diff --git a/packages/kibana/data_stream/cluster_actions/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/cluster_actions/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..5b3dcc8cb8e
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["cluster_actions"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/cluster_actions/fields/base-fields.yml b/packages/kibana/data_stream/cluster_actions/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/cluster_actions/fields/ecs.yml b/packages/kibana/data_stream/cluster_actions/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/cluster_actions/fields/fields.yml b/packages/kibana/data_stream/cluster_actions/fields/fields.yml
new file mode 100644
index 00000000000..3793e3a65c3
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/fields.yml
@@ -0,0 +1,20 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: cluster_actions
+      type: group
+      fields:
+        - name: overdue
+          type: group
+          fields:
+            - name: count
+              type: long
+            - name: delay
+              type: group
+              fields:
+                - name: p50
+                  type: float
+                - name: p99
+                  type: float
diff --git a/packages/kibana/data_stream/cluster_actions/fields/package-fields.yml b/packages/kibana/data_stream/cluster_actions/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/cluster_actions/manifest.yml b/packages/kibana/data_stream/cluster_actions/manifest.yml
new file mode 100644
index 00000000000..6b00477793b
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana cluster_actions metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana cluster_actions metrics
+    description: Collect Kibana cluster_actions metrics
diff --git a/packages/kibana/data_stream/cluster_actions/sample_event.json b/packages/kibana/data_stream/cluster_actions/sample_event.json
new file mode 100644
index 00000000000..82f597effa0
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/sample_event.json
@@ -0,0 +1,74 @@
+{
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "type": "metricbeat",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "version": "8.5.0"
+    },
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:38:59.780Z",
+    "service.version": "8.5.0",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/cluster_actions",
+        "type": "kibana"
+    },
+    "service.address": "0.0.0.0:5601",
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.cluster_actions"
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "cluster_actions"
+    },
+    "event": {
+        "duration": 13732239,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:39:00Z",
+        "module": "kibana",
+        "dataset": "kibana.cluster_actions"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "cluster_actions": {
+            "overdue": {
+                "delay": {
+                    "p99": 0,
+                    "p50": 0
+                },
+                "count": 0
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/packages/kibana/data_stream/cluster_rules/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/cluster_rules/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..2c9de373712
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["cluster_rules"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/cluster_rules/fields/base-fields.yml b/packages/kibana/data_stream/cluster_rules/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/cluster_rules/fields/ecs.yml b/packages/kibana/data_stream/cluster_rules/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/cluster_rules/fields/fields.yml b/packages/kibana/data_stream/cluster_rules/fields/fields.yml
new file mode 100644
index 00000000000..3c2fc6b07ee
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/fields.yml
@@ -0,0 +1,21 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: cluster_rules
+      type: group
+      release: beta
+      fields:
+        - name: overdue
+          type: group
+          fields:
+            - name: count
+              type: long
+            - name: delay
+              type: group
+              fields:
+                - name: p50
+                  type: float
+                - name: p99
+                  type: float
diff --git a/packages/kibana/data_stream/cluster_rules/fields/package-fields.yml b/packages/kibana/data_stream/cluster_rules/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/cluster_rules/manifest.yml b/packages/kibana/data_stream/cluster_rules/manifest.yml
new file mode 100644
index 00000000000..2ecdf23b089
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana cluster_rules metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana cluster_rules metrics
+    description: Collect Kibana cluster_rules metrics
diff --git a/packages/kibana/data_stream/cluster_rules/sample_event.json b/packages/kibana/data_stream/cluster_rules/sample_event.json
new file mode 100644
index 00000000000..bda053b694b
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/sample_event.json
@@ -0,0 +1,74 @@
+{
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "type": "metricbeat",
+        "version": "8.5.0"
+    },
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:41:29.650Z",
+    "service.version": "8.5.0",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/cluster_rules",
+        "type": "kibana"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.cluster_rules"
+    },
+    "service.address": "0.0.0.0:5601",
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "cluster_rules"
+    },
+    "event": {
+        "duration": 8419517,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:41:30Z",
+        "module": "kibana",
+        "dataset": "kibana.cluster_rules"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "cluster_rules": {
+            "overdue": {
+                "delay": {
+                    "p99": 0,
+                    "p50": 0
+                },
+                "count": 0
