From a174e2951b6a38c3d270f650ec4a7941bbc77698 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sat, 6 Aug 2022 21:21:28 +0200
Subject: [PATCH 01/15] align kibana stats/status mappings

---
 .../data_stream/stats/fields/base-fields.yml  |   3 -
 .../kibana/data_stream/stats/fields/ecs.yml   |  12 +-
 .../data_stream/stats/fields/fields.yml       | 202 +++++++++---------
 .../stats/fields/package-fields.yml           |  19 +-
 .../kibana/data_stream/stats/manifest.yml     |   4 +
 .../data_stream/status/fields/base-fields.yml |   3 -
 .../kibana/data_stream/status/fields/ecs.yml  |   3 +
 .../kibana/data_stream/status/manifest.yml    |   4 +
 packages/kibana/manifest.yml                  |   2 +-
 9 files changed, 140 insertions(+), 112 deletions(-)

diff --git a/packages/kibana/data_stream/stats/fields/base-fields.yml b/packages/kibana/data_stream/stats/fields/base-fields.yml
index 5316f1c6661..a3e80e3a547 100644
--- a/packages/kibana/data_stream/stats/fields/base-fields.yml
+++ b/packages/kibana/data_stream/stats/fields/base-fields.yml
@@ -7,6 +7,3 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: service.address
-  type: keyword
-  description: Address where data about this service was collected from.
diff --git a/packages/kibana/data_stream/stats/fields/ecs.yml b/packages/kibana/data_stream/stats/fields/ecs.yml
index dbdec2aab0b..7a5b56ce613 100644
--- a/packages/kibana/data_stream/stats/fields/ecs.yml
+++ b/packages/kibana/data_stream/stats/fields/ecs.yml
@@ -2,13 +2,21 @@
   external: ecs
 - name: service.id
   external: ecs
+- name: service.address
+  external: ecs
 - name: service.version
   external: ecs
 - name: service.type
   external: ecs
-- name: service.name
-  external: ecs
 - name: ecs.version
   external: ecs
 - name: process.pid
   external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/stats/fields/fields.yml b/packages/kibana/data_stream/stats/fields/fields.yml
index d01420e4011..d1ea4873ddc 100644
--- a/packages/kibana/data_stream/stats/fields/fields.yml
+++ b/packages/kibana/data_stream/stats/fields/fields.yml
@@ -1,119 +1,127 @@
-- name: kibana.stats
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: kibana
   type: group
   fields:
-    - name: kibana
-      type: group
-      fields:
-        - name: status
-          type: keyword
-    - name: usage
-      type: group
-      fields:
-        - name: index
-          type: keyword
-    - name: name
-      type: keyword
-      description: |
-        Kibana instance name
-    - name: index
-      type: keyword
-      description: |
-        Name of Kibana's internal index
-    - name: host.name
+    - name: elasticsearch.cluster.id
       type: keyword
-      description: |
-        Kibana instance hostname
-    - name: snapshot
-      type: boolean
-      description: |
-        Whether the Kibana build is a snapshot build
-    - name: status
-      type: keyword
-      description: |
-        Kibana instance's health status
-    - name: os
+    - name: stats
       type: group
       fields:
-        - name: distro
+        - name: kibana
+          type: group
+          fields:
+            - name: status
+              type: keyword
+        - name: usage
+          type: group
+          fields:
+            - name: index
+              type: keyword
+        - name: name
           type: keyword
-        - name: distroRelease
+          description: |
+            Kibana instance name
+        - name: index
           type: keyword
-        - name: platform
+          description: |
+            Name of Kibana's internal index
+        - name: host.name
           type: keyword
-        - name: platformRelease
+          description: |
+            Kibana instance hostname
+        - name: snapshot
+          type: boolean
+          description: |
+            Whether the Kibana build is a snapshot build
+        - name: status
           type: keyword
-        - name: memory
-          type: group
-          fields:
-            - name: free_in_bytes
-              type: long
-            - name: total_in_bytes
-              type: long
-            - name: used_in_bytes
-              type: long
-        - name: load
+          description: |
+            Kibana instance's health status
+        - name: os
           type: group
           fields:
-            - name: 1m
-              type: half_float
-            - name: 5m
-              type: half_float
-            - name: 15m
-              type: half_float
-    - name: concurrent_connections
-      type: long
-      description: |
-        Number of client connections made to the server. Note that browsers can send multiple simultaneous connections to request multiple server assets at once, and they can re-use established connections.
-    - name: process
-      type: group
-      fields:
-        - name: memory.resident_set_size.bytes
-          type: long
-        - name: uptime.ms
+            - name: distro
+              type: keyword
+            - name: distroRelease
+              type: keyword
+            - name: platform
+              type: keyword
+            - name: platformRelease
+              type: keyword
+            - name: memory
+              type: group
+              fields:
+                - name: free_in_bytes
+                  type: long
+                - name: total_in_bytes
+                  type: long
+                - name: used_in_bytes
+                  type: long
+            - name: load
+              type: group
+              fields:
+                - name: 1m
+                  type: half_float
+                - name: 5m
+                  type: half_float
+                - name: 15m
+                  type: half_float
+        - name: concurrent_connections
           type: long
-        - name: event_loop_delay.ms
-          type: scaled_float
           description: |
-            Event loop delay in milliseconds
-        - name: memory.heap
+            Number of client connections made to the server. Note that browsers can send multiple simultaneous connections to request multiple server assets at once, and they can re-use established connections.
+        - name: process
           type: group
           fields:
-            - name: total.bytes
+            - name: memory.resident_set_size.bytes
               type: long
-              format: bytes
-              description: |
-                Total heap allocated to process in bytes
-            - name: used.bytes
+            - name: uptime.ms
               type: long
-              format: bytes
+            - name: event_loop_delay.ms
+              type: scaled_float
               description: |
-                Heap used by process in bytes
-            - name: size_limit.bytes
+                Event loop delay in milliseconds
+            - name: memory.heap
+              type: group
+              fields:
+                - name: total.bytes
+                  type: long
+                  format: bytes
+                  description: |
+                    Total heap allocated to process in bytes
+                - name: used.bytes
+                  type: long
+                  format: bytes
+                  description: |
+                    Heap used by process in bytes
+                - name: size_limit.bytes
+                  type: long
+                  format: bytes
+                  description: |
+                    Max. old space size allocated to Node.js process, in bytes
+                - name: uptime.ms
+                  type: long
+                  description: |
+                    Uptime of process in milliseconds
+        - name: request
+          type: group
+          fields:
+            - name: disconnects
               type: long
-              format: bytes
               description: |
-                Max. old space size allocated to Node.js process, in bytes
-            - name: uptime.ms
+                Number of requests that were disconnected
+            - name: total
               type: long
               description: |
-                Uptime of process in milliseconds
-    - name: request
-      type: group
-      fields:
-        - name: disconnects
-          type: long
-          description: |
-            Number of requests that were disconnected
-        - name: total
-          type: long
-          description: |
-            Total number of requests
-    - name: response_time
-      type: group
-      fields:
-        - name: avg.ms
-          type: long
-          description: Average response time in milliseconds
-        - name: max.ms
-          type: long
-          description: Maximum response time in milliseconds
+                Total number of requests
+        - name: response_time
+          type: group
+          fields:
+            - name: avg.ms
+              type: long
+              description: Average response time in milliseconds
+            - name: max.ms
+              type: long
+              description: Maximum response time in milliseconds
diff --git a/packages/kibana/data_stream/stats/fields/package-fields.yml b/packages/kibana/data_stream/stats/fields/package-fields.yml
index 72c7fcfdc31..17c135032ad 100644
--- a/packages/kibana/data_stream/stats/fields/package-fields.yml
+++ b/packages/kibana/data_stream/stats/fields/package-fields.yml
@@ -1,6 +1,6 @@
-- name: elasticsearch.cluster.id
-  type: keyword
-  description: ID of the Elasticsearch cluster
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
 - name: kibana_stats
   type: group
   fields:
@@ -9,7 +9,13 @@
       path: kibana.stats.response_time.max.ms
     - name: kibana.status
       type: alias
-      path: kibana.stats.kibana.status
+      path: kibana.stats.status
+    - name: kibana.uuid
+      type: alias
+      path: service.id
+    - name: kibana.version
+      type: alias
+      path: service.version
     - name: os.memory.free_in_bytes
       type: alias
       path: kibana.stats.os.memory.free_in_bytes
@@ -49,5 +55,6 @@
     - name: response_times.average
       type: alias
       path: kibana.stats.response_time.avg.ms
-- name: kibana
-  type: group
+    - name: timestamp
+      type: alias
+      path: '@timestamp'
diff --git a/packages/kibana/data_stream/stats/manifest.yml b/packages/kibana/data_stream/stats/manifest.yml
index a5102b8dec7..2760141c62f 100644
--- a/packages/kibana/data_stream/stats/manifest.yml
+++ b/packages/kibana/data_stream/stats/manifest.yml
@@ -1,6 +1,10 @@
 type: metrics
 title: Kibana stats metrics
 release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
 streams:
   - input: kibana/metrics
     title: Kibana stats metrics
diff --git a/packages/kibana/data_stream/status/fields/base-fields.yml b/packages/kibana/data_stream/status/fields/base-fields.yml
index 5316f1c6661..a3e80e3a547 100644
--- a/packages/kibana/data_stream/status/fields/base-fields.yml
+++ b/packages/kibana/data_stream/status/fields/base-fields.yml
@@ -7,6 +7,3 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: service.address
-  type: keyword
-  description: Address where data about this service was collected from.
diff --git a/packages/kibana/data_stream/status/fields/ecs.yml b/packages/kibana/data_stream/status/fields/ecs.yml
index c66fafdcd9d..cc40570f854 100644
--- a/packages/kibana/data_stream/status/fields/ecs.yml
+++ b/packages/kibana/data_stream/status/fields/ecs.yml
@@ -10,3 +10,6 @@
   external: ecs
 - name: ecs.version
   external: ecs
+- name: service.address
+  type: keyword
+  description: Address where data about this service was collected from.
diff --git a/packages/kibana/data_stream/status/manifest.yml b/packages/kibana/data_stream/status/manifest.yml
index 32d077279d5..f4e3b1aaa4e 100644
--- a/packages/kibana/data_stream/status/manifest.yml
+++ b/packages/kibana/data_stream/status/manifest.yml
@@ -1,6 +1,10 @@
 type: metrics
 title: Kibana status metrics
 release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
 streams:
   - input: kibana/metrics
     title: Kibana status metrics
diff --git a/packages/kibana/manifest.yml b/packages/kibana/manifest.yml
index 416540b1522..80d79c8ef16 100644
--- a/packages/kibana/manifest.yml
+++ b/packages/kibana/manifest.yml
@@ -13,7 +13,7 @@ format_version: 1.0.0
 license: basic
 categories: ["elastic_stack"]
 conditions:
-  kibana.version: ^7.15.0
+  kibana.version: ^8.5.0
 policy_templates:
   - name: kibana
     title: Kibana logs and metrics

