+                            },
+                            "smtp": {
+                              "type": "long"
+                            },
+                            "ssh": {
+                              "type": "long"
+                            },
+                            "tls": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "capture": {
+                      "properties": {
+                        "kernel_drops": {
+                          "type": "long"
+                        },
+                        "kernel_ifdrops": {
+                          "type": "long"
+                        },
+                        "kernel_packets": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "decoder": {
+                      "properties": {
+                        "avg_pkt_size": {
+                          "type": "long"
+                        },
+                        "bytes": {
+                          "type": "long"
+                        },
+                        "dce": {
+                          "properties": {
+                            "pkt_too_small": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "erspan": {
+                          "type": "long"
+                        },
+                        "ethernet": {
+                          "type": "long"
+                        },
+                        "gre": {
+                          "type": "long"
+                        },
+                        "icmpv4": {
+                          "type": "long"
+                        },
+                        "icmpv6": {
+                          "type": "long"
+                        },
+                        "ieee8021ah": {
+                          "type": "long"
+                        },
+                        "invalid": {
+                          "type": "long"
+                        },
+                        "ipraw": {
+                          "properties": {
+                            "invalid_ip_version": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "ipv4": {
+                          "type": "long"
+                        },
+                        "ipv4_in_ipv6": {
+                          "type": "long"
+                        },
+                        "ipv6": {
+                          "type": "long"
+                        },
+                        "ipv6_in_ipv6": {
+                          "type": "long"
+                        },
+                        "ltnull": {
+                          "properties": {
+                            "pkt_too_small": {
+                              "type": "long"
+                            },
+                            "unsupported_type": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "max_pkt_size": {
+                          "type": "long"
+                        },
+                        "mpls": {
+                          "type": "long"
+                        },
+                        "null": {
+                          "type": "long"
+                        },
+                        "pkts": {
+                          "type": "long"
+                        },
+                        "ppp": {
+                          "type": "long"
+                        },
+                        "pppoe": {
+                          "type": "long"
+                        },
+                        "raw": {
+                          "type": "long"
+                        },
+                        "sctp": {
+                          "type": "long"
+                        },
+                        "sll": {
+                          "type": "long"
+                        },
+                        "tcp": {
+                          "type": "long"
+                        },
+                        "teredo": {
+                          "type": "long"
+                        },
+                        "udp": {
+                          "type": "long"
+                        },
+                        "vlan": {
+                          "type": "long"
+                        },
+                        "vlan_qinq": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "defrag": {
+                      "properties": {
+                        "ipv4": {
+                          "properties": {
+                            "fragments": {
+                              "type": "long"
+                            },
+                            "reassembled": {
+                              "type": "long"
+                            },
+                            "timeouts": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "ipv6": {
+                          "properties": {
+                            "fragments": {
+                              "type": "long"
+                            },
+                            "reassembled": {
+                              "type": "long"
+                            },
+                            "timeouts": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "max_frag_hits": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "detect": {
+                      "properties": {
+                        "alert": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "dns": {
+                      "properties": {
+                        "memcap_global": {
+                          "type": "long"
+                        },
+                        "memcap_state": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "file_store": {
+                      "properties": {
+                        "open_files": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "flow": {
+                      "properties": {
+                        "emerg_mode_entered": {
+                          "type": "long"
+                        },
+                        "emerg_mode_over": {
+                          "type": "long"
+                        },
+                        "icmpv4": {
+                          "type": "long"
+                        },
+                        "icmpv6": {
+                          "type": "long"
+                        },
+                        "memcap": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        },
+                        "spare": {
+                          "type": "long"
+                        },
+                        "tcp": {
+                          "type": "long"
+                        },
+                        "tcp_reuse": {
+                          "type": "long"
+                        },
+                        "udp": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "flow_mgr": {
+                      "properties": {
+                        "bypassed_pruned": {
+                          "type": "long"
+                        },
+                        "closed_pruned": {
+                          "type": "long"
+                        },
+                        "est_pruned": {
+                          "type": "long"
+                        },
+                        "flows_checked": {
+                          "type": "long"
+                        },
+                        "flows_notimeout": {
+                          "type": "long"
+                        },
+                        "flows_removed": {
+                          "type": "long"
+                        },
+                        "flows_timeout": {
+                          "type": "long"
+                        },
+                        "flows_timeout_inuse": {
+                          "type": "long"
+                        },
+                        "new_pruned": {
+                          "type": "long"
+                        },
+                        "rows_busy": {
+                          "type": "long"
+                        },
+                        "rows_checked": {
+                          "type": "long"
+                        },
+                        "rows_empty": {
+                          "type": "long"
+                        },
+                        "rows_maxlen": {
+                          "type": "long"
+                        },
+                        "rows_skipped": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "http": {
+                      "properties": {
+                        "memcap": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "tcp": {
+                      "properties": {
+                        "insert_data_normal_fail": {
+                          "type": "long"
+                        },
+                        "insert_data_overlap_fail": {
+                          "type": "long"
+                        },
+                        "insert_list_fail": {
+                          "type": "long"
+                        },
+                        "invalid_checksum": {
+                          "type": "long"
+                        },
+                        "memuse": {
+                          "type": "long"
+                        },
+                        "no_flow": {
+                          "type": "long"
+                        },
+                        "overlap": {
+                          "type": "long"
+                        },
+                        "overlap_diff_data": {
+                          "type": "long"
+                        },
+                        "pseudo": {
+                          "type": "long"
+                        },
+                        "pseudo_failed": {
+                          "type": "long"
+                        },
+                        "reassembly_gap": {
+                          "type": "long"
+                        },
+                        "reassembly_memuse": {
+                          "type": "long"
+                        },
+                        "rst": {
+                          "type": "long"
+                        },
+                        "segment_memcap_drop": {
+                          "type": "long"
+                        },
+                        "sessions": {
+                          "type": "long"
+                        },
+                        "ssn_memcap_drop": {
+                          "type": "long"
+                        },
+                        "stream_depth_reached": {
+                          "type": "long"
+                        },
+                        "syn": {
+                          "type": "long"
+                        },
+                        "synack": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "uptime": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "tcp": {
+                  "properties": {
+                    "ack": {
+                      "type": "boolean"
+                    },
+                    "fin": {
+                      "type": "boolean"
+                    },
+                    "psh": {
+                      "type": "boolean"
+                    },
+                    "rst": {
+                      "type": "boolean"
+                    },
+                    "state": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "syn": {
+                      "type": "boolean"
+                    },
+                    "tcp_flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tcp_flags_tc": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tcp_flags_ts": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestamp": {
+                  "path": "@timestamp",
+                  "type": "alias"
+                },
+                "tls": {
+                  "properties": {
+                    "fingerprint": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuerdn": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "notafter": {
+                      "type": "date"
+                    },
+                    "notbefore": {
+                      "type": "date"
+                    },
+                    "serial": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "session_resumed": {
+                      "type": "boolean"
+                    },
+                    "sni": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "tx_id": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "syslog": {
+          "properties": {
+            "facility": {
+              "type": "long"
+            },
+            "facility_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "priority": {
+              "type": "long"
+            },
+            "severity_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "auth": {
+              "properties": {
+                "groupadd": {
+                  "type": "object"
+                },
+                "ssh": {
+                  "properties": {
+                    "dropped_ip": {
+                      "type": "ip"
+                    },
+                    "event": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "geoip": {
+                      "type": "object"
+                    },
+                    "method": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "sudo": {
+                  "properties": {
+                    "command": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "error": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pwd": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tty": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "useradd": {
+                  "properties": {
+                    "home": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "shell": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "syslog": {
+              "type": "object"
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "traefik": {
+          "properties": {
+            "access": {
+              "properties": {
+                "backend_url": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "frontend_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "properties": {
+                    "city_name": {
+                      "path": "source.geo.city_name",
+                      "type": "alias"
+                    },
+                    "continent_name": {
+                      "path": "source.geo.continent_name",
+                      "type": "alias"
+                    },
+                    "country_iso_code": {
+                      "path": "source.geo.country_iso_code",
+                      "type": "alias"
+                    },
+                    "location": {
+                      "path": "source.geo.location",
+                      "type": "alias"
+                    },
+                    "region_iso_code": {
+                      "path": "source.geo.region_iso_code",
+                      "type": "alias"
+                    },
+                    "region_name": {
+                      "path": "source.geo.region_name",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "request_count": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "properties": {
+                    "device": {
+                      "path": "user_agent.device.name",
+                      "type": "alias"
+                    },
+                    "name": {
+                      "path": "user_agent.name",
+                      "type": "alias"
+                    },
+                    "original": {
+                      "path": "user_agent.original",
+                      "type": "alias"
+                    },
+                    "os": {
+                      "path": "user_agent.os.full_name",
+                      "type": "alias"
+                    },
+                    "os_name": {
+                      "path": "user_agent.os.name",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "user_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "zeek": {
+          "properties": {
+            "connection": {
+              "properties": {
+                "history": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inner_vlan": {
+                  "type": "long"
+                },
+                "local_orig": {
+                  "type": "boolean"
+                },
+                "local_resp": {
+                  "type": "boolean"
+                },
+                "missed_bytes": {
+                  "type": "long"
+                },
+                "orig_l2_addr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resp_l2_addr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vlan": {
+                  "type": "long"
+                }
+              }
+            },
+            "dns": {
+              "properties": {
+                "AA": {
+                  "type": "boolean"
+                },
+                "RA": {
+                  "type": "boolean"
+                },
+                "RD": {
+                  "type": "boolean"
+                },
+                "TC": {
+                  "type": "boolean"
+                },
+                "TTLs": {
+                  "type": "double"
+                },
+                "answers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "qclass": {
+                  "type": "long"
+                },
+                "qclass_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "qtype": {
+                  "type": "long"
+                },
+                "qtype_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rcode": {
+                  "type": "long"
+                },
+                "rcode_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rejected": {
+                  "type": "boolean"
+                },
+                "rtt": {
+                  "type": "double"
+                },
+                "saw_query": {
+                  "type": "boolean"
+                },
+                "saw_reply": {
+                  "type": "boolean"
+                },
+                "total_answers": {
+                  "type": "long"
+                },
+                "total_replies": {
+                  "type": "long"
+                },
+                "trans_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "files": {
+              "properties": {
+                "analyzers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "depth": {
+                  "type": "long"
+                },
+                "duration": {
+                  "type": "double"
+                },
+                "entropy": {
+                  "type": "double"
+                },
+                "extracted": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "extracted_cutoff": {
+                  "type": "boolean"
+                },
+                "extracted_size": {
+                  "type": "long"
+                },
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "is_orig": {
+                  "type": "boolean"
+                },
+                "local_orig": {
+                  "type": "boolean"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mime_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "missing_bytes": {
+                  "type": "long"
+                },
+                "overflow_bytes": {
+                  "type": "long"
+                },
+                "parent_fuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rx_host": {
+                  "type": "ip"
+                },
+                "seen_bytes": {
+                  "type": "long"
+                },
+                "session_ids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timedout": {
+                  "type": "boolean"
+                },
+                "total_bytes": {
+                  "type": "long"
+                },
+                "tx_host": {
+                  "type": "ip"
+                }
+              }
+            },
+            "fnotice": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "total_bytes": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "http": {
+              "properties": {
+                "captured_password": {
+                  "type": "boolean"
+                },
+                "client_header_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "info_code": {
+                  "type": "long"
+                },
+                "info_msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "orig_filenames": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "orig_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "orig_mime_depth": {
+                  "type": "long"
+                },
+                "orig_mime_types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "password": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "proxied": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "range_request": {
+                  "type": "boolean"
+                },
+                "resp_filenames": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resp_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resp_mime_depth": {
+                  "type": "long"
+                },
+                "resp_mime_types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "server_header_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status_msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trans_depth": {
+                  "type": "long"
+                }
+              }
+            },
+            "notice": {
+              "properties": {
+                "actions": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "connection_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dropped": {
+                  "type": "boolean"
+                },
+                "email_body_sections": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "email_delay_tokens": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "is_orig": {
+                      "type": "boolean"
+                    },
+                    "mime_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "missing_bytes": {
+                      "type": "long"
+                    },
+                    "overflow_bytes": {
+                      "type": "long"
+                    },
+                    "parent_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "seen_bytes": {
+                      "type": "long"
+                    },
+                    "source": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "fuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "icmp_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "n": {
+                  "type": "long"
+                },
+                "note": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "peer_descr": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "peer_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sub": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "suppress_for": {
+                  "type": "double"
+                }
+              }
+            },
+            "session_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ssl": {
+              "properties": {
+                "cert_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cert_chain_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cipher": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_cert_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_cert_chain_fuids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "curve": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "established": {
+                  "type": "boolean"
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "last_alert": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "next_protocol": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resumed": {
+                  "type": "boolean"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "validation_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "validation_status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_nginx/data.json.gz b/x-pack/test/functional/es_archives/ml/module_nginx/data.json.gz
new file mode 100644
index 00000000000000..8ed959d02001de
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_nginx/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_nginx/mappings.json b/x-pack/test/functional/es_archives/ml/module_nginx/mappings.json
new file mode 100644
index 00000000000000..7a6623f40f39ed
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_nginx/mappings.json
@@ -0,0 +1,2675 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_nginx",
+    "mappings": {
+      "_meta": {
+        "beat": "filebeat",
+        "version": "7.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kibana.log.meta": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "kibana.log.meta.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "apache": {
+          "properties": {