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/packages/kibana/data_stream/node_actions/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/node_actions/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..012bf125cb0
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["node_actions"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/node_actions/fields/base-fields.yml b/packages/kibana/data_stream/node_actions/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/node_actions/fields/ecs.yml b/packages/kibana/data_stream/node_actions/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/node_actions/fields/fields.yml b/packages/kibana/data_stream/node_actions/fields/fields.yml
new file mode 100644
index 00000000000..2a8342393ce
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/fields.yml
@@ -0,0 +1,15 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: node_actions
+      type: group
+      release: beta
+      fields:
+        - name: failures
+          type: long
+        - name: executions
+          type: long
+        - name: timeouts
+          type: long
diff --git a/packages/kibana/data_stream/node_actions/fields/package-fields.yml b/packages/kibana/data_stream/node_actions/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/node_actions/manifest.yml b/packages/kibana/data_stream/node_actions/manifest.yml
new file mode 100644
index 00000000000..392b0a81e52
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana node_actions metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana node_actions metrics
+    description: Collect Kibana node_actions metrics
diff --git a/packages/kibana/data_stream/node_actions/sample_event.json b/packages/kibana/data_stream/node_actions/sample_event.json
new file mode 100644
index 00000000000..264230273b3
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/sample_event.json
@@ -0,0 +1,70 @@
+{
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "type": "metricbeat",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "version": "8.5.0"
+    },
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:42:19.560Z",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service.version": "8.5.0",
+    "service.address": "0.0.0.0:5601",
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/node_actions",
+        "type": "kibana"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.node_actions"
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "family": "debian",
+            "type": "linux",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "node_actions"
+    },
+    "event": {
+        "duration": 6658572,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:42:20Z",
+        "module": "kibana",
+        "dataset": "kibana.node_actions"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "node_actions": {
+            "failures": 0,
+            "executions": 0,
+            "timeouts": 0
+        }
+    }
+}
\ No newline at end of file
diff --git a/packages/kibana/data_stream/node_rules/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/node_rules/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..f2aef622c8c
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["node_rules"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/node_rules/fields/base-fields.yml b/packages/kibana/data_stream/node_rules/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/node_rules/fields/ecs.yml b/packages/kibana/data_stream/node_rules/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/node_rules/fields/fields.yml b/packages/kibana/data_stream/node_rules/fields/fields.yml
new file mode 100644
index 00000000000..f1b4927986a
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/fields.yml
@@ -0,0 +1,15 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: node_rules
+      type: group
+      release: beta
+      fields:
+        - name: failures
+          type: long
+        - name: executions
+          type: long
+        - name: timeouts
+          type: long
diff --git a/packages/kibana/data_stream/node_rules/fields/package-fields.yml b/packages/kibana/data_stream/node_rules/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/node_rules/manifest.yml b/packages/kibana/data_stream/node_rules/manifest.yml
new file mode 100644
index 00000000000..9b07eb74a86
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana node_rules metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana node_rules metrics
+    description: Collect Kibana node_rules metrics
diff --git a/packages/kibana/data_stream/node_rules/sample_event.json b/packages/kibana/data_stream/node_rules/sample_event.json
new file mode 100644
index 00000000000..cb48feef64b
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/sample_event.json
@@ -0,0 +1,70 @@
+{
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "type": "metricbeat",
+        "version": "8.5.0"
+    },
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:42:59.474Z",
+    "service.version": "8.5.0",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service.address": "0.0.0.0:5601",
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.node_rules"
+    },
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/node_rules",
+        "type": "kibana"
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "node_rules"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "node_rules": {
+            "failures": 0,
+            "executions": 0,
+            "timeouts": 0
+        }
+    },
+    "event": {
+        "duration": 9031470,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:43:00Z",
+        "module": "kibana",
+        "dataset": "kibana.node_rules"
+    }
+}
\ No newline at end of file
diff --git a/packages/kibana/data_stream/stats/fields/base-fields.yml b/packages/kibana/data_stream/stats/fields/base-fields.yml
index 5316f1c6661..a3e80e3a547 100644
--- a/packages/kibana/data_stream/stats/fields/base-fields.yml
+++ b/packages/kibana/data_stream/stats/fields/base-fields.yml
@@ -7,6 +7,3 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: service.address
-  type: keyword
-  description: Address where data about this service was collected from.