From 87f5f5a26c856ef25421c5bf5e138e699af4d3f7 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sat, 6 Aug 2022 21:34:51 +0200
Subject: [PATCH 02/15] cluster_actions datastream

---
 .../agent/stream/stream.yml.hbs               | 16 ++++++++++++++
 .../cluster_actions/fields/base-fields.yml    |  9 ++++++++
 .../cluster_actions/fields/ecs.yml            | 22 +++++++++++++++++++
 .../cluster_actions/fields/fields.yml         | 22 +++++++++++++++++++
 .../cluster_actions/fields/package-fields.yml | 15 +++++++++++++
 .../data_stream/cluster_actions/manifest.yml  | 11 ++++++++++
 .../cluster_actions/sample_event.json         |  1 +
 7 files changed, 96 insertions(+)
 create mode 100644 packages/kibana/data_stream/cluster_actions/agent/stream/stream.yml.hbs
 create mode 100644 packages/kibana/data_stream/cluster_actions/fields/base-fields.yml
 create mode 100644 packages/kibana/data_stream/cluster_actions/fields/ecs.yml
 create mode 100644 packages/kibana/data_stream/cluster_actions/fields/fields.yml
 create mode 100644 packages/kibana/data_stream/cluster_actions/fields/package-fields.yml
 create mode 100644 packages/kibana/data_stream/cluster_actions/manifest.yml
 create mode 100644 packages/kibana/data_stream/cluster_actions/sample_event.json

diff --git a/packages/kibana/data_stream/cluster_actions/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/cluster_actions/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..5b3dcc8cb8e
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["cluster_actions"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/cluster_actions/fields/base-fields.yml b/packages/kibana/data_stream/cluster_actions/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/cluster_actions/fields/ecs.yml b/packages/kibana/data_stream/cluster_actions/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/cluster_actions/fields/fields.yml b/packages/kibana/data_stream/cluster_actions/fields/fields.yml
new file mode 100644
index 00000000000..7f76daf3e3c
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/fields.yml
@@ -0,0 +1,22 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: cluster_actions
+      type: group
+      description: >
+        Kibana cluster actions metrics.
+      fields:
+        - name: overdue
+          type: group
+          fields:
+            - name: count
+              type: long
+            - name: delay
+              type: group
+              fields:
+                - name: p50
+                  type: float
+                - name: p99
+                  type: float
diff --git a/packages/kibana/data_stream/cluster_actions/fields/package-fields.yml b/packages/kibana/data_stream/cluster_actions/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/cluster_actions/manifest.yml b/packages/kibana/data_stream/cluster_actions/manifest.yml
new file mode 100644
index 00000000000..6b00477793b
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana cluster_actions metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana cluster_actions metrics
+    description: Collect Kibana cluster_actions metrics
diff --git a/packages/kibana/data_stream/cluster_actions/sample_event.json b/packages/kibana/data_stream/cluster_actions/sample_event.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_actions/sample_event.json
@@ -0,0 +1 @@
+{}

From 84fb7ca158090d158b76be9b244e2cf6a6dd5648 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sat, 6 Aug 2022 21:35:01 +0200
Subject: [PATCH 03/15] cluster_rules datastream

---
 .../cluster_rules/agent/stream/stream.yml.hbs | 16 +++++++++++++
 .../cluster_rules/fields/base-fields.yml      |  9 ++++++++
 .../data_stream/cluster_rules/fields/ecs.yml  | 22 ++++++++++++++++++
 .../cluster_rules/fields/fields.yml           | 23 +++++++++++++++++++
 .../cluster_rules/fields/package-fields.yml   | 15 ++++++++++++
 .../data_stream/cluster_rules/manifest.yml    | 11 +++++++++
 .../cluster_rules/sample_event.json           |  1 +
 7 files changed, 97 insertions(+)
 create mode 100644 packages/kibana/data_stream/cluster_rules/agent/stream/stream.yml.hbs
 create mode 100644 packages/kibana/data_stream/cluster_rules/fields/base-fields.yml
 create mode 100644 packages/kibana/data_stream/cluster_rules/fields/ecs.yml
 create mode 100644 packages/kibana/data_stream/cluster_rules/fields/fields.yml
 create mode 100644 packages/kibana/data_stream/cluster_rules/fields/package-fields.yml
 create mode 100644 packages/kibana/data_stream/cluster_rules/manifest.yml
 create mode 100644 packages/kibana/data_stream/cluster_rules/sample_event.json

diff --git a/packages/kibana/data_stream/cluster_rules/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/cluster_rules/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..2c9de373712
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["cluster_rules"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/cluster_rules/fields/base-fields.yml b/packages/kibana/data_stream/cluster_rules/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/cluster_rules/fields/ecs.yml b/packages/kibana/data_stream/cluster_rules/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/cluster_rules/fields/fields.yml b/packages/kibana/data_stream/cluster_rules/fields/fields.yml
new file mode 100644
index 00000000000..375f582fa93
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/fields.yml
@@ -0,0 +1,23 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: cluster_rules
+      type: group
+      description: >
+        Kibana cluster rule metrics.
+      release: beta
+      fields:
+        - name: overdue
+          type: group
+          fields:
+            - name: count
+              type: long
+            - name: delay
+              type: group
+              fields:
+                - name: p50
+                  type: float
+                - name: p99
+                  type: float
diff --git a/packages/kibana/data_stream/cluster_rules/fields/package-fields.yml b/packages/kibana/data_stream/cluster_rules/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/cluster_rules/manifest.yml b/packages/kibana/data_stream/cluster_rules/manifest.yml
new file mode 100644
index 00000000000..2ecdf23b089
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana cluster_rules metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana cluster_rules metrics
+    description: Collect Kibana cluster_rules metrics
diff --git a/packages/kibana/data_stream/cluster_rules/sample_event.json b/packages/kibana/data_stream/cluster_rules/sample_event.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/packages/kibana/data_stream/cluster_rules/sample_event.json
@@ -0,0 +1 @@
+{}

