From 178637ce296eb2932c431d5bb3fef78846bcdc65 Mon Sep 17 00:00:00 2001
From: James Gowdy <jgowdy@elastic.co>
Date: Mon, 1 Feb 2021 16:19:56 +0000
Subject: [PATCH 1/8] [ML] Fixing saved object authorization check when
 security is disabled (#89850)

* [ML] Fixing saved object authorization check when security is disabled

* updating to use mode.useRbacForRequest for check
---
 x-pack/plugins/ml/server/saved_objects/authorization.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/x-pack/plugins/ml/server/saved_objects/authorization.ts b/x-pack/plugins/ml/server/saved_objects/authorization.ts
index 958ee2091f11e..9afc479c32d7d 100644
--- a/x-pack/plugins/ml/server/saved_objects/authorization.ts
+++ b/x-pack/plugins/ml/server/saved_objects/authorization.ts
@@ -10,6 +10,15 @@ import { ML_SAVED_OBJECT_TYPE } from '../../common/types/saved_objects';
 
 export function authorizationProvider(authorization: SecurityPluginSetup['authz']) {
   async function authorizationCheck(request: KibanaRequest) {
+    const shouldAuthorizeRequest = authorization?.mode.useRbacForRequest(request) ?? false;
+
+    if (shouldAuthorizeRequest === false) {
+      return {
+        canCreateGlobally: true,
+        canCreateAtSpace: true,
+      };
+    }
+
     const checkPrivilegesWithRequest = authorization.checkPrivilegesWithRequest(request);
     // Checking privileges "dynamically" will check against the current space, if spaces are enabled.
     // If spaces are disabled, then this will check privileges globally instead.

From 9f4dae82c59ad9d355f3d666f4af84c82781624e Mon Sep 17 00:00:00 2001
From: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Date: Mon, 1 Feb 2021 16:35:37 +0000
Subject: [PATCH 2/8] [Security Solution] Push new case to the connector when
 created (#89131)

* init push case

* fix connectorToUpdate

* add unit test

* revert change

* remove useEffect after case created

* add unit test

* add cancel flag

* update unit test

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../components/create/form_context.test.tsx   | 121 +++++++++++++-----
 .../cases/components/create/form_context.tsx  |  36 ++++--
 .../cases/containers/use_post_case.test.tsx   |  15 ++-
 .../public/cases/containers/use_post_case.tsx |  73 +++++------
 4 files changed, 154 insertions(+), 91 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/cases/components/create/form_context.test.tsx b/x-pack/plugins/security_solution/public/cases/components/create/form_context.test.tsx
index f3b47f756bce9..1b4df7730cc8b 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/form_context.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/form_context.test.tsx
@@ -33,8 +33,13 @@ import {
 import { FormContext } from './form_context';
 import { CreateCaseForm } from './form';
 import { SubmitCaseButton } from './submit_button';
+import { usePostPushToService } from '../../containers/use_post_push_to_service';
+import { noop } from 'lodash/fp';
+
+const sampleId = 'case-id';
 
 jest.mock('../../containers/use_post_case');
+jest.mock('../../containers/use_post_push_to_service');
 jest.mock('../../containers/use_get_tags');
 jest.mock('../../containers/configure/use_connectors');
 jest.mock('../../containers/configure/use_configure');
@@ -48,19 +53,28 @@ jest.mock('../settings/jira/use_get_issues');
 const useConnectorsMock = useConnectors as jest.Mock;
 const useCaseConfigureMock = useCaseConfigure as jest.Mock;
 const usePostCaseMock = usePostCase as jest.Mock;
+const usePostPushToServiceMock = usePostPushToService as jest.Mock;
 const useGetIncidentTypesMock = useGetIncidentTypes as jest.Mock;
 const useGetSeverityMock = useGetSeverity as jest.Mock;
 const useGetIssueTypesMock = useGetIssueTypes as jest.Mock;
 const useGetFieldsByIssueTypeMock = useGetFieldsByIssueType as jest.Mock;
 const postCase = jest.fn();
+const postPushToService = jest.fn();
 
 const defaultPostCase = {
   isLoading: false,
   isError: false,
-  caseData: null,
   postCase,
 };
 
+const defaultPostPushToService = {
+  serviceData: null,
+  pushedCaseData: null,
+  isLoading: false,
+  isError: false,
+  postPushToService,
+};
+
 const fillForm = (wrapper: ReactWrapper) => {
   wrapper
     .find(`[data-test-subj="caseTitle"] input`)
@@ -85,7 +99,12 @@ describe('Create case', () => {
 
   beforeEach(() => {
     jest.resetAllMocks();
+    postCase.mockResolvedValue({
+      id: sampleId,
+      ...sampleData,
+    });
     usePostCaseMock.mockImplementation(() => defaultPostCase);
+    usePostPushToServiceMock.mockImplementation(() => defaultPostPushToService);
     useConnectorsMock.mockReturnValue(sampleConnectorData);
     useCaseConfigureMock.mockImplementation(() => useCaseConfigureResponse);
     useGetIncidentTypesMock.mockReturnValue(useGetIncidentTypesResponse);
@@ -163,25 +182,6 @@ describe('Create case', () => {
       );
     });
 
-    it('should redirect to new case when caseData is there', async () => {
-      const sampleId = 'case-id';
-      usePostCaseMock.mockImplementation(() => ({
-        ...defaultPostCase,
-        caseData: { id: sampleId },
-      }));
-
-      mount(
-        <TestProviders>
-          <FormContext onSuccess={onFormSubmitSuccess}>
-            <CreateCaseForm />
-            <SubmitCaseButton />
-          </FormContext>
-        </TestProviders>
-      );
-
-      await waitFor(() => expect(onFormSubmitSuccess).toHaveBeenCalledWith({ id: 'case-id' }));
-    });
-
     it('it should select the default connector set in the configuration', async () => {
       useCaseConfigureMock.mockImplementation(() => ({
         ...useCaseConfigureResponse,
@@ -258,12 +258,15 @@ describe('Create case', () => {
 
       fillForm(wrapper);
       wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
-      await waitFor(() => expect(postCase).toBeCalledWith(sampleData));
+      await waitFor(() => {
+        expect(postCase).toBeCalledWith(sampleData);
+        expect(postPushToService).not.toHaveBeenCalled();
+      });
     });
   });
 
   describe('Step 2 - Connector Fields', () => {
-    it(`it should submit a Jira connector`, async () => {
+    it(`it should submit and push to Jira connector`, async () => {
       useConnectorsMock.mockReturnValue({
         ...sampleConnectorData,
         connectors: connectorsMock,
@@ -304,7 +307,7 @@ describe('Create case', () => {
 
       wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
 
-      await waitFor(() =>
+      await waitFor(() => {
         expect(postCase).toBeCalledWith({
           ...sampleData,
           connector: {
@@ -313,11 +316,27 @@ describe('Create case', () => {
             type: '.jira',
             fields: { issueType: '10007', parent: null, priority: '2' },
           },
-        })
-      );
+        });
+        expect(postPushToService).toHaveBeenCalledWith({
+          caseId: sampleId,
+          caseServices: {},
+          connector: {
+            id: 'jira-1',
+            name: 'Jira',
+            type: '.jira',
+            fields: { issueType: '10007', parent: null, priority: '2' },
+          },
+          alerts: {},
+          updateCase: noop,
+        });
+        expect(onFormSubmitSuccess).toHaveBeenCalledWith({
+          id: sampleId,
+          ...sampleData,
+        });
+      });
     });
 
-    it(`it should submit a resilient connector`, async () => {
+    it(`it should submit and push to resilient connector`, async () => {
       useConnectorsMock.mockReturnValue({
         ...sampleConnectorData,
         connectors: connectorsMock,
@@ -359,7 +378,7 @@ describe('Create case', () => {
 
       wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
 
-      await waitFor(() =>
+      await waitFor(() => {
         expect(postCase).toBeCalledWith({
           ...sampleData,
           connector: {
@@ -368,11 +387,29 @@ describe('Create case', () => {
             type: '.resilient',
             fields: { incidentTypes: ['19'], severityCode: '4' },
           },
-        })
-      );
+        });
+
+        expect(postPushToService).toHaveBeenCalledWith({
+          caseId: sampleId,
+          caseServices: {},
+          connector: {
+            id: 'resilient-2',
+            name: 'My Connector 2',
+            type: '.resilient',
+            fields: { incidentTypes: ['19'], severityCode: '4' },
+          },
+          alerts: {},
+          updateCase: noop,
+        });
+
+        expect(onFormSubmitSuccess).toHaveBeenCalledWith({
+          id: sampleId,
+          ...sampleData,
+        });
+      });
     });
 
-    it(`it should submit a servicenow connector`, async () => {
+    it(`it should submit and push to servicenow connector`, async () => {
       useConnectorsMock.mockReturnValue({
         ...sampleConnectorData,
         connectors: connectorsMock,
@@ -404,7 +441,7 @@ describe('Create case', () => {
 
       wrapper.find(`[data-test-subj="create-case-submit"]`).first().simulate('click');
 
-      await waitFor(() =>
+      await waitFor(() => {
         expect(postCase).toBeCalledWith({
           ...sampleData,
           connector: {
@@ -413,8 +450,26 @@ describe('Create case', () => {
             type: '.servicenow',
             fields: { impact: '2', severity: '2', urgency: '2' },
           },
-        })
-      );
+        });
+
+        expect(postPushToService).toHaveBeenCalledWith({
+          caseId: sampleId,
+          caseServices: {},
+          connector: {
+            id: 'servicenow-1',
+            name: 'My Connector',
+            type: '.servicenow',
+            fields: { impact: '2', severity: '2', urgency: '2' },
+          },
+          alerts: {},
+          updateCase: noop,
+        });
+
+        expect(onFormSubmitSuccess).toHaveBeenCalledWith({
+          id: sampleId,
+          ...sampleData,
+        });
+      });
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx b/x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx
index 4315011ac8df1..03e03d853878c 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/form_context.tsx
@@ -3,9 +3,8 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
 import React, { useCallback, useEffect, useMemo } from 'react';
-
+import { noop } from 'lodash/fp';
 import { schema, FormProps } from './schema';
 import { Form, useForm } from '../../../shared_imports';
 import {
@@ -14,6 +13,8 @@ import {
   normalizeActionConnector,
 } from '../configure_cases/utils';
 import { usePostCase } from '../../containers/use_post_case';
+import { usePostPushToService } from '../../containers/use_post_push_to_service';
+
 import { useConnectors } from '../../containers/configure/use_connectors';
 import { useCaseConfigure } from '../../containers/configure/use_configure';
 import { Case } from '../../containers/types';
@@ -34,7 +35,9 @@ interface Props {
 export const FormContext: React.FC<Props> = ({ children, onSuccess }) => {
   const { connectors } = useConnectors();
   const { connector: configurationConnector } = useCaseConfigure();
-  const { caseData, postCase } = usePostCase();
+  const { postCase } = usePostCase();
+  const { postPushToService } = usePostPushToService();
+
   const connectorId = useMemo(
     () =>
       connectors.some((connector) => connector.id === configurationConnector.id)
@@ -50,18 +53,33 @@ export const FormContext: React.FC<Props> = ({ children, onSuccess }) => {
     ) => {
       if (isValid) {
         const caseConnector = getConnectorById(dataConnectorId, connectors);
+
         const connectorToUpdate = caseConnector
           ? normalizeActionConnector(caseConnector, fields)
           : getNoneConnector();
 
-        await postCase({
+        const updatedCase = await postCase({
           ...dataWithoutConnectorId,
           connector: connectorToUpdate,
           settings: { syncAlerts },
         });
+
+        if (updatedCase?.id && dataConnectorId !== 'none') {
+          await postPushToService({
+            caseId: updatedCase.id,
+            caseServices: {},
+            connector: connectorToUpdate,
+            alerts: {},
+            updateCase: noop,
+          });
+        }
+
+        if (onSuccess && updatedCase) {
+          onSuccess(updatedCase);
+        }
       }
     },
-    [postCase, connectors]
+    [connectors, postCase, onSuccess, postPushToService]
   );
 
   const { form } = useForm<FormProps>({
@@ -70,18 +88,10 @@ export const FormContext: React.FC<Props> = ({ children, onSuccess }) => {
     schema,
     onSubmit: submitCase,
   });
-
   const { setFieldValue } = form;
-
   // Set the selected connector to the configuration connector
   useEffect(() => setFieldValue('connectorId', connectorId), [connectorId, setFieldValue]);
 
-  useEffect(() => {
-    if (caseData && onSuccess) {
-      onSuccess(caseData);
-    }
-  }, [caseData, onSuccess]);
-
   return <Form form={form}>{children}</Form>;
 };
 
diff --git a/x-pack/plugins/security_solution/public/cases/containers/use_post_case.test.tsx b/x-pack/plugins/security_solution/public/cases/containers/use_post_case.test.tsx
index 8e8432d0d190c..bd57f57713e08 100644
--- a/x-pack/plugins/security_solution/public/cases/containers/use_post_case.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/containers/use_post_case.test.tsx
@@ -6,9 +6,9 @@
 
 import { renderHook, act } from '@testing-library/react-hooks';
 import { usePostCase, UsePostCase } from './use_post_case';
-import { basicCasePost } from './mock';
 import * as api from './api';
 import { ConnectorTypes } from '../../../../case/common/api/connectors';
+import { basicCasePost } from './mock';
 
 jest.mock('./api');
 
@@ -40,7 +40,6 @@ describe('usePostCase', () => {
       expect(result.current).toEqual({
         isLoading: false,
         isError: false,
-        caseData: null,
         postCase: result.current.postCase,
       });
     });
@@ -59,6 +58,16 @@ describe('usePostCase', () => {
     });
   });
 
+  it('calls postCase with correct result', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook<string, UsePostCase>(() => usePostCase());
+      await waitForNextUpdate();
+
+      const postData = await result.current.postCase(samplePost);
+      expect(postData).toEqual(basicCasePost);
+    });
+  });
+
   it('post case', async () => {
     await act(async () => {
       const { result, waitForNextUpdate } = renderHook<string, UsePostCase>(() => usePostCase());
@@ -66,7 +75,6 @@ describe('usePostCase', () => {
       result.current.postCase(samplePost);
       await waitForNextUpdate();
       expect(result.current).toEqual({
-        caseData: basicCasePost,
         isLoading: false,
         isError: false,
         postCase: result.current.postCase,
@@ -96,7 +104,6 @@ describe('usePostCase', () => {
       result.current.postCase(samplePost);
 
       expect(result.current).toEqual({
-        caseData: null,
         isLoading: false,
         isError: true,
         postCase: result.current.postCase,
diff --git a/x-pack/plugins/security_solution/public/cases/containers/use_post_case.tsx b/x-pack/plugins/security_solution/public/cases/containers/use_post_case.tsx
index 3ca78dfe75c80..c98446effe47d 100644
--- a/x-pack/plugins/security_solution/public/cases/containers/use_post_case.tsx
+++ b/x-pack/plugins/security_solution/public/cases/containers/use_post_case.tsx
@@ -3,25 +3,17 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
-import { useReducer, useCallback } from 'react';
-
+import { useReducer, useCallback, useRef, useEffect } from 'react';
 import { CasePostRequest } from '../../../../case/common/api';
 import { errorToToaster, useStateToaster } from '../../common/components/toasters';
 import { postCase } from './api';
 import * as i18n from './translations';
 import { Case } from './types';
-
 interface NewCaseState {
-  caseData: Case | null;
   isLoading: boolean;
   isError: boolean;
 }
-type Action =
-  | { type: 'FETCH_INIT' }
-  | { type: 'FETCH_SUCCESS'; payload: Case }
-  | { type: 'FETCH_FAILURE' };
-
+type Action = { type: 'FETCH_INIT' } | { type: 'FETCH_SUCCESS' } | { type: 'FETCH_FAILURE' };
 const dataFetchReducer = (state: NewCaseState, action: Action): NewCaseState => {
   switch (action.type) {
     case 'FETCH_INIT':
@@ -35,7 +27,6 @@ const dataFetchReducer = (state: NewCaseState, action: Action): NewCaseState =>
         ...state,
         isLoading: false,
         isError: false,
-        caseData: action.payload ?? null,
       };
     case 'FETCH_FAILURE':
       return {
@@ -47,47 +38,47 @@ const dataFetchReducer = (state: NewCaseState, action: Action): NewCaseState =>
       return state;
   }
 };
-
 export interface UsePostCase extends NewCaseState {
-  postCase: (data: CasePostRequest) => Promise<() => void>;
+  postCase: (data: CasePostRequest) => Promise<Case | undefined>;
 }
 export const usePostCase = (): UsePostCase => {
   const [state, dispatch] = useReducer(dataFetchReducer, {
     isLoading: false,
     isError: false,
-    caseData: null,
   });
   const [, dispatchToaster] = useStateToaster();
-
-  const postMyCase = useCallback(async (data: CasePostRequest) => {
-    let cancel = false;
-    const abortCtrl = new AbortController();
-
-    try {
-      dispatch({ type: 'FETCH_INIT' });
-      const response = await postCase(data, abortCtrl.signal);
-      if (!cancel) {
-        dispatch({
-          type: 'FETCH_SUCCESS',
-          payload: response,
-        });
+  const cancel = useRef(false);
+  const abortCtrl = useRef(new AbortController());
+  const postMyCase = useCallback(
+    async (data: CasePostRequest) => {
+      try {
+        dispatch({ type: 'FETCH_INIT' });
+        abortCtrl.current.abort();
+        cancel.current = false;
+        abortCtrl.current = new AbortController();
+        const response = await postCase(data, abortCtrl.current.signal);
+        if (!cancel.current) {
+          dispatch({ type: 'FETCH_SUCCESS' });
+        }
+        return response;
+      } catch (error) {
+        if (!cancel.current) {
+          errorToToaster({
+            title: i18n.ERROR_TITLE,
+            error: error.body && error.body.message ? new Error(error.body.message) : error,
+            dispatchToaster,
+          });
+          dispatch({ type: 'FETCH_FAILURE' });
+        }
       }
-    } catch (error) {
-      if (!cancel) {
-        errorToToaster({
-          title: i18n.ERROR_TITLE,
-          error: error.body && error.body.message ? new Error(error.body.message) : error,
-          dispatchToaster,
-        });
-        dispatch({ type: 'FETCH_FAILURE' });
-      }
-    }
+    },
+    [dispatchToaster]
+  );
+  useEffect(() => {
     return () => {
-      abortCtrl.abort();
-      cancel = true;
+      abortCtrl.current.abort();
+      cancel.current = true;
     };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
-
   return { ...state, postCase: postMyCase };
 };