diff --git a/packages/kibana/data_stream/stats/fields/ecs.yml b/packages/kibana/data_stream/stats/fields/ecs.yml
index dbdec2aab0b..7a5b56ce613 100644
--- a/packages/kibana/data_stream/stats/fields/ecs.yml
+++ b/packages/kibana/data_stream/stats/fields/ecs.yml
@@ -2,13 +2,21 @@
   external: ecs
 - name: service.id
   external: ecs
+- name: service.address
+  external: ecs
 - name: service.version
   external: ecs
 - name: service.type
   external: ecs
-- name: service.name
-  external: ecs
 - name: ecs.version
   external: ecs
 - name: process.pid
   external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/stats/fields/fields.yml b/packages/kibana/data_stream/stats/fields/fields.yml
index d01420e4011..d1ea4873ddc 100644
--- a/packages/kibana/data_stream/stats/fields/fields.yml
+++ b/packages/kibana/data_stream/stats/fields/fields.yml
@@ -1,119 +1,127 @@
-- name: kibana.stats
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: kibana
   type: group
   fields:
-    - name: kibana
-      type: group
-      fields:
-        - name: status
-          type: keyword
-    - name: usage
-      type: group
-      fields:
-        - name: index
-          type: keyword
-    - name: name
-      type: keyword
-      description: |
-        Kibana instance name
-    - name: index
-      type: keyword
-      description: |
-        Name of Kibana's internal index
-    - name: host.name
+    - name: elasticsearch.cluster.id
       type: keyword
-      description: |
-        Kibana instance hostname
-    - name: snapshot
-      type: boolean
-      description: |
-        Whether the Kibana build is a snapshot build
-    - name: status
-      type: keyword
-      description: |
-        Kibana instance's health status
-    - name: os
+    - name: stats
       type: group
       fields:
-        - name: distro
+        - name: kibana
+          type: group
+          fields:
+            - name: status
+              type: keyword
+        - name: usage
+          type: group
+          fields:
+            - name: index
+              type: keyword
+        - name: name
           type: keyword
-        - name: distroRelease
+          description: |
+            Kibana instance name
+        - name: index
           type: keyword
-        - name: platform
+          description: |
+            Name of Kibana's internal index
+        - name: host.name
           type: keyword
-        - name: platformRelease
+          description: |
+            Kibana instance hostname
+        - name: snapshot
+          type: boolean
+          description: |
+            Whether the Kibana build is a snapshot build
+        - name: status
           type: keyword
-        - name: memory
-          type: group
-          fields:
-            - name: free_in_bytes
-              type: long
-            - name: total_in_bytes
-              type: long
-            - name: used_in_bytes
-              type: long
-        - name: load
+          description: |
+            Kibana instance's health status
+        - name: os
           type: group
           fields:
-            - name: 1m
-              type: half_float
-            - name: 5m
-              type: half_float
-            - name: 15m
-              type: half_float
-    - name: concurrent_connections
-      type: long
-      description: |
-        Number of client connections made to the server. Note that browsers can send multiple simultaneous connections to request multiple server assets at once, and they can re-use established connections.