From c34f9047762119f87fd988d3a3d208053228dfc6 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sat, 6 Aug 2022 21:35:12 +0200
Subject: [PATCH 04/15] node_actions datastream

---
 .../node_actions/agent/stream/stream.yml.hbs  | 16 ++++++++++++++
 .../node_actions/fields/base-fields.yml       |  9 ++++++++
 .../data_stream/node_actions/fields/ecs.yml   | 22 +++++++++++++++++++
 .../node_actions/fields/fields.yml            | 22 +++++++++++++++++++
 .../node_actions/fields/package-fields.yml    | 15 +++++++++++++
 .../data_stream/node_actions/manifest.yml     | 11 ++++++++++
 .../node_actions/sample_event.json            |  1 +
 7 files changed, 96 insertions(+)
 create mode 100644 packages/kibana/data_stream/node_actions/agent/stream/stream.yml.hbs
 create mode 100644 packages/kibana/data_stream/node_actions/fields/base-fields.yml
 create mode 100644 packages/kibana/data_stream/node_actions/fields/ecs.yml
 create mode 100644 packages/kibana/data_stream/node_actions/fields/fields.yml
 create mode 100644 packages/kibana/data_stream/node_actions/fields/package-fields.yml
 create mode 100644 packages/kibana/data_stream/node_actions/manifest.yml
 create mode 100644 packages/kibana/data_stream/node_actions/sample_event.json

diff --git a/packages/kibana/data_stream/node_actions/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/node_actions/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..012bf125cb0
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["node_actions"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/node_actions/fields/base-fields.yml b/packages/kibana/data_stream/node_actions/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/node_actions/fields/ecs.yml b/packages/kibana/data_stream/node_actions/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/node_actions/fields/fields.yml b/packages/kibana/data_stream/node_actions/fields/fields.yml
new file mode 100644
index 00000000000..e55f16e3786
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/fields.yml
@@ -0,0 +1,22 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: node_actions
+      type: group
+      description: >
+        Kibana node actions metrics.
+      release: beta
+      fields:
+        - name: kibana
+          type: group
+          fields:
+            - name: status
+              type: keyword
+        - name: failures
+          type: long
+        - name: executions
+          type: long
+        - name: timeouts
+          type: long
diff --git a/packages/kibana/data_stream/node_actions/fields/package-fields.yml b/packages/kibana/data_stream/node_actions/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/node_actions/manifest.yml b/packages/kibana/data_stream/node_actions/manifest.yml
new file mode 100644
index 00000000000..392b0a81e52
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana node_actions metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana node_actions metrics
+    description: Collect Kibana node_actions metrics
diff --git a/packages/kibana/data_stream/node_actions/sample_event.json b/packages/kibana/data_stream/node_actions/sample_event.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/packages/kibana/data_stream/node_actions/sample_event.json
@@ -0,0 +1 @@
+{}

From 527906141ca9cae7692303697f647a23d18dc1fa Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sat, 6 Aug 2022 21:35:25 +0200
Subject: [PATCH 05/15] node_rules datastream

---
 .../node_rules/agent/stream/stream.yml.hbs    | 16 ++++++++++++++
 .../node_rules/fields/base-fields.yml         |  9 ++++++++
 .../data_stream/node_rules/fields/ecs.yml     | 22 +++++++++++++++++++
 .../data_stream/node_rules/fields/fields.yml  | 22 +++++++++++++++++++
 .../node_rules/fields/package-fields.yml      | 15 +++++++++++++
 .../data_stream/node_rules/manifest.yml       | 11 ++++++++++
 .../data_stream/node_rules/sample_event.json  |  1 +
 7 files changed, 96 insertions(+)
 create mode 100644 packages/kibana/data_stream/node_rules/agent/stream/stream.yml.hbs
 create mode 100644 packages/kibana/data_stream/node_rules/fields/base-fields.yml
 create mode 100644 packages/kibana/data_stream/node_rules/fields/ecs.yml
 create mode 100644 packages/kibana/data_stream/node_rules/fields/fields.yml
 create mode 100644 packages/kibana/data_stream/node_rules/fields/package-fields.yml
 create mode 100644 packages/kibana/data_stream/node_rules/manifest.yml
 create mode 100644 packages/kibana/data_stream/node_rules/sample_event.json

diff --git a/packages/kibana/data_stream/node_rules/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/node_rules/agent/stream/stream.yml.hbs
new file mode 100644
index 00000000000..f2aef622c8c
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/agent/stream/stream.yml.hbs
@@ -0,0 +1,16 @@
+metricsets: ["node_rules"]
+hosts:
+{{#each hosts}}
+  - {{this}}
+{{/each}}
+{{#if basepath}}
+basepath: {{basepath}}
+{{/if}}
+{{#if username}}
+username: {{username}}
+{{/if}}
+{{#if password}}
+password: {{password}}
+{{/if}}
+period: {{period}}
+
diff --git a/packages/kibana/data_stream/node_rules/fields/base-fields.yml b/packages/kibana/data_stream/node_rules/fields/base-fields.yml
new file mode 100644
index 00000000000..a3e80e3a547
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/base-fields.yml
@@ -0,0 +1,9 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
diff --git a/packages/kibana/data_stream/node_rules/fields/ecs.yml b/packages/kibana/data_stream/node_rules/fields/ecs.yml
new file mode 100644
index 00000000000..7a5b56ce613
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/ecs.yml
@@ -0,0 +1,22 @@
+- name: '@timestamp'
+  external: ecs
+- name: service.id
+  external: ecs
+- name: service.address
+  external: ecs
+- name: service.version
+  external: ecs
+- name: service.type
+  external: ecs
+- name: ecs.version
+  external: ecs
+- name: process.pid
+  external: ecs
+- name: event.dataset
+  external: ecs
+- name: event.duration
+  external: ecs
+- name: event.module
+  external: ecs
+- name: host.name
+  external: ecs
diff --git a/packages/kibana/data_stream/node_rules/fields/fields.yml b/packages/kibana/data_stream/node_rules/fields/fields.yml
new file mode 100644
index 00000000000..9ebded160aa
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/fields.yml
@@ -0,0 +1,22 @@
+- name: kibana
+  type: group
+  fields:
+    - name: elasticsearch.cluster.id
+      type: keyword
+    - name: node_rules
+      type: group
+      description: >
+        Kibana node rule metrics.
+      release: beta
+      fields:
+        - name: kibana
+          type: group
+          fields:
+            - name: status
+              type: keyword
+        - name: failures
+          type: long
+        - name: executions
+          type: long
+        - name: timeouts
+          type: long
diff --git a/packages/kibana/data_stream/node_rules/fields/package-fields.yml b/packages/kibana/data_stream/node_rules/fields/package-fields.yml
new file mode 100644
index 00000000000..bf8a3120508
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/fields/package-fields.yml
@@ -0,0 +1,15 @@
+- name: timestamp
+  type: alias
+  path: '@timestamp'
+- name: cluster_uuid
+  type: alias
+  path: kibana.elasticsearch.cluster.id
+- name: kibana_stats.kibana.uuid
+  type: alias
+  path: service.id
+- name: kibana_stats.kibana.version
+  type: alias
+  path: service.version
+- name: kibana_stats.timestamp
+  type: alias
+  path: '@timestamp'
diff --git a/packages/kibana/data_stream/node_rules/manifest.yml b/packages/kibana/data_stream/node_rules/manifest.yml
new file mode 100644
index 00000000000..9b07eb74a86
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/manifest.yml
@@ -0,0 +1,11 @@
+type: metrics
+title: Kibana node_rules metrics
+release: experimental
+elasticsearch:
+  index_template:
+    mappings:
+      dynamic: false
+streams:
+  - input: kibana/metrics
+    title: Kibana node_rules metrics
+    description: Collect Kibana node_rules metrics
diff --git a/packages/kibana/data_stream/node_rules/sample_event.json b/packages/kibana/data_stream/node_rules/sample_event.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/packages/kibana/data_stream/node_rules/sample_event.json
@@ -0,0 +1 @@
+{}