From 8701ac85d32c39a8c40f38cdf103aa55c97d0ee4 Mon Sep 17 00:00:00 2001
From: Tim Sullivan <tsullivan@users.noreply.github.com>
Date: Mon, 1 Feb 2021 09:36:49 -0700
Subject: [PATCH 3/8] Deprecate CSV job type (#89794)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 x-pack/plugins/reporting/common/constants.ts     | 13 +++++++++----
 .../components/reporting_panel_content.tsx       |  8 ++++++--
 .../panel_actions/get_csv_panel_action.tsx       |  3 +--
 .../register_csv_reporting.tsx                   |  9 ++++++---
 .../server/export_types/csv/create_job.ts        | 14 +++++++++-----
 .../server/export_types/csv/execute_job.test.ts  |  4 ++--
 .../server/export_types/csv/execute_job.ts       |  8 ++++----
 .../csv/generate_csv/field_format_map.test.ts    |  4 ++--
 .../csv/generate_csv/field_format_map.ts         |  4 ++--
 .../export_types/csv/generate_csv/index.ts       |  4 ++--
 .../reporting/server/export_types/csv/index.ts   |  8 ++++----
 .../reporting/server/export_types/csv/types.d.ts | 16 ++++++++--------
 .../csv_from_savedobject/lib/get_data_source.ts  |  6 +++---
 .../server/routes/lib/get_document_payload.ts    |  4 ++--
 .../server/usage/decorate_range_stats.ts         |  4 ++--
 15 files changed, 62 insertions(+), 47 deletions(-)

diff --git a/x-pack/plugins/reporting/common/constants.ts b/x-pack/plugins/reporting/common/constants.ts
index 16e40bab65a46..882387184ba9c 100644
--- a/x-pack/plugins/reporting/common/constants.ts
+++ b/x-pack/plugins/reporting/common/constants.ts
@@ -56,14 +56,19 @@ export const LAYOUT_TYPES = {
 };
 
 // Export Type Definitions
-export const CSV_REPORT_TYPE = 'CSV';
 export const PDF_REPORT_TYPE = 'printablePdf';
-export const PNG_REPORT_TYPE = 'PNG';
-
 export const PDF_JOB_TYPE = 'printable_pdf';
+
+export const PNG_REPORT_TYPE = 'PNG';
 export const PNG_JOB_TYPE = 'PNG';
-export const CSV_JOB_TYPE = 'csv';
+
 export const CSV_FROM_SAVEDOBJECT_JOB_TYPE = 'csv_from_savedobject';
+
+// This is deprecated because it lacks support for runtime fields
+// but the extension points are still needed for pre-existing scripted automation, until 8.0
+export const CSV_REPORT_TYPE_DEPRECATED = 'CSV';
+export const CSV_JOB_TYPE_DEPRECATED = 'csv';
+
 export const USES_HEADLESS_JOB_TYPES = [PDF_JOB_TYPE, PNG_JOB_TYPE];
 
 // Licenses
diff --git a/x-pack/plugins/reporting/public/components/reporting_panel_content.tsx b/x-pack/plugins/reporting/public/components/reporting_panel_content.tsx
index bbdc2e1aebe77..bafb5d7a68630 100644
--- a/x-pack/plugins/reporting/public/components/reporting_panel_content.tsx
+++ b/x-pack/plugins/reporting/public/components/reporting_panel_content.tsx
@@ -10,7 +10,11 @@ import React, { Component, ReactElement } from 'react';
 import { ToastsSetup } from 'src/core/public';
 import url from 'url';
 import { toMountPoint } from '../../../../../src/plugins/kibana_react/public';
-import { CSV_REPORT_TYPE, PDF_REPORT_TYPE, PNG_REPORT_TYPE } from '../../common/constants';
+import {
+  CSV_REPORT_TYPE_DEPRECATED,
+  PDF_REPORT_TYPE,
+  PNG_REPORT_TYPE,
+} from '../../common/constants';
 import { BaseParams } from '../../common/types';
 import { ReportingAPIClient } from '../lib/reporting_api_client';
 
@@ -173,7 +177,7 @@ class ReportingPanelContentUi extends Component<Props, State> {
       case PDF_REPORT_TYPE:
         return 'PDF';
       case 'csv':
-        return CSV_REPORT_TYPE;
+        return CSV_REPORT_TYPE_DEPRECATED;
       case 'png':
         return PNG_REPORT_TYPE;
       default:
diff --git a/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx b/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
index 9a4832b114e40..49c0eaaa2960d 100644
--- a/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
+++ b/x-pack/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
@@ -103,7 +103,6 @@ export class GetCsvReportPanelAction implements ActionDefinition<ActionContext>
     const kibanaTimezone = this.core.uiSettings.get('dateFormat:tz');
 
     const id = `search:${embeddable.getSavedSearch().id}`;
-    const filename = embeddable.getSavedSearch().title;
     const timezone = kibanaTimezone === 'Browser' ? moment.tz.guess() : kibanaTimezone;
     const fromTime = dateMath.parse(from);
     const toTime = dateMath.parse(to, { roundUp: true });
@@ -140,7 +139,7 @@ export class GetCsvReportPanelAction implements ActionDefinition<ActionContext>
       .then((rawResponse: string) => {
         this.isDownloading = false;
 
-        const download = `${filename}.csv`;
+        const download = `${embeddable.getSavedSearch().title}.csv`;
         const blob = new Blob([rawResponse], { type: 'text/csv;charset=utf-8;' });
 
         // Hack for IE11 Support
diff --git a/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx b/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx
index 7126762c0f4ee..4659952eef720 100644
--- a/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx
+++ b/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx
@@ -10,7 +10,10 @@ import React from 'react';
 import { IUiSettingsClient, ToastsSetup } from 'src/core/public';
 import { ShareContext } from '../../../../../src/plugins/share/public';
 import { LicensingPluginSetup } from '../../../licensing/public';
-import { JobParamsCSV, SearchRequest } from '../../server/export_types/csv/types';
+import {
+  JobParamsDeprecatedCSV,
+  SearchRequestDeprecatedCSV,
+} from '../../server/export_types/csv/types';
 import { ReportingPanelContent } from '../components/reporting_panel_content_lazy';
 import { checkLicense } from '../lib/license_check';
 import { ReportingAPIClient } from '../lib/reporting_api_client';
@@ -59,12 +62,12 @@ export const csvReportingProvider = ({
       return [];
     }
 
-    const jobParams: JobParamsCSV = {
+    const jobParams: JobParamsDeprecatedCSV = {
       browserTimezone,
       objectType,
       title: sharingData.title as string,
       indexPatternId: sharingData.indexPatternId as string,
-      searchRequest: sharingData.searchRequest as SearchRequest,
+      searchRequest: sharingData.searchRequest as SearchRequestDeprecatedCSV,
       fields: sharingData.fields as string[],
       metaFields: sharingData.metaFields as string[],
       conflictedTypesFields: sharingData.conflictedTypesFields as string[],
diff --git a/x-pack/plugins/reporting/server/export_types/csv/create_job.ts b/x-pack/plugins/reporting/server/export_types/csv/create_job.ts
index f0f72a0bc9965..e704f9650b7a8 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/create_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/create_job.ts
@@ -4,15 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CSV_JOB_TYPE } from '../../../common/constants';
+import { CSV_JOB_TYPE_DEPRECATED } from '../../../common/constants';
 import { cryptoFactory } from '../../lib';
 import { CreateJobFn, CreateJobFnFactory } from '../../types';
-import { IndexPatternSavedObject, JobParamsCSV, TaskPayloadCSV } from './types';
+import {
+  IndexPatternSavedObjectDeprecatedCSV,
+  JobParamsDeprecatedCSV,
+  TaskPayloadDeprecatedCSV,
+} from './types';
 
 export const createJobFnFactory: CreateJobFnFactory<
-  CreateJobFn<JobParamsCSV, TaskPayloadCSV>
+  CreateJobFn<JobParamsDeprecatedCSV, TaskPayloadDeprecatedCSV>
 > = function createJobFactoryFn(reporting, parentLogger) {
-  const logger = parentLogger.clone([CSV_JOB_TYPE, 'create-job']);
+  const logger = parentLogger.clone([CSV_JOB_TYPE_DEPRECATED, 'create-job']);
 
   const config = reporting.getConfig();
   const crypto = cryptoFactory(config.get('encryptionKey'));
@@ -24,7 +28,7 @@ export const createJobFnFactory: CreateJobFnFactory<
     const indexPatternSavedObject = ((await savedObjectsClient.get(
       'index-pattern',
       jobParams.indexPatternId
-    )) as unknown) as IndexPatternSavedObject; // FIXME
+    )) as unknown) as IndexPatternSavedObjectDeprecatedCSV;
 
     return {
       headers: serializedEncryptedHeaders,
diff --git a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
index ea65262c090ee..098a90959f8a7 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
@@ -22,7 +22,7 @@ import { LevelLogger } from '../../lib';
 import { setFieldFormats } from '../../services';
 import { createMockReportingCore } from '../../test_helpers';
 import { runTaskFnFactory } from './execute_job';
-import { TaskPayloadCSV } from './types';
+import { TaskPayloadDeprecatedCSV } from './types';
 
 const delay = (ms: number) => new Promise<void>((resolve) => setTimeout(() => resolve(), ms));
 
@@ -31,7 +31,7 @@ const getRandomScrollId = () => {
   return puid.generate();
 };
 
-const getBasePayload = (baseObj: any) => baseObj as TaskPayloadCSV;
+const getBasePayload = (baseObj: any) => baseObj as TaskPayloadDeprecatedCSV;
 
 describe('CSV Execute Job', function () {
   const encryptionKey = 'testEncryptionKey';
diff --git a/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts b/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
index 6b4dd48583efe..cb321b7573701 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
@@ -4,20 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CONTENT_TYPE_CSV, CSV_JOB_TYPE } from '../../../common/constants';
+import { CONTENT_TYPE_CSV, CSV_JOB_TYPE_DEPRECATED } from '../../../common/constants';
 import { RunTaskFn, RunTaskFnFactory } from '../../types';
 import { decryptJobHeaders } from '../common';
 import { createGenerateCsv } from './generate_csv';
-import { TaskPayloadCSV } from './types';
+import { TaskPayloadDeprecatedCSV } from './types';
 
 export const runTaskFnFactory: RunTaskFnFactory<
-  RunTaskFn<TaskPayloadCSV>
+  RunTaskFn<TaskPayloadDeprecatedCSV>
 > = function executeJobFactoryFn(reporting, parentLogger) {
   const config = reporting.getConfig();
 
   return async function runTask(jobId, job, cancellationToken) {
     const elasticsearch = reporting.getElasticsearchService();
-    const logger = parentLogger.clone([CSV_JOB_TYPE, 'execute-job', jobId]);
+    const logger = parentLogger.clone([CSV_JOB_TYPE_DEPRECATED, 'execute-job', jobId]);
     const generateCsv = createGenerateCsv(logger);
 
     const encryptionKey = config.get('encryptionKey');
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts
index 4cb8de5810584..0c74e3aa54b0e 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts
@@ -6,13 +6,13 @@
 
 import expect from '@kbn/expect';
 import { fieldFormats, FieldFormatsGetConfigFn, UI_SETTINGS } from 'src/plugins/data/server';
-import { IndexPatternSavedObject } from '../types';
+import { IndexPatternSavedObjectDeprecatedCSV } from '../types';
 import { fieldFormatMapFactory } from './field_format_map';
 
 type ConfigValue = { number: { id: string; params: {} } } | string;
 
 describe('field format map', function () {
-  const indexPatternSavedObject: IndexPatternSavedObject = {
+  const indexPatternSavedObject: IndexPatternSavedObjectDeprecatedCSV = {
     timeFieldName: '@timestamp',
     title: 'logstash-*',
     attributes: {
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts
index e01fee530fc65..c05dc7d3fd75f 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts
@@ -7,7 +7,7 @@
 import _ from 'lodash';
 import { FieldFormat } from 'src/plugins/data/common';
 import { FieldFormatConfig, IFieldFormatsRegistry } from 'src/plugins/data/server';
-import { IndexPatternSavedObject } from '../types';
+import { IndexPatternSavedObjectDeprecatedCSV } from '../types';
 
 /**
  *  Create a map of FieldFormat instances for index pattern fields
@@ -17,7 +17,7 @@ import { IndexPatternSavedObject } from '../types';
  *  @return {Map} key: field name, value: FieldFormat instance
  */
 export function fieldFormatMapFactory(
-  indexPatternSavedObject: IndexPatternSavedObject,
+  indexPatternSavedObject: IndexPatternSavedObjectDeprecatedCSV,
   fieldFormatsRegistry: IFieldFormatsRegistry,
   timezone: string | undefined
 ) {
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
index 2f6df9cd67a75..ee09f3904678c 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
@@ -12,7 +12,7 @@ import { CSV_BOM_CHARS } from '../../../../common/constants';
 import { byteSizeValueToNumber } from '../../../../common/schema_utils';
 import { LevelLogger } from '../../../lib';
 import { getFieldFormats } from '../../../services';
-import { IndexPatternSavedObject, SavedSearchGeneratorResult } from '../types';
+import { IndexPatternSavedObjectDeprecatedCSV, SavedSearchGeneratorResult } from '../types';
 import { checkIfRowsHaveFormulas } from './check_cells_for_formulas';
 import { createEscapeValue } from './escape_value';
 import { fieldFormatMapFactory } from './field_format_map';
@@ -39,7 +39,7 @@ interface SearchRequest {
 export interface GenerateCsvParams {
   browserTimezone?: string;
   searchRequest: SearchRequest;
-  indexPatternSavedObject: IndexPatternSavedObject;
+  indexPatternSavedObject: IndexPatternSavedObjectDeprecatedCSV;
   fields: string[];
   metaFields: string[];
   conflictedTypesFields: string[];
diff --git a/x-pack/plugins/reporting/server/export_types/csv/index.ts b/x-pack/plugins/reporting/server/export_types/csv/index.ts
index f7b7ff5709fe6..23f4b879eb140 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/index.ts
@@ -5,7 +5,7 @@
  */
 
 import {
-  CSV_JOB_TYPE as jobType,
+  CSV_JOB_TYPE_DEPRECATED as jobType,
   LICENSE_TYPE_BASIC,
   LICENSE_TYPE_ENTERPRISE,
   LICENSE_TYPE_GOLD,
@@ -17,11 +17,11 @@ import { CreateJobFn, ExportTypeDefinition, RunTaskFn } from '../../types';
 import { createJobFnFactory } from './create_job';
 import { runTaskFnFactory } from './execute_job';
 import { metadata } from './metadata';
-import { JobParamsCSV, TaskPayloadCSV } from './types';
+import { JobParamsDeprecatedCSV, TaskPayloadDeprecatedCSV } from './types';
 
 export const getExportType = (): ExportTypeDefinition<
-  CreateJobFn<JobParamsCSV>,
-  RunTaskFn<TaskPayloadCSV>
+  CreateJobFn<JobParamsDeprecatedCSV>,
+  RunTaskFn<TaskPayloadDeprecatedCSV>
 > => ({
   ...metadata,
   jobType,
diff --git a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts b/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
index 78615a0e7b72c..dd0b37a17a2ff 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
@@ -8,7 +8,7 @@ import { BaseParams, BasePayload } from '../../types';
 
 export type RawValue = string | object | null | undefined;
 
-export interface IndexPatternSavedObject {
+export interface IndexPatternSavedObjectDeprecatedCSV {
   title: string;
   timeFieldName: string;
   fields?: any[];
@@ -18,25 +18,25 @@ export interface IndexPatternSavedObject {
   };
 }
 