-    - name: process
-      type: group
-      fields:
-        - name: memory.resident_set_size.bytes
-          type: long
-        - name: uptime.ms
+            - name: distro
+              type: keyword
+            - name: distroRelease
+              type: keyword
+            - name: platform
+              type: keyword
+            - name: platformRelease
+              type: keyword
+            - name: memory
+              type: group
+              fields:
+                - name: free_in_bytes
+                  type: long
+                - name: total_in_bytes
+                  type: long
+                - name: used_in_bytes
+                  type: long
+            - name: load
+              type: group
+              fields:
+                - name: 1m
+                  type: half_float
+                - name: 5m
+                  type: half_float
+                - name: 15m
+                  type: half_float
+        - name: concurrent_connections
           type: long
-        - name: event_loop_delay.ms
-          type: scaled_float
           description: |
-            Event loop delay in milliseconds
-        - name: memory.heap
+            Number of client connections made to the server. Note that browsers can send multiple simultaneous connections to request multiple server assets at once, and they can re-use established connections.
+        - name: process
           type: group
           fields:
-            - name: total.bytes
+            - name: memory.resident_set_size.bytes
               type: long
-              format: bytes
-              description: |
-                Total heap allocated to process in bytes
-            - name: used.bytes
+            - name: uptime.ms
               type: long
-              format: bytes
+            - name: event_loop_delay.ms
+              type: scaled_float
               description: |
-                Heap used by process in bytes
-            - name: size_limit.bytes
+                Event loop delay in milliseconds
+            - name: memory.heap
+              type: group
+              fields:
+                - name: total.bytes
+                  type: long
+                  format: bytes
+                  description: |
+                    Total heap allocated to process in bytes
+                - name: used.bytes
+                  type: long
+                  format: bytes
+                  description: |
+                    Heap used by process in bytes
+                - name: size_limit.bytes
+                  type: long
+                  format: bytes
+                  description: |
+                    Max. old space size allocated to Node.js process, in bytes
+                - name: uptime.ms
+                  type: long
+                  description: |
+                    Uptime of process in milliseconds
+        - name: request
+          type: group
+          fields:
+            - name: disconnects
               type: long
-              format: bytes
               description: |
-                Max. old space size allocated to Node.js process, in bytes
-            - name: uptime.ms
+                Number of requests that were disconnected
+            - name: total
               type: long
               description: |
-                Uptime of process in milliseconds
-    - name: request
-      type: group
-      fields:
-        - name: disconnects
-          type: long
-          description: |
-            Number of requests that were disconnected
-        - name: total
-          type: long
-          description: |
-            Total number of requests
-    - name: response_time
-      type: group
-      fields:
-        - name: avg.ms
-          type: long
-          description: Average response time in milliseconds
-        - name: max.ms
-          type: long
-          description: Maximum response time in milliseconds
+                Total number of requests
+        - name: response_time
+          type: group
+          fields:
+            - name: avg.ms
+              type: long
+              description: Average response time in milliseconds
+            - name: max.ms
+              type: long
+              description: Maximum response time in milliseconds
diff --git a/packages/kibana/data_stream/stats/fields/package-fields.yml b/packages/kibana/data_stream/stats/fields/package-fields.yml
index 72c7fcfdc31..17c135032ad 100644
--- a/packages/kibana/data_stream/stats/fields/package-fields.yml