From 3b3b2bc38d2f8abed5df34b19939e6de19210c53 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sat, 6 Aug 2022 23:02:05 +0200
Subject: [PATCH 06/15] invalid property

---
 packages/kibana/data_stream/cluster_actions/fields/fields.yml | 2 --
 packages/kibana/data_stream/cluster_rules/fields/fields.yml   | 2 --
 packages/kibana/data_stream/node_actions/fields/fields.yml    | 2 --
 packages/kibana/data_stream/node_rules/fields/fields.yml      | 2 --
 4 files changed, 8 deletions(-)

diff --git a/packages/kibana/data_stream/cluster_actions/fields/fields.yml b/packages/kibana/data_stream/cluster_actions/fields/fields.yml
index 7f76daf3e3c..3793e3a65c3 100644
--- a/packages/kibana/data_stream/cluster_actions/fields/fields.yml
+++ b/packages/kibana/data_stream/cluster_actions/fields/fields.yml
@@ -5,8 +5,6 @@
       type: keyword
     - name: cluster_actions
       type: group
-      description: >
-        Kibana cluster actions metrics.
       fields:
         - name: overdue
           type: group
diff --git a/packages/kibana/data_stream/cluster_rules/fields/fields.yml b/packages/kibana/data_stream/cluster_rules/fields/fields.yml
index 375f582fa93..3c2fc6b07ee 100644
--- a/packages/kibana/data_stream/cluster_rules/fields/fields.yml
+++ b/packages/kibana/data_stream/cluster_rules/fields/fields.yml
@@ -5,8 +5,6 @@
       type: keyword
     - name: cluster_rules
       type: group
-      description: >
-        Kibana cluster rule metrics.
       release: beta
       fields:
         - name: overdue
diff --git a/packages/kibana/data_stream/node_actions/fields/fields.yml b/packages/kibana/data_stream/node_actions/fields/fields.yml
index e55f16e3786..3a978ab729c 100644
--- a/packages/kibana/data_stream/node_actions/fields/fields.yml
+++ b/packages/kibana/data_stream/node_actions/fields/fields.yml
@@ -5,8 +5,6 @@
       type: keyword
     - name: node_actions
       type: group
-      description: >
-        Kibana node actions metrics.
       release: beta
       fields:
         - name: kibana
diff --git a/packages/kibana/data_stream/node_rules/fields/fields.yml b/packages/kibana/data_stream/node_rules/fields/fields.yml
index 9ebded160aa..68ebb2e9305 100644
--- a/packages/kibana/data_stream/node_rules/fields/fields.yml
+++ b/packages/kibana/data_stream/node_rules/fields/fields.yml
@@ -5,8 +5,6 @@
       type: keyword
     - name: node_rules
       type: group
-      description: >
-        Kibana node rule metrics.
       release: beta
       fields:
         - name: kibana

From d478b832ba85ca2d515fc64c8e1b20e58bcd9c72 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sat, 6 Aug 2022 23:43:49 +0200
Subject: [PATCH 07/15] add sample events for new metricsets

---
 .../cluster_actions/sample_event.json         | 75 ++++++++++++++++++-
 .../cluster_rules/sample_event.json           | 75 ++++++++++++++++++-
 .../node_actions/sample_event.json            | 71 +++++++++++++++++-
 .../data_stream/node_rules/sample_event.json  | 71 +++++++++++++++++-
 4 files changed, 288 insertions(+), 4 deletions(-)