-interface BaseParamsCSV {
-  searchRequest: SearchRequest;
+interface BaseParamsDeprecatedCSV {
+  searchRequest: SearchRequestDeprecatedCSV;
   fields: string[];
   metaFields: string[];
   conflictedTypesFields: string[];
 }
 
-export type JobParamsCSV = BaseParamsCSV &
+export type JobParamsDeprecatedCSV = BaseParamsDeprecatedCSV &
   BaseParams & {
     indexPatternId: string;
   };
 
 // CSV create job method converts indexPatternID to indexPatternSavedObject
-export type TaskPayloadCSV = BaseParamsCSV &
+export type TaskPayloadDeprecatedCSV = BaseParamsDeprecatedCSV &
   BasePayload & {
-    indexPatternSavedObject: IndexPatternSavedObject;
+    indexPatternSavedObject: IndexPatternSavedObjectDeprecatedCSV;
   };
 
-export interface SearchRequest {
+export interface SearchRequestDeprecatedCSV {
   index: string;
   body:
     | {
@@ -66,7 +66,7 @@ export interface SearchRequest {
     | any;
 }
 
-type FormatsMap = Map<
+type FormatsMapDeprecatedCSV = Map<
   string,
   {
     id: string;
diff --git a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/lib/get_data_source.ts b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/lib/get_data_source.ts
index e3631b9c89724..fa983c5af639c 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/lib/get_data_source.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_from_savedobject/lib/get_data_source.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IndexPatternSavedObject } from '../../csv/types';
+import { IndexPatternSavedObjectDeprecatedCSV } from '../../csv/types';
 import { SavedObjectReference, SavedSearchObjectAttributesJSON, SearchSource } from '../types';
 
 export async function getDataSource(
@@ -12,10 +12,10 @@ export async function getDataSource(
   indexPatternId?: string,
   savedSearchObjectId?: string
 ): Promise<{
-  indexPatternSavedObject: IndexPatternSavedObject;
+  indexPatternSavedObject: IndexPatternSavedObjectDeprecatedCSV;
   searchSource: SearchSource | null;
 }> {
-  let indexPatternSavedObject: IndexPatternSavedObject;
+  let indexPatternSavedObject: IndexPatternSavedObjectDeprecatedCSV;
   let searchSource: SearchSource | null = null;
 
   if (savedSearchObjectId) {
diff --git a/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts b/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
index 7706aa9d650c7..641ce6e48a1f3 100644
--- a/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
@@ -7,7 +7,7 @@
 // @ts-ignore
 import contentDisposition from 'content-disposition';
 import { get } from 'lodash';
-import { CSV_JOB_TYPE } from '../../../common/constants';
+import { CSV_JOB_TYPE_DEPRECATED } from '../../../common/constants';
 import { ExportTypesRegistry, statuses } from '../../lib';
 import { ReportDocument } from '../../lib/store';
 import { TaskRunResult } from '../../lib/tasks';
@@ -33,7 +33,7 @@ const getTitle = (exportType: ExportTypeDefinition, title?: string): string =>
 const getReportingHeaders = (output: TaskRunResult, exportType: ExportTypeDefinition) => {
   const metaDataHeaders: Record<string, boolean> = {};
 
-  if (exportType.jobType === CSV_JOB_TYPE) {
+  if (exportType.jobType === CSV_JOB_TYPE_DEPRECATED) {
     const csvContainsFormulas = get(output, 'csv_contains_formulas', false);
     const maxSizedReach = get(output, 'max_size_reached', false);
 
diff --git a/x-pack/plugins/reporting/server/usage/decorate_range_stats.ts b/x-pack/plugins/reporting/server/usage/decorate_range_stats.ts
index 30befcf291a54..8d69d75f66212 100644
--- a/x-pack/plugins/reporting/server/usage/decorate_range_stats.ts
+++ b/x-pack/plugins/reporting/server/usage/decorate_range_stats.ts
@@ -5,7 +5,7 @@
  */
 
 import { uniq } from 'lodash';
-import { CSV_JOB_TYPE, PDF_JOB_TYPE, PNG_JOB_TYPE } from '../../common/constants';
+import { CSV_JOB_TYPE_DEPRECATED, PDF_JOB_TYPE, PNG_JOB_TYPE } from '../../common/constants';
 import { AvailableTotal, ExportType, FeatureAvailabilityMap, RangeStats } from './types';
 
 function getForFeature(
@@ -54,7 +54,7 @@ export const decorateRangeStats = (
 
   // combine the known types with any unknown type found in reporting data
   const keysBasic = uniq([
-    CSV_JOB_TYPE,
+    CSV_JOB_TYPE_DEPRECATED,
     PNG_JOB_TYPE,
     ...Object.keys(rangeStatsBasic),
   ]) as ExportType[];

From e4c344ada604781e8cd0f484a190bb022843a3d9 Mon Sep 17 00:00:00 2001
From: Patrick Mueller <pmuellr@gmail.com>
Date: Mon, 1 Feb 2021 12:22:29 -0500
Subject: [PATCH 4/8] [data] change KQL node builder to not generate recursive
 and/or clauses (#89345)

resolves https://github.com/elastic/kibana/issues/88367

Prior to this PR, the KQL node_builder code was using recursion to generate
"and" & "or" expressions.  Eg, `and(foo1=bar1, foo2=bar2, foo3=bar3)` would
be generated as if was specified as `and(foo1=bar1, and(foo2=bar2, foo3=bar3))`.

Calls to the builder with long lists of expressions would generate nested JSON
as deep as the lists are long.  This is problematic, as Elasticsearch is
changing the default limit on nested bools to 20 levels, and alerting already
generates nested bools greater than that limit.
See: https://github.com/elastic/elasticsearch/issues/55303

This PR changes the generated shape of above, so that all the nodes are at the
same level, instead of the previous "recursive" treatment.
---
 packages/kbn-es/src/cluster.js                |   2 +-
 .../src/integration_tests/cluster.test.js     |   8 +-
 .../kuery/node_types/node_builder.test.ts     | 280 +++++++++++
 .../es_query/kuery/node_types/node_builder.ts |  10 +-
 .../alerts_authorization.test.ts.snap         | 316 ++++++++++++
 .../alerts_authorization_kuery.test.ts.snap   | 448 ++++++++++++++++++
 .../alerts_authorization.test.ts              |  17 +-
 .../alerts_authorization_kuery.test.ts        |  40 +-
 8 files changed, 1086 insertions(+), 35 deletions(-)
 create mode 100644 src/plugins/data/common/es_query/kuery/node_types/node_builder.test.ts
 create mode 100644 x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization.test.ts.snap
 create mode 100644 x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization_kuery.test.ts.snap

diff --git a/packages/kbn-es/src/cluster.js b/packages/kbn-es/src/cluster.js
index f554dd8a1b8e5..5948e9ecececc 100644
--- a/packages/kbn-es/src/cluster.js
+++ b/packages/kbn-es/src/cluster.js
@@ -246,7 +246,7 @@ exports.Cluster = class Cluster {
     this._log.info(chalk.bold('Starting'));
     this._log.indent(4);
 
-    const esArgs = ['indices.query.bool.max_nested_depth=100'].concat(options.esArgs || []);
+    const esArgs = options.esArgs || [];
 
     // Add to esArgs if ssl is enabled
     if (this._ssl) {
diff --git a/packages/kbn-es/src/integration_tests/cluster.test.js b/packages/kbn-es/src/integration_tests/cluster.test.js
index c1adc84ddc954..684667355852d 100644
--- a/packages/kbn-es/src/integration_tests/cluster.test.js
+++ b/packages/kbn-es/src/integration_tests/cluster.test.js
@@ -264,9 +264,7 @@ describe('#start(installPath)', () => {
     expect(extractConfigFiles.mock.calls).toMatchInlineSnapshot(`
       Array [
         Array [
-          Array [
-            "indices.query.bool.max_nested_depth=100",
-          ],
+          Array [],
           undefined,
           Object {
             "log": <ToolingLog>,
@@ -342,9 +340,7 @@ describe('#run()', () => {
     expect(extractConfigFiles.mock.calls).toMatchInlineSnapshot(`
       Array [
         Array [
-          Array [
-            "indices.query.bool.max_nested_depth=100",
-          ],
+          Array [],
           undefined,
           Object {
             "log": <ToolingLog>,
diff --git a/src/plugins/data/common/es_query/kuery/node_types/node_builder.test.ts b/src/plugins/data/common/es_query/kuery/node_types/node_builder.test.ts
new file mode 100644
index 0000000000000..df78d68aaef48
--- /dev/null
+++ b/src/plugins/data/common/es_query/kuery/node_types/node_builder.test.ts
@@ -0,0 +1,280 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * and the Server Side Public License, v 1; you may not use this file except in
+ * compliance with, at your election, the Elastic License or the Server Side
+ * Public License, v 1.
+ */
+
+import { nodeBuilder } from './node_builder';
+import { toElasticsearchQuery } from '../index';
+
+describe('nodeBuilder', () => {
+  describe('is method', () => {
+    test('string value', () => {
+      const nodes = nodeBuilder.is('foo', 'bar');
+      const query = toElasticsearchQuery(nodes);
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match": Object {
+                  "foo": "bar",
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+
+    test('KueryNode value', () => {
+      const literalValue = {
+        type: 'literal' as 'literal',
+        value: 'bar',
+      };
+      const nodes = nodeBuilder.is('foo', literalValue);
+      const query = toElasticsearchQuery(nodes);
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match": Object {
+                  "foo": "bar",
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+  });
+
+  describe('and method', () => {
+    test('single clause', () => {
+      const nodes = [nodeBuilder.is('foo', 'bar')];
+      const query = toElasticsearchQuery(nodeBuilder.and(nodes));
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match": Object {
+                  "foo": "bar",
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+
+    test('two clauses', () => {
+      const nodes = [nodeBuilder.is('foo1', 'bar1'), nodeBuilder.is('foo2', 'bar2')];
+      const query = toElasticsearchQuery(nodeBuilder.and(nodes));
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "filter": Array [
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo1": "bar1",
+                      },
+                    },
+                  ],
+                },
+              },
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo2": "bar2",
+                      },
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+
+    test('three clauses', () => {
+      const nodes = [
+        nodeBuilder.is('foo1', 'bar1'),
+        nodeBuilder.is('foo2', 'bar2'),
+        nodeBuilder.is('foo3', 'bar3'),
+      ];
+      const query = toElasticsearchQuery(nodeBuilder.and(nodes));
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "filter": Array [
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo1": "bar1",
+                      },
+                    },
+                  ],
+                },
+              },
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo2": "bar2",
+                      },
+                    },
+                  ],
+                },
+              },
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo3": "bar3",
+                      },
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+  });
+
+  describe('or method', () => {
+    test('single clause', () => {
+      const nodes = [nodeBuilder.is('foo', 'bar')];
+      const query = toElasticsearchQuery(nodeBuilder.or(nodes));
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match": Object {
+                  "foo": "bar",
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+
+    test('two clauses', () => {
+      const nodes = [nodeBuilder.is('foo1', 'bar1'), nodeBuilder.is('foo2', 'bar2')];
+      const query = toElasticsearchQuery(nodeBuilder.or(nodes));
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo1": "bar1",
+                      },
+                    },
+                  ],
+                },
+              },
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo2": "bar2",
+                      },
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+
+    test('three clauses', () => {
+      const nodes = [
+        nodeBuilder.is('foo1', 'bar1'),
+        nodeBuilder.is('foo2', 'bar2'),
+        nodeBuilder.is('foo3', 'bar3'),
+      ];
+      const query = toElasticsearchQuery(nodeBuilder.or(nodes));
+      expect(query).toMatchInlineSnapshot(`
+        Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo1": "bar1",
+                      },
+                    },
+                  ],
+                },
+              },
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo2": "bar2",
+                      },
+                    },
+                  ],
+                },
+              },
+              Object {
+                "bool": Object {
+                  "minimum_should_match": 1,
+                  "should": Array [
+                    Object {
+                      "match": Object {
+                        "foo3": "bar3",
+                      },
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        }
+      `);
+    });
+  });
+});
diff --git a/src/plugins/data/common/es_query/kuery/node_types/node_builder.ts b/src/plugins/data/common/es_query/kuery/node_types/node_builder.ts
index a72c7f2db41a8..6da9c3aa293ef 100644
--- a/src/plugins/data/common/es_query/kuery/node_types/node_builder.ts
+++ b/src/plugins/data/common/es_query/kuery/node_types/node_builder.ts
@@ -16,12 +16,10 @@ export const nodeBuilder = {
       nodeTypes.literal.buildNode(false),
     ]);
   },
-  or: ([first, ...args]: KueryNode[]): KueryNode => {
-    return args.length ? nodeTypes.function.buildNode('or', [first, nodeBuilder.or(args)]) : first;
+  or: (nodes: KueryNode[]): KueryNode => {
+    return nodes.length > 1 ? nodeTypes.function.buildNode('or', nodes) : nodes[0];
   },
-  and: ([first, ...args]: KueryNode[]): KueryNode => {
-    return args.length
-      ? nodeTypes.function.buildNode('and', [first, nodeBuilder.and(args)])
-      : first;
+  and: (nodes: KueryNode[]): KueryNode => {
+    return nodes.length > 1 ? nodeTypes.function.buildNode('and', nodes) : nodes[0];
   },
 };
diff --git a/x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization.test.ts.snap b/x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization.test.ts.snap
new file mode 100644
index 0000000000000..f9a28dc3eb119
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization.test.ts.snap
@@ -0,0 +1,316 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`AlertsAuthorization getFindAuthorizationFilter creates a filter based on the privileged types 1`] = `
+Object {
+  "arguments": Array [
+    Object {
+      "arguments": Array [
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.alertTypeId",
+            },
+            Object {
+              "type": "literal",
+              "value": "myAppAlertType",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "alerts",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myOtherApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myAppWithSubFeature",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+          ],
+          "function": "or",
+          "type": "function",
+        },
+      ],
+      "function": "and",
+      "type": "function",
+    },
+    Object {
+      "arguments": Array [
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.alertTypeId",
+            },
+            Object {
+              "type": "literal",
+              "value": "myOtherAppAlertType",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "alerts",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myOtherApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myAppWithSubFeature",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+          ],
+          "function": "or",
+          "type": "function",
+        },
+      ],
+      "function": "and",
+      "type": "function",
+    },
+    Object {
+      "arguments": Array [
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.alertTypeId",
+            },
+            Object {
+              "type": "literal",
+              "value": "mySecondAppAlertType",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "alerts",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myOtherApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myAppWithSubFeature",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+          ],
+          "function": "or",
+          "type": "function",
+        },
+      ],
+      "function": "and",
+      "type": "function",
+    },
+  ],
+  "function": "or",
+  "type": "function",
+}
+`;
diff --git a/x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization_kuery.test.ts.snap b/x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization_kuery.test.ts.snap
new file mode 100644
index 0000000000000..de01a7b27ef05
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/__snapshots__/alerts_authorization_kuery.test.ts.snap
@@ -0,0 +1,448 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`asFiltersByAlertTypeAndConsumer constructs filter for multiple alert types across authorized consumer 1`] = `
+Object {
+  "arguments": Array [
+    Object {
+      "arguments": Array [
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.alertTypeId",
+            },
+            Object {
+              "type": "literal",
+              "value": "myAppAlertType",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "alerts",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myOtherApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myAppWithSubFeature",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+          ],
+          "function": "or",
+          "type": "function",
+        },
+      ],
+      "function": "and",
+      "type": "function",
+    },
+    Object {
+      "arguments": Array [
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.alertTypeId",
+            },
+            Object {
+              "type": "literal",
+              "value": "myOtherAppAlertType",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "alerts",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myOtherApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myAppWithSubFeature",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+          ],
+          "function": "or",
+          "type": "function",
+        },
+      ],
+      "function": "and",
+      "type": "function",
+    },
+    Object {
+      "arguments": Array [
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.alertTypeId",
+            },
+            Object {
+              "type": "literal",
+              "value": "mySecondAppAlertType",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "alerts",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myOtherApp",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+            Object {
+              "arguments": Array [
+                Object {
+                  "type": "literal",
+                  "value": "alert.attributes.consumer",
+                },
+                Object {
+                  "type": "literal",
+                  "value": "myAppWithSubFeature",
+                },
+                Object {
+                  "type": "literal",
+                  "value": false,
+                },
+              ],
+              "function": "is",
+              "type": "function",
+            },
+          ],
+          "function": "or",
+          "type": "function",
+        },
+      ],
+      "function": "and",
+      "type": "function",
+    },
+  ],
+  "function": "or",
+  "type": "function",
+}
+`;
+
+exports[`asFiltersByAlertTypeAndConsumer constructs filter for single alert type with multiple authorized consumer 1`] = `
+Object {
+  "arguments": Array [
+    Object {
+      "arguments": Array [
+        Object {
+          "type": "literal",
+          "value": "alert.attributes.alertTypeId",
+        },
+        Object {
+          "type": "literal",
+          "value": "myAppAlertType",
+        },
+        Object {
+          "type": "literal",
+          "value": false,
+        },
+      ],
+      "function": "is",
+      "type": "function",
+    },
+    Object {
+      "arguments": Array [
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.consumer",
+            },
+            Object {
+              "type": "literal",
+              "value": "alerts",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.consumer",
+            },
+            Object {
+              "type": "literal",
+              "value": "myApp",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+        Object {
+          "arguments": Array [
+            Object {
+              "type": "literal",
+              "value": "alert.attributes.consumer",
+            },
+            Object {
+              "type": "literal",
+              "value": "myOtherApp",
+            },
+            Object {
+              "type": "literal",
+              "value": false,
+            },
+          ],
+          "function": "is",
+          "type": "function",
+        },
+      ],
+      "function": "or",
+      "type": "function",
+    },
+  ],
+  "function": "and",
+  "type": "function",
+}
+`;
+
+exports[`asFiltersByAlertTypeAndConsumer constructs filter for single alert type with single authorized consumer 1`] = `
+Object {
+  "arguments": Array [
+    Object {
+      "arguments": Array [
+        Object {
+          "type": "literal",
+          "value": "alert.attributes.alertTypeId",
+        },
+        Object {
+          "type": "literal",
+          "value": "myAppAlertType",
+        },
+        Object {
+          "type": "literal",
+          "value": false,
+        },
+      ],
+      "function": "is",
+      "type": "function",
+    },
+    Object {
+      "arguments": Array [
+        Object {
+          "type": "literal",
+          "value": "alert.attributes.consumer",
+        },
+        Object {
+          "type": "literal",
+          "value": "myApp",
+        },
+        Object {
+          "type": "literal",
+          "value": false,
+        },
+      ],
+      "function": "is",
+      "type": "function",
+    },
+  ],
+  "function": "and",
+  "type": "function",
+}
+`;
diff --git a/x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts b/x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts
index a7d9421073483..fc895f3e308f4 100644
--- a/x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts
+++ b/x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts
@@ -6,7 +6,6 @@
 import { KibanaRequest } from 'kibana/server';
 import { alertTypeRegistryMock } from '../alert_type_registry.mock';
 import { securityMock } from '../../../../plugins/security/server/mocks';
-import { esKuery } from '../../../../../src/plugins/data/server';
 import {
   PluginStartContract as FeaturesStartContract,
   KibanaFeature,
@@ -627,11 +626,17 @@ describe('AlertsAuthorization', () => {
       });
       alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
 