+++ b/packages/kibana/data_stream/stats/fields/package-fields.yml
@@ -1,6 +1,6 @@
-- name: elasticsearch.cluster.id
-  type: keyword
-  description: ID of the Elasticsearch cluster
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
 - name: kibana_stats
   type: group
   fields:
@@ -9,7 +9,13 @@
       path: kibana.stats.response_time.max.ms
     - name: kibana.status
       type: alias
-      path: kibana.stats.kibana.status
+      path: kibana.stats.status
+    - name: kibana.uuid
+      type: alias
+      path: service.id
+    - name: kibana.version
+      type: alias
+      path: service.version
     - name: os.memory.free_in_bytes
       type: alias
       path: kibana.stats.os.memory.free_in_bytes
@@ -49,5 +55,6 @@
     - name: response_times.average
       type: alias
       path: kibana.stats.response_time.avg.ms
-- name: kibana
-  type: group
+    - name: timestamp
+      type: alias
+      path: '@timestamp'
diff --git a/packages/kibana/data_stream/stats/manifest.yml b/packages/kibana/data_stream/stats/manifest.yml
index a5102b8dec7..2760141c62f 100644
--- a/packages/kibana/data_stream/stats/manifest.yml
+++ b/packages/kibana/data_stream/stats/manifest.yml
@@ -1,6 +1,10 @@
 type: metrics
 title: Kibana stats metrics
 release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
 streams:
   - input: kibana/metrics
     title: Kibana stats metrics
diff --git a/packages/kibana/data_stream/stats/sample_event.json b/packages/kibana/data_stream/stats/sample_event.json
index 61989b19e54..da08f5edb66 100644
--- a/packages/kibana/data_stream/stats/sample_event.json
+++ b/packages/kibana/data_stream/stats/sample_event.json
@@ -1,53 +1,72 @@
 {
-    "@timestamp": "2021-08-11T09:37:48.038Z",
     "agent": {
-        "hostname": "docker-fleet-agent",
         "name": "docker-fleet-agent",
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "ephemeral_id": "c73a88e9-ff0d-4bc0-8454-a4eace232146",
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
         "type": "metricbeat",
-        "version": "7.15.0"
+        "ephemeral_id": "ab3cdd2a-3336-4682-a038-6844197893f4",
+        "version": "8.5.0"
     },
     "process": {
-        "pid": 1218
-    },
-    "elastic_agent": {
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "version": "7.15.0",
-        "snapshot": true
+        "pid": 7
     },
+    "@timestamp": "2022-08-06T22:34:12.983Z",
     "ecs": {
-        "version": "1.10.0"
-    },
-    "elasticsearch": {
-        "cluster": {
-            "id": "hEwxs-BJRuWNwJOV__gppg"
-        }
-    },
-    "service": {
-        "address": "http://kibana:5601/api/stats?extended=true",
-        "name": "kibana",
-        "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
-        "type": "kibana",
-        "version": "7.15.0"
+        "version": "8.0.0"
     },
     "data_stream": {
         "namespace": "default",
         "type": "metrics",
         "dataset": "kibana.stats"
     },
+    "service": {
+        "address": "https://kibana:5601/api/stats?extended=true",
+        "id": "79307ef1-725a-4f29-992a-446bcbedf380",
+        "type": "kibana",
+        "version": "8.5.0"
+    },
+    "elastic_agent": {
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.21.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:15:00:07"
+        ],
+        "architecture": "x86_64"
+    },
     "metricset": {
         "period": 10000,
         "name": "stats"
     },
     "event": {
-        "duration": 16850171,
+        "duration": 22471757,
         "agent_id_status": "verified",
-        "ingested": "2021-08-11T09:37:51.538117032Z",
+        "ingested": "2022-08-06T22:34:13Z",
         "module": "kibana",
         "dataset": "kibana.stats"
     },
     "kibana": {
+        "elasticsearch": {
+            "cluster": {
+                "id": "wMZ6Mw1nR1ydMG25AiiOLw"
+            }
+        },
         "stats": {
             "request": {
                 "total": 4,
@@ -55,12 +74,15 @@
             },
             "process": {
                 "memory": {
+                    "resident_set_size": {
+                        "bytes": 510763008
+                    },
                     "heap": {
                         "total": {
-                            "bytes": 296554496
+                            "bytes": 354033664
                         },
                         "used": {
-                            "bytes": 228129512
+                            "bytes": 280320136
                         },
                         "size_limit": {