+            "access": {
+              "properties": {
+                "ssl": {
+                  "properties": {
+                    "cipher": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "protocol": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apache2": {
+          "properties": {
+            "access": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "type": "object"
+            }
+          }
+        },
+        "auditd": {
+          "properties": {
+            "log": {
+              "properties": {
+                "a0": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "addr": {
+                  "type": "ip"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "item": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "items": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "laddr": {
+                  "type": "ip"
+                },
+                "lport": {
+                  "type": "long"
+                },
+                "new_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rport": {
+                  "type": "long"
+                },
+                "sequence": {
+                  "type": "long"
+                },
+                "tty": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "certificate": {
+          "properties": {
+            "common_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "elasticsearch": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "indices": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "layer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "origin": {
+                  "properties": {
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "realm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "request": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "url": {
+                  "properties": {
+                    "params": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "realm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "roles": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "cluster": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "component": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "deprecation": {
+              "type": "object"
+            },
+            "gc": {
+              "properties": {
+                "heap": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "jvm_runtime_sec": {
+                  "type": "float"
+                },
+                "old_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "phase": {
+                  "properties": {
+                    "class_unload_time_sec": {
+                      "type": "float"
+                    },
+                    "cpu_time": {
+                      "properties": {
+                        "real_sec": {
+                          "type": "float"
+                        },
+                        "sys_sec": {
+                          "type": "float"
+                        },
+                        "user_sec": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "duration_sec": {
+                      "type": "float"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "parallel_rescan_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_string_table_time_sec": {
+                      "type": "float"
+                    },
+                    "scrub_symbol_table_time_sec": {
+                      "type": "float"
+                    },
+                    "weak_refs_processing_time_sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "stopping_threads_time_sec": {
+                  "type": "float"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "threads_total_stop_time_sec": {
+                  "type": "float"
+                },
+                "young_gen": {
+                  "properties": {
+                    "size_kb": {
+                      "type": "long"
+                    },
+                    "used_kb": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "index": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "node": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "server": {
+              "properties": {
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "gc": {
+                  "properties": {
+                    "collection_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "observation_duration": {
+                      "properties": {
+                        "ms": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "overhead_seq": {
+                      "type": "long"
+                    },
+                    "young": {
+                      "properties": {
+                        "one": {
+                          "type": "long"
+                        },
+                        "two": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "shard": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "extra_source": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "routing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "search_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source_query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "stats": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_hits": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "total_shards": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fileset": {
+          "properties": {
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "haproxy": {
+          "properties": {
+            "backend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "backend_queue": {
+              "type": "long"
+            },
+            "bind_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes_read": {
+              "type": "long"
+            },
+            "client": {
+              "type": "object"
+            },
+            "connection_wait_time_ms": {
+              "type": "long"
+            },
+            "connections": {
+              "properties": {
+                "active": {
+                  "type": "long"
+                },
+                "backend": {
+                  "type": "long"
+                },
+                "frontend": {
+                  "type": "long"
+                },
+                "retries": {
+                  "type": "long"
+                },
+                "server": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "type": "object"
+            },
+            "error_message": {
+              "norms": false,
+              "type": "text"
+            },
+            "frontend_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geoip": {
+              "type": "object"
+            },
+            "http": {
+              "properties": {
+                "request": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_request_line": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "time_wait_ms": {
+                      "type": "long"
+                    },
+                    "time_wait_without_data_ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "response": {
+                  "properties": {
+                    "captured_cookie": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "captured_headers": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_queue": {
+              "type": "long"
+            },
+            "source": {
+              "norms": false,
+              "type": "text"
+            },
+            "tcp": {
+              "properties": {
+                "connection_waiting_time_ms": {
+                  "type": "long"
+                }
+              }
+            },
+            "termination_state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "time_backend_connect": {
+              "type": "long"
+            },
+            "time_queue": {
+              "type": "long"
+            },
+            "total_waiting_time_ms": {
+              "type": "long"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "icinga": {
+          "properties": {
+            "debug": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "main": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "startup": {
+              "properties": {
+                "facility": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "iis": {
+          "properties": {
+            "access": {
+              "properties": {
+                "cookie": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "site_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sub_status": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "type": "object"
+                },
+                "win32_status": {
+                  "type": "long"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "geoip": {
+                  "type": "object"
+                },
+                "queue_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reason_phrase": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "input": {
+          "properties": {
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kafka": {
+          "properties": {
+            "log": {
+              "properties": {
+                "class": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trace": {
+                  "properties": {
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "full": {
+                      "norms": false,
+                      "type": "text"
+                    },
+                    "message": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "kibana": {
+          "properties": {
+            "log": {
+              "properties": {
+                "meta": {
+                  "type": "object"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "file": {
+              "properties": {
+                "path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "offset": {
+              "type": "long"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "source": {
+              "properties": {
+                "address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "logstash": {
+          "properties": {
+            "log": {
+              "properties": {
+                "log_event": {
+                  "type": "object"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "event": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "plugin_params_object": {
+                  "type": "object"
+                },
+                "plugin_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "took_in_millis": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "mongodb": {
+          "properties": {
+            "log": {
+              "properties": {
+                "component": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "mysql": {
+          "properties": {
+            "error": {
+              "type": "object"
+            },
+            "slowlog": {
+              "properties": {
+                "bytes_sent": {
+                  "type": "long"
+                },
+                "current_user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "filesort": {
+                  "type": "boolean"
+                },
+                "filesort_on_disk": {
+                  "type": "boolean"
+                },
+                "full_join": {
+                  "type": "boolean"
+                },
+                "full_scan": {
+                  "type": "boolean"
+                },
+                "innodb": {
+                  "properties": {
+                    "io_r_bytes": {
+                      "type": "long"
+                    },
+                    "io_r_ops": {
+                      "type": "long"
+                    },
+                    "io_r_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "pages_distinct": {
+                      "type": "long"
+                    },
+                    "queue_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "rec_lock_wait": {
+                      "properties": {
+                        "sec": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "trx_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "killed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "last_errno": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "lock_time": {
+                  "properties": {
+                    "sec": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "log_slow_rate_limit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "log_slow_rate_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "merge_passes": {
+                  "type": "long"
+                },
+                "priority_queue": {
+                  "type": "boolean"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query_cache_hit": {
+                  "type": "boolean"
+                },
+                "rows_affected": {
+                  "type": "long"
+                },
+                "rows_examined": {
+                  "type": "long"
+                },
+                "rows_sent": {
+                  "type": "long"
+                },
+                "schema": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tmp_disk_tables": {
+                  "type": "long"
+                },
+                "tmp_table": {
+                  "type": "boolean"
+                },
+                "tmp_table_on_disk": {
+                  "type": "boolean"
+                },
+                "tmp_table_sizes": {
+                  "type": "long"
+                },
+                "tmp_tables": {
+                  "type": "long"
+                }
+              }
+            },
+            "thread_id": {
+              "type": "long"
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "nginx": {
+          "properties": {
+            "access": {
+              "properties": {
+                "agent": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "type": "object"
+                },
+                "remote_ip_list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user_agent": {
+                  "type": "object"
+                }
+              }
+            },
+            "error": {
+              "properties": {
+                "connection_id": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "osquery": {
+          "properties": {
+            "result": {
+              "properties": {
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "calendar_time": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "host_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unix_time": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "postgresql": {
+          "properties": {
+            "log": {
+              "properties": {
+                "core_id": {
+                  "type": "long"
+                },
+                "database": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "program": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "working_directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "redis": {
+          "properties": {
+            "log": {
+              "properties": {
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "slowlog": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "duration": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "id": {
+                  "type": "long"
+                },
+                "key": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            }
+          }
+        },
+        "santa": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "decision": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "disk": {
+              "properties": {
+                "bsdname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bus": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "model": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mount": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "volume": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reason": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            }
+          }
+        },
+        "stream": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "syslog": {
+          "properties": {
+            "facility": {
+              "type": "long"
+            },
+            "facility_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "priority": {
+              "type": "long"
+            },
+            "severity_label": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "auth": {
+              "properties": {
+                "groupadd": {
+                  "type": "object"
+                },
+                "ssh": {
+                  "properties": {
+                    "dropped_ip": {
+                      "type": "ip"
+                    },
+                    "geoip": {
+                      "type": "object"
+                    },
+                    "method": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "sudo": {
+                  "properties": {
+                    "command": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "error": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pwd": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "tty": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "useradd": {
+                  "properties": {
+                    "home": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "shell": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "syslog": {
+              "type": "object"
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "traefik": {
+          "properties": {
+            "access": {
+              "properties": {
+                "backend_url": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "frontend_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "geoip": {
+                  "properties": {
+                    "city_name": {
+                      "path": "source.geo.city_name",
+                      "type": "alias"
+                    },
+                    "continent_name": {
+                      "path": "source.geo.continent_name",
+                      "type": "alias"
+                    },
+                    "country_iso_code": {
+                      "path": "source.geo.country_iso_code",
+                      "type": "alias"
+                    },
+                    "location": {
+                      "path": "source.geo.location",
+                      "type": "alias"
+                    },
+                    "region_iso_code": {
+                      "path": "source.geo.region_iso_code",
+                      "type": "alias"
+                    },
+                    "region_name": {
+                      "path": "source.geo.region_name",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "request_count": {
+                  "type": "long"
+                },
+                "user_agent": {
+                  "properties": {
+                    "device": {
+                      "path": "user_agent.device.name",
+                      "type": "alias"
+                    },
+                    "major": {
+                      "path": "user_agent.major",
+                      "type": "alias"
+                    },
+                    "minor": {
+                      "path": "user_agent.minor",
+                      "type": "alias"
+                    },
+                    "name": {
+                      "path": "user_agent.name",
+                      "type": "alias"
+                    },
+                    "original": {
+                      "path": "user_agent.original",
+                      "type": "alias"
+                    },
+                    "os": {
+                      "path": "user_agent.os.full_name",
+                      "type": "alias"
+                    },
+                    "os_major": {
+                      "path": "user_agent.os.major",
+                      "type": "alias"
+                    },
+                    "os_minor": {
+                      "path": "user_agent.os.minor",
+                      "type": "alias"
+                    },
+                    "os_name": {
+                      "path": "user_agent.os.name",
+                      "type": "alias"
+                    },
+                    "patch": {
+                      "path": "user_agent.patch",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "user_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "major": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "minor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "major": {
+                  "type": "long"
+                },
+                "minor": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "patch": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_sample_ecommerce/data.json.gz b/x-pack/test/functional/es_archives/ml/module_sample_ecommerce/data.json.gz
new file mode 100644
index 00000000000000..76357734a94aab
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_sample_ecommerce/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_sample_ecommerce/mappings.json b/x-pack/test/functional/es_archives/ml/module_sample_ecommerce/mappings.json
new file mode 100644
index 00000000000000..2b22f5eb431d44
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_sample_ecommerce/mappings.json
@@ -0,0 +1,211 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_sample_ecommerce",
+    "mappings": {
+      "properties": {
+        "category": {
+          "fields": {
+            "keyword": {
+              "type": "keyword"
+            }
+          },
+          "type": "text"
+        },
+        "currency": {
+          "type": "keyword"
+        },
+        "customer_birth_date": {
+          "type": "date"
+        },
+        "customer_first_name": {
+          "fields": {
+            "keyword": {
+              "ignore_above": 256,
+              "type": "keyword"
+            }
+          },
+          "type": "text"
+        },
+        "customer_full_name": {
+          "fields": {
+            "keyword": {
+              "ignore_above": 256,
+              "type": "keyword"
+            }
+          },
+          "type": "text"
+        },
+        "customer_gender": {
+          "type": "keyword"
+        },
+        "customer_id": {
+          "type": "keyword"
+        },
+        "customer_last_name": {
+          "fields": {
+            "keyword": {
+              "ignore_above": 256,
+              "type": "keyword"
+            }
+          },
+          "type": "text"
+        },
+        "customer_phone": {
+          "type": "keyword"
+        },
+        "day_of_week": {
+          "type": "keyword"
+        },
+        "day_of_week_i": {
+          "type": "integer"
+        },
+        "email": {
+          "type": "keyword"
+        },
+        "geoip": {
+          "properties": {
+            "city_name": {
+              "type": "keyword"
+            },
+            "continent_name": {
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "region_name": {
+              "type": "keyword"
+            }
+          }
+        },
+        "manufacturer": {
+          "fields": {
+            "keyword": {
+              "type": "keyword"
+            }
+          },
+          "type": "text"
+        },
+        "order_date": {
+          "type": "date"
+        },
+        "order_id": {
+          "type": "keyword"
+        },
+        "products": {
+          "properties": {
+            "_id": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "base_price": {
+              "type": "half_float"
+            },
+            "base_unit_price": {
+              "type": "half_float"
+            },
+            "category": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "created_on": {
+              "type": "date"
+            },
+            "discount_amount": {
+              "type": "half_float"
+            },
+            "discount_percentage": {
+              "type": "half_float"
+            },
+            "manufacturer": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "min_price": {
+              "type": "half_float"
+            },
+            "price": {
+              "type": "half_float"
+            },
+            "product_id": {
+              "type": "long"
+            },
+            "product_name": {
+              "analyzer": "english",
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "quantity": {
+              "type": "integer"
+            },
+            "sku": {
+              "type": "keyword"
+            },
+            "tax_amount": {
+              "type": "half_float"
+            },
+            "taxful_price": {
+              "type": "half_float"
+            },
+            "taxless_price": {
+              "type": "half_float"
+            },
+            "unit_discount_amount": {
+              "type": "half_float"
+            }