-      expect((await alertAuthorization.getFindAuthorizationFilter()).filter).toEqual(
-        esKuery.fromKueryExpression(
-          `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:myOtherAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:mySecondAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)))`
-        )
-      );
+      // TODO: once issue https://github.com/elastic/kibana/issues/89473 is
+      // resolved, we can start using this code again, instead of toMatchSnapshot():
+      //
+      // expect((await alertAuthorization.getFindAuthorizationFilter()).filter).toEqual(
+      //   esKuery.fromKueryExpression(
+      //     `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:myOtherAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:mySecondAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)))`
+      //   )
+      // );
+
+      // This code is the replacement code for above
+      expect((await alertAuthorization.getFindAuthorizationFilter()).filter).toMatchSnapshot();
 
       expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
     });
diff --git a/x-pack/plugins/alerts/server/authorization/alerts_authorization_kuery.test.ts b/x-pack/plugins/alerts/server/authorization/alerts_authorization_kuery.test.ts
index 8249047c0ef39..3d80ff0273db7 100644
--- a/x-pack/plugins/alerts/server/authorization/alerts_authorization_kuery.test.ts
+++ b/x-pack/plugins/alerts/server/authorization/alerts_authorization_kuery.test.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { esKuery } from '../../../../../src/plugins/data/server';
 import { RecoveredActionGroup } from '../../common';
 import {
   asFiltersByAlertTypeAndConsumer,
@@ -30,11 +29,14 @@ describe('asFiltersByAlertTypeAndConsumer', () => {
           },
         ])
       )
-    ).toEqual(
-      esKuery.fromKueryExpression(
-        `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(myApp)))`
-      )
-    );
+    ).toMatchSnapshot();
+    // TODO: once issue https://github.com/elastic/kibana/issues/89473 is
+    // resolved, we can start using this code again instead of toMatchSnapshot()
+    // ).toEqual(
+    //   esKuery.fromKueryExpression(
+    //     `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(myApp)))`
+    //   )
+    // );
   });
 
   test('constructs filter for single alert type with multiple authorized consumer', async () => {
@@ -58,11 +60,14 @@ describe('asFiltersByAlertTypeAndConsumer', () => {
           },
         ])
       )
-    ).toEqual(
-      esKuery.fromKueryExpression(
-        `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp)))`
-      )
-    );
+    ).toMatchSnapshot();
+    // TODO: once issue https://github.com/elastic/kibana/issues/89473 is
+    // resolved, we can start using this code again, instead of toMatchSnapshot():
+    // ).toEqual(
+    //   esKuery.fromKueryExpression(
+    //     `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp)))`
+    //  )
+    // );
   });
 
   test('constructs filter for multiple alert types across authorized consumer', async () => {
@@ -119,11 +124,14 @@ describe('asFiltersByAlertTypeAndConsumer', () => {
           },
         ])
       )
-    ).toEqual(
-      esKuery.fromKueryExpression(
-        `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:myOtherAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:mySecondAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)))`
-      )
-    );
+    ).toMatchSnapshot();
+    // TODO: once issue https://github.com/elastic/kibana/issues/89473 is
+    // resolved, we can start using this code again, instead of toMatchSnapshot():
+    // ).toEqual(
+    //   esKuery.fromKueryExpression(
+    //     `((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:myOtherAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:mySecondAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)))`
+    //   )
+    // );
   });
 });
 

From cb16a5c042d34facb22563aeda09a789f0c95943 Mon Sep 17 00:00:00 2001
From: Jen Huang <its.jenetic@gmail.com>
Date: Mon, 1 Feb 2021 09:24:12 -0800
Subject: [PATCH 5/8] [Fleet] Update data streams mappings directly instead of
 against backing indices (#89660)

* Update data streams mappings directly instead of querying for backing indices, update integration tests to test with multiple namespaces

* Add flag to only update mappings of the current write index

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../epm/elasticsearch/template/template.ts    |  99 ++++--------
 .../apis/epm/data_stream.ts                   | 148 ++++++++++--------
 2 files changed, 112 insertions(+), 135 deletions(-)

diff --git a/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts b/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts
index e1fa2a0b18b59..95f9997645176 100644
--- a/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts
+++ b/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts
@@ -11,7 +11,6 @@ import {
   TemplateRef,
   IndexTemplate,
   IndexTemplateMappings,
-  DataType,
 } from '../../../../types';
 import { getRegistryDataStreamAssetBaseName } from '../index';
 
@@ -26,8 +25,8 @@ interface MultiFields {
 export interface IndexTemplateMapping {
   [key: string]: any;
 }
-export interface CurrentIndex {
-  indexName: string;
+export interface CurrentDataStream {
+  dataStreamName: string;
   indexTemplate: IndexTemplate;
 }
 const DEFAULT_SCALING_FACTOR = 1000;
@@ -348,33 +347,31 @@ export const updateCurrentWriteIndices = async (
 ): Promise<void> => {
   if (!templates.length) return;
 
-  const allIndices = await queryIndicesFromTemplates(callCluster, templates);
+  const allIndices = await queryDataStreamsFromTemplates(callCluster, templates);
   if (!allIndices.length) return;
-  return updateAllIndices(allIndices, callCluster);
+  return updateAllDataStreams(allIndices, callCluster);
 };
 
-function isCurrentIndex(item: CurrentIndex[] | undefined): item is CurrentIndex[] {
+function isCurrentDataStream(item: CurrentDataStream[] | undefined): item is CurrentDataStream[] {
   return item !== undefined;
 }
 
-const queryIndicesFromTemplates = async (
+const queryDataStreamsFromTemplates = async (
   callCluster: CallESAsCurrentUser,
   templates: TemplateRef[]
-): Promise<CurrentIndex[]> => {
-  const indexPromises = templates.map((template) => {
-    return getIndices(callCluster, template);
+): Promise<CurrentDataStream[]> => {
+  const dataStreamPromises = templates.map((template) => {
+    return getDataStreams(callCluster, template);
   });
-  const indexObjects = await Promise.all(indexPromises);
-  return indexObjects.filter(isCurrentIndex).flat();
+  const dataStreamObjects = await Promise.all(dataStreamPromises);
+  return dataStreamObjects.filter(isCurrentDataStream).flat();
 };
 
-const getIndices = async (
+const getDataStreams = async (
   callCluster: CallESAsCurrentUser,
   template: TemplateRef
-): Promise<CurrentIndex[] | undefined> => {
+): Promise<CurrentDataStream[] | undefined> => {
   const { templateName, indexTemplate } = template;
-  // Until ES provides a way to update mappings of a data stream
-  // get the last index of the data stream, which is the current write index
   const res = await callCluster('transport.request', {
     method: 'GET',
     path: `/_data_stream/${templateName}-*`,
@@ -382,26 +379,28 @@ const getIndices = async (
   const dataStreams = res.data_streams;
   if (!dataStreams.length) return;
   return dataStreams.map((dataStream: any) => ({
-    indexName: dataStream.indices[dataStream.indices.length - 1].index_name,
+    dataStreamName: dataStream.name,
     indexTemplate,
   }));
 };
 
-const updateAllIndices = async (
-  indexNameWithTemplates: CurrentIndex[],
+const updateAllDataStreams = async (
+  indexNameWithTemplates: CurrentDataStream[],
   callCluster: CallESAsCurrentUser
 ): Promise<void> => {
-  const updateIndexPromises = indexNameWithTemplates.map(({ indexName, indexTemplate }) => {
-    return updateExistingIndex({ indexName, callCluster, indexTemplate });
-  });
-  await Promise.all(updateIndexPromises);
+  const updatedataStreamPromises = indexNameWithTemplates.map(
+    ({ dataStreamName, indexTemplate }) => {
+      return updateExistingDataStream({ dataStreamName, callCluster, indexTemplate });
+    }
+  );
+  await Promise.all(updatedataStreamPromises);
 };
-const updateExistingIndex = async ({
-  indexName,
+const updateExistingDataStream = async ({
+  dataStreamName,
   callCluster,
   indexTemplate,
 }: {
-  indexName: string;
+  dataStreamName: string;
   callCluster: CallESAsCurrentUser;
   indexTemplate: IndexTemplate;
 }) => {
@@ -416,53 +415,13 @@ const updateExistingIndex = async ({
   // try to update the mappings first
   try {
     await callCluster('indices.putMapping', {
-      index: indexName,
+      index: dataStreamName,
       body: mappings,
+      write_index_only: true,
     });
     // if update fails, rollover data stream
   } catch (err) {
     try {
-      // get the data_stream values to compose datastream name
-      const searchDataStreamFieldsResponse = await callCluster('search', {
-        index: indexTemplate.index_patterns[0],
-        body: {
-          size: 1,
-          _source: ['data_stream.namespace', 'data_stream.type', 'data_stream.dataset'],
-          query: {
-            bool: {
-              filter: [
-                {
-                  exists: {
-                    field: 'data_stream.type',
-                  },
-                },
-                {
-                  exists: {
-                    field: 'data_stream.dataset',
-                  },
-                },
-                {
-                  exists: {
-                    field: 'data_stream.namespace',
-                  },
-                },
-              ],
-            },
-          },
-        },
-      });
-      if (searchDataStreamFieldsResponse.hits.total.value === 0)
-        throw new Error('data_stream fields are missing from datastream indices');
-      const {
-        dataset,
-        namespace,
-        type,
-      }: {
-        dataset: string;
-        namespace: string;
-        type: DataType;
-      } = searchDataStreamFieldsResponse.hits.hits[0]._source.data_stream;
-      const dataStreamName = `${type}-${dataset}-${namespace}`;
       const path = `/${dataStreamName}/_rollover`;
       await callCluster('transport.request', {
         method: 'POST',
@@ -478,10 +437,10 @@ const updateExistingIndex = async ({
   if (!settings.index.default_pipeline) return;
   try {
     await callCluster('indices.putSettings', {
-      index: indexName,
+      index: dataStreamName,
       body: { index: { default_pipeline: settings.index.default_pipeline } },
     });
   } catch (err) {
-    throw new Error(`could not update index template settings for ${indexName}`);
+    throw new Error(`could not update index template settings for ${dataStreamName}`);
   }
 };
diff --git a/x-pack/test/fleet_api_integration/apis/epm/data_stream.ts b/x-pack/test/fleet_api_integration/apis/epm/data_stream.ts
index 574ff6dd615ad..a43f51a1655e5 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/data_stream.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/data_stream.ts
@@ -12,8 +12,6 @@ export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
   const es = getService('es');
-  const dockerServers = getService('dockerServers');
-  const server = dockerServers.get('registry');
   const pkgName = 'datastreams';
   const pkgVersion = '0.1.0';
   const pkgUpdateVersion = '0.2.0';
@@ -21,6 +19,7 @@ export default function (providerContext: FtrProviderContext) {
   const pkgUpdateKey = `${pkgName}-${pkgUpdateVersion}`;
   const logsTemplateName = `logs-${pkgName}.test_logs`;
   const metricsTemplateName = `metrics-${pkgName}.test_metrics`;
+  const namespaces = ['default', 'foo', 'bar'];
 
   const uninstallPackage = async (pkg: string) => {
     await supertest.delete(`/api/fleet/epm/packages/${pkg}`).set('kbn-xsrf', 'xxxx');
@@ -35,86 +34,105 @@ export default function (providerContext: FtrProviderContext) {
 
   describe('datastreams', async () => {
     skipIfNoDockerRegistry(providerContext);
+
     beforeEach(async () => {
       await installPackage(pkgKey);
-      await es.transport.request({
-        method: 'POST',
-        path: `/${logsTemplateName}-default/_doc`,
-        body: {
-          '@timestamp': '2015-01-01',
-          logs_test_name: 'test',
-          data_stream: {
-            dataset: `${pkgName}.test_logs`,
-            namespace: 'default',
-            type: 'logs',
-          },
-        },
-      });
-      await es.transport.request({
-        method: 'POST',
-        path: `/${metricsTemplateName}-default/_doc`,
-        body: {
-          '@timestamp': '2015-01-01',
-          logs_test_name: 'test',
-          data_stream: {
-            dataset: `${pkgName}.test_metrics`,
-            namespace: 'default',
-            type: 'metrics',
-          },
-        },
-      });
+      await Promise.all(
+        namespaces.map(async (namespace) => {
+          const createLogsRequest = es.transport.request({
+            method: 'POST',
+            path: `/${logsTemplateName}-${namespace}/_doc`,
+            body: {
+              '@timestamp': '2015-01-01',
+              logs_test_name: 'test',
+              data_stream: {
+                dataset: `${pkgName}.test_logs`,
+                namespace,
+                type: 'logs',
+              },
+            },
+          });
+          const createMetricsRequest = es.transport.request({
+            method: 'POST',
+            path: `/${metricsTemplateName}-${namespace}/_doc`,
+            body: {
+              '@timestamp': '2015-01-01',
+              logs_test_name: 'test',
+              data_stream: {
+                dataset: `${pkgName}.test_metrics`,
+                namespace,
+                type: 'metrics',
+              },
+            },
+          });
+          return Promise.all([createLogsRequest, createMetricsRequest]);
+        })
+      );
     });
+
     afterEach(async () => {
-      if (!server.enabled) return;
-      await es.transport.request({
-        method: 'DELETE',
-        path: `/_data_stream/${logsTemplateName}-default`,
-      });
-      await es.transport.request({
-        method: 'DELETE',
-        path: `/_data_stream/${metricsTemplateName}-default`,
-      });
+      await Promise.all(
+        namespaces.map(async (namespace) => {
+          const deleteLogsRequest = es.transport.request({
+            method: 'DELETE',
+            path: `/_data_stream/${logsTemplateName}-${namespace}`,
+          });
+          const deleteMetricsRequest = es.transport.request({
+            method: 'DELETE',
+            path: `/_data_stream/${metricsTemplateName}-${namespace}`,
+          });
+          return Promise.all([deleteLogsRequest, deleteMetricsRequest]);
+        })
+      );
       await uninstallPackage(pkgKey);
       await uninstallPackage(pkgUpdateKey);
     });
+
     it('should list the logs and metrics datastream', async function () {
-      const resLogsDatastream = await es.transport.request({
-        method: 'GET',
-        path: `/_data_stream/${logsTemplateName}-default`,
-      });
-      const resMetricsDatastream = await es.transport.request({
-        method: 'GET',
-        path: `/_data_stream/${metricsTemplateName}-default`,
+      namespaces.forEach(async (namespace) => {
+        const resLogsDatastream = await es.transport.request({
+          method: 'GET',
+          path: `/_data_stream/${logsTemplateName}-${namespace}`,
+        });
+        const resMetricsDatastream = await es.transport.request({
+          method: 'GET',
+          path: `/_data_stream/${metricsTemplateName}-${namespace}`,
+        });
+        expect(resLogsDatastream.body.data_streams.length).equal(1);
+        expect(resLogsDatastream.body.data_streams[0].indices.length).equal(1);
+        expect(resMetricsDatastream.body.data_streams.length).equal(1);
+        expect(resMetricsDatastream.body.data_streams[0].indices.length).equal(1);
       });
-      expect(resLogsDatastream.body.data_streams.length).equal(1);
-      expect(resLogsDatastream.body.data_streams[0].indices.length).equal(1);
-      expect(resMetricsDatastream.body.data_streams.length).equal(1);
-      expect(resMetricsDatastream.body.data_streams[0].indices.length).equal(1);
     });
 