                             "bytes": 4345298944
@@ -68,26 +90,42 @@
                     }
                 },
                 "event_loop_delay": {
-                    "ms": 0.56603500014171
+                    "ms": 10.395972266666668
                 },
                 "uptime": {
-                    "ms": 1088184
+                    "ms": 64365
                 }
             },
+            "os": {
+                "distroRelease": "Ubuntu-20.04",
+                "distro": "Ubuntu",
+                "memory": {
+                    "used_in_bytes": 4305055744,
+                    "total_in_bytes": 35739144192,
+                    "free_in_bytes": 31434088448
+                },
+                "load": {
+                    "5m": 0.66,
+                    "15m": 0.25,
+                    "1m": 1.66
+                },
+                "platformRelease": "linux-5.10.47-linuxkit",
+                "platform": "linux"
+            },
+            "name": "kibana",
             "host": {
                 "name": "0.0.0.0"
             },
-            "name": "kibana",
-            "index": "kibana",
+            "index": ".kibana",
             "response_time": {
                 "avg": {
-                    "ms": 11
+                    "ms": 8
                 },
                 "max": {
-                    "ms": 16
+                    "ms": 11
                 }
             },
-            "concurrent_connections": 8,
+            "concurrent_connections": 10,
             "snapshot": true,
             "status": "green"
         }
diff --git a/packages/kibana/data_stream/status/fields/base-fields.yml b/packages/kibana/data_stream/status/fields/base-fields.yml
index 5316f1c6661..a3e80e3a547 100644
--- a/packages/kibana/data_stream/status/fields/base-fields.yml
+++ b/packages/kibana/data_stream/status/fields/base-fields.yml
@@ -7,6 +7,3 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: service.address
-  type: keyword
-  description: Address where data about this service was collected from.
diff --git a/packages/kibana/data_stream/status/fields/ecs.yml b/packages/kibana/data_stream/status/fields/ecs.yml
index c66fafdcd9d..bb81f45e7a5 100644
--- a/packages/kibana/data_stream/status/fields/ecs.yml
+++ b/packages/kibana/data_stream/status/fields/ecs.yml
@@ -6,7 +6,8 @@
   external: ecs
 - name: service.type
   external: ecs
-- name: service.name
-  external: ecs
 - name: ecs.version
   external: ecs
+- name: service.address
+  type: keyword
+  description: Address where data about this service was collected from.
diff --git a/packages/kibana/data_stream/status/manifest.yml b/packages/kibana/data_stream/status/manifest.yml
index 32d077279d5..f4e3b1aaa4e 100644
--- a/packages/kibana/data_stream/status/manifest.yml
+++ b/packages/kibana/data_stream/status/manifest.yml
@@ -1,6 +1,10 @@
 type: metrics
 title: Kibana status metrics
 release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
 streams:
   - input: kibana/metrics
     title: Kibana status metrics
diff --git a/packages/kibana/data_stream/status/sample_event.json b/packages/kibana/data_stream/status/sample_event.json
index 85456bde8b4..f40a374e6db 100644
--- a/packages/kibana/data_stream/status/sample_event.json
+++ b/packages/kibana/data_stream/status/sample_event.json
@@ -18,7 +18,6 @@
     },
     "service": {
         "address": "http://kibana:5601/api/status",
-        "name": "kibana",
         "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
         "type": "kibana",
         "version": "7.15.0"
diff --git a/packages/kibana/docs/README.md b/packages/kibana/docs/README.md
index 30491cb67c0..de827e8b093 100644
--- a/packages/kibana/docs/README.md
+++ b/packages/kibana/docs/README.md
@@ -122,55 +122,74 @@ An example event for `stats` looks as following:
 
 ```json
 {
-    "@timestamp": "2021-08-11T09:37:48.038Z",
     "agent": {
-        "hostname": "docker-fleet-agent",
         "name": "docker-fleet-agent",
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "ephemeral_id": "c73a88e9-ff0d-4bc0-8454-a4eace232146",
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
         "type": "metricbeat",
-        "version": "7.15.0"
+        "ephemeral_id": "ab3cdd2a-3336-4682-a038-6844197893f4",
+        "version": "8.5.0"
     },
     "process": {
-        "pid": 1218
-    },
-    "elastic_agent": {
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "version": "7.15.0",
-        "snapshot": true
+        "pid": 7
     },
+    "@timestamp": "2022-08-06T22:34:12.983Z",