+          }
+        },
+        "sku": {
+          "type": "keyword"
+        },
+        "taxful_total_price": {
+          "type": "half_float"
+        },
+        "taxless_total_price": {
+          "type": "half_float"
+        },
+        "total_quantity": {
+          "type": "integer"
+        },
+        "total_unique_products": {
+          "type": "integer"
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "user": {
+          "type": "keyword"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_sample_logs/data.json.gz b/x-pack/test/functional/es_archives/ml/module_sample_logs/data.json.gz
new file mode 100644
index 00000000000000..b49b826f066d0c
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_sample_logs/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/sample_logs/mappings.json b/x-pack/test/functional/es_archives/ml/module_sample_logs/mappings.json
similarity index 96%
rename from x-pack/test/functional/es_archives/ml/sample_logs/mappings.json
rename to x-pack/test/functional/es_archives/ml/module_sample_logs/mappings.json
index 62f69063695e7b..88ff2ed01a6248 100644
--- a/x-pack/test/functional/es_archives/ml/sample_logs/mappings.json
+++ b/x-pack/test/functional/es_archives/ml/module_sample_logs/mappings.json
@@ -3,7 +3,7 @@
   "value": {
     "aliases": {
     },
-    "index": "kibana_sample_data_logs",
+    "index": "ft_module_sample_logs",
     "mappings": {
       "properties": {
         "@timestamp": {
@@ -158,10 +158,9 @@
     },
     "settings": {
       "index": {
-        "auto_expand_replicas": "0-1",
-        "number_of_replicas": "0",
+        "number_of_replicas": "1",
         "number_of_shards": "1"
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_siem_auditbeat/data.json.gz b/x-pack/test/functional/es_archives/ml/module_siem_auditbeat/data.json.gz
new file mode 100644
index 00000000000000..64f582011db502
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_siem_auditbeat/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_siem_auditbeat/mappings.json b/x-pack/test/functional/es_archives/ml/module_siem_auditbeat/mappings.json
new file mode 100644
index 00000000000000..818036fa32ebf2
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_siem_auditbeat/mappings.json
@@ -0,0 +1,1663 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_siem_auditbeat",
+    "mappings": {
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "auditd": {
+          "properties": {
+            "data": {
+              "properties": {
+                "a0": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a2": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a[0-3]": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "acct": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "acl": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "added": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "addr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "apparmor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "arch": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "argc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_backlog_limit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_backlog_wait_time": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_failure": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "banners": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bool": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bus": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "capability": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cgroup": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "changed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cipher": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "compat": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "daddr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "default-context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "device": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dir": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "direction": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dmac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "enforcing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entries": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fam": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "feature": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "flags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "format": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "grantors": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "grp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hook": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hostname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "icmp_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "igid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "img-ctx": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inif": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ino": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode_uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "invalid_context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ioctlcmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ip": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ipid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ipx-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "items": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "iuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kind": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ksize": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "laddr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "len": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "lport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "macproto": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "maj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "major": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "minor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "model": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nargs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-chardev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-disk": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-log_passwd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-mem": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-rng": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-vcpu": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_lock": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-fam": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-grp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-pid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oauid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ocomm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oflag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-chardev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-disk": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-log_passwd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-mem": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-rng": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-vcpu": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_enforcing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_lock": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_prom": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_val": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "op": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "outif": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "parent": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "per": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "perm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "perm_mask": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "permissive": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pfs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "printer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "prom": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "proto": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "qbytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reason": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "removed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "res": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resrc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sauid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "scontext": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "selected-context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seperm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seperms": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seqno": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seresult": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sig": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sigev_signo": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "smac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "socket": {
+                  "properties": {
+                    "addr": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "family": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "port": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "saddr": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "spid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "success": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "syscall": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "table": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tclass": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tcontext": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "terminal": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tty": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uri": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "val": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "virt": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm-ctx": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm-pid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "watch": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "paths": {
+              "properties": {
+                "dev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "item": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nametype": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "objtype": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ogid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ouid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rdev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "session": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "summary": {
+              "properties": {
+                "actor": {
+                  "properties": {
+                    "primary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "secondary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "how": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "object": {
+                  "properties": {
+                    "primary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "secondary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "blake2b_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "xxh64": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "working_directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name_map": {
+              "type": "object"
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "selinux": {
+              "properties": {
+                "category": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_siem_packetbeat/data.json.gz b/x-pack/test/functional/es_archives/ml/module_siem_packetbeat/data.json.gz
new file mode 100644
index 00000000000000..d8e3af5eeb48d3
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_siem_packetbeat/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_siem_packetbeat/mappings.json b/x-pack/test/functional/es_archives/ml/module_siem_packetbeat/mappings.json
new file mode 100644
index 00000000000000..9c0ca8901a0da6
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_siem_packetbeat/mappings.json
@@ -0,0 +1,4643 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_siem_packetbeat",
+    "mappings": {
+      "_meta": {
+        "beat": "packetbeat",
+        "version": "7.6.2"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "amqp.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "amqp.headers.*"
+          }
+        },
+        {
+          "cassandra.response.supported": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "cassandra.response.supported.*"
+          }
+        },
+        {
+          "http.request.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "http.request.headers.*"
+          }
+        },
+        {
+          "http.response.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "http.response.headers.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "amqp": {
+          "properties": {
+            "app-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "arguments": {
+              "type": "object"
+            },
+            "auto-delete": {
+              "type": "boolean"
+            },
+            "class-id": {
+              "type": "long"
+            },
+            "consumer-count": {
+              "type": "long"
+            },
+            "consumer-tag": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "content-encoding": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "content-type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "correlation-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "delivery-mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "delivery-tag": {
+              "type": "long"
+            },
+            "durable": {
+              "type": "boolean"
+            },
+            "exchange": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exchange-type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exclusive": {
+              "type": "boolean"
+            },
+            "expiration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "headers": {
+              "type": "object"
+            },
+            "if-empty": {
+              "type": "boolean"
+            },
+            "if-unused": {
+              "type": "boolean"
+            },
+            "immediate": {
+              "type": "boolean"
+            },
+            "mandatory": {
+              "type": "boolean"
+            },
+            "message-count": {
+              "type": "long"
+            },
+            "message-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "method-id": {
+              "type": "long"
+            },
+            "multiple": {
+              "type": "boolean"
+            },
+            "no-ack": {
+              "type": "boolean"
+            },
+            "no-local": {
+              "type": "boolean"
+            },
+            "no-wait": {
+              "type": "boolean"
+            },
+            "passive": {
+              "type": "boolean"
+            },
+            "priority": {
+              "type": "long"
+            },
+            "queue": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "redelivered": {
+              "type": "boolean"
+            },
+            "reply-code": {
+              "type": "long"
+            },
+            "reply-text": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reply-to": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "routing-key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "timestamp": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "bytes_in": {
+          "path": "source.bytes",
+          "type": "alias"
+        },
+        "bytes_out": {
+          "path": "destination.bytes",
+          "type": "alias"
+        },
+        "cassandra": {
+          "properties": {
+            "no_request": {
+              "type": "boolean"
+            },
+            "request": {
+              "properties": {
+                "headers": {
+                  "properties": {
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "length": {
+                      "type": "long"
+                    },
+                    "op": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stream": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "authentication": {
+                  "properties": {
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "error": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "details": {
+                      "properties": {
+                        "alive": {
+                          "type": "long"
+                        },
+                        "arg_types": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "blockfor": {
+                          "type": "long"
+                        },
+                        "data_present": {
+                          "type": "boolean"
+                        },
+                        "function": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "num_failures": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "read_consistency": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "received": {
+                          "type": "long"
+                        },
+                        "required": {
+                          "type": "long"
+                        },
+                        "stmt_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "write_type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "msg": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "event": {
+                  "properties": {
+                    "change": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "host": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "port": {
+                      "type": "long"
+                    },
+                    "schema_change": {
+                      "properties": {
+                        "args": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "change": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "object": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "target": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "headers": {
+                  "properties": {
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "length": {
+                      "type": "long"
+                    },
+                    "op": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stream": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "result": {
+                  "properties": {
+                    "keyspace": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "prepared": {
+                      "properties": {
+                        "prepared_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "req_meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "resp_meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "rows": {
+                      "properties": {
+                        "meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "num_rows": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "schema_change": {
+                      "properties": {
+                        "args": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "change": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "object": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "target": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "supported": {
+                  "type": "object"
+                },
+                "warnings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "process": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "working_directory": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dhcpv4": {
+          "properties": {
+            "assigned_ip": {
+              "type": "ip"
+            },
+            "client_ip": {
+              "type": "ip"
+            },
+            "client_mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hardware_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hops": {
+              "type": "long"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "option": {
+              "properties": {
+                "boot_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "broadcast_address": {
+                  "type": "ip"
+                },
+                "class_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dns_servers": {
+                  "type": "ip"
+                },
+                "domain_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hostname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ip_address_lease_time_sec": {
+                  "type": "long"
+                },
+                "max_dhcp_message_size": {
+                  "type": "long"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "message_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ntp_servers": {
+                  "type": "ip"
+                },
+                "parameter_request_list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rebinding_time_sec": {
+                  "type": "long"
+                },
+                "renewal_time_sec": {
+                  "type": "long"
+                },
+                "requested_ip_address": {
+                  "type": "ip"
+                },
+                "router": {
+                  "type": "ip"
+                },
+                "server_identifier": {
+                  "type": "ip"
+                },
+                "subnet_mask": {
+                  "type": "ip"
+                },
+                "time_servers": {
+                  "type": "ip"
+                },
+                "utc_time_offset_sec": {
+                  "type": "long"
+                },
+                "vendor_identifying_options": {
+                  "type": "object"
+                }
+              }
+            },
+            "relay_ip": {
+              "type": "ip"
+            },
+            "seconds": {
+              "type": "long"
+            },
+            "server_ip": {
+              "type": "ip"
+            },
+            "server_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transaction_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "additionals": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "additionals_count": {
+              "type": "long"
+            },
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "answers_count": {
+              "type": "long"
+            },
+            "authorities": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "authorities_count": {
+              "type": "long"
+            },
+            "flags": {
+              "properties": {
+                "authentic_data": {
+                  "type": "boolean"
+                },
+                "authoritative": {
+                  "type": "boolean"
+                },
+                "checking_disabled": {
+                  "type": "boolean"
+                },
+                "recursion_available": {
+                  "type": "boolean"
+                },
+                "recursion_desired": {
+                  "type": "boolean"
+                },
+                "truncated_response": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "opt": {
+              "properties": {
+                "do": {
+                  "type": "boolean"
+                },
+                "ext_rcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "udp_size": {
+                  "type": "long"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "etld_plus_one": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "flow": {
+          "properties": {
+            "final": {
+              "type": "boolean"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "type": "long"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "properties": {
+                    "content-length": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "properties": {
+                    "content-length": {
+                      "type": "long"
+                    },
+                    "content-type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "status_code": {
+                  "type": "long"
+                },
+                "status_phrase": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "icmp": {
+          "properties": {
+            "request": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jolokia": {
+          "properties": {
+            "agent": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "secured": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "memcache": {