     it('after update, it should have rolled over logs datastream because mappings are not compatible and not metrics', async function () {
       await installPackage(pkgUpdateKey);
-      const resLogsDatastream = await es.transport.request({
-        method: 'GET',
-        path: `/_data_stream/${logsTemplateName}-default`,
-      });
-      const resMetricsDatastream = await es.transport.request({
-        method: 'GET',
-        path: `/_data_stream/${metricsTemplateName}-default`,
+      namespaces.forEach(async (namespace) => {
+        const resLogsDatastream = await es.transport.request({
+          method: 'GET',
+          path: `/_data_stream/${logsTemplateName}-${namespace}`,
+        });
+        const resMetricsDatastream = await es.transport.request({
+          method: 'GET',
+          path: `/_data_stream/${metricsTemplateName}-${namespace}`,
+        });
+        expect(resLogsDatastream.body.data_streams[0].indices.length).equal(2);
+        expect(resMetricsDatastream.body.data_streams[0].indices.length).equal(1);
       });
-      expect(resLogsDatastream.body.data_streams[0].indices.length).equal(2);
-      expect(resMetricsDatastream.body.data_streams[0].indices.length).equal(1);
     });
+
     it('should be able to upgrade a package after a rollover', async function () {
-      await es.transport.request({
-        method: 'POST',
-        path: `/${logsTemplateName}-default/_rollover`,
-      });
-      const resLogsDatastream = await es.transport.request({
-        method: 'GET',
-        path: `/_data_stream/${logsTemplateName}-default`,
+      namespaces.forEach(async (namespace) => {
+        await es.transport.request({
+          method: 'POST',
+          path: `/${logsTemplateName}-${namespace}/_rollover`,
+        });
+        const resLogsDatastream = await es.transport.request({
+          method: 'GET',
+          path: `/_data_stream/${logsTemplateName}-${namespace}`,
+        });
+        expect(resLogsDatastream.body.data_streams[0].indices.length).equal(2);
       });
-      expect(resLogsDatastream.body.data_streams[0].indices.length).equal(2);
       await installPackage(pkgUpdateKey);
     });
   });

From 9787911c5fa23acc096ad925bd2b6b883c38877b Mon Sep 17 00:00:00 2001
From: "Christiane (Tina) Heiligers" <christiane.heiligers@elastic.co>
Date: Mon, 1 Feb 2021 10:26:33 -0700
Subject: [PATCH 6/8] Migrates ingest_pipelines to a TS project ref (#89505)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../add_docs_accordion.scss}                  |  0
 .../add_docs_accordion.tsx}                   |  2 +-
 .../index.ts                                  |  2 +-
 .../tab_documents/tab_documents.tsx           |  2 +-
 x-pack/plugins/ingest_pipelines/tsconfig.json | 28 +++++++++++++++++++
 x-pack/test/tsconfig.json                     |  1 +
 x-pack/tsconfig.json                          |  6 ++++
 x-pack/tsconfig.refs.json                     | 11 ++++++++
 8 files changed, 49 insertions(+), 3 deletions(-)
 rename x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/{add_documents_accordion/add_documents_accordion.scss => add_docs_accordion/add_docs_accordion.scss} (100%)
 rename x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/{add_documents_accordion/add_documents_accordion.tsx => add_docs_accordion/add_docs_accordion.tsx} (98%)
 rename x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/{add_documents_accordion => add_docs_accordion}/index.ts (78%)
 create mode 100644 x-pack/plugins/ingest_pipelines/tsconfig.json

diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/add_documents_accordion.scss b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/add_docs_accordion.scss
similarity index 100%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/add_documents_accordion.scss
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/add_docs_accordion.scss
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/add_documents_accordion.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/add_docs_accordion.tsx
similarity index 98%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/add_documents_accordion.tsx
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/add_docs_accordion.tsx
index 9519d849e5d90..cbbd032f25b3d 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/add_documents_accordion.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/add_docs_accordion.tsx
@@ -15,7 +15,7 @@ import { useKibana } from '../../../../../../../../shared_imports';
 import { useIsMounted } from '../../../../../use_is_mounted';
 import { AddDocumentForm } from '../add_document_form';
 
-import './add_documents_accordion.scss';
+import './add_docs_accordion.scss';
 
 const DISCOVER_URL_GENERATOR_ID = 'DISCOVER_APP_URL_GENERATOR';
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/index.ts
similarity index 78%
rename from x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/index.ts
rename to x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/index.ts
index cb00ec640b5a6..5f7939690fa55 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_documents_accordion/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/add_docs_accordion/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { AddDocumentsAccordion } from './add_documents_accordion';
+export { AddDocumentsAccordion } from './add_docs_accordion';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/tab_documents.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/tab_documents.tsx
index 6888f947b8606..dccc343e9359c 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/tab_documents.tsx
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/tab_documents/tab_documents.tsx
@@ -23,7 +23,7 @@ import {
   Form,
 } from '../../../../../../../shared_imports';
 import { Document } from '../../../../types';
-import { AddDocumentsAccordion } from './add_documents_accordion';
+import { AddDocumentsAccordion } from './add_docs_accordion';
 import { ResetDocumentsModal } from './reset_documents_modal';
 
 import './tab_documents.scss';
diff --git a/x-pack/plugins/ingest_pipelines/tsconfig.json b/x-pack/plugins/ingest_pipelines/tsconfig.json
new file mode 100644
index 0000000000000..5d78992600e81
--- /dev/null
+++ b/x-pack/plugins/ingest_pipelines/tsconfig.json
@@ -0,0 +1,28 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "outDir": "./target/types",
+    "emitDeclarationOnly": true,
+    "declaration": true,
+    "declarationMap": true
+  },
+  "include": [
+    "common/**/*",
+    "public/**/*",
+    "server/**/*",
+    "__jest__/**/*",
+    "../../typings/**/*"
+  ],
+  "references": [
+    { "path": "../../../src/core/tsconfig.json" },
+    { "path": "../licensing/tsconfig.json" },
+    { "path": "../features/tsconfig.json" },
+    { "path": "../security/tsconfig.json" },
+    { "path": "../../../src/plugins/es_ui_shared/tsconfig.json"},
+    { "path": "../../../src/plugins/kibana_react/tsconfig.json"},
+    { "path": "../../../src/plugins/management/tsconfig.json"},
+    { "path": "../../../src/plugins/share/tsconfig.json"},
+    { "path": "../../../src/plugins/usage_collection/tsconfig.json"},
+  ]
+}
diff --git a/x-pack/test/tsconfig.json b/x-pack/test/tsconfig.json
index 12cd2896faaa8..783315b36efaf 100644
--- a/x-pack/test/tsconfig.json
+++ b/x-pack/test/tsconfig.json
@@ -61,6 +61,7 @@
     { "path": "../plugins/cloud/tsconfig.json" },
     { "path": "../plugins/saved_objects_tagging/tsconfig.json" },
     { "path": "../plugins/global_search_bar/tsconfig.json" },
+    { "path": "../plugins/ingest_pipelines/tsconfig.json" },
     { "path": "../plugins/license_management/tsconfig.json" },
     { "path": "../plugins/painless_lab/tsconfig.json" },
     { "path": "../plugins/watcher/tsconfig.json" }
diff --git a/x-pack/tsconfig.json b/x-pack/tsconfig.json
index 85e285f3c83ac..c93bc2c5bd181 100644
--- a/x-pack/tsconfig.json
+++ b/x-pack/tsconfig.json
@@ -40,6 +40,7 @@
     "plugins/cloud/**/*",
     "plugins/saved_objects_tagging/**/*",
     "plugins/global_search_bar/**/*",
+    "plugins/ingest_pipelines/**/*",
     "plugins/license_management/**/*",
     "plugins/painless_lab/**/*",
     "plugins/watcher/**/*",
@@ -115,6 +116,11 @@
     { "path": "./plugins/task_manager/tsconfig.json" },
     { "path": "./plugins/telemetry_collection_xpack/tsconfig.json" },
     { "path": "./plugins/translations/tsconfig.json" },
+    { "path": "./plugins/triggers_actions_ui/tsconfig.json"},
+    { "path": "./plugins/stack_alerts/tsconfig.json"},
+    { "path": "./plugins/ingest_pipelines/tsconfig.json"},
+    { "path": "./plugins/license_management/tsconfig.json" },
+    { "path": "./plugins/painless_lab/tsconfig.json" },
     { "path": "./plugins/triggers_actions_ui/tsconfig.json" },
     { "path": "./plugins/ui_actions_enhanced/tsconfig.json" },
     { "path": "./plugins/watcher/tsconfig.json" }
diff --git a/x-pack/tsconfig.refs.json b/x-pack/tsconfig.refs.json
index ed209cd241586..eff35147a1da9 100644
--- a/x-pack/tsconfig.refs.json
+++ b/x-pack/tsconfig.refs.json
@@ -36,6 +36,17 @@
     { "path": "./plugins/telemetry_collection_xpack/tsconfig.json" },
     { "path": "./plugins/translations/tsconfig.json" },
     { "path": "./plugins/triggers_actions_ui/tsconfig.json"},
+    { "path": "./plugins/spaces/tsconfig.json" },
+    { "path": "./plugins/security/tsconfig.json" },
+    { "path": "./plugins/stack_alerts/tsconfig.json"},
+    { "path": "./plugins/encrypted_saved_objects/tsconfig.json" },
+    { "path": "./plugins/beats_management/tsconfig.json" },
+    { "path": "./plugins/cloud/tsconfig.json" },
+    { "path": "./plugins/saved_objects_tagging/tsconfig.json" },
+    { "path": "./plugins/global_search_bar/tsconfig.json" },
+    { "path": "./plugins/ingest_pipelines/tsconfig.json" },
+    { "path": "./plugins/license_management/tsconfig.json" },
+    { "path": "./plugins/painless_lab/tsconfig.json" },
     { "path": "./plugins/ui_actions_enhanced/tsconfig.json" },
     { "path": "./plugins/watcher/tsconfig.json" }
   ]

From 16500d89c247f8ab3c773fe901b7f3743587e1b9 Mon Sep 17 00:00:00 2001
From: Sandra Gonzales <neptunian@users.noreply.github.com>
Date: Mon, 1 Feb 2021 12:27:36 -0500
Subject: [PATCH 7/8] [Metrics UI] remove middle number in legend and adjust
 calculation of max number (#89020)

* get midpoint of max and min instead of half of max number

* remove middle tick from stepped gradient legend

* use value instead of max values to calculate bounds

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../waffle/stepped_gradient_legend.tsx         |  5 ++---
 .../lib/calculate_bounds_from_nodes.test.ts    |  4 ++--
 .../lib/calculate_bounds_from_nodes.ts         | 18 ++++++------------
 3 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/stepped_gradient_legend.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/stepped_gradient_legend.tsx
index ed34a32012bd2..71cfab79ba0cc 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/stepped_gradient_legend.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/stepped_gradient_legend.tsx
@@ -16,13 +16,12 @@ interface Props {
   bounds: InfraWaffleMapBounds;
   formatter: InfraFormatter;
 }
-
+type TickValue = 0 | 1;
 export const SteppedGradientLegend: React.FC<Props> = ({ legend, bounds, formatter }) => {
   return (
     <LegendContainer>
       <Ticks>
         <TickLabel value={0} bounds={bounds} formatter={formatter} />
-        <TickLabel value={0.5} bounds={bounds} formatter={formatter} />
         <TickLabel value={1} bounds={bounds} formatter={formatter} />
       </Ticks>
       <GradientContainer>
@@ -39,7 +38,7 @@ export const SteppedGradientLegend: React.FC<Props> = ({ legend, bounds, formatt
 
 interface TickProps {
   bounds: InfraWaffleMapBounds;
-  value: number;
+  value: TickValue;
   formatter: InfraFormatter;
 }
 
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.test.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.test.ts
index 49f4b56532936..9f1c2f90635a3 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.test.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.test.ts
@@ -37,14 +37,14 @@ describe('calculateBoundsFromNodes', () => {
     const bounds = calculateBoundsFromNodes(nodes);
     expect(bounds).toEqual({
       min: 0.2,
-      max: 1.5,
+      max: 0.5,
     });
   });
   it('should have a minimum of 0 for only a single node', () => {
     const bounds = calculateBoundsFromNodes([nodes[0]]);
     expect(bounds).toEqual({
       min: 0,
-      max: 1.5,
+      max: 0.5,
     });
   });
   it('should return zero for empty nodes', () => {
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.ts
index 6eb64971efbd7..ff1093a795a10 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/calculate_bounds_from_nodes.ts
@@ -9,23 +9,17 @@ import { SnapshotNode } from '../../../../../common/http_api/snapshot_api';
 import { InfraWaffleMapBounds } from '../../../../lib/lib';
 
 export const calculateBoundsFromNodes = (nodes: SnapshotNode[]): InfraWaffleMapBounds => {
-  const maxValues = nodes.map((node) => {
+  const values = nodes.map((node) => {
     const metric = first(node.metrics);
-    if (!metric) return 0;
-    return metric.max;
-  });
-  const minValues = nodes.map((node) => {
-    const metric = first(node.metrics);
-    if (!metric) return 0;
-    return metric.value;
+    return !metric || !metric.value ? 0 : metric.value;
   });
   // if there is only one value then we need to set the bottom range to zero for min
   // otherwise the legend will look silly since both values are the same for top and
   // bottom.
-  if (minValues.length === 1) {
-    minValues.unshift(0);
+  if (values.length === 1) {
+    values.unshift(0);
   }
-  const maxValue = max(maxValues) || 0;
-  const minValue = min(minValues) || 0;
+  const maxValue = max(values) || 0;
+  const minValue = min(values) || 0;
   return { min: isFinite(minValue) ? minValue : 0, max: isFinite(maxValue) ? maxValue : 0 };
 };

From 391ab72be158217b266b25b163ceaf12eb0f9581 Mon Sep 17 00:00:00 2001
From: Thomas Neirynck <thomas@elastic.co>
Date: Mon, 1 Feb 2021 12:43:03 -0500
Subject: [PATCH 8/8] [Maps] Add table source for choropleth mapping (#89263)