diff --git a/packages/kibana/data_stream/cluster_actions/sample_event.json b/packages/kibana/data_stream/cluster_actions/sample_event.json
index 0967ef424bc..975743bbc92 100644
--- a/packages/kibana/data_stream/cluster_actions/sample_event.json
+++ b/packages/kibana/data_stream/cluster_actions/sample_event.json
@@ -1 +1,74 @@
-{}
+{
+  "agent": {
+    "name": "docker-fleet-agent",
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "type": "metricbeat",
+    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+    "version": "8.5.0"
+  },
+  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+  "elastic_agent": {
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "version": "8.5.0",
+    "snapshot": true
+  },
+  "@timestamp": "2022-08-06T21:38:59.780Z",
+  "service.version": "8.5.0",
+  "ecs": {
+    "version": "8.0.0"
+  },
+  "service": {
+    "address": "https://kibana:5601/api/monitoring_collection/cluster_actions",
+    "type": "kibana"
+  },
+  "service.address": "0.0.0.0:5601",
+  "data_stream": {
+    "namespace": "default",
+    "type": "metrics",
+    "dataset": "kibana.cluster_actions"
+  },
+  "host": {
+    "hostname": "docker-fleet-agent",
+    "os": {
+      "kernel": "5.10.47-linuxkit",
+      "codename": "focal",
+      "name": "Ubuntu",
+      "type": "linux",
+      "family": "debian",
+      "version": "20.04.4 LTS (Focal Fossa)",
+      "platform": "ubuntu"
+    },
+    "containerized": true,
+    "ip": [
+      "172.20.0.7"
+    ],
+    "name": "docker-fleet-agent",
+    "mac": [
+      "02:42:ac:14:00:07"
+    ],
+    "architecture": "x86_64"
+  },
+  "metricset": {
+    "period": 10000,
+    "name": "cluster_actions"
+  },
+  "event": {
+    "duration": 13732239,
+    "agent_id_status": "verified",
+    "ingested": "2022-08-06T21:39:00Z",
+    "module": "kibana",
+    "dataset": "kibana.cluster_actions"
+  },
+  "kibana": {
+    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+    "cluster_actions": {
+      "overdue": {
+        "delay": {
+          "p99": 0,
+          "p50": 0
+        },
+        "count": 0
+      }
+    }
+  }
+}
diff --git a/packages/kibana/data_stream/cluster_rules/sample_event.json b/packages/kibana/data_stream/cluster_rules/sample_event.json
index 0967ef424bc..26300155f76 100644
--- a/packages/kibana/data_stream/cluster_rules/sample_event.json
+++ b/packages/kibana/data_stream/cluster_rules/sample_event.json
@@ -1 +1,74 @@
-{}
+{
+  "agent": {
+    "name": "docker-fleet-agent",
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+    "type": "metricbeat",
+    "version": "8.5.0"
+  },
+  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+  "elastic_agent": {
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "version": "8.5.0",
+    "snapshot": true
+  },
+  "@timestamp": "2022-08-06T21:41:29.650Z",
+  "service.version": "8.5.0",
+  "ecs": {
+    "version": "8.0.0"
+  },
+  "service": {
+    "address": "https://kibana:5601/api/monitoring_collection/cluster_rules",
+    "type": "kibana"
+  },
+  "data_stream": {
+    "namespace": "default",
+    "type": "metrics",
+    "dataset": "kibana.cluster_rules"
+  },
+  "service.address": "0.0.0.0:5601",
+  "host": {
+    "hostname": "docker-fleet-agent",
+    "os": {
+      "kernel": "5.10.47-linuxkit",
+      "codename": "focal",
+      "name": "Ubuntu",
+      "type": "linux",
+      "family": "debian",
+      "version": "20.04.4 LTS (Focal Fossa)",
+      "platform": "ubuntu"
+    },
+    "containerized": true,
+    "ip": [
+      "172.20.0.7"
+    ],
+    "name": "docker-fleet-agent",
+    "mac": [
+      "02:42:ac:14:00:07"
+    ],
+    "architecture": "x86_64"
+  },
+  "metricset": {
+    "period": 10000,
+    "name": "cluster_rules"
+  },
+  "event": {
+    "duration": 8419517,
+    "agent_id_status": "verified",
+    "ingested": "2022-08-06T21:41:30Z",
+    "module": "kibana",
+    "dataset": "kibana.cluster_rules"
+  },
+  "kibana": {
+    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+    "cluster_rules": {
+      "overdue": {
+        "delay": {
+          "p99": 0,
+          "p50": 0
+        },
+        "count": 0
+      }
+    }
+  }
+}
diff --git a/packages/kibana/data_stream/node_actions/sample_event.json b/packages/kibana/data_stream/node_actions/sample_event.json
index 0967ef424bc..8bcf95fe28a 100644
--- a/packages/kibana/data_stream/node_actions/sample_event.json
+++ b/packages/kibana/data_stream/node_actions/sample_event.json
@@ -1 +1,70 @@
-{}
+{
+  "agent": {
+    "name": "docker-fleet-agent",
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "type": "metricbeat",
+    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+    "version": "8.5.0"
+  },
+  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+  "elastic_agent": {
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "version": "8.5.0",
+    "snapshot": true
+  },
+  "@timestamp": "2022-08-06T21:42:19.560Z",
+  "ecs": {
+    "version": "8.0.0"
+  },
+  "service.version": "8.5.0",
+  "service.address": "0.0.0.0:5601",
+  "service": {
+    "address": "https://kibana:5601/api/monitoring_collection/node_actions",
+    "type": "kibana"
+  },
+  "data_stream": {
+    "namespace": "default",
+    "type": "metrics",
+    "dataset": "kibana.node_actions"
+  },
+  "host": {
+    "hostname": "docker-fleet-agent",
+    "os": {
+      "kernel": "5.10.47-linuxkit",
+      "codename": "focal",
+      "name": "Ubuntu",
+      "family": "debian",
+      "type": "linux",
+      "version": "20.04.4 LTS (Focal Fossa)",
+      "platform": "ubuntu"
+    },
+    "containerized": true,
+    "ip": [
+      "172.20.0.7"
+    ],
+    "name": "docker-fleet-agent",
+    "mac": [
+      "02:42:ac:14:00:07"
+    ],
+    "architecture": "x86_64"
+  },
+  "metricset": {
+    "period": 10000,
+    "name": "node_actions"
+  },
+  "event": {
+    "duration": 6658572,
+    "agent_id_status": "verified",
+    "ingested": "2022-08-06T21:42:20Z",
+    "module": "kibana",
+    "dataset": "kibana.node_actions"
+  },
+  "kibana": {
+    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+    "node_actions": {
+      "failures": 0,
+      "executions": 0,
+      "timeouts": 0
+    }
+  }
+}
diff --git a/packages/kibana/data_stream/node_rules/sample_event.json b/packages/kibana/data_stream/node_rules/sample_event.json
index 0967ef424bc..32c6588ad0e 100644
--- a/packages/kibana/data_stream/node_rules/sample_event.json
+++ b/packages/kibana/data_stream/node_rules/sample_event.json
@@ -1 +1,70 @@
-{}
+{
+  "agent": {
+    "name": "docker-fleet-agent",
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+    "type": "metricbeat",
+    "version": "8.5.0"
+  },
+  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+  "elastic_agent": {
+    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+    "version": "8.5.0",
+    "snapshot": true
+  },
+  "@timestamp": "2022-08-06T21:42:59.474Z",
+  "service.version": "8.5.0",
+  "ecs": {
+    "version": "8.0.0"
+  },
+  "service.address": "0.0.0.0:5601",
+  "data_stream": {
+    "namespace": "default",
+    "type": "metrics",
+    "dataset": "kibana.node_rules"
+  },
+  "service": {
+    "address": "https://kibana:5601/api/monitoring_collection/node_rules",
+    "type": "kibana"
+  },
+  "host": {
+    "hostname": "docker-fleet-agent",
+    "os": {
+      "kernel": "5.10.47-linuxkit",
+      "codename": "focal",
+      "name": "Ubuntu",
+      "type": "linux",
+      "family": "debian",
+      "version": "20.04.4 LTS (Focal Fossa)",
+      "platform": "ubuntu"
+    },
+    "containerized": true,
+    "ip": [
+      "172.20.0.7"
+    ],
+    "name": "docker-fleet-agent",
+    "mac": [
+      "02:42:ac:14:00:07"
+    ],
+    "architecture": "x86_64"
+  },
+  "metricset": {
+    "period": 10000,
+    "name": "node_rules"
+  },
+  "kibana": {
+    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+    "node_rules": {
+      "failures": 0,
+      "executions": 0,
+      "timeouts": 0
+    }
+  },
+  "event": {
+    "duration": 9031470,
+    "agent_id_status": "verified",
+    "ingested": "2022-08-06T21:43:00Z",
+    "module": "kibana",
+    "dataset": "kibana.node_rules"
+  }
+}

From 15c4dc0d9bd871d8fa6c20d091fdac521f6b62e8 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sun, 7 Aug 2022 00:11:02 +0200
Subject: [PATCH 08/15] format the package

---
 .../cluster_actions/sample_event.json         | 140 +++++++++---------
 .../cluster_rules/sample_event.json           | 140 +++++++++---------
 .../node_actions/sample_event.json            | 134 ++++++++---------
 .../data_stream/node_rules/sample_event.json  | 134 ++++++++---------
 4 files changed, 274 insertions(+), 274 deletions(-)