+          "properties": {
+            "protocol_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "request": {
+              "properties": {
+                "automove": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "cas_unique": {
+                  "type": "long"
+                },
+                "command": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "count_values": {
+                  "type": "long"
+                },
+                "delta": {
+                  "type": "long"
+                },
+                "dest_class": {
+                  "type": "long"
+                },
+                "exptime": {
+                  "type": "long"
+                },
+                "flags": {
+                  "type": "long"
+                },
+                "initial": {
+                  "type": "long"
+                },
+                "line": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "noreply": {
+                  "type": "boolean"
+                },
+                "opaque": {
+                  "type": "long"
+                },
+                "opcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opcode_value": {
+                  "type": "long"
+                },
+                "quiet": {
+                  "type": "boolean"
+                },
+                "raw_args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sleep_us": {
+                  "type": "long"
+                },
+                "source_class": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vbucket": {
+                  "type": "long"
+                },
+                "verbosity": {
+                  "type": "long"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                },
+                "cas_unique": {
+                  "type": "long"
+                },
+                "command": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "count_values": {
+                  "type": "long"
+                },
+                "error_msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "flags": {
+                  "type": "long"
+                },
+                "opaque": {
+                  "type": "long"
+                },
+                "opcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opcode_value": {
+                  "type": "long"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status_code": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "value": {
+                  "type": "long"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "method": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "mongodb": {
+          "properties": {
+            "cursorId": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "error": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fullCollectionName": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "numberReturned": {
+              "type": "long"
+            },
+            "numberToReturn": {
+              "type": "long"
+            },
+            "numberToSkip": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "returnFieldsSelector": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "selector": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "startingFrom": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "update": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "mysql": {
+          "properties": {
+            "affected_rows": {
+              "type": "long"
+            },
+            "error_code": {
+              "type": "long"
+            },
+            "error_message": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "insert_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_fields": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_rows": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "nfs": {
+          "properties": {
+            "minor_version": {
+              "type": "long"
+            },
+            "opcode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tag": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        },
+        "notes": {
+          "path": "error.message",
+          "type": "alias"
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "params": {
+          "norms": false,
+          "type": "text"
+        },
+        "path": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "pgsql": {
+          "properties": {
+            "error_code": {
+              "type": "long"
+            },
+            "error_message": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "error_severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_fields": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_rows": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "query": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "redis": {
+          "properties": {
+            "error": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "return_value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "request": {
+          "norms": false,
+          "type": "text"
+        },
+        "resource": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "response": {
+          "norms": false,
+          "type": "text"
+        },
+        "rpc": {
+          "properties": {
+            "auth_flavor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "cred": {
+              "properties": {
+                "gid": {
+                  "type": "long"
+                },
+                "gids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "machinename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "stamp": {
+                  "type": "long"
+                },
+                "uid": {
+                  "type": "long"
+                }
+              }
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "xid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "process": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "working_directory": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "status": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "thrift": {
+          "properties": {
+            "exceptions": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "params": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "return_value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "alert_types": {
+              "path": "tls.detailed.alert_types",
+              "type": "alias"
+            },
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "client_certificate": {
+              "properties": {
+                "alternative_names": {
+                  "path": "tls.detailed.client_certificate.alternative_names",
+                  "type": "alias"
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.client_certificate.issuer.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.client_certificate.issuer.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.client_certificate.issuer.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.client_certificate.issuer.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.client_certificate.issuer.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.client_certificate.issuer.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "not_after": {
+                  "path": "tls.detailed.client_certificate.not_after",
+                  "type": "alias"
+                },
+                "not_before": {
+                  "path": "tls.detailed.client_certificate.not_before",
+                  "type": "alias"
+                },
+                "public_key_algorithm": {
+                  "path": "tls.detailed.client_certificate.public_key_algorithm",
+                  "type": "alias"
+                },
+                "public_key_size": {
+                  "path": "tls.detailed.client_certificate.public_key_size",
+                  "type": "alias"
+                },
+                "serial_number": {
+                  "path": "tls.detailed.client_certificate.serial_number",
+                  "type": "alias"
+                },
+                "signature_algorithm": {
+                  "path": "tls.detailed.client_certificate.signature_algorithm",
+                  "type": "alias"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.client_certificate.subject.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.client_certificate.subject.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.client_certificate.subject.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.client_certificate.subject.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.client_certificate.subject.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.client_certificate.subject.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "version": {
+                  "path": "tls.detailed.client_certificate.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "client_certificate_requested": {
+              "path": "tls.detailed.client_certificate_requested",
+              "type": "alias"
+            },
+            "client_hello": {
+              "properties": {
+                "extensions": {
+                  "properties": {
+                    "_unparsed_": {
+                      "path": "tls.detailed.client_hello.extensions._unparsed_",
+                      "type": "alias"
+                    },
+                    "application_layer_protocol_negotiation": {
+                      "path": "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation",
+                      "type": "alias"
+                    },
+                    "ec_points_formats": {
+                      "path": "tls.detailed.client_hello.extensions.ec_points_formats",
+                      "type": "alias"
+                    },
+                    "server_name_indication": {
+                      "path": "tls.detailed.client_hello.extensions.server_name_indication",
+                      "type": "alias"
+                    },
+                    "session_ticket": {
+                      "path": "tls.detailed.client_hello.extensions.session_ticket",
+                      "type": "alias"
+                    },
+                    "signature_algorithms": {
+                      "path": "tls.detailed.client_hello.extensions.signature_algorithms",
+                      "type": "alias"
+                    },
+                    "supported_groups": {
+                      "path": "tls.detailed.client_hello.extensions.supported_groups",
+                      "type": "alias"
+                    },
+                    "supported_versions": {
+                      "path": "tls.detailed.client_hello.extensions.supported_versions",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "session_id": {
+                  "path": "tls.detailed.client_hello.session_id",
+                  "type": "alias"
+                },
+                "supported_ciphers": {
+                  "path": "tls.client.supported_ciphers",
+                  "type": "alias"
+                },
+                "supported_compression_methods": {
+                  "path": "tls.detailed.client_hello.supported_compression_methods",
+                  "type": "alias"
+                },
+                "version": {
+                  "path": "tls.detailed.client_hello.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "detailed": {
+              "properties": {
+                "alert_types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_certificate": {
+                  "properties": {
+                    "alternative_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "type": "date"
+                    },
+                    "not_before": {
+                      "type": "date"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "client_certificate_requested": {
+                  "type": "boolean"
+                },
+                "client_hello": {
+                  "properties": {
+                    "extensions": {
+                      "properties": {
+                        "_unparsed_": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "application_layer_protocol_negotiation": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ec_points_formats": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "server_name_indication": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "session_ticket": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "signature_algorithms": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "supported_groups": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "supported_versions": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "session_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "supported_compression_methods": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "resumption_method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "server_certificate": {
+                  "properties": {
+                    "alternative_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "type": "date"
+                    },
+                    "not_before": {
+                      "type": "date"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "server_certificate_chain": {
+                  "properties": {
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "not_before": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "server_hello": {
+                  "properties": {
+                    "extensions": {
+                      "properties": {
+                        "_unparsed_": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "application_layer_protocol_negotiation": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ec_points_formats": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "session_ticket": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "supported_versions": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "selected_compression_method": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "session_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "fingerprints": {
+              "properties": {
+                "ja3": {
+                  "path": "tls.client.ja3",
+                  "type": "alias"
+                }
+              }
+            },
+            "handshake_completed": {
+              "path": "tls.established",
+              "type": "alias"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "resumption_method": {
+              "path": "tls.detailed.resumption_method",
+              "type": "alias"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "server_certificate": {
+              "properties": {
+                "alternative_names": {
+                  "path": "tls.detailed.server_certificate.alternative_names",
+                  "type": "alias"
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.server_certificate.issuer.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.server_certificate.issuer.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.server_certificate.issuer.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.server_certificate.issuer.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.server_certificate.issuer.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.server_certificate.issuer.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "not_after": {
+                  "path": "tls.detailed.server_certificate.not_after",
+                  "type": "alias"
+                },
+                "not_before": {
+                  "path": "tls.detailed.server_certificate.not_before",
+                  "type": "alias"
+                },
+                "public_key_algorithm": {
+                  "path": "tls.detailed.server_certificate.public_key_algorithm",
+                  "type": "alias"
+                },
+                "public_key_size": {
+                  "path": "tls.detailed.server_certificate.public_key_size",
+                  "type": "alias"
+                },
+                "serial_number": {
+                  "path": "tls.detailed.server_certificate.serial_number",
+                  "type": "alias"
+                },
+                "signature_algorithm": {
+                  "path": "tls.detailed.server_certificate.signature_algorithm",
+                  "type": "alias"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.server_certificate.subject.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.server_certificate.subject.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.server_certificate.subject.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.server_certificate.subject.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.server_certificate.subject.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.server_certificate.subject.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "version": {
+                  "path": "tls.detailed.server_certificate.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "server_hello": {
+              "properties": {
+                "extensions": {
+                  "properties": {
+                    "_unparsed_": {
+                      "path": "tls.detailed.server_hello.extensions._unparsed_",
+                      "type": "alias"
+                    },
+                    "application_layer_protocol_negotiation": {
+                      "path": "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation",
+                      "type": "alias"
+                    },
+                    "ec_points_formats": {
+                      "path": "tls.detailed.server_hello.extensions.ec_points_formats",
+                      "type": "alias"
+                    },
+                    "session_ticket": {
+                      "path": "tls.detailed.server_hello.extensions.session_ticket",
+                      "type": "alias"
+                    },
+                    "supported_versions": {
+                      "path": "tls.detailed.server_hello.extensions.supported_versions",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "selected_cipher": {
+                  "path": "tls.cipher",
+                  "type": "alias"
+                },
+                "selected_compression_method": {
+                  "path": "tls.detailed.server_hello.selected_compression_method",
+                  "type": "alias"
+                },
+                "session_id": {
+                  "path": "tls.detailed.server_hello.session_id",
+                  "type": "alias"
+                },
+                "version": {
+                  "path": "tls.detailed.server_hello.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "type": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/module_siem_winlogbeat/data.json.gz b/x-pack/test/functional/es_archives/ml/module_siem_winlogbeat/data.json.gz
new file mode 100644
index 00000000000000..238fb3b6e79c0a
Binary files /dev/null and b/x-pack/test/functional/es_archives/ml/module_siem_winlogbeat/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/ml/module_siem_winlogbeat/mappings.json b/x-pack/test/functional/es_archives/ml/module_siem_winlogbeat/mappings.json
new file mode 100644
index 00000000000000..e9310630408156
--- /dev/null
+++ b/x-pack/test/functional/es_archives/ml/module_siem_winlogbeat/mappings.json
@@ -0,0 +1,884 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "ft_module_siem_winlogbeat",
+    "mappings": {
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "type": "long"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "blake2b_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "xxh64": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "keyword": {
+                      "ignore_above": 256,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "text"
+                }
+              }
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "working_directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name_map": {
+              "type": "object"
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "selinux": {
+              "properties": {
+                "category": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "winlog": {
+          "properties": {
+            "activity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "api": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "channel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "computer_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "event_data": {
+              "properties": {
+                "ContextInfo": {
+                  "type": "keyword"
+                },
+                "LogonType": {
+                  "fields": {
+                    "keyword": {
+                      "ignore_above": 256,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "text"
+                },
+                "MessageNumber": {
+                  "type": "keyword"
+                },
+                "MessageTotal": {
+                  "type": "keyword"
+                },
+                "Path": {
+                  "type": "keyword"
+                },
+                "Payload": {
+                  "type": "keyword"
+                },
+                "ScriptBlockId": {
+                  "type": "keyword"
+                },
+                "ScriptBlockText": {
+                  "type": "keyword"
+                },
+                "param1": {
+                  "type": "keyword"
+                },
+                "param2": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "event_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "keywords": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "opcode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "process": {
+              "properties": {
+                "pid": {
+                  "type": "long"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "provider_guid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "record_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "related_activity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "task": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "user_data": {
+              "type": "object"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/ml/sample_logs/data.json.gz b/x-pack/test/functional/es_archives/ml/sample_logs/data.json.gz
deleted file mode 100644
index 88937d484d24e1..00000000000000
Binary files a/x-pack/test/functional/es_archives/ml/sample_logs/data.json.gz and /dev/null differ
diff --git a/x-pack/test/functional/services/ml/anomaly_explorer.ts b/x-pack/test/functional/services/ml/anomaly_explorer.ts
index 6ec72c76bb9cf0..7c479a4234673e 100644
--- a/x-pack/test/functional/services/ml/anomaly_explorer.ts
+++ b/x-pack/test/functional/services/ml/anomaly_explorer.ts
@@ -66,5 +66,38 @@ export function MachineLearningAnomalyExplorerProvider({ getService }: FtrProvid
     async assertSwimlaneViewByExists() {
       await testSubjects.existOrFail('mlAnomalyExplorerSwimlaneViewBy');
     },
+
+    async openAddToDashboardControl() {
+      await testSubjects.click('mlAnomalyTimelinePanelMenu');
+      await testSubjects.click('mlAnomalyTimelinePanelAddToDashboardButton');
+      await testSubjects.existOrFail('mlAddToDashboardModal');
+    },
+
+    async addAndEditSwimlaneInDashboard(dashboardTitle: string) {
+      await this.filterWithSearchString(dashboardTitle);
+      await testSubjects.isDisplayed('mlDashboardSelectionTable > checkboxSelectAll');
+      await testSubjects.click('mlDashboardSelectionTable > checkboxSelectAll');
+      expect(await testSubjects.isChecked('mlDashboardSelectionTable > checkboxSelectAll')).to.be(
+        true
+      );
+      await testSubjects.clickWhenNotDisabled('mlAddAndEditDashboardButton');
+      const embeddable = await testSubjects.find('mlAnomalySwimlaneEmbeddableWrapper');
+      const swimlane = await embeddable.findByClassName('ml-swimlanes');
+      expect(await swimlane.isDisplayed()).to.eql(
+        true,
+        'Anomaly swimlane should be displayed in dashboard'
+      );
+    },
+
+    async waitForDashboardsToLoad() {
+      await testSubjects.existOrFail('~mlDashboardSelectionTable', { timeout: 60 * 1000 });
+    },
+
+    async filterWithSearchString(filter: string) {
+      await this.waitForDashboardsToLoad();
+      const searchBarInput = await testSubjects.find('mlDashboardsSearchBox');
+      await searchBarInput.clearValueWithKeyboard();
+      await searchBarInput.type(filter);
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/test_resources.ts b/x-pack/test/functional/services/ml/test_resources.ts
index 739fd844f11933..9927c987bbea5d 100644
--- a/x-pack/test/functional/services/ml/test_resources.ts
+++ b/x-pack/test/functional/services/ml/test_resources.ts
@@ -5,7 +5,7 @@
  */
 