---
 .../VisitorBreakdownMap/useLayerList.ts       |   5 +-
 x-pack/plugins/maps/common/constants.ts       |   1 +
 .../layer_descriptor_types.ts                 |   4 +-
 .../source_descriptor_types.ts                |  24 +-
 .../migrations/add_type_to_termjoin.test.ts   |  45 ++++
 .../common/migrations/add_type_to_termjoin.ts |  48 ++++
 ...{geojson_file_field.ts => inline_field.ts} |   7 +-
 .../public/classes/joins/inner_join.test.js   |   2 +
 .../maps/public/classes/joins/inner_join.ts   |  50 ++--
 .../maps/public/classes/layers/layer.test.ts  |  10 +-
 .../maps/public/classes/layers/layer.tsx      |  14 +-
 .../layers/vector_layer/vector_layer.tsx      |   9 +-
 .../sources/es_agg_source/es_agg_source.ts    |   6 -
 .../sources/es_term_source/es_term_source.ts  |  10 +-
 .../geojson_file_source.ts                    |  14 +-
 .../classes/sources/table_source/index.ts     |   7 +
 .../sources/table_source/table_source.test.ts | 200 ++++++++++++++++
 .../sources/table_source/table_source.ts      | 218 ++++++++++++++++++
 .../classes/sources/term_join_source/index.ts |   7 +
 .../term_join_source/term_join_source.ts      |  33 +++
 .../properties/dynamic_style_property.tsx     |   2 +-
 .../classes/styles/vector/vector_style.tsx    |   8 +-
 .../layer_panel/join_editor/join_editor.tsx   |  34 +--
 .../layer_panel/join_editor/resources/join.js |   2 +
 .../sample_data/ecommerce_saved_objects.js    |   4 +
 .../sample_data/web_logs_saved_objects.js     |   1 +
 .../maps/server/saved_objects/migrations.js   |   9 +
 .../api_integration/apis/maps/migrations.js   |   2 +-
 28 files changed, 708 insertions(+), 68 deletions(-)
 create mode 100644 x-pack/plugins/maps/common/migrations/add_type_to_termjoin.test.ts
 create mode 100644 x-pack/plugins/maps/common/migrations/add_type_to_termjoin.ts
 rename x-pack/plugins/maps/public/classes/fields/{geojson_file_field.ts => inline_field.ts} (80%)
 create mode 100644 x-pack/plugins/maps/public/classes/sources/table_source/index.ts
 create mode 100644 x-pack/plugins/maps/public/classes/sources/table_source/table_source.test.ts
 create mode 100644 x-pack/plugins/maps/public/classes/sources/table_source/table_source.ts
 create mode 100644 x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts
 create mode 100644 x-pack/plugins/maps/public/classes/sources/term_join_source/term_join_source.ts

diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts
index c8bbe599ca44f..3ff6686138e9a 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts
@@ -16,6 +16,7 @@ import {
   COLOR_MAP_TYPE,
   FIELD_ORIGIN,
   LABEL_BORDER_SIZES,
+  SOURCE_TYPES,
   STYLE_TYPE,
   SYMBOLIZE_AS_TYPES,
 } from '../../../../../../maps/common/constants';
@@ -29,7 +30,7 @@ import {
 import { TRANSACTION_PAGE_LOAD } from '../../../../../common/transaction_types';
 
 const ES_TERM_SOURCE_COUNTRY: ESTermSourceDescriptor = {
-  type: 'ES_TERM_SOURCE',
+  type: SOURCE_TYPES.ES_TERM_SOURCE,
   id: '3657625d-17b0-41ef-99ba-3a2b2938655c',
   indexPatternTitle: 'apm-*',
   term: 'client.geo.country_iso_code',
@@ -46,7 +47,7 @@ const ES_TERM_SOURCE_COUNTRY: ESTermSourceDescriptor = {
 };
 
 const ES_TERM_SOURCE_REGION: ESTermSourceDescriptor = {
-  type: 'ES_TERM_SOURCE',
+  type: SOURCE_TYPES.ES_TERM_SOURCE,
   id: 'e62a1b9c-d7ff-4fd4-a0f6-0fdc44bb9e41',
   indexPatternTitle: 'apm-*',
   term: 'client.geo.region_iso_code',
diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index b86d48bfccdab..c8db433a37235 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -85,6 +85,7 @@ export enum SOURCE_TYPES {
   REGIONMAP_FILE = 'REGIONMAP_FILE',
   GEOJSON_FILE = 'GEOJSON_FILE',
   MVT_SINGLE_LAYER = 'MVT_SINGLE_LAYER',
+  TABLE_SOURCE = 'TABLE_SOURCE',
 }
 
 export enum FIELD_ORIGIN {
diff --git a/x-pack/plugins/maps/common/descriptor_types/layer_descriptor_types.ts b/x-pack/plugins/maps/common/descriptor_types/layer_descriptor_types.ts
index b67f05cb169fd..65cc145e20c89 100644
--- a/x-pack/plugins/maps/common/descriptor_types/layer_descriptor_types.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/layer_descriptor_types.ts
@@ -8,11 +8,11 @@
 import { Query } from 'src/plugins/data/public';
 import { StyleDescriptor, VectorStyleDescriptor } from './style_property_descriptor_types';
 import { DataRequestDescriptor } from './data_request_descriptor_types';
-import { AbstractSourceDescriptor, ESTermSourceDescriptor } from './source_descriptor_types';
+import { AbstractSourceDescriptor, TermJoinSourceDescriptor } from './source_descriptor_types';
 
 export type JoinDescriptor = {
   leftField?: string;
-  right: ESTermSourceDescriptor;
+  right: TermJoinSourceDescriptor;
 };
 
 export type LayerDescriptor = {
diff --git a/x-pack/plugins/maps/common/descriptor_types/source_descriptor_types.ts b/x-pack/plugins/maps/common/descriptor_types/source_descriptor_types.ts
index b849b42429cf6..dca7ae766f375 100644
--- a/x-pack/plugins/maps/common/descriptor_types/source_descriptor_types.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/source_descriptor_types.ts
@@ -8,7 +8,14 @@
 import { FeatureCollection } from 'geojson';
 import { Query } from 'src/plugins/data/public';
 import { SortDirection } from 'src/plugins/data/common/search';
-import { AGG_TYPE, GRID_RESOLUTION, RENDER_AS, SCALING_TYPES, MVT_FIELD_TYPE } from '../constants';
+import {
+  AGG_TYPE,
+  GRID_RESOLUTION,
+  RENDER_AS,
+  SCALING_TYPES,
+  MVT_FIELD_TYPE,
+  SOURCE_TYPES,
+} from '../constants';
 
 export type AttributionDescriptor = {
   attributionText?: string;
@@ -105,6 +112,7 @@ export type ESTermSourceDescriptor = AbstractESAggSourceDescriptor & {
   term: string; // term field name
   whereQuery?: Query;
   size?: number;
+  type: SOURCE_TYPES.ES_TERM_SOURCE;
 };
 
 export type KibanaRegionmapSourceDescriptor = AbstractSourceDescriptor & {
@@ -156,14 +164,24 @@ export type TiledSingleLayerVectorSourceDescriptor = AbstractSourceDescriptor &
     tooltipProperties: string[];
   };
 
-export type GeoJsonFileFieldDescriptor = {
+export type InlineFieldDescriptor = {
   name: string;
   type: 'string' | 'number';
 };
 
 export type GeojsonFileSourceDescriptor = {
-  __fields?: GeoJsonFileFieldDescriptor[];
+  __fields?: InlineFieldDescriptor[];
   __featureCollection: FeatureCollection;
   name: string;
   type: string;
 };
+
+export type TableSourceDescriptor = {
+  id: string;
+  type: SOURCE_TYPES.TABLE_SOURCE;
+  __rows: Array<{ [key: string]: string | number }>;
+  __columns: InlineFieldDescriptor[];
+  term: string;
+};
+
+export type TermJoinSourceDescriptor = ESTermSourceDescriptor | TableSourceDescriptor;
diff --git a/x-pack/plugins/maps/common/migrations/add_type_to_termjoin.test.ts b/x-pack/plugins/maps/common/migrations/add_type_to_termjoin.test.ts
new file mode 100644
index 0000000000000..c9ab4b00d8923
--- /dev/null
+++ b/x-pack/plugins/maps/common/migrations/add_type_to_termjoin.test.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { addTypeToTermJoin } from './add_type_to_termjoin';
+import { LAYER_TYPE, SOURCE_TYPES } from '../constants';
+import { LayerDescriptor } from '../descriptor_types';
+
+describe('addTypeToTermJoin', () => {
+  test('Should handle missing type attribute', () => {
+    const layerListJSON = JSON.stringify(([
+      {
+        type: LAYER_TYPE.VECTOR,
+        joins: [
+          {
+            right: {},
+          },
+          {
+            right: {
+              type: SOURCE_TYPES.TABLE_SOURCE,
+            },
+          },
+          {
+            right: {
+              type: SOURCE_TYPES.ES_TERM_SOURCE,
+            },
+          },
+        ],
+      },
+    ] as unknown) as LayerDescriptor[]);
+
+    const attributes = {
+      title: 'my map',
+      layerListJSON,
+    };
+
+    const { layerListJSON: migratedLayerListJSON } = addTypeToTermJoin({ attributes });
+    const migratedLayerList = JSON.parse(migratedLayerListJSON!);
+    expect(migratedLayerList[0].joins[0].right.type).toEqual(SOURCE_TYPES.ES_TERM_SOURCE);
+    expect(migratedLayerList[0].joins[1].right.type).toEqual(SOURCE_TYPES.TABLE_SOURCE);
+    expect(migratedLayerList[0].joins[2].right.type).toEqual(SOURCE_TYPES.ES_TERM_SOURCE);
+  });
+});
diff --git a/x-pack/plugins/maps/common/migrations/add_type_to_termjoin.ts b/x-pack/plugins/maps/common/migrations/add_type_to_termjoin.ts
new file mode 100644
index 0000000000000..84e13eb6c3947
--- /dev/null
+++ b/x-pack/plugins/maps/common/migrations/add_type_to_termjoin.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MapSavedObjectAttributes } from '../map_saved_object_type';
+import { JoinDescriptor, LayerDescriptor } from '../descriptor_types';
+import { LAYER_TYPE, SOURCE_TYPES } from '../constants';
+
+// enforce type property on joins. It's possible older saved-objects do not have this correctly filled in
+// e.g. sample-data was missing the right.type field.
+// This is just to be safe.
+export function addTypeToTermJoin({
+  attributes,
+}: {
+  attributes: MapSavedObjectAttributes;
+}): MapSavedObjectAttributes {
+  if (!attributes || !attributes.layerListJSON) {
+    return attributes;
+  }
+
+  const layerList: LayerDescriptor[] = JSON.parse(attributes.layerListJSON);
+
+  layerList.forEach((layer: LayerDescriptor) => {
+    if (layer.type !== LAYER_TYPE.VECTOR) {
+      return;
+    }
+
+    if (!layer.joins) {
+      return;
+    }
+    layer.joins.forEach((join: JoinDescriptor) => {
+      if (!join.right) {
+        return;
+      }
+
+      if (typeof join.right.type === 'undefined') {
+        join.right.type = SOURCE_TYPES.ES_TERM_SOURCE;
+      }
+    });
+  });
+
+  return {
+    ...attributes,
+    layerListJSON: JSON.stringify(layerList),
+  };
+}
diff --git a/x-pack/plugins/maps/public/classes/fields/geojson_file_field.ts b/x-pack/plugins/maps/public/classes/fields/inline_field.ts
similarity index 80%
rename from x-pack/plugins/maps/public/classes/fields/geojson_file_field.ts
rename to x-pack/plugins/maps/public/classes/fields/inline_field.ts
index ae42b09d491c5..287edbd07cce8 100644
--- a/x-pack/plugins/maps/public/classes/fields/geojson_file_field.ts
+++ b/x-pack/plugins/maps/public/classes/fields/inline_field.ts
@@ -7,10 +7,9 @@
 import { FIELD_ORIGIN } from '../../../common/constants';
 import { IField, AbstractField } from './field';
 import { IVectorSource } from '../sources/vector_source';
-import { GeoJsonFileSource } from '../sources/geojson_file_source';
 
-export class GeoJsonFileField extends AbstractField implements IField {
-  private readonly _source: GeoJsonFileSource;
+export class InlineField<T extends IVectorSource> extends AbstractField implements IField {
+  private readonly _source: T;
   private readonly _dataType: string;
 
   constructor({
@@ -20,7 +19,7 @@ export class GeoJsonFileField extends AbstractField implements IField {
     dataType,
   }: {
     fieldName: string;
-    source: GeoJsonFileSource;
+    source: T;
     origin: FIELD_ORIGIN;
     dataType: string;
   }) {
diff --git a/x-pack/plugins/maps/public/classes/joins/inner_join.test.js b/x-pack/plugins/maps/public/classes/joins/inner_join.test.js
index ca40ab1ea7db7..bca5954e73d7b 100644
--- a/x-pack/plugins/maps/public/classes/joins/inner_join.test.js
+++ b/x-pack/plugins/maps/public/classes/joins/inner_join.test.js
@@ -5,11 +5,13 @@
  */
 
 import { InnerJoin } from './inner_join';
+import { SOURCE_TYPES } from '../../../common/constants';
 
 jest.mock('../../kibana_services', () => {});
 jest.mock('../layers/vector_layer/vector_layer', () => {});
 
 const rightSource = {
+  type: SOURCE_TYPES.ES_TERM_SOURCE,
   id: 'd3625663-5b34-4d50-a784-0d743f676a0c',
   indexPatternId: '90943e30-9a47-11e8-b64d-95841ca0b247',
   indexPatternTitle: 'kibana_sample_data_logs',
diff --git a/x-pack/plugins/maps/public/classes/joins/inner_join.ts b/x-pack/plugins/maps/public/classes/joins/inner_join.ts
index 32bd767aa94d8..95e163709dff9 100644
--- a/x-pack/plugins/maps/public/classes/joins/inner_join.ts
+++ b/x-pack/plugins/maps/public/classes/joins/inner_join.ts
@@ -9,29 +9,51 @@ import { Feature, GeoJsonProperties } from 'geojson';
 import { ESTermSource } from '../sources/es_term_source';
 import { getComputedFieldNamePrefix } from '../styles/vector/style_util';
 import {
-  META_DATA_REQUEST_ID_SUFFIX,
   FORMATTERS_DATA_REQUEST_ID_SUFFIX,
+  META_DATA_REQUEST_ID_SUFFIX,
+  SOURCE_TYPES,
 } from '../../../common/constants';
-import { JoinDescriptor } from '../../../common/descriptor_types';
+import {
+  ESTermSourceDescriptor,
+  JoinDescriptor,
+  TableSourceDescriptor,
+  TermJoinSourceDescriptor,
+} from '../../../common/descriptor_types';
 import { IVectorSource } from '../sources/vector_source';
 import { IField } from '../fields/field';
 import { PropertiesMap } from '../../../common/elasticsearch_util';
+import { ITermJoinSource } from '../sources/term_join_source';
+import { TableSource } from '../sources/table_source';
+import { Adapters } from '../../../../../../src/plugins/inspector/common/adapters';
+
+function createJoinTermSource(
+  descriptor: Partial<TermJoinSourceDescriptor> | undefined,
+  inspectorAdapters: Adapters | undefined
+): ITermJoinSource | undefined {
+  if (!descriptor) {
+    return;
+  }
+
+  if (
+    descriptor.type === SOURCE_TYPES.ES_TERM_SOURCE &&
+    'indexPatternId' in descriptor &&
+    'term' in descriptor
+  ) {
+    return new ESTermSource(descriptor as ESTermSourceDescriptor, inspectorAdapters);
+  } else if (descriptor.type === SOURCE_TYPES.TABLE_SOURCE) {
+    return new TableSource(descriptor as TableSourceDescriptor, inspectorAdapters);
+  }
+}
 
 export class InnerJoin {
   private readonly _descriptor: JoinDescriptor;
-  private readonly _rightSource?: ESTermSource;
+  private readonly _rightSource?: ITermJoinSource;
   private readonly _leftField?: IField;
 
   constructor(joinDescriptor: JoinDescriptor, leftSource: IVectorSource) {
     this._descriptor = joinDescriptor;
     const inspectorAdapters = leftSource.getInspectorAdapters();
-    if (
-      joinDescriptor.right &&
-      'indexPatternId' in joinDescriptor.right &&
-      'term' in joinDescriptor.right
-    ) {
-      this._rightSource = new ESTermSource(joinDescriptor.right, inspectorAdapters);
-    }
+    this._rightSource = createJoinTermSource(this._descriptor.right, inspectorAdapters);
     this._leftField = joinDescriptor.leftField
       ? leftSource.createField({ fieldName: joinDescriptor.leftField })
       : undefined;
@@ -47,8 +69,8 @@ export class InnerJoin {
     return this._leftField && this._rightSource ? this._rightSource.hasCompleteConfig() : false;
   }
 
-  getJoinFields() {
-    return this._rightSource ? this._rightSource.getMetricFields() : [];
+  getJoinFields(): IField[] {
+    return this._rightSource ? this._rightSource.getRightFields() : [];
   }
 
   // Source request id must be static and unique because the re-fetch logic uses the id to locate the previous request.
@@ -77,7 +99,7 @@ export class InnerJoin {
     if (!feature.properties || !this._leftField || !this._rightSource) {
       return false;
     }
-    const rightMetricFields = this._rightSource.getMetricFields();
+    const rightMetricFields: IField[] = this._rightSource.getRightFields();
     // delete feature properties added by previous join
     for (let j = 0; j < rightMetricFields.length; j++) {
       const metricPropertyKey = rightMetricFields[j].getName();
@@ -106,7 +128,7 @@ export class InnerJoin {
     }
   }
 
-  getRightJoinSource(): ESTermSource {
+  getRightJoinSource(): ITermJoinSource {
     if (!this._rightSource) {
       throw new Error('Cannot get rightSource from InnerJoin with incomplete config');
     }
diff --git a/x-pack/plugins/maps/public/classes/layers/layer.test.ts b/x-pack/plugins/maps/public/classes/layers/layer.test.ts
index e669ddf13e5ac..d8e6a4906a63a 100644
--- a/x-pack/plugins/maps/public/classes/layers/layer.test.ts
+++ b/x-pack/plugins/maps/public/classes/layers/layer.test.ts
@@ -7,7 +7,13 @@
 
 import { AbstractLayer } from './layer';
 import { ISource } from '../sources/source';
-import { AGG_TYPE, FIELD_ORIGIN, LAYER_STYLE_TYPE, VECTOR_STYLES } from '../../../common/constants';
+import {
+  AGG_TYPE,
+  FIELD_ORIGIN,
+  LAYER_STYLE_TYPE,
+  SOURCE_TYPES,
+  VECTOR_STYLES,
+} from '../../../common/constants';
 import { ESTermSourceDescriptor, VectorStyleDescriptor } from '../../../common/descriptor_types';
 import { getDefaultDynamicProperties } from '../styles/vector/vector_style_defaults';
 