diff --git a/packages/kibana/data_stream/cluster_actions/sample_event.json b/packages/kibana/data_stream/cluster_actions/sample_event.json
index 975743bbc92..82f597effa0 100644
--- a/packages/kibana/data_stream/cluster_actions/sample_event.json
+++ b/packages/kibana/data_stream/cluster_actions/sample_event.json
@@ -1,74 +1,74 @@
 {
-  "agent": {
-    "name": "docker-fleet-agent",
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "type": "metricbeat",
-    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
-    "version": "8.5.0"
-  },
-  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
-  "elastic_agent": {
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "version": "8.5.0",
-    "snapshot": true
-  },
-  "@timestamp": "2022-08-06T21:38:59.780Z",
-  "service.version": "8.5.0",
-  "ecs": {
-    "version": "8.0.0"
-  },
-  "service": {
-    "address": "https://kibana:5601/api/monitoring_collection/cluster_actions",
-    "type": "kibana"
-  },
-  "service.address": "0.0.0.0:5601",
-  "data_stream": {
-    "namespace": "default",
-    "type": "metrics",
-    "dataset": "kibana.cluster_actions"
-  },
-  "host": {
-    "hostname": "docker-fleet-agent",
-    "os": {
-      "kernel": "5.10.47-linuxkit",
-      "codename": "focal",
-      "name": "Ubuntu",
-      "type": "linux",
-      "family": "debian",
-      "version": "20.04.4 LTS (Focal Fossa)",
-      "platform": "ubuntu"
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "type": "metricbeat",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "version": "8.5.0"
     },
-    "containerized": true,
-    "ip": [
-      "172.20.0.7"
-    ],
-    "name": "docker-fleet-agent",
-    "mac": [
-      "02:42:ac:14:00:07"
-    ],
-    "architecture": "x86_64"
-  },
-  "metricset": {
-    "period": 10000,
-    "name": "cluster_actions"
-  },
-  "event": {
-    "duration": 13732239,
-    "agent_id_status": "verified",
-    "ingested": "2022-08-06T21:39:00Z",
-    "module": "kibana",
-    "dataset": "kibana.cluster_actions"
-  },
-  "kibana": {
-    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
-    "cluster_actions": {
-      "overdue": {
-        "delay": {
-          "p99": 0,
-          "p50": 0
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:38:59.780Z",
+    "service.version": "8.5.0",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/cluster_actions",
+        "type": "kibana"
+    },
+    "service.address": "0.0.0.0:5601",
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.cluster_actions"
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
         },
-        "count": 0
-      }
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "cluster_actions"
+    },
+    "event": {
+        "duration": 13732239,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:39:00Z",
+        "module": "kibana",
+        "dataset": "kibana.cluster_actions"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "cluster_actions": {
+            "overdue": {
+                "delay": {
+                    "p99": 0,
+                    "p50": 0
+                },
+                "count": 0
+            }
+        }
     }
-  }
-}
+}
\ No newline at end of file
diff --git a/packages/kibana/data_stream/cluster_rules/sample_event.json b/packages/kibana/data_stream/cluster_rules/sample_event.json
index 26300155f76..bda053b694b 100644
--- a/packages/kibana/data_stream/cluster_rules/sample_event.json
+++ b/packages/kibana/data_stream/cluster_rules/sample_event.json
@@ -1,74 +1,74 @@
 {
-  "agent": {
-    "name": "docker-fleet-agent",
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
-    "type": "metricbeat",
-    "version": "8.5.0"
-  },
-  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
-  "elastic_agent": {
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "version": "8.5.0",
-    "snapshot": true
-  },
-  "@timestamp": "2022-08-06T21:41:29.650Z",
-  "service.version": "8.5.0",
-  "ecs": {
-    "version": "8.0.0"
-  },
-  "service": {
-    "address": "https://kibana:5601/api/monitoring_collection/cluster_rules",
-    "type": "kibana"
-  },
-  "data_stream": {
-    "namespace": "default",
-    "type": "metrics",
-    "dataset": "kibana.cluster_rules"
-  },
-  "service.address": "0.0.0.0:5601",
-  "host": {
-    "hostname": "docker-fleet-agent",
-    "os": {
-      "kernel": "5.10.47-linuxkit",
-      "codename": "focal",
-      "name": "Ubuntu",
-      "type": "linux",
-      "family": "debian",
-      "version": "20.04.4 LTS (Focal Fossa)",
-      "platform": "ubuntu"
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "type": "metricbeat",
+        "version": "8.5.0"
     },
-    "containerized": true,
-    "ip": [
-      "172.20.0.7"
-    ],
-    "name": "docker-fleet-agent",
-    "mac": [
-      "02:42:ac:14:00:07"
-    ],
-    "architecture": "x86_64"
-  },
-  "metricset": {
-    "period": 10000,
-    "name": "cluster_rules"
-  },
-  "event": {
-    "duration": 8419517,
-    "agent_id_status": "verified",
-    "ingested": "2022-08-06T21:41:30Z",
-    "module": "kibana",
-    "dataset": "kibana.cluster_rules"
-  },
-  "kibana": {
-    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
-    "cluster_rules": {
-      "overdue": {
-        "delay": {
-          "p99": 0,
-          "p50": 0
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:41:29.650Z",
+    "service.version": "8.5.0",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/cluster_rules",
+        "type": "kibana"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.cluster_rules"
+    },
+    "service.address": "0.0.0.0:5601",
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
         },
-        "count": 0
-      }
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "cluster_rules"
+    },
+    "event": {
+        "duration": 8419517,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:41:30Z",
+        "module": "kibana",
+        "dataset": "kibana.cluster_rules"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "cluster_rules": {
+            "overdue": {
+                "delay": {
+                    "p99": 0,
+                    "p50": 0
+                },
+                "count": 0
+            }
+        }
     }
-  }
-}
+}
\ No newline at end of file
diff --git a/packages/kibana/data_stream/node_actions/sample_event.json b/packages/kibana/data_stream/node_actions/sample_event.json
index 8bcf95fe28a..264230273b3 100644
--- a/packages/kibana/data_stream/node_actions/sample_event.json
+++ b/packages/kibana/data_stream/node_actions/sample_event.json
@@ -1,70 +1,70 @@
 {
-  "agent": {
-    "name": "docker-fleet-agent",
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "type": "metricbeat",
-    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
-    "version": "8.5.0"
-  },
-  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
-  "elastic_agent": {
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "version": "8.5.0",
-    "snapshot": true
-  },
-  "@timestamp": "2022-08-06T21:42:19.560Z",
-  "ecs": {
-    "version": "8.0.0"
-  },
-  "service.version": "8.5.0",
-  "service.address": "0.0.0.0:5601",
-  "service": {
-    "address": "https://kibana:5601/api/monitoring_collection/node_actions",
-    "type": "kibana"
-  },
-  "data_stream": {
-    "namespace": "default",
-    "type": "metrics",
-    "dataset": "kibana.node_actions"
-  },
-  "host": {
-    "hostname": "docker-fleet-agent",
-    "os": {
-      "kernel": "5.10.47-linuxkit",
-      "codename": "focal",
-      "name": "Ubuntu",
-      "family": "debian",
-      "type": "linux",
-      "version": "20.04.4 LTS (Focal Fossa)",
-      "platform": "ubuntu"
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "type": "metricbeat",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "version": "8.5.0"
     },
-    "containerized": true,
-    "ip": [
-      "172.20.0.7"
-    ],
-    "name": "docker-fleet-agent",
-    "mac": [
-      "02:42:ac:14:00:07"
-    ],
-    "architecture": "x86_64"
-  },
-  "metricset": {
-    "period": 10000,
-    "name": "node_actions"
-  },
-  "event": {
-    "duration": 6658572,
-    "agent_id_status": "verified",
-    "ingested": "2022-08-06T21:42:20Z",
-    "module": "kibana",
-    "dataset": "kibana.node_actions"
-  },
-  "kibana": {
-    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
-    "node_actions": {
-      "failures": 0,
-      "executions": 0,
-      "timeouts": 0
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:42:19.560Z",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service.version": "8.5.0",
+    "service.address": "0.0.0.0:5601",
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/node_actions",
+        "type": "kibana"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.node_actions"
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "family": "debian",
+            "type": "linux",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "node_actions"
+    },
+    "event": {
+        "duration": 6658572,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:42:20Z",
+        "module": "kibana",
+        "dataset": "kibana.node_actions"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "node_actions": {
+            "failures": 0,
+            "executions": 0,
+            "timeouts": 0
+        }
     }
-  }
-}
+}
\ No newline at end of file
diff --git a/packages/kibana/data_stream/node_rules/sample_event.json b/packages/kibana/data_stream/node_rules/sample_event.json
index 32c6588ad0e..cb48feef64b 100644
--- a/packages/kibana/data_stream/node_rules/sample_event.json
+++ b/packages/kibana/data_stream/node_rules/sample_event.json
@@ -1,70 +1,70 @@
 {
-  "agent": {
-    "name": "docker-fleet-agent",
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
-    "type": "metricbeat",
-    "version": "8.5.0"
-  },
-  "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
-  "elastic_agent": {
-    "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
-    "version": "8.5.0",
-    "snapshot": true
-  },
-  "@timestamp": "2022-08-06T21:42:59.474Z",
-  "service.version": "8.5.0",
-  "ecs": {
-    "version": "8.0.0"
-  },
-  "service.address": "0.0.0.0:5601",
-  "data_stream": {
-    "namespace": "default",
-    "type": "metrics",
-    "dataset": "kibana.node_rules"
-  },
-  "service": {
-    "address": "https://kibana:5601/api/monitoring_collection/node_rules",
-    "type": "kibana"
-  },
-  "host": {
-    "hostname": "docker-fleet-agent",
-    "os": {
-      "kernel": "5.10.47-linuxkit",
-      "codename": "focal",
-      "name": "Ubuntu",
-      "type": "linux",
-      "family": "debian",
-      "version": "20.04.4 LTS (Focal Fossa)",
-      "platform": "ubuntu"
+    "agent": {
+        "name": "docker-fleet-agent",
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "ephemeral_id": "f0c34fc3-ac35-4a80-80ed-a0de44ff6be0",
+        "type": "metricbeat",
+        "version": "8.5.0"
     },
-    "containerized": true,
-    "ip": [
-      "172.20.0.7"
-    ],
-    "name": "docker-fleet-agent",
-    "mac": [
-      "02:42:ac:14:00:07"
-    ],
-    "architecture": "x86_64"
-  },
-  "metricset": {
-    "period": 10000,
-    "name": "node_rules"
-  },
-  "kibana": {
-    "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
-    "node_rules": {
-      "failures": 0,
-      "executions": 0,
-      "timeouts": 0
+    "service.id": "543c4fcf-bf38-4483-8cc4-df01fcb095e1",
+    "elastic_agent": {
+        "id": "83c9f2b5-5134-4df2-88d8-ae48906024fc",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "@timestamp": "2022-08-06T21:42:59.474Z",
+    "service.version": "8.5.0",
+    "ecs": {
+        "version": "8.0.0"
+    },
+    "service.address": "0.0.0.0:5601",
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "kibana.node_rules"
+    },
+    "service": {
+        "address": "https://kibana:5601/api/monitoring_collection/node_rules",
+        "type": "kibana"
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.20.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:14:00:07"
+        ],
+        "architecture": "x86_64"
+    },
+    "metricset": {
+        "period": 10000,
+        "name": "node_rules"
+    },
+    "kibana": {
+        "elasticsearch.cluster.id": "Og-OqdQZQ62JHTfGBMc0CA",
+        "node_rules": {
+            "failures": 0,
+            "executions": 0,
+            "timeouts": 0
+        }
+    },
+    "event": {
+        "duration": 9031470,
+        "agent_id_status": "verified",
+        "ingested": "2022-08-06T21:43:00Z",
+        "module": "kibana",
+        "dataset": "kibana.node_rules"
     }
-  },
-  "event": {
-    "duration": 9031470,
-    "agent_id_status": "verified",
-    "ingested": "2022-08-06T21:43:00Z",
-    "module": "kibana",
-    "dataset": "kibana.node_rules"
-  }
-}
+}
\ No newline at end of file