 import { ProvidedType } from '@kbn/test/types/ftr';
-import { savedSearches } from './test_resources_data';
+import { savedSearches, dashboards } from './test_resources_data';
 import { COMMON_REQUEST_HEADERS } from './common';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
@@ -36,11 +36,20 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
       await kibanaServer.uiSettings.unset('dateFormat:tz');
     },
 
-    async savedObjectExists(id: string, objectType: SavedObjectType): Promise<boolean> {
+    async savedObjectExistsById(id: string, objectType: SavedObjectType): Promise<boolean> {
       const response = await supertest.get(`/api/saved_objects/${objectType}/${id}`);
       return response.status === 200;
     },
 
+    async savedObjectExistsByTitle(title: string, objectType: SavedObjectType): Promise<boolean> {
+      const id = await this.getSavedObjectIdByTitle(title, objectType);
+      if (id) {
+        return await this.savedObjectExistsById(id, objectType);
+      } else {
+        return false;
+      }
+    },
+
     async getSavedObjectIdByTitle(
       title: string,
       objectType: SavedObjectType
@@ -70,6 +79,14 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
       return this.getSavedObjectIdByTitle(title, SavedObjectType.SEARCH);
     },
 
+    async getVisualizationId(title: string): Promise<string | undefined> {
+      return this.getSavedObjectIdByTitle(title, SavedObjectType.VISUALIZATION);
+    },
+
+    async getDashboardId(title: string): Promise<string | undefined> {
+      return this.getSavedObjectIdByTitle(title, SavedObjectType.DASHBOARD);
+    },
+
     async createIndexPattern(title: string, timeFieldName?: string): Promise<string> {
       log.debug(
         `Creating index pattern with title '${title}'${
@@ -84,6 +101,8 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
         .expect(200)
         .then((res: any) => res.body);
 