@@ -73,7 +79,7 @@ describe('cloneDescriptor', () => {
               indexPatternTitle: 'logs-*',
               metrics: [{ type: AGG_TYPE.COUNT }],
               term: 'myTermField',
-              type: 'joinSource',
+              type: SOURCE_TYPES.ES_TERM_SOURCE,
               applyGlobalQuery: true,
               applyGlobalTime: true,
             },
diff --git a/x-pack/plugins/maps/public/classes/layers/layer.tsx b/x-pack/plugins/maps/public/classes/layers/layer.tsx
index fe13e4f0ac2f6..1596c392e8d63 100644
--- a/x-pack/plugins/maps/public/classes/layers/layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/layer.tsx
@@ -20,11 +20,13 @@ import {
   MB_SOURCE_ID_LAYER_ID_PREFIX_DELIMITER,
   MIN_ZOOM,
   SOURCE_DATA_REQUEST_ID,
+  SOURCE_TYPES,
   STYLE_TYPE,
 } from '../../../common/constants';
 import { copyPersistentState } from '../../reducers/util';
 import {
   AggDescriptor,
+  ESTermSourceDescriptor,
   JoinDescriptor,
   LayerDescriptor,
   MapExtent,
@@ -158,6 +160,14 @@ export class AbstractLayer implements ILayer {
 
     if (clonedDescriptor.joins) {
       clonedDescriptor.joins.forEach((joinDescriptor: JoinDescriptor) => {
+        if (joinDescriptor.right && joinDescriptor.right.type === SOURCE_TYPES.TABLE_SOURCE) {
+          throw new Error(
+            'Cannot clone table-source. Should only be used in MapEmbeddable, not in UX'
+          );
+        }
+        const termSourceDescriptor: ESTermSourceDescriptor = joinDescriptor.right as ESTermSourceDescriptor;
+
+        // todo: must tie this to generic thing
         const originalJoinId = joinDescriptor.right.id!;
 
         // right.id is uuid used to track requests in inspector
@@ -166,8 +176,8 @@ export class AbstractLayer implements ILayer {
         // Update all data driven styling properties using join fields
         if (clonedDescriptor.style && 'properties' in clonedDescriptor.style) {
           const metrics =
-            joinDescriptor.right.metrics && joinDescriptor.right.metrics.length
-              ? joinDescriptor.right.metrics
+            termSourceDescriptor.metrics && termSourceDescriptor.metrics.length
+              ? termSourceDescriptor.metrics
               : [{ type: AGG_TYPE.COUNT }];
           metrics.forEach((metricsDescriptor: AggDescriptor) => {
             const originalJoinKey = getJoinAggKey({
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
index 2304bb277da49..e3a80a4c9eb5d 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/vector_layer.tsx
@@ -63,6 +63,7 @@ import { ITooltipProperty } from '../../tooltips/tooltip_property';
 import { IDynamicStyleProperty } from '../../styles/vector/properties/dynamic_style_property';
 import { IESSource } from '../../sources/es_source';
 import { PropertiesMap } from '../../../../common/elasticsearch_util';
+import { ITermJoinSource } from '../../sources/term_join_source';
 
 interface SourceResult {
   refreshed: boolean;
@@ -574,7 +575,7 @@ export class VectorLayer extends AbstractLayer {
       dynamicStyleProps: this.getCurrentStyle()
         .getDynamicPropertiesArray()
         .filter((dynamicStyleProp) => {
-          const matchingField = joinSource.getMetricFieldForName(dynamicStyleProp.getFieldName());
+          const matchingField = joinSource.getFieldByName(dynamicStyleProp.getFieldName());
           return (
             dynamicStyleProp.getFieldOrigin() === FIELD_ORIGIN.JOIN &&
             !!matchingField &&
@@ -599,7 +600,7 @@ export class VectorLayer extends AbstractLayer {
   }: {
     dataRequestId: string;
     dynamicStyleProps: Array<IDynamicStyleProperty<DynamicStylePropertyOptions>>;
-    source: IVectorSource;
+    source: IVectorSource | ITermJoinSource;
     sourceQuery?: MapQuery;
     style: IVectorStyle;
   } & DataRequestContext) {
@@ -679,7 +680,7 @@ export class VectorLayer extends AbstractLayer {
       fields: style
         .getDynamicPropertiesArray()
         .filter((dynamicStyleProp) => {
-          const matchingField = joinSource.getMetricFieldForName(dynamicStyleProp.getFieldName());
+          const matchingField = joinSource.getFieldByName(dynamicStyleProp.getFieldName());
           return dynamicStyleProp.getFieldOrigin() === FIELD_ORIGIN.JOIN && !!matchingField;
         })
         .map((dynamicStyleProp) => {
@@ -699,7 +700,7 @@ export class VectorLayer extends AbstractLayer {
   }: {
     dataRequestId: string;
     fields: IField[];
-    source: IVectorSource;
+    source: IVectorSource | ITermJoinSource;
   } & DataRequestContext) {
     if (fields.length === 0) {
       return;
diff --git a/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.ts b/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.ts
index 77177dd47a166..5cb299ac33ff8 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_agg_source/es_agg_source.ts
@@ -23,7 +23,6 @@ export interface IESAggSource extends IESSource {
   getAggKey(aggType: AGG_TYPE, fieldName: string): string;
   getAggLabel(aggType: AGG_TYPE, fieldLabel: string): string;
   getMetricFields(): IESAggField[];
-  hasMatchingMetricField(fieldName: string): boolean;
   getMetricFieldForName(fieldName: string): IESAggField | null;
   getValueAggsDsl(indexPattern: IndexPattern): { [key: string]: unknown };
 }
@@ -74,11 +73,6 @@ export abstract class AbstractESAggSource extends AbstractESSource implements IE
     throw new Error('Cannot create a new field from just a fieldname for an es_agg_source.');
   }
 
-  hasMatchingMetricField(fieldName: string): boolean {
-    const matchingField = this.getMetricFieldForName(fieldName);
-    return !!matchingField;
-  }
-
   getMetricFieldForName(fieldName: string): IESAggField | null {
     const targetMetricField = this.getMetricFields().find((metricField: IESAggField) => {
       return metricField.getName() === fieldName;
diff --git a/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.ts b/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.ts
index 235e8e3a651ee..c7107964568c9 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_term_source/es_term_source.ts
@@ -30,6 +30,8 @@ import {
 import { Adapters } from '../../../../../../../src/plugins/inspector/common/adapters';
 import { PropertiesMap } from '../../../../common/elasticsearch_util';
 import { isValidStringConfig } from '../../util/valid_string_config';
+import { ITermJoinSource } from '../term_join_source/term_join_source';
+import { IField } from '../../fields/field';
 
 const TERMS_AGG_NAME = 'join';
 const TERMS_BUCKET_KEYS_TO_IGNORE = ['key', 'doc_count'];
@@ -47,7 +49,7 @@ export function extractPropertiesMap(rawEsData: any, countPropertyName: string):
   return propertiesMap;
 }
 
-export class ESTermSource extends AbstractESAggSource {
+export class ESTermSource extends AbstractESAggSource implements ITermJoinSource {
   static type = SOURCE_TYPES.ES_TERM_SOURCE;
 
   static createDescriptor(descriptor: Partial<ESTermSourceDescriptor>): ESTermSourceDescriptor {
@@ -79,7 +81,7 @@ export class ESTermSource extends AbstractESAggSource {
     });
   }
 
-  hasCompleteConfig() {
+  hasCompleteConfig(): boolean {
     return _.has(this._descriptor, 'indexPatternId') && _.has(this._descriptor, 'term');
   }
 
@@ -174,4 +176,8 @@ export class ESTermSource extends AbstractESAggSource {
         }
       : null;
   }
+
+  getRightFields(): IField[] {
+    return this.getMetricFields();
+  }
 }
diff --git a/x-pack/plugins/maps/public/classes/sources/geojson_file_source/geojson_file_source.ts b/x-pack/plugins/maps/public/classes/sources/geojson_file_source/geojson_file_source.ts
index 69d84dc65d382..35464b24185d0 100644
--- a/x-pack/plugins/maps/public/classes/sources/geojson_file_source/geojson_file_source.ts
+++ b/x-pack/plugins/maps/public/classes/sources/geojson_file_source/geojson_file_source.ts
@@ -8,15 +8,15 @@ import { Feature, FeatureCollection } from 'geojson';
 import { AbstractVectorSource, BoundsFilters, GeoJsonWithMeta } from '../vector_source';
 import { EMPTY_FEATURE_COLLECTION, FIELD_ORIGIN, SOURCE_TYPES } from '../../../../common/constants';
 import {
-  GeoJsonFileFieldDescriptor,
+  InlineFieldDescriptor,
   GeojsonFileSourceDescriptor,
   MapExtent,
 } from '../../../../common/descriptor_types';
 import { registerSource } from '../source_registry';
 import { IField } from '../../fields/field';
 import { getFeatureCollectionBounds } from '../../util/get_feature_collection_bounds';
-import { GeoJsonFileField } from '../../fields/geojson_file_field';
 import { Adapters } from '../../../../../../../src/plugins/inspector/common/adapters';
+import { InlineField } from '../../fields/inline_field';
 
 function getFeatureCollection(
   geoJson: Feature | FeatureCollection | null | undefined
@@ -56,14 +56,14 @@ export class GeoJsonFileSource extends AbstractVectorSource {
     super(normalizedDescriptor, inspectorAdapters);
   }
 
-  _getFields(): GeoJsonFileFieldDescriptor[] {
+  _getFields(): InlineFieldDescriptor[] {
     const fields = (this._descriptor as GeojsonFileSourceDescriptor).__fields;
     return fields ? fields : [];
   }
 
   createField({ fieldName }: { fieldName: string }): IField {
     const fields = this._getFields();
-    const descriptor: GeoJsonFileFieldDescriptor | undefined = fields.find((field) => {
+    const descriptor: InlineFieldDescriptor | undefined = fields.find((field) => {
       return field.name === fieldName;
     });
 
@@ -74,7 +74,7 @@ export class GeoJsonFileSource extends AbstractVectorSource {
         )} `
       );
     }
-    return new GeoJsonFileField({
+    return new InlineField<GeoJsonFileSource>({
       fieldName: descriptor.name,
       source: this,
       origin: FIELD_ORIGIN.SOURCE,
@@ -84,8 +84,8 @@ export class GeoJsonFileSource extends AbstractVectorSource {
 