From a0777f8babe005c365ed9a21f7f2d1c512ee42e8 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sun, 7 Aug 2022 00:35:09 +0200
Subject: [PATCH 09/15] update stats sample_event

---
 .../data_stream/stats/sample_event.json       | 109 ++++++++++++------
 1 file changed, 74 insertions(+), 35 deletions(-)

diff --git a/packages/kibana/data_stream/stats/sample_event.json b/packages/kibana/data_stream/stats/sample_event.json
index 61989b19e54..289f03541de 100644
--- a/packages/kibana/data_stream/stats/sample_event.json
+++ b/packages/kibana/data_stream/stats/sample_event.json
@@ -1,53 +1,72 @@
 {
-    "@timestamp": "2021-08-11T09:37:48.038Z",
     "agent": {
-        "hostname": "docker-fleet-agent",
         "name": "docker-fleet-agent",
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "ephemeral_id": "c73a88e9-ff0d-4bc0-8454-a4eace232146",
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
         "type": "metricbeat",
-        "version": "7.15.0"
+        "ephemeral_id": "ab3cdd2a-3336-4682-a038-6844197893f4",
+        "version": "8.5.0"
     },
     "process": {
-        "pid": 1218
-    },
-    "elastic_agent": {
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "version": "7.15.0",
-        "snapshot": true
+        "pid": 7
     },
+    "@timestamp": "2022-08-06T22:34:12.983Z",
     "ecs": {
-        "version": "1.10.0"
-    },
-    "elasticsearch": {
-        "cluster": {
-            "id": "hEwxs-BJRuWNwJOV__gppg"
-        }
-    },
-    "service": {
-        "address": "http://kibana:5601/api/stats?extended=true",
-        "name": "kibana",
-        "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
-        "type": "kibana",
-        "version": "7.15.0"
+        "version": "8.0.0"
     },
     "data_stream": {
         "namespace": "default",
         "type": "metrics",
         "dataset": "kibana.stats"
     },
+    "service": {
+        "address": "https://kibana:5601/api/stats?extended=true",
+        "id": "79307ef1-725a-4f29-992a-446bcbedf380",
+        "type": "kibana",
+        "version": "8.5.0"
+    },
+    "elastic_agent": {
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.21.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:15:00:07"
+        ],
+        "architecture": "x86_64"
+    },
     "metricset": {
         "period": 10000,
         "name": "stats"
     },
     "event": {
-        "duration": 16850171,
+        "duration": 22471757,
         "agent_id_status": "verified",
-        "ingested": "2021-08-11T09:37:51.538117032Z",
+        "ingested": "2022-08-06T22:34:13Z",
         "module": "kibana",
         "dataset": "kibana.stats"
     },
     "kibana": {
+        "elasticsearch": {
+            "cluster": {
+                "id": "wMZ6Mw1nR1ydMG25AiiOLw"
+            }
+        },
         "stats": {
             "request": {
                 "total": 4,
@@ -55,12 +74,15 @@
             },
             "process": {
                 "memory": {
+                    "resident_set_size": {
+                        "bytes": 510763008
+                    },
                     "heap": {
                         "total": {
-                            "bytes": 296554496
+                            "bytes": 354033664
                         },
                         "used": {
-                            "bytes": 228129512
+                            "bytes": 280320136
                         },
                         "size_limit": {
                             "bytes": 4345298944
@@ -68,26 +90,43 @@
                     }
                 },
                 "event_loop_delay": {
-                    "ms": 0.56603500014171
+                    "ms": 10.395972266666668
                 },
                 "uptime": {
-                    "ms": 1088184
+                    "ms": 64365
                 }
             },
+            "os": {
+                "distroRelease": "Ubuntu-20.04",
+                "distro": "Ubuntu",
+                "memory": {
+                    "used_in_bytes": 4305055744,
+                    "total_in_bytes": 35739144192,
+                    "free_in_bytes": 31434088448
+                },
+                "load": {
+                    "5m": 0.66,
+                    "15m": 0.25,
+                    "1m": 1.66
+                },
+                "platformRelease": "linux-5.10.47-linuxkit",
+                "platform": "linux"
+            },
+            "transport_address": "0.0.0.0:5601",
+            "name": "kibana",
             "host": {
                 "name": "0.0.0.0"
             },
-            "name": "kibana",
-            "index": "kibana",
+            "index": ".kibana",
             "response_time": {
                 "avg": {
-                    "ms": 11
+                    "ms": 8
                 },
                 "max": {
-                    "ms": 16
+                    "ms": 11
                 }
             },
-            "concurrent_connections": 8,
+            "concurrent_connections": 10,
             "snapshot": true,
             "status": "green"
         }

From 815aa860fbb7d6f33d6add64e5622ddf69111618 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Sun, 7 Aug 2022 00:54:35 +0200
Subject: [PATCH 10/15] update redame

---
 packages/kibana/docs/README.md | 109 ++++++++++++++++++++++-----------
 1 file changed, 74 insertions(+), 35 deletions(-)