+      await this.assertIndexPatternExistByTitle(title);
+
       log.debug(` > Created with id '${createResponse.id}'`);
       return createResponse.id;
     },
@@ -99,18 +118,7 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
     },
 
     async assertIndexPatternNotExist(title: string) {
-      await retry.waitForWithTimeout(
-        `index pattern '${title}' to not exist`,
-        5 * 1000,
-        async () => {
-          const indexPatternId = await this.getIndexPatternId(title);
-          if (!indexPatternId) {
-            return true;
-          } else {
-            throw new Error(`Index pattern '${title}' should not exist.`);
-          }
-        }
-      );
+      await this.assertSavedObjectNotExistsByTitle(title, SavedObjectType.INDEX_PATTERN);
     },
 
     async createSavedSearch(title: string, body: object): Promise<string> {
@@ -123,6 +131,22 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
         .expect(200)
         .then((res: any) => res.body);
 
+      await this.assertSavedSearchExistByTitle(title);
+
+      log.debug(` > Created with id '${createResponse.id}'`);
+      return createResponse.id;
+    },
+
+    async createDashboard(title: string, body: object): Promise<string> {
+      log.debug(`Creating dashboard with title '${title}'`);
+
+      const createResponse = await supertest
+        .post(`/api/saved_objects/${SavedObjectType.DASHBOARD}`)
+        .set(COMMON_REQUEST_HEADERS)
+        .send(body)
+        .expect(200)
+        .then((res: any) => res.body);
+
       log.debug(` > Created with id '${createResponse.id}'`);
       return createResponse.id;
     },
@@ -171,6 +195,21 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
       await this.createSavedSearchIfNeeded(savedSearches.farequoteFilter);
     },
 
+    async createMLTestDashboardIfNeeded() {
+      await this.createDashboardIfNeeded(dashboards.mlTestDashboard);
+    },
+
+    async createDashboardIfNeeded(dashboard: any) {
+      const title = dashboard.requestBody.attributes.title;
+      const dashboardId = await this.getDashboardId(title);
+      if (dashboardId !== undefined) {
+        log.debug(`Dashboard with title '${title}' already exists. Nothing to create.`);
+        return dashboardId;
+      } else {
+        return await this.createDashboard(title, dashboard.requestBody);
+      }
+    },
+
     async createSavedSearchFarequoteLuceneIfNeeded() {
       await this.createSavedSearchIfNeeded(savedSearches.farequoteLucene);
     },
@@ -187,24 +226,41 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
       await this.createSavedSearchIfNeeded(savedSearches.farequoteFilterAndKuery);
     },
 
-    async deleteIndexPattern(title: string) {
-      log.debug(`Deleting index pattern with title '${title}'...`);
+    async deleteSavedObjectById(id: string, objectType: SavedObjectType) {
+      log.debug(`Deleting ${objectType} with id '${id}'...`);
 
-      const indexPatternId = await this.getIndexPatternId(title);
-      if (indexPatternId === undefined) {
-        log.debug(`Index pattern with title '${title}' does not exists. Nothing to delete.`);
+      if ((await this.savedObjectExistsById(id, objectType)) === false) {
+        log.debug(`${objectType} with id '${id}' does not exists. Nothing to delete.`);
         return;
       } else {
         await supertest
-          .delete(`/api/saved_objects/${SavedObjectType.INDEX_PATTERN}/${indexPatternId}`)
+          .delete(`/api/saved_objects/${objectType}/${id}`)
           .set(COMMON_REQUEST_HEADERS)
           .expect(200);
 
-        log.debug(` > Deleted index pattern with id '${indexPatternId}'`);
+        await this.assertSavedObjectNotExistsById(id, objectType);
+
+        log.debug(` > Deleted ${objectType} with id '${id}'`);
+      }
+    },
+
+    async deleteIndexPatternByTitle(title: string) {
+      log.debug(`Deleting index pattern with title '${title}'...`);
+
+      const indexPatternId = await this.getIndexPatternId(title);
+      if (indexPatternId === undefined) {
+        log.debug(`Index pattern with title '${title}' does not exists. Nothing to delete.`);
+        return;
+      } else {
+        await this.deleteIndexPatternById(indexPatternId);
       }
     },
 
-    async deleteSavedSearch(title: string) {
+    async deleteIndexPatternById(id: string) {
+      await this.deleteSavedObjectById(id, SavedObjectType.INDEX_PATTERN);
+    },
+
+    async deleteSavedSearchByTitle(title: string) {
       log.debug(`Deleting saved search with title '${title}'...`);
 
       const savedSearchId = await this.getSavedSearchId(title);
@@ -212,19 +268,144 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
         log.debug(`Saved search with title '${title}' does not exists. Nothing to delete.`);
         return;
       } else {
-        await supertest
-          .delete(`/api/saved_objects/${SavedObjectType.SEARCH}/${savedSearchId}`)
-          .set(COMMON_REQUEST_HEADERS)
-          .expect(200);
+        await this.deleteSavedSearchById(savedSearchId);
+      }
+    },
+
+    async deleteSavedSearchById(id: string) {
+      await this.deleteSavedObjectById(id, SavedObjectType.SEARCH);
+    },
+
+    async deleteVisualizationByTitle(title: string) {
+      log.debug(`Deleting visualization with title '${title}'...`);
 
-        log.debug(` > Deleted saved searchwith id '${savedSearchId}'`);
+      const visualizationId = await this.getVisualizationId(title);
+      if (visualizationId === undefined) {
+        log.debug(`Visualization with title '${title}' does not exists. Nothing to delete.`);
+        return;
+      } else {
+        await this.deleteVisualizationById(visualizationId);
       }
     },
 
+    async deleteVisualizationById(id: string) {
+      await this.deleteSavedObjectById(id, SavedObjectType.VISUALIZATION);
+    },
+
+    async deleteDashboardByTitle(title: string) {
+      log.debug(`Deleting dashboard with title '${title}'...`);
+
+      const dashboardId = await this.getDashboardId(title);
+      if (dashboardId === undefined) {
+        log.debug(`Dashboard with title '${title}' does not exists. Nothing to delete.`);
+        return;
+      } else {
+        await this.deleteDashboardById(dashboardId);
+      }
+    },
+
+    async deleteDashboardById(id: string) {
+      await this.deleteSavedObjectById(id, SavedObjectType.DASHBOARD);
+    },
+
     async deleteSavedSearches() {
       for (const search of Object.values(savedSearches)) {
-        await this.deleteSavedSearch(search.requestBody.attributes.title);
+        await this.deleteSavedSearchByTitle(search.requestBody.attributes.title);
+      }
+    },
+
+    async deleteDashboards() {
+      for (const dashboard of Object.values(dashboards)) {
+        await this.deleteDashboardByTitle(dashboard.requestBody.attributes.title);
       }
     },
+
+    async assertSavedObjectExistsByTitle(title: string, objectType: SavedObjectType) {
+      await retry.waitForWithTimeout(
+        `${objectType} with title '${title}' to exist`,
+        5 * 1000,
+        async () => {
+          if ((await this.savedObjectExistsByTitle(title, objectType)) === true) {
+            return true;
+          } else {
+            throw new Error(`${objectType} with title '${title}' should exist.`);
+          }
+        }
+      );
+    },
+
+    async assertSavedObjectNotExistsByTitle(title: string, objectType: SavedObjectType) {
+      await retry.waitForWithTimeout(
+        `${objectType} with title '${title}' not to exist`,
+        5 * 1000,
+        async () => {
+          if ((await this.savedObjectExistsByTitle(title, objectType)) === false) {
+            return true;
+          } else {
+            throw new Error(`${objectType} with title '${title}' should not exist.`);
+          }
+        }
+      );
+    },
+
+    async assertSavedObjectExistsById(id: string, objectType: SavedObjectType) {
+      await retry.waitForWithTimeout(
+        `${objectType} with id '${id}' to exist`,
+        5 * 1000,
+        async () => {
+          if ((await this.savedObjectExistsById(id, objectType)) === true) {
+            return true;
+          } else {
+            throw new Error(`${objectType} with id '${id}' should exist.`);
+          }
+        }
+      );
+    },
+
+    async assertSavedObjectNotExistsById(id: string, objectType: SavedObjectType) {
+      await retry.waitForWithTimeout(
+        `${objectType} with id '${id}' not to exist`,
+        5 * 1000,
+        async () => {
+          if ((await this.savedObjectExistsById(id, objectType)) === false) {
+            return true;
+          } else {
+            throw new Error(`${objectType} with id '${id}' should not exist.`);
+          }
+        }
+      );
+    },
+
+    async assertIndexPatternExistByTitle(title: string) {
+      await this.assertSavedObjectExistsByTitle(title, SavedObjectType.INDEX_PATTERN);
+    },
+
+    async assertIndexPatternExistById(id: string) {
+      await this.assertSavedObjectExistsById(id, SavedObjectType.INDEX_PATTERN);
+    },
+
+    async assertSavedSearchExistByTitle(title: string) {
+      await this.assertSavedObjectExistsByTitle(title, SavedObjectType.SEARCH);
+    },
+
+    async assertSavedSearchExistById(id: string) {
+      await this.assertSavedObjectExistsById(id, SavedObjectType.SEARCH);
+    },
+
+    async assertVisualizationExistByTitle(title: string) {
+      await this.assertSavedObjectExistsByTitle(title, SavedObjectType.VISUALIZATION);
+    },
+
+    async assertVisualizationExistById(id: string) {
+      await this.assertSavedObjectExistsById(id, SavedObjectType.VISUALIZATION);
+    },
+
+    async assertDashboardExistByTitle(title: string) {
+      await this.assertSavedObjectExistsByTitle(title, SavedObjectType.DASHBOARD);
+    },
+
+    async assertDashboardExistById(id: string) {
+      await this.assertSavedObjectExistsById(id, SavedObjectType.DASHBOARD);
+    },
   };
 }
diff --git a/x-pack/test/functional/services/ml/test_resources_data.ts b/x-pack/test/functional/services/ml/test_resources_data.ts
index dd600077182f93..2ab1f4de542284 100644
--- a/x-pack/test/functional/services/ml/test_resources_data.ts
+++ b/x-pack/test/functional/services/ml/test_resources_data.ts
@@ -247,3 +247,22 @@ export const savedSearches = {
     },
   },
 };
+
+export const dashboards = {
+  mlTestDashboard: {
+    requestBody: {
+      attributes: {
+        title: 'ML Test',
+        hits: 0,
+        description: '',
+        panelsJSON: '[]',
+        optionsJSON: '{"hidePanelTitles":false,"useMargins":true}',
+        version: 1,
+        timeRestore: false,
+        kibanaSavedObjectMeta: {
+          searchSourceJSON: '{"query":{"language":"kuery","query":""},"filter":[]}',
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
index 25fb477b5a99aa..036f82a591fb3f 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
@@ -99,107 +99,71 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         );
 
