saved_query: Cleanup saved objects mappings

[TinaHeiligers]

Summary

Related to #149102

Subset of the global cleanup attempt in #153070

Cleans up saved_query mappings

• Unit or functional tests were updated or added to match the most common scenarios

[TinaHeiligers]

@elastic/kibana-data-discovery @elastic/kibana-visualizations if CI goes green, we can use this PR to clean up the savedSearch mappings.
If not, it means there's a direct reference to the fields and you'll need to decide how to handle that.

[rudolf]

@elasticmachine merge upstream

[TinaHeiligers]

cleanup self reviw

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 919f001

Failed CI Steps

• Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution

Test Failures

• [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution / Related integrations installed integrations: Amazon CloudFront, AWS CloudTrail, System, enabled integrations: Amazon CloudFront, Aws Cloudfront, System "before all" hook for "should display a badge with the installed integrations on the rule management page"

Metrics [docs]

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id	before	after	diff
query	6	5	-1

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	433	436	+3

Total ESLint disabled count

id	before	after	diff
securitySolution	513	516	+3

History

• 💚 Build #113744 succeeded e34f55f
• 💔 Build #113449 failed c9cd16d
• 💔 Build #113438 failed ab008e0

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[davismcphee]

Changes LGTM, did a quick test locally too just in case and everything seems fine 👍

if CI goes green, we can use this PR to clean up the savedSearch mappings.

I'm not sure if I'm just misunderstanding this point, but these changes will affect the "saved query" mappings (queries saved from the Unified Search bar), not the "saved search" mappings (Discover searches), which are located in src/plugins/saved_search/server/saved_objects/search.ts.

[rudolf]

I'm not sure if I'm just misunderstanding this point, but these changes will affect the "saved query" mappings

Thanks raising this to clarify. I think there was some confusion about what saved_query saved objects are used for but the important thing is that we clean up these mappings. 👍

[davismcphee]

Thanks raising this to clarify. I think there was some confusion about what saved_query saved objects are used for but the important thing is that we clean up these mappings. 👍

NP and definitely, they all need to be cleaned up regardless. We've discussed renaming these at some point anyway -- if it's confusing for our own team, I can only imagine it's even more confusing for our users 😅