   async getFields(): Promise<IField[]> {
     const fields = this._getFields();
-    return fields.map((field: GeoJsonFileFieldDescriptor) => {
-      return new GeoJsonFileField({
+    return fields.map((field: InlineFieldDescriptor) => {
+      return new InlineField<GeoJsonFileSource>({
         fieldName: field.name,
         source: this,
         origin: FIELD_ORIGIN.SOURCE,
diff --git a/x-pack/plugins/maps/public/classes/sources/table_source/index.ts b/x-pack/plugins/maps/public/classes/sources/table_source/index.ts
new file mode 100644
index 0000000000000..7258e6b464cd0
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/sources/table_source/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { TableSource } from './table_source';
diff --git a/x-pack/plugins/maps/public/classes/sources/table_source/table_source.test.ts b/x-pack/plugins/maps/public/classes/sources/table_source/table_source.test.ts
new file mode 100644
index 0000000000000..9409eefa4ae07
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/sources/table_source/table_source.test.ts
@@ -0,0 +1,200 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { TableSource } from './table_source';
+import { FIELD_ORIGIN } from '../../../../common/constants';
+import {
+  MapFilters,
+  MapQuery,
+  VectorJoinSourceRequestMeta,
+  VectorSourceSyncMeta,
+} from '../../../../common/descriptor_types';
+
+describe('TableSource', () => {
+  describe('getName', () => {
+    it('should get default display name', async () => {
+      const tableSource = new TableSource({});
+      expect((await tableSource.getDisplayName()).startsWith('table source')).toBe(true);
+    });
+  });
+
+  describe('getPropertiesMap', () => {
+    it('should roll up results', async () => {
+      const tableSource = new TableSource({
+        term: 'iso',
+        __rows: [
+          {
+            iso: 'US',
+            population: 100,
+          },
+          {
+            iso: 'CN',
+            population: 400,
+            foo: 'bar', // ignore this prop, not defined in `__columns`
+          },
+          {
+            // ignore this row, cannot be joined
+            population: 400,
+          },
+          {
+            // row ignored since it's not first row with key 'US'
+            iso: 'US',
+            population: -1,
+          },
+        ],
+        __columns: [
+          {
+            name: 'iso',
+            type: 'string',
+          },
+          {
+            name: 'population',
+            type: 'number',
+          },
+        ],
+      });
+
+      const propertiesMap = await tableSource.getPropertiesMap(
+        ({} as unknown) as VectorJoinSourceRequestMeta,
+        'a',
+        'b',
+        () => {}
+      );
+
+      expect(propertiesMap.size).toEqual(2);
+      expect(propertiesMap.get('US')).toEqual({
+        population: 100,
+      });
+      expect(propertiesMap.get('CN')).toEqual({
+        population: 400,
+      });
+    });
+  });
+
+  describe('getTermField', () => {
+    it('should throw when no match', async () => {
+      const tableSource = new TableSource({
+        term: 'foobar',
+        __columns: [
+          {
+            name: 'iso',
+            type: 'string',
+          },
+          {
+            name: 'population',
+            type: 'number',
+          },
+        ],
+      });
+
+      expect(() => {
+        tableSource.getTermField();
+      }).toThrow();
+    });
+
+    it('should return field', async () => {
+      const tableSource = new TableSource({
+        term: 'iso',
+        __columns: [
+          {
+            name: 'iso',
+            type: 'string',
+          },
+          {
+            name: 'population',
+            type: 'number',
+          },
+        ],
+      });
+
+      const termField = tableSource.getTermField();
+      expect(termField.getName()).toEqual('iso');
+      expect(await termField.getDataType()).toEqual('string');
+    });
+  });
+
+  describe('getRightFields', () => {
+    it('should return columns', async () => {
+      const tableSource = new TableSource({
+        term: 'foobar',
+        __columns: [
+          {
+            name: 'iso',
+            type: 'string',
+          },
+          {
+            name: 'population',
+            type: 'number',
+          },
+        ],
+      });
+
+      const rightFields = tableSource.getRightFields();
+      expect(rightFields[0].getName()).toEqual('iso');
+      expect(await rightFields[0].getDataType()).toEqual('string');
+      expect(rightFields[0].getOrigin()).toEqual(FIELD_ORIGIN.JOIN);
+      expect(rightFields[0].getSource()).toEqual(tableSource);
+
+      expect(rightFields[1].getName()).toEqual('population');
+      expect(await rightFields[1].getDataType()).toEqual('number');
+      expect(rightFields[1].getOrigin()).toEqual(FIELD_ORIGIN.JOIN);
+      expect(rightFields[1].getSource()).toEqual(tableSource);
+    });
+  });
+
+  describe('getFieldByName', () => {
+    it('should return columns', async () => {
+      const tableSource = new TableSource({
+        term: 'foobar',
+        __columns: [
+          {
+            name: 'iso',
+            type: 'string',
+          },
+          {
+            name: 'population',
+            type: 'number',
+          },
+        ],
+      });
+
+      const field = tableSource.getFieldByName('iso');
+      expect(field!.getName()).toEqual('iso');
+      expect(await field!.getDataType()).toEqual('string');
+      expect(field!.getOrigin()).toEqual(FIELD_ORIGIN.JOIN);
+      expect(field!.getSource()).toEqual(tableSource);
+    });
+  });
+
+  describe('getGeoJsonWithMeta', () => {
+    it('should throw - not implemented', async () => {
+      const tableSource = new TableSource({});
+
+      let didThrow = false;
+      try {
+        await tableSource.getGeoJsonWithMeta(
+          'foobar',
+          ({} as unknown) as MapFilters & {
+            applyGlobalQuery: boolean;
+            applyGlobalTime: boolean;
+            fieldNames: string[];
+            geogridPrecision?: number;
+            sourceQuery?: MapQuery;
+            sourceMeta: VectorSourceSyncMeta;
+          },
+          () => {},
+          () => {
+            return false;
+          }
+        );
+      } catch (e) {
+        didThrow = true;
+      } finally {
+        expect(didThrow).toBe(true);
+      }
+    });
+  });
+});
diff --git a/x-pack/plugins/maps/public/classes/sources/table_source/table_source.ts b/x-pack/plugins/maps/public/classes/sources/table_source/table_source.ts
new file mode 100644
index 0000000000000..d157c4f5df60a
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/sources/table_source/table_source.ts
@@ -0,0 +1,218 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import uuid from 'uuid';
+import { FIELD_ORIGIN, SOURCE_TYPES, VECTOR_SHAPE_TYPE } from '../../../../common/constants';
+import {
+  MapExtent,
+  MapFilters,
+  MapQuery,
+  TableSourceDescriptor,
+  VectorJoinSourceRequestMeta,
+  VectorSourceSyncMeta,
+} from '../../../../common/descriptor_types';
+import { Adapters } from '../../../../../../../src/plugins/inspector/common/adapters';
+import { ITermJoinSource } from '../term_join_source';
+import { BucketProperties, PropertiesMap } from '../../../../common/elasticsearch_util';
+import { IField } from '../../fields/field';
+import { Query } from '../../../../../../../src/plugins/data/common/query';
+import {
+  AbstractVectorSource,
+  BoundsFilters,
+  GeoJsonWithMeta,
+  IVectorSource,
+  SourceTooltipConfig,
+} from '../vector_source';
+import { DataRequest } from '../../util/data_request';
+import { InlineField } from '../../fields/inline_field';
+
+export class TableSource extends AbstractVectorSource implements ITermJoinSource, IVectorSource {
+  static type = SOURCE_TYPES.TABLE_SOURCE;
+
+  static createDescriptor(descriptor: Partial<TableSourceDescriptor>): TableSourceDescriptor {
+    return {
+      type: SOURCE_TYPES.TABLE_SOURCE,
+      __rows: descriptor.__rows || [],
+      __columns: descriptor.__columns || [],
+      term: descriptor.term || '',
+      id: descriptor.id || uuid(),
+    };
+  }
+
+  readonly _descriptor: TableSourceDescriptor;
+
+  constructor(descriptor: Partial<TableSourceDescriptor>, inspectorAdapters?: Adapters) {
+    const sourceDescriptor = TableSource.createDescriptor(descriptor);
+    super(sourceDescriptor, inspectorAdapters);
+    this._descriptor = sourceDescriptor;
+  }
+
+  async getDisplayName(): Promise<string> {
+    // no need to localize. this is never rendered.
+    return `table source ${uuid()}`;
+  }
+
+  getSyncMeta(): VectorSourceSyncMeta | null {
+    return null;
+  }
+
+  async getPropertiesMap(
+    searchFilters: VectorJoinSourceRequestMeta,
+    leftSourceName: string,
+    leftFieldName: string,
+    registerCancelCallback: (callback: () => void) => void
+  ): Promise<PropertiesMap> {
+    const propertiesMap: PropertiesMap = new Map<string, BucketProperties>();
+
+    const fieldNames = await this.getFieldNames();
+
+    for (let i = 0; i < this._descriptor.__rows.length; i++) {
+      const row: { [key: string]: string | number } = this._descriptor.__rows[i];
+      let propKey: string | number | undefined;
+      const props: { [key: string]: string | number } = {};
+      for (const key in row) {
+        if (row.hasOwnProperty(key)) {
+          if (key === this._descriptor.term && row[key]) {
+            propKey = row[key];
+          }
+          if (fieldNames.indexOf(key) >= 0 && key !== this._descriptor.term) {
+            props[key] = row[key];
+          }
+        }
+      }
+      if (propKey && !propertiesMap.has(propKey.toString())) {
+        // If propKey is not a primary key in the table, this will favor the first match
+        propertiesMap.set(propKey.toString(), props);
+      }
+    }
+
+    return propertiesMap;
+  }
+
+  getTermField(): IField {
+    const column = this._descriptor.__columns.find((c) => {
+      return c.name === this._descriptor.term;
+    });
+
+    if (!column) {
+      throw new Error(
+        `Cannot find column for ${this._descriptor.term} in ${JSON.stringify(
+          this._descriptor.__columns
+        )}`
+      );
+    }
+
+    return new InlineField<TableSource>({
+      fieldName: column.name,
+      source: this,
+      origin: FIELD_ORIGIN.JOIN,
+      dataType: column.type,
+    });
+  }
+
+  getWhereQuery(): Query | undefined {
+    return undefined;
+  }
+
+  hasCompleteConfig(): boolean {
+    return true;
+  }
+
+  getId(): string {
+    return this._descriptor.id;
+  }
+
+  getRightFields(): IField[] {
+    return this._descriptor.__columns.map((column) => {
+      return new InlineField<TableSource>({
+        fieldName: column.name,
+        source: this,
+        origin: FIELD_ORIGIN.JOIN,
+        dataType: column.type,
+      });
+    });
+  }
+
+  getFieldNames(): string[] {
+    return this._descriptor.__columns.map((column) => {
+      return column.name;
+    });
+  }
+
+  canFormatFeatureProperties(): boolean {
+    return false;
+  }
+
+  createField({ fieldName }: { fieldName: string }): IField {
+    const field = this.getFieldByName(fieldName);
+    if (!field) {
+      throw new Error(`Cannot find field for ${fieldName}`);
+    }
+    return field;
+  }
+
+  async getBoundsForFilters(
+    boundsFilters: BoundsFilters,
+    registerCancelCallback: (callback: () => void) => void
+  ): Promise<MapExtent | null> {
+    return null;
+  }
+
+  getFieldByName(fieldName: string): IField | null {
+    const column = this._descriptor.__columns.find((c) => {
+      return c.name === fieldName;
+    });
+
+    if (!column) {
+      return null;
+    }
+
+    return new InlineField<TableSource>({
+      fieldName: column.name,
+      source: this,
+      origin: FIELD_ORIGIN.JOIN,
+      dataType: column.type,
+    });
+  }
+
+  getFields(): Promise<IField[]> {
+    throw new Error('must implement');
+  }
+
+  // The below is the IVectorSource interface.
+  // Could be useful to implement, e.g. to preview raw csv data
+  async getGeoJsonWithMeta(
+    layerName: string,
+    searchFilters: MapFilters & {
+      applyGlobalQuery: boolean;
+      applyGlobalTime: boolean;
+      fieldNames: string[];
+      geogridPrecision?: number;
+      sourceQuery?: MapQuery;
+      sourceMeta: VectorSourceSyncMeta;
+    },
+    registerCancelCallback: (callback: () => void) => void,
+    isRequestStillActive: () => boolean
+  ): Promise<GeoJsonWithMeta> {
+    throw new Error('TableSource cannot return GeoJson');
+  }
+
+  async getLeftJoinFields(): Promise<IField[]> {
+    throw new Error('TableSource cannot be used as a left-layer in a term join');
+  }
+
+  getSourceTooltipContent(sourceDataRequest?: DataRequest): SourceTooltipConfig {
+    throw new Error('must add tooltip content');
+  }
+
+  async getSupportedShapeTypes(): Promise<VECTOR_SHAPE_TYPE[]> {
+    return [];
+  }
+
+  isBoundsAware(): boolean {
+    return false;
+  }
+}
diff --git a/x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts b/x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts
new file mode 100644
index 0000000000000..1879d64d3b207
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { ITermJoinSource } from './term_join_source';
diff --git a/x-pack/plugins/maps/public/classes/sources/term_join_source/term_join_source.ts b/x-pack/plugins/maps/public/classes/sources/term_join_source/term_join_source.ts
new file mode 100644
index 0000000000000..534ac9f200362
--- /dev/null
+++ b/x-pack/plugins/maps/public/classes/sources/term_join_source/term_join_source.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { GeoJsonProperties } from 'geojson';
+import { IField } from '../../fields/field';
+import { Query } from '../../../../../../../src/plugins/data/common/query';
+import {
+  VectorJoinSourceRequestMeta,
+  VectorSourceSyncMeta,
+} from '../../../../common/descriptor_types';
+import { PropertiesMap } from '../../../../common/elasticsearch_util';
+import { ITooltipProperty } from '../../tooltips/tooltip_property';
+import { ISource } from '../source';
+
+export interface ITermJoinSource extends ISource {
+  hasCompleteConfig(): boolean;
+  getTermField(): IField;
+  getWhereQuery(): Query | undefined;
+  getPropertiesMap(
+    searchFilters: VectorJoinSourceRequestMeta,
+    leftSourceName: string,
+    leftFieldName: string,
+    registerCancelCallback: (callback: () => void) => void
+  ): Promise<PropertiesMap>;
+  getSyncMeta(): VectorSourceSyncMeta | null;
+  getId(): string;
+  getRightFields(): IField[];
+  getTooltipProperties(properties: GeoJsonProperties): Promise<ITooltipProperty[]>;
+  getFieldByName(fieldName: string): IField | null;
+}
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
index 882247e375ddc..96494a346e625 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/properties/dynamic_style_property.tsx
@@ -97,7 +97,7 @@ export class DynamicStyleProperty<T>
     }
 
     const join = this._layer.getValidJoins().find((validJoin: InnerJoin) => {
-      return validJoin.getRightJoinSource().hasMatchingMetricField(fieldName);
+      return !!validJoin.getRightJoinSource().getFieldByName(fieldName);
     });
     return join ? join.getSourceMetaDataRequestId() : null;
   }
diff --git a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx
index 9bf4cafd66407..126f19b7012f8 100644
--- a/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx
+++ b/x-pack/plugins/maps/public/classes/styles/vector/vector_style.tsx
@@ -620,7 +620,7 @@ export class VectorStyle implements IVectorStyle {
       dataRequestId = SOURCE_FORMATTERS_DATA_REQUEST_ID;
     } else {
       const targetJoin = this._layer.getValidJoins().find((join) => {
-        return join.getRightJoinSource().hasMatchingMetricField(fieldName);
+        return !!join.getRightJoinSource().getFieldByName(fieldName);
       });
       if (targetJoin) {
         dataRequestId = targetJoin.getSourceFormattersDataRequestId();
@@ -841,7 +841,7 @@ export class VectorStyle implements IVectorStyle {
     this._iconOrientationProperty.syncIconRotationWithMb(symbolLayerId, mbMap);
   }
 
-  _makeField(fieldDescriptor?: StylePropertyField) {
+  _makeField(fieldDescriptor?: StylePropertyField): IField | null {
     if (!fieldDescriptor || !fieldDescriptor.name) {
       return null;
     }
@@ -852,10 +852,10 @@ export class VectorStyle implements IVectorStyle {
       return this._source.getFieldByName(fieldDescriptor.name);
     } else if (fieldDescriptor.origin === FIELD_ORIGIN.JOIN) {
       const targetJoin = this._layer.getValidJoins().find((join) => {
-        return join.getRightJoinSource().hasMatchingMetricField(fieldDescriptor.name);
+        return !!join.getRightJoinSource().getFieldByName(fieldDescriptor.name);
       });
       return targetJoin
-        ? targetJoin.getRightJoinSource().getMetricFieldForName(fieldDescriptor.name)
+        ? targetJoin.getRightJoinSource().getFieldByName(fieldDescriptor.name)
         : null;
     } else {
       throw new Error(`Unknown origin-type ${fieldDescriptor.origin}`);
diff --git a/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/join_editor.tsx b/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/join_editor.tsx
index d47f130d4ede3..ce5c0ed5fdcad 100644
--- a/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/join_editor.tsx
+++ b/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/join_editor.tsx
@@ -5,7 +5,6 @@
  */
 
 import React, { Fragment } from 'react';
-import _ from 'lodash';
 import uuid from 'uuid/v4';
 
 import {
@@ -24,6 +23,7 @@ import { Join } from './resources/join';
 import { ILayer } from '../../../classes/layers/layer';
 import { JoinDescriptor } from '../../../../common/descriptor_types';
 import { IField } from '../../../classes/fields/field';
+import { SOURCE_TYPES } from '../../../../common/constants';
 
 export interface Props {
   joins: JoinDescriptor[];
@@ -44,19 +44,25 @@ export function JoinEditor({ joins, layer, onChange, leftJoinFields, layerDispla
         onChange(layer, [...joins.slice(0, index), ...joins.slice(index + 1)]);
       };
 
-      return (
-        <Fragment key={index}>
-          <EuiSpacer size="m" />
-          <Join
-            join={joinDescriptor}
-            layer={layer}
-            onChange={handleOnChange}
-            onRemove={handleOnRemove}
-            leftFields={leftJoinFields}
-            leftSourceName={layerDisplayName}
-          />
-        </Fragment>
-      );
+      if (joinDescriptor.right.type === SOURCE_TYPES.TABLE_SOURCE) {
+        throw new Error(
+          'PEBKAC - Table sources cannot be edited in the UX and should only be used in MapEmbeddable'
+        );
+      } else {
+        return (
+          <Fragment key={index}>
+            <EuiSpacer size="m" />
+            <Join
+              join={joinDescriptor}
+              layer={layer}
+              onChange={handleOnChange}
+              onRemove={handleOnRemove}
+              leftFields={leftJoinFields}
+              leftSourceName={layerDisplayName}
+            />
+          </Fragment>
+        );
+      }
     });
   };
 
diff --git a/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join.js b/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join.js
index 507b32fa39fd8..a46b27b62a19e 100644
--- a/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join.js
+++ b/x-pack/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join.js
@@ -17,6 +17,7 @@ import { GlobalTimeCheckbox } from '../../../../components/global_time_checkbox'
 import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
 
 import { getIndexPatternService } from '../../../../kibana_services';
+import { SOURCE_TYPES } from '../../../../../common/constants';
 
 export class Join extends Component {
   state = {
@@ -85,6 +86,7 @@ export class Join extends Component {
         ...restOfRight,
         indexPatternId,
         indexPatternTitle,
+        type: SOURCE_TYPES.ES_TERM_SOURCE,
       },
     });
   };
diff --git a/x-pack/plugins/maps/server/sample_data/ecommerce_saved_objects.js b/x-pack/plugins/maps/server/sample_data/ecommerce_saved_objects.js
index a3dbf8b1438fa..d1aa044676e00 100644
--- a/x-pack/plugins/maps/server/sample_data/ecommerce_saved_objects.js
+++ b/x-pack/plugins/maps/server/sample_data/ecommerce_saved_objects.js
@@ -70,6 +70,7 @@ const layerList = [
       {
         leftField: 'iso2',
         right: {
+          type: 'ES_TERM_SOURCE',
           id: '741db9c6-8ebb-4ea9-9885-b6b4ac019d14',
           indexPatternTitle: 'kibana_sample_data_ecommerce',
           term: 'geoip.country_iso_code',
@@ -134,6 +135,7 @@ const layerList = [
       {
         leftField: 'name',
         right: {
+          type: 'ES_TERM_SOURCE',
           id: '30a0ec24-49b6-476a-b4ed-6c1636333695',
           indexPatternTitle: 'kibana_sample_data_ecommerce',
           term: 'geoip.region_name',
@@ -198,6 +200,7 @@ const layerList = [
       {
         leftField: 'label_en',
         right: {
+          type: 'ES_TERM_SOURCE',
           id: 'e325c9da-73fa-4b3b-8b59-364b99370826',
           indexPatternTitle: 'kibana_sample_data_ecommerce',
           term: 'geoip.region_name',
@@ -262,6 +265,7 @@ const layerList = [
       {
         leftField: 'label_en',
         right: {
+          type: 'ES_TERM_SOURCE',
           id: '612d805d-8533-43a9-ac0e-cbf51fe63dcd',
           indexPatternTitle: 'kibana_sample_data_ecommerce',
           term: 'geoip.region_name',
diff --git a/x-pack/plugins/maps/server/sample_data/web_logs_saved_objects.js b/x-pack/plugins/maps/server/sample_data/web_logs_saved_objects.js
index ec445567de21c..010f06e00ca3f 100644
--- a/x-pack/plugins/maps/server/sample_data/web_logs_saved_objects.js
+++ b/x-pack/plugins/maps/server/sample_data/web_logs_saved_objects.js
@@ -70,6 +70,7 @@ const layerList = [
       {
         leftField: 'iso2',
         right: {
+          type: 'ES_TERM_SOURCE',
           id: '673ff994-fc75-4c67-909b-69fcb0e1060e',
           indexPatternTitle: 'kibana_sample_data_logs',
           term: 'geo.src',
diff --git a/x-pack/plugins/maps/server/saved_objects/migrations.js b/x-pack/plugins/maps/server/saved_objects/migrations.js
index 653f07772ee58..346bc5eff1657 100644
--- a/x-pack/plugins/maps/server/saved_objects/migrations.js
+++ b/x-pack/plugins/maps/server/saved_objects/migrations.js
@@ -14,6 +14,7 @@ import { migrateUseTopHitsToScalingType } from '../../common/migrations/scaling_
 import { migrateJoinAggKey } from '../../common/migrations/join_agg_key';
 import { removeBoundsFromSavedObject } from '../../common/migrations/remove_bounds';
 import { setDefaultAutoFitToBounds } from '../../common/migrations/set_default_auto_fit_to_bounds';
+import { addTypeToTermJoin } from '../../common/migrations/add_type_to_termjoin';
 
 export const migrations = {
   map: {
@@ -79,6 +80,14 @@ export const migrations = {
     '7.10.0': (doc) => {
       const attributes = setDefaultAutoFitToBounds(doc);
 
+      return {
+        ...doc,
+        attributes,
+      };
+    },
+    '7.12.0': (doc) => {
+      const attributes = addTypeToTermJoin(doc);
+
       return {
         ...doc,
         attributes,
diff --git a/x-pack/test/api_integration/apis/maps/migrations.js b/x-pack/test/api_integration/apis/maps/migrations.js
index b634e7117e607..9f9082c959ca5 100644
--- a/x-pack/test/api_integration/apis/maps/migrations.js
+++ b/x-pack/test/api_integration/apis/maps/migrations.js
@@ -41,7 +41,7 @@ export default function ({ getService }) {
           type: 'index-pattern',
         },
       ]);
-      expect(resp.body.migrationVersion).to.eql({ map: '7.10.0' });
+      expect(resp.body.migrationVersion).to.eql({ map: '7.12.0' });
       expect(resp.body.attributes.layerListJSON.includes('indexPatternRefName')).to.be(true);
     });
   });