Cross Cluster Search version compatibility testing for 7.12.0 -> 6.8

[LeeDr]

This issue lists specific CCS tests for Kibana 7.12.0 performing cross cluster search for data in a remote cluster running Elasticsearch version 6.8.14.

• Index Patterns - create index patterns referencing only a remote cluster data:makelogs*
• Index Patterns - create index patterns referencing both local and remote cluster with wildcard *:makelogs*
• Index Patterns - create index patterns referencing both local and remote cluster with comma-separated list local:makelogs*,data:makelogs*
• Discover - shows data from remote cluster data:makelogs*
• Discover - shows data from local and remote cluster *:makelogs*
• Discover - shows data from local and remote cluster local:makelogs*,data:makelogs*
• Discover - filters apply to both local and remote data
• Discover - queries apply to both local and remote data
• Visualize - Lens @LeeDr , need to check this again, we see warning on 7.11
• Visualize - aggregation based Visualizations
• Visualize - TSVB
• Visualize - Vega
• Monitoring
• Reporting - csv
• Reporting - PDF
• Users/Roles - don't test everything as superuser
• ML - see Cross Cluster Search version compatibility testing for 7.12.0 -> 6.8 #93624 (comment)
• Observability
• Security
• Cross Cluster Replication (CCR)
• Maps - Failed 👎 geotile_grid aggregation was not available yet in ES at 6.8 this was only introduced in 7.0 - This works with both clusters on 7.12.0
• Canvas - Elasticsearch queries 👎 "Request Timeout after 30000ms" - This works with both clusters on 7.12.0
• Canvas - SQL queries 👎 "Request Timeout after 30000ms" - This works with both clusters on 7.12.0
• Canvas - Timelion queries
• TBD

[elasticmachine]

Pinging @elastic/kibana-qa (Team:QA)

[LeeDr]

This screenshot in Discover shows that with the default Kibana settings we don't get the _source;

But if I go into Kibana Advanced Settings and turn on discover:searchFieldsFromSource
"Read fields from _source
When enabled will load documents directly from _source. This is soon going to be deprecated. When disabled, will retrieve fields via the new Fields API in the high-level search service."

Now we do see the _source. But what happens when it's deprecated ^ ?

[wwang500]

Summary of CCS testing for ML related functions.

1. Anomaly Detection, Data Visualization, Transform all work fine, except for several issues if remote indices are on an old version cluster (6.8.14 was used for testing). Details can be found below.
   2 We don't support CCS on Data frame analytics.
2. Transform geotile_grid grouby is not supported if remote indices are on an old version cluster (6.8.14 was used for testing)
3. Runtime Fields in search is not supported for both Transform and Anomaly Detection if remote indices are on an old version cluster (6.8.14 was used for testing)
4. Categorization job will hit an error on UI if remote indices are on an old version cluster (6.8.14 was used for testing). Kibana issue: [ML] Categorization validation failed if source index is from a remote CCS 6.8 cluster  #94737
5. Transform source index view is empty if remote indices are on an old version cluster (6.8.14 was used for testing).

[jpountz]

In case it helps, I believe that our Security solution uses the case_sensitive flag of the wildcard and regexp queries, which wouldn't work on 6.8 and early 7.x remote clusters.

[stacey-gammon]

@LeeDr - did you get any results from the 7.11 -> 6.8 testing?

[LeeDr]

@stacey-gammon I have the automation in place to create this 7.11 -> 6.8 configuration and the very basic index pattern creation and Discover automated tests pass. Now that 7.12 is released I can add some people to the manual testing (and eventually automation) of the other features on this configuration.

[LeeDr]

see #95213 for 7.11 -> 6.8 testing

[rashmivkulkarni]

Note: tested on 7.12.1 ( snapshot) - 7.12.1
Tested Maps, Discover and Lens documents and their available ffields for the index patters data:makelogs, makelogs and the combination one - data:makelogs, local:makelogs - and the fields were available, and also the top fields available as well.