         expect(agentFullConfig).to.eql({
-          datasources: [
+          inputs: [
             {
-              enabled: true,
               id: policyInfo.datasource.id,
-              inputs: [
-                {
-                  enabled: true,
-                  policy: {
-                    linux: {
-                      advanced: {
-                        elasticsearch: {
-                          indices: {
-                            control: 'control-index',
-                            event: 'event-index',
-                            logging: 'logging-index',
-                          },
-                          kernel: {
-                            connect: true,
-                            process: true,
-                          },
-                        },
-                      },
-                      events: {
-                        file: false,
-                        network: true,
-                        process: true,
-                      },
-                      logging: {
-                        file: 'info',
-                        stdout: 'debug',
+              dataset: { namespace: 'default' },
+              name: 'Protect East Coast',
+              package: {
+                name: 'endpoint',
+                version: policyInfo.packageInfo.version,
+              },
+              policy: {
+                linux: {
+                  advanced: {
+                    elasticsearch: {
+                      indices: {
+                        control: 'control-index',
+                        event: 'event-index',
+                        logging: 'logging-index',
                       },
+                      kernel: { connect: true, process: true },
                     },
-                    mac: {
-                      advanced: {
-                        elasticsearch: {
-                          indices: {
-                            control: 'control-index',
-                            event: 'event-index',
-                            logging: 'logging-index',
-                          },
-                          kernel: {
-                            connect: true,
-                            process: true,
-                          },
-                        },
-                      },
-                      events: {
-                        file: false,
-                        network: true,
-                        process: true,
-                      },
-                      logging: {
-                        file: 'info',
-                        stdout: 'debug',
-                      },
-                      malware: {
-                        mode: 'detect',
+                  },
+                  events: { file: false, network: true, process: true },
+                  logging: { file: 'info', stdout: 'debug' },
+                },
+                mac: {
+                  advanced: {
+                    elasticsearch: {
+                      indices: {
+                        control: 'control-index',
+                        event: 'event-index',
+                        logging: 'logging-index',
                       },
+                      kernel: { connect: true, process: true },
                     },
-                    windows: {
-                      advanced: {
-                        elasticsearch: {
-                          indices: {
-                            control: 'control-index',
-                            event: 'event-index',
-                            logging: 'logging-index',
-                          },
-                          kernel: {
-                            connect: true,
-                            process: true,
-                          },
-                        },
-                      },
-                      events: {
-                        dll_and_driver_load: true,
-                        dns: true,
-                        file: false,
-                        network: true,
-                        process: true,
-                        registry: true,
-                        security: true,
-                      },
-                      logging: {
-                        file: 'info',
-                        stdout: 'debug',
-                      },
-                      malware: {
-                        mode: 'prevent',
+                  },
+                  events: { file: false, network: true, process: true },
+                  logging: { file: 'info', stdout: 'debug' },
+                  malware: { mode: 'detect' },
+                },
+                windows: {
+                  advanced: {
+                    elasticsearch: {
+                      indices: {
+                        control: 'control-index',
+                        event: 'event-index',
+                        logging: 'logging-index',
                       },
+                      kernel: { connect: true, process: true },
                     },
                   },
-                  streams: [],
-                  type: 'endpoint',
+                  events: {
+                    dll_and_driver_load: true,
+                    dns: true,
+                    file: false,
+                    network: true,
+                    process: true,
+                    registry: true,
+                    security: true,
+                  },
+                  logging: { file: 'info', stdout: 'debug' },
+                  malware: { mode: 'prevent' },
                 },
-              ],
-              name: 'Protect East Coast',
-              namespace: 'default',
-              package: {
-                name: 'endpoint',
-                version: policyInfo.packageInfo.version,
               },
+              streams: [],
+              type: 'endpoint',
               use_output: 'default',
             },
           ],
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
index 7ce1a07ad5a17d..1f5b6889f8fed5 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
@@ -8,7 +8,13 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 import { PolicyTestResourceInfo } from '../../services/endpoint_policy';
 
 export default function ({ getPageObjects, getService }: FtrProviderContext) {
-  const pageObjects = getPageObjects(['common', 'endpoint', 'policy', 'endpointPageUtils']);
+  const pageObjects = getPageObjects([
+    'common',
+    'endpoint',
+    'policy',
+    'endpointPageUtils',
+    'ingestManagerCreateDatasource',
+  ]);
   const testSubjects = getService('testSubjects');
   const policyTestResources = getService('policyTestResources');
   const RELATIVE_DATE_FORMAT = /\d (?:seconds|minutes) ago/i;
@@ -26,6 +32,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       const policyTitle = await testSubjects.getVisibleText('pageViewHeaderLeftTitle');
       expect(policyTitle).to.equal('Policies');
     });
+    it('shows header create policy button', async () => {
+      const createButtonTitle = await testSubjects.getVisibleText('headerCreateNewPolicyButton');
+      expect(createButtonTitle).to.equal('Create new policy');
+    });
     it('shows policy count total', async () => {
       const policyTotal = await testSubjects.getVisibleText('policyTotalCount');
       expect(policyTotal).to.equal('0 Policies');
@@ -101,5 +111,42 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         expect(policyTotal).to.equal('0 Policies');
       });
     });
+
+    describe('and user clicks on page header create button', () => {
+      beforeEach(async () => {
+        await pageObjects.policy.navigateToPolicyList();
+        await (await pageObjects.policy.findHeaderCreateNewButton()).click();
+      });
+
+      it('should redirect to ingest management integrations add datasource', async () => {
+        await pageObjects.ingestManagerCreateDatasource.ensureOnCreatePageOrFail();
+      });
+
+      it('should redirect user back to Policy List if Cancel button is clicked', async () => {
+        await (await pageObjects.ingestManagerCreateDatasource.findCancelButton()).click();
+        await pageObjects.policy.ensureIsOnPolicyPage();
+      });
+
+      it('should redirect user back to Policy List if Back link is clicked', async () => {
+        await (await pageObjects.ingestManagerCreateDatasource.findBackLink()).click();
+        await pageObjects.policy.ensureIsOnPolicyPage();
+      });
+
+      it('should display custom endpoint configuration message', async () => {
+        await pageObjects.ingestManagerCreateDatasource.selectAgentConfig();
+        const endpointConfig = await pageObjects.policy.findDatasourceEndpointCustomConfiguration();
+        expect(endpointConfig).not.to.be(undefined);
+      });
+
+      it('should redirect user back to Policy List after a successful save', async () => {
+        const newPolicyName = `endpoint policy ${Date.now()}`;
+        await pageObjects.ingestManagerCreateDatasource.selectAgentConfig();
+        await pageObjects.ingestManagerCreateDatasource.setDatasourceName(newPolicyName);
+        await (await pageObjects.ingestManagerCreateDatasource.findDSaveButton()).click();
+        await pageObjects.ingestManagerCreateDatasource.waitForSaveSuccessNotification();
+        await pageObjects.policy.ensureIsOnPolicyPage();
+        await policyTestResources.deletePolicyByName(newPolicyName);
+      });
+    });
   });
 }
diff --git a/x-pack/test/security_solution_endpoint/page_objects/index.ts b/x-pack/test/security_solution_endpoint/page_objects/index.ts
index 5b550bea5b55dc..96e2a47e7803e7 100644
--- a/x-pack/test/security_solution_endpoint/page_objects/index.ts
+++ b/x-pack/test/security_solution_endpoint/page_objects/index.ts
@@ -9,6 +9,7 @@ import { EndpointPageProvider } from './endpoint_page';
 import { EndpointAlertsPageProvider } from './endpoint_alerts_page';
 import { EndpointPolicyPageProvider } from './policy_page';
 import { EndpointPageUtils } from './page_utils';
+import { IngestManagerCreateDatasource } from './ingest_manager_create_datasource_page';
 
 export const pageObjects = {
   ...xpackFunctionalPageObjects,
@@ -16,4 +17,5 @@ export const pageObjects = {
   policy: EndpointPolicyPageProvider,
   endpointPageUtils: EndpointPageUtils,
   endpointAlerts: EndpointAlertsPageProvider,
+  ingestManagerCreateDatasource: IngestManagerCreateDatasource,
 };
diff --git a/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_datasource_page.ts b/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_datasource_page.ts
new file mode 100644
index 00000000000000..f50cde6285be72
--- /dev/null
+++ b/x-pack/test/security_solution_endpoint/page_objects/ingest_manager_create_datasource_page.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export function IngestManagerCreateDatasource({ getService }: FtrProviderContext) {
+  const testSubjects = getService('testSubjects');
+  const find = getService('find');
+
+  return {
+    /**
+     * Validates that the page shown is the Datasource Craete Page
+     */
+    async ensureOnCreatePageOrFail() {
+      await testSubjects.existOrFail('createDataSource_header');
+    },
+
+    /**
+     * Finds and returns the Cancel button on the sticky bottom bar
+     */
+    async findCancelButton() {
+      return await testSubjects.find('createDatasourceCancelButton');
+    },
+
+    /**
+     * Finds and returns the Cancel back link at the top of the create page
+     */
+    async findBackLink() {
+      return await testSubjects.find('createDataSource_cancelBackLink');
+    },
+
+    /**
+     * Finds and returns the save button on the sticky bottom bar
+     */
+    async findDSaveButton() {
+      return await testSubjects.find('createDatasourceSaveButton');
+    },
+
+    /**
+     * Selects an agent configuration on the form
+     * @param name
+     * Visual name of the configuration. if one is not provided, the first agent
+     * configuration on the list will be chosen
+     */
+    async selectAgentConfig(name?: string) {
+      // if we have a name, then find the button with that `title` set.
+      if (name) {
+        await (
+          await find.byCssSelector(`[data-test-subj="agentConfigItem"][title="${name}"]`)
+        ).click();
+      }
+      // Else, just select the first agent configuration that is present
+      else {
+        await (await testSubjects.find('agentConfigItem')).click();
+      }
+    },
+
+    /**
+     * Set the name of the datasource on the input field
+     * @param name
+     */
+    async setDatasourceName(name: string) {
+      // Because of the bottom sticky bar, we need to scroll section 2 into view
+      // so that `setValue()` enters the data on the input field.
+      await testSubjects.scrollIntoView('dataCollectionSetupStep');
+      await testSubjects.setValue('datasourceNameInput', name);
+    },
+
+    /**
+     * Waits for the save Notification toast to be visible
+     */
+    async waitForSaveSuccessNotification() {
+      await testSubjects.existOrFail('datasourceCreateSuccessToast');
+    },
+  };
+}
diff --git a/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts b/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts
index eb481cdfc99c44..a2b0f9a671039f 100644
--- a/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts
+++ b/x-pack/test/security_solution_endpoint/page_objects/policy_page.ts
@@ -42,7 +42,7 @@ export function EndpointPolicyPageProvider({ getService, getPageObjects }: FtrPr
      * ensures that the Policy Page is the currently display view
      */
     async ensureIsOnPolicyPage() {
-      await testSubjects.existOrFail('policyTable');
+      await testSubjects.existOrFail('policyListPage');
     },
 