     "ecs": {
-        "version": "1.10.0"
-    },
-    "elasticsearch": {
-        "cluster": {
-            "id": "hEwxs-BJRuWNwJOV__gppg"
-        }
-    },
-    "service": {
-        "address": "http://kibana:5601/api/stats?extended=true",
-        "name": "kibana",
-        "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
-        "type": "kibana",
-        "version": "7.15.0"
+        "version": "8.0.0"
     },
     "data_stream": {
         "namespace": "default",
         "type": "metrics",
         "dataset": "kibana.stats"
     },
+    "service": {
+        "address": "https://kibana:5601/api/stats?extended=true",
+        "id": "79307ef1-725a-4f29-992a-446bcbedf380",
+        "type": "kibana",
+        "version": "8.5.0"
+    },
+    "elastic_agent": {
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.21.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:15:00:07"
+        ],
+        "architecture": "x86_64"
+    },
     "metricset": {
         "period": 10000,
         "name": "stats"
     },
     "event": {
-        "duration": 16850171,
+        "duration": 22471757,
         "agent_id_status": "verified",
-        "ingested": "2021-08-11T09:37:51.538117032Z",
+        "ingested": "2022-08-06T22:34:13Z",
         "module": "kibana",
         "dataset": "kibana.stats"
     },
     "kibana": {
+        "elasticsearch": {
+            "cluster": {
+                "id": "wMZ6Mw1nR1ydMG25AiiOLw"
+            }
+        },
         "stats": {
             "request": {
                 "total": 4,
@@ -178,12 +197,15 @@ An example event for `stats` looks as following:
             },
             "process": {
                 "memory": {
+                    "resident_set_size": {
+                        "bytes": 510763008
+                    },
                     "heap": {
                         "total": {
-                            "bytes": 296554496
+                            "bytes": 354033664
                         },
                         "used": {
-                            "bytes": 228129512
+                            "bytes": 280320136
                         },
                         "size_limit": {
                             "bytes": 4345298944
@@ -191,26 +213,42 @@ An example event for `stats` looks as following:
                     }
                 },
                 "event_loop_delay": {
-                    "ms": 0.56603500014171
+                    "ms": 10.395972266666668
                 },
                 "uptime": {
-                    "ms": 1088184
+                    "ms": 64365
                 }
             },
+            "os": {
+                "distroRelease": "Ubuntu-20.04",
+                "distro": "Ubuntu",
+                "memory": {
+                    "used_in_bytes": 4305055744,
+                    "total_in_bytes": 35739144192,
+                    "free_in_bytes": 31434088448
+                },
+                "load": {
+                    "5m": 0.66,
+                    "15m": 0.25,
+                    "1m": 1.66
+                },
+                "platformRelease": "linux-5.10.47-linuxkit",
+                "platform": "linux"
+            },
+            "name": "kibana",
             "host": {
                 "name": "0.0.0.0"
             },
-            "name": "kibana",
-            "index": "kibana",
+            "index": ".kibana",
             "response_time": {
                 "avg": {
-                    "ms": 11
+                    "ms": 8
                 },
                 "max": {
-                    "ms": 16
+                    "ms": 11
                 }
             },
-            "concurrent_connections": 8,
+            "concurrent_connections": 10,
             "snapshot": true,
             "status": "green"
         }
@@ -261,7 +299,6 @@ An example event for `status` looks as following:
     },
     "service": {
         "address": "http://kibana:5601/api/status",
-        "name": "kibana",
         "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
         "type": "kibana",
         "version": "7.15.0"
diff --git a/packages/kibana/manifest.yml b/packages/kibana/manifest.yml
index 416540b1522..80d79c8ef16 100644
--- a/packages/kibana/manifest.yml
+++ b/packages/kibana/manifest.yml
@@ -13,7 +13,7 @@ format_version: 1.0.0
 license: basic
 categories: ["elastic_stack"]
 conditions:
-  kibana.version: ^7.15.0
+  kibana.version: ^8.5.0
 policy_templates:
   - name: kibana
     title: Kibana logs and metrics