     /**
@@ -81,5 +81,25 @@ export function EndpointPolicyPageProvider({ getService, getPageObjects }: FtrPr
       await testSubjects.existOrFail('policyDetailsConfirmModal');
       await pageObjects.common.clickConfirmOnModal();
     },
+
+    /**
+     * Finds and returns the Create New policy Policy button displayed on the List page
+     */
+    async findHeaderCreateNewButton() {
+      // The Create button is initially disabled because we need to first make a call to Ingest
+      // to retrieve the package version, so that the redirect works as expected. So, we wait
+      // for that to occur here a well.
+      await testSubjects.waitForEnabled('headerCreateNewPolicyButton');
+      return await testSubjects.find('headerCreateNewPolicyButton');
+    },
+
+    /**
+     * Used when looking a the Ingest create/edit datasource pages. Finds the endpoint
+     * custom configuaration component
+     * @param onEditPage
+     */
+    async findDatasourceEndpointCustomConfiguration(onEditPage: boolean = false) {
+      return await testSubjects.find(`endpointDatasourceConfig_${onEditPage ? 'edit' : 'create'}`);
+    },
   };
 }
diff --git a/x-pack/test/security_solution_endpoint/services/endpoint_policy.ts b/x-pack/test/security_solution_endpoint/services/endpoint_policy.ts
index cfba9e803be7d5..fbed7dcc663ecd 100644
--- a/x-pack/test/security_solution_endpoint/services/endpoint_policy.ts
+++ b/x-pack/test/security_solution_endpoint/services/endpoint_policy.ts
@@ -10,8 +10,10 @@ import {
   CreateAgentConfigResponse,
   CreateDatasourceRequest,
   CreateDatasourceResponse,
+  DATASOURCE_SAVED_OBJECT_TYPE,
   DeleteAgentConfigRequest,
   DeleteDatasourcesRequest,
+  GetDatasourcesResponse,
   GetFullAgentConfigResponse,
   GetPackagesResponse,
 } from '../../../plugins/ingest_manager/common';
@@ -223,5 +225,48 @@ export function EndpointPolicyTestResourcesProvider({ getService }: FtrProviderC
         },
       };
     },
+
+    /**
+     * Deletes a policy (Datasource) by using the policy name
+     * @param name
+     */
+    async deletePolicyByName(name: string) {
+      let datasourceList: GetDatasourcesResponse['items'];
+      try {
+        const { body: datasourcesResponse }: { body: GetDatasourcesResponse } = await supertest
+          .get(INGEST_API_DATASOURCES)
+          .set('kbn-xsrf', 'xxx')
+          .query({ kuery: `${DATASOURCE_SAVED_OBJECT_TYPE}.name: ${name}` })
+          .send()
+          .expect(200);
+        datasourceList = datasourcesResponse.items;
+      } catch (error) {
+        return logSupertestApiErrorAndThrow(
+          `Unable to get list of datasources with name=${name}`,
+          error
+        );
+      }
+
+      if (datasourceList.length === 0) {
+        throw new Error(`Policy named '${name}' was not found!`);
+      }
+
+      if (datasourceList.length > 1) {
+        throw new Error(`Found ${datasourceList.length} Policies - was expecting only one!`);
+      }
+
+      try {
+        const deleteDatasourceData: DeleteDatasourcesRequest['body'] = {
+          datasourceIds: [datasourceList[0].id],
+        };
+        await supertest
+          .post(INGEST_API_DATASOURCES_DELETE)
+          .set('kbn-xsrf', 'xxx')
+          .send(deleteDatasourceData)
+          .expect(200);
+      } catch (error) {
+        logSupertestApiErrorAndThrow('Unable to delete Datasource via Ingest!', error);
+      }
+    },
   };
 }
diff --git a/yarn.lock b/yarn.lock
index e43cb2997e5316..256c8642a02ae0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2100,11 +2100,13 @@
   dependencies:
     "@elastic/apm-rum-core" "^5.3.0"
 
-"@elastic/charts@19.2.0":
-  version "19.2.0"
-  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-19.2.0.tgz#45db8c80e4699e5088a1771f190171c1144c5242"
-  integrity sha512-uhk73OQPaxg7l54gfr+kv+c6jiEngewwH408OySzJbnH23z/5sIpLSziZhV33I6bs/LKDXQSqamC9Jh6Xcwk1A==
+"@elastic/charts@19.5.2":
+  version "19.5.2"
+  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-19.5.2.tgz#6117f7b3acce6deef0a4f272ae491d99d2e3b1e0"
+  integrity sha512-6GdqwVrDwQu+h5GUXpwy9a8dQ66oTNl3SO+ih1sljWvni+f/wcsrRcCTJUP99vtUcPQ8BT9Pn79QknBk1ZOH5Q==
   dependencies:
+    "@popperjs/core" "^2.4.0"
+    chroma-js "^2.1.0"
     classnames "^2.2.6"
     d3-array "^1.2.4"
     d3-collection "^1.0.7"
@@ -3348,6 +3350,11 @@
     which "^2.0.1"
     winston "^3.0.0"
 
+"@popperjs/core@^2.4.0":
+  version "2.4.2"
+  resolved "https://registry.yarnpkg.com/@popperjs/core/-/core-2.4.2.tgz#7c6dc4ecef16149fd7a736710baa1b811017fdca"
+  integrity sha512-JlGTGRYHC2QK+DDbePyXdBdooxFq2+noLfWpRqJtkxcb/oYWzOF0kcbfvvbWrwevCC1l6hLUg1wHYT+ona5BWQ==
+
 "@reach/router@^1.2.1":
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/@reach/router/-/router-1.2.1.tgz#34ae3541a5ac44fa7796e5506a5d7274a162be4e"
@@ -4796,6 +4803,11 @@
   resolved "https://registry.yarnpkg.com/@types/delete-empty/-/delete-empty-2.0.0.tgz#1647ae9e68f708a6ba778531af667ec55bc61964"
   integrity sha512-sq+kwx8zA9BSugT9N+Jr8/uWjbHMZ+N/meJEzRyT3gmLq/WMtx/iSIpvdpmBUi/cvXl6Kzpvve8G2ESkabFwmg==
 
+"@types/dragselect@^1.13.1":
+  version "1.13.1"
+  resolved "https://registry.yarnpkg.com/@types/dragselect/-/dragselect-1.13.1.tgz#f19b7b41063a7c9d5963194c83c3c364e84d46ee"
+  integrity sha512-3m0fvSM0cSs0DXvprytV/ZY92hNX3jJuEb/vkdqU+4QMzV2jxYKgBFTuaT2fflqbmfzUqHHIkGP55WIuigElQw==
+
 "@types/elasticsearch@^5.0.33":
   version "5.0.33"
   resolved "https://registry.yarnpkg.com/@types/elasticsearch/-/elasticsearch-5.0.33.tgz#b0fd37dc674f498223b6d68c313bdfd71f4d812b"
@@ -9780,7 +9792,7 @@ chroma-js@^1.4.1:
   resolved "https://registry.yarnpkg.com/chroma-js/-/chroma-js-1.4.1.tgz#eb2d9c4d1ff24616be84b35119f4d26f8205f134"
   integrity sha512-jTwQiT859RTFN/vIf7s+Vl/Z2LcMrvMv3WUFmd/4u76AdlFC0NTNgqEEFPcRiHmAswPsMiQEDZLM8vX8qXpZNQ==
 
-chroma-js@^2.0.4:
+chroma-js@^2.0.4, chroma-js@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/chroma-js/-/chroma-js-2.1.0.tgz#c0be48a21fe797ef8965608c1c4f911ef2da49d5"
   integrity sha512-uiRdh4ZZy+UTPSrAdp8hqEdVb1EllLtTHOt5TMaOjJUvi+O54/83Fc5K2ld1P+TJX+dw5B+8/sCgzI6eaur/lg==
@@ -25625,14 +25637,6 @@ react-textarea-autosize@^7.1.0:
     "@babel/runtime" "^7.1.2"
     prop-types "^15.6.0"
 
-react-textarea-autosize@^7.1.2:
-  version "7.1.2"
-  resolved "https://registry.yarnpkg.com/react-textarea-autosize/-/react-textarea-autosize-7.1.2.tgz#70fdb333ef86bcca72717e25e623e90c336e2cda"
-  integrity sha512-uH3ORCsCa3C6LHxExExhF4jHoXYCQwE5oECmrRsunlspaDAbS4mGKNlWZqjLfInWtFQcf0o1n1jC/NGXFdUBCg==
-  dependencies:
-    "@babel/runtime" "^7.1.2"
-    prop-types "^15.6.0"
-
 react-tiny-virtual-list@^2.2.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/react-tiny-virtual-list/-/react-tiny-virtual-list-2.2.0.tgz#eafb6fcf764e4ed41150ff9752cdaad8b35edf4a"
@@ -27880,14 +27884,6 @@ simplebar-react@^1.0.0-alpha.6:
     prop-types "^15.6.1"
     simplebar "^4.2.0"
 
-simplebar-react@^2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/simplebar-react/-/simplebar-react-2.1.0.tgz#57d524f4253579d81ac30db00acf7886b17bf826"
-  integrity sha512-UIMFPNkn6o57v058vPOiYbnbpc1CUZwPKLmQaDMvEJdgm+btZ2umFA6meXfiqFEQUjDE6Vq4ePnL7Fr6nzJd8w==
-  dependencies:
-    prop-types "^15.6.1"
-    simplebar "^5.1.0"
-
 simplebar@^4.2.0:
   version "4.2.0"
   resolved "https://registry.yarnpkg.com/simplebar/-/simplebar-4.2.0.tgz#97e5c1c85d05cc04f8c92939e4da71dd087e325c"
@@ -27900,18 +27896,6 @@ simplebar@^4.2.0:
     lodash.throttle "^4.1.1"
     resize-observer-polyfill "^1.5.1"
 
-simplebar@^5.1.0:
-  version "5.1.0"
-  resolved "https://registry.yarnpkg.com/simplebar/-/simplebar-5.1.0.tgz#15437ace314ec888accd7d8f24ada672e9bb2717"
-  integrity sha512-bdi1SleK1YOSnfeUjo5UQXt/79zNjsCJVEfzrm6photmGi2aU6x0l7rX4KAGcrtj5AwsWPBVXgDyYAqbbpnuRg==
-  dependencies:
-    can-use-dom "^0.1.0"
-    core-js "^3.0.1"
-    lodash.debounce "^4.0.8"
-    lodash.memoize "^4.1.2"
-    lodash.throttle "^4.1.1"
-    resize-observer-polyfill "^1.5.1"
-
 simplicial-complex@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/simplicial-complex/-/simplicial-complex-1.0.0.tgz#6c33a4ed69fcd4d91b7bcadd3b30b63683eae241"