diff --git a/packages/kibana/docs/README.md b/packages/kibana/docs/README.md
index 30491cb67c0..cfd1427ad0d 100644
--- a/packages/kibana/docs/README.md
+++ b/packages/kibana/docs/README.md
@@ -122,55 +122,74 @@ An example event for `stats` looks as following:
 
 ```json
 {
-    "@timestamp": "2021-08-11T09:37:48.038Z",
     "agent": {
-        "hostname": "docker-fleet-agent",
         "name": "docker-fleet-agent",
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "ephemeral_id": "c73a88e9-ff0d-4bc0-8454-a4eace232146",
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
         "type": "metricbeat",
-        "version": "7.15.0"
+        "ephemeral_id": "ab3cdd2a-3336-4682-a038-6844197893f4",
+        "version": "8.5.0"
     },
     "process": {
-        "pid": 1218
-    },
-    "elastic_agent": {
-        "id": "09cdd3e1-f67a-4aca-bd69-ab2a5127490c",
-        "version": "7.15.0",
-        "snapshot": true
+        "pid": 7
     },
+    "@timestamp": "2022-08-06T22:34:12.983Z",
     "ecs": {
-        "version": "1.10.0"
-    },
-    "elasticsearch": {
-        "cluster": {
-            "id": "hEwxs-BJRuWNwJOV__gppg"
-        }
-    },
-    "service": {
-        "address": "http://kibana:5601/api/stats?extended=true",
-        "name": "kibana",
-        "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
-        "type": "kibana",
-        "version": "7.15.0"
+        "version": "8.0.0"
     },
     "data_stream": {
         "namespace": "default",
         "type": "metrics",
         "dataset": "kibana.stats"
     },
+    "service": {
+        "address": "https://kibana:5601/api/stats?extended=true",
+        "id": "79307ef1-725a-4f29-992a-446bcbedf380",
+        "type": "kibana",
+        "version": "8.5.0"
+    },
+    "elastic_agent": {
+        "id": "44d99b67-3ac6-44a7-aa72-63367a8c2f8b",
+        "version": "8.5.0",
+        "snapshot": true
+    },
+    "host": {
+        "hostname": "docker-fleet-agent",
+        "os": {
+            "kernel": "5.10.47-linuxkit",
+            "codename": "focal",
+            "name": "Ubuntu",
+            "type": "linux",
+            "family": "debian",
+            "version": "20.04.4 LTS (Focal Fossa)",
+            "platform": "ubuntu"
+        },
+        "containerized": true,
+        "ip": [
+            "172.21.0.7"
+        ],
+        "name": "docker-fleet-agent",
+        "mac": [
+            "02:42:ac:15:00:07"
+        ],
+        "architecture": "x86_64"
+    },
     "metricset": {
         "period": 10000,
         "name": "stats"
     },
     "event": {
-        "duration": 16850171,
+        "duration": 22471757,
         "agent_id_status": "verified",
-        "ingested": "2021-08-11T09:37:51.538117032Z",
+        "ingested": "2022-08-06T22:34:13Z",
         "module": "kibana",
         "dataset": "kibana.stats"
     },
     "kibana": {
+        "elasticsearch": {
+            "cluster": {
+                "id": "wMZ6Mw1nR1ydMG25AiiOLw"
+            }
+        },
         "stats": {
             "request": {
                 "total": 4,
@@ -178,12 +197,15 @@ An example event for `stats` looks as following:
             },
             "process": {
                 "memory": {
+                    "resident_set_size": {
+                        "bytes": 510763008
+                    },
                     "heap": {
                         "total": {
-                            "bytes": 296554496
+                            "bytes": 354033664
                         },
                         "used": {
-                            "bytes": 228129512
+                            "bytes": 280320136
                         },
                         "size_limit": {
                             "bytes": 4345298944
@@ -191,26 +213,43 @@ An example event for `stats` looks as following:
                     }
                 },
                 "event_loop_delay": {
-                    "ms": 0.56603500014171
+                    "ms": 10.395972266666668
                 },
                 "uptime": {
-                    "ms": 1088184
+                    "ms": 64365
                 }
             },
+            "os": {
+                "distroRelease": "Ubuntu-20.04",
+                "distro": "Ubuntu",
+                "memory": {
+                    "used_in_bytes": 4305055744,
+                    "total_in_bytes": 35739144192,
+                    "free_in_bytes": 31434088448
+                },
+                "load": {
+                    "5m": 0.66,
+                    "15m": 0.25,
+                    "1m": 1.66
+                },
+                "platformRelease": "linux-5.10.47-linuxkit",
+                "platform": "linux"
+            },
+            "transport_address": "0.0.0.0:5601",
+            "name": "kibana",
             "host": {
                 "name": "0.0.0.0"
             },
-            "name": "kibana",
-            "index": "kibana",
+            "index": ".kibana",
             "response_time": {
                 "avg": {
-                    "ms": 11
+                    "ms": 8
                 },
                 "max": {
-                    "ms": 16
+                    "ms": 11
                 }
             },
-            "concurrent_connections": 8,
+            "concurrent_connections": 10,
             "snapshot": true,
             "status": "green"
         }

From 0267f90a7c39e8c5010a63cc7f508cb486bef548 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Tue, 9 Aug 2022 15:22:59 +0200
Subject: [PATCH 11/15] fix test

---
 packages/kibana/data_stream/stats/sample_event.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/kibana/data_stream/stats/sample_event.json b/packages/kibana/data_stream/stats/sample_event.json
index 289f03541de..d54473e8f4c 100644
--- a/packages/kibana/data_stream/stats/sample_event.json
+++ b/packages/kibana/data_stream/stats/sample_event.json
@@ -112,7 +112,6 @@
                 "platformRelease": "linux-5.10.47-linuxkit",
                 "platform": "linux"
             },
-            "transport_address": "0.0.0.0:5601",
             "name": "kibana",
             "host": {
                 "name": "0.0.0.0"
@@ -131,4 +130,4 @@
             "status": "green"
         }
     }
-}
\ No newline at end of file
+}

From 23212d8ab94720973cf7f31272cefa08a64182bb Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Tue, 9 Aug 2022 15:41:29 +0200
Subject: [PATCH 12/15] elastic-package format

---
 packages/kibana/data_stream/stats/sample_event.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/kibana/data_stream/stats/sample_event.json b/packages/kibana/data_stream/stats/sample_event.json
index d54473e8f4c..da08f5edb66 100644
--- a/packages/kibana/data_stream/stats/sample_event.json
+++ b/packages/kibana/data_stream/stats/sample_event.json
@@ -130,4 +130,4 @@
             "status": "green"
         }
     }
-}
+}
\ No newline at end of file

From 4a9e24704bccc87a06d0a2b3b6e9e713c81a351c Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Tue, 9 Aug 2022 15:56:12 +0200
Subject: [PATCH 13/15] fix test

---
 packages/kibana/docs/README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/kibana/docs/README.md b/packages/kibana/docs/README.md
index cfd1427ad0d..a7d30440727 100644
--- a/packages/kibana/docs/README.md
+++ b/packages/kibana/docs/README.md
@@ -235,7 +235,6 @@ An example event for `stats` looks as following:
                 "platformRelease": "linux-5.10.47-linuxkit",
                 "platform": "linux"
             },
-            "transport_address": "0.0.0.0:5601",
             "name": "kibana",
             "host": {
                 "name": "0.0.0.0"

From 32d97e7feaf3a106fb1e8e93ca521c11cd847e23 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Tue, 9 Aug 2022 16:16:07 +0200
Subject: [PATCH 14/15] remove unused properties

---
 packages/kibana/data_stream/node_actions/fields/fields.yml | 5 -----
 packages/kibana/data_stream/node_rules/fields/fields.yml   | 5 -----
 packages/kibana/data_stream/status/fields/ecs.yml          | 2 --
 3 files changed, 12 deletions(-)

diff --git a/packages/kibana/data_stream/node_actions/fields/fields.yml b/packages/kibana/data_stream/node_actions/fields/fields.yml
index 3a978ab729c..2a8342393ce 100644
--- a/packages/kibana/data_stream/node_actions/fields/fields.yml
+++ b/packages/kibana/data_stream/node_actions/fields/fields.yml
@@ -7,11 +7,6 @@
       type: group
       release: beta
       fields:
-        - name: kibana
-          type: group
-          fields:
-            - name: status
-              type: keyword
         - name: failures
           type: long
         - name: executions
diff --git a/packages/kibana/data_stream/node_rules/fields/fields.yml b/packages/kibana/data_stream/node_rules/fields/fields.yml
index 68ebb2e9305..f1b4927986a 100644
--- a/packages/kibana/data_stream/node_rules/fields/fields.yml
+++ b/packages/kibana/data_stream/node_rules/fields/fields.yml
@@ -7,11 +7,6 @@
       type: group
       release: beta
       fields:
-        - name: kibana
-          type: group
-          fields:
-            - name: status
-              type: keyword
         - name: failures
           type: long
         - name: executions
diff --git a/packages/kibana/data_stream/status/fields/ecs.yml b/packages/kibana/data_stream/status/fields/ecs.yml
index cc40570f854..bb81f45e7a5 100644
--- a/packages/kibana/data_stream/status/fields/ecs.yml
+++ b/packages/kibana/data_stream/status/fields/ecs.yml
@@ -6,8 +6,6 @@
   external: ecs
 - name: service.type
   external: ecs
-- name: service.name
-  external: ecs
 - name: ecs.version
   external: ecs
 - name: service.address

From bf56ff11a7c17299ab990a010017ea4c9357ba18 Mon Sep 17 00:00:00 2001
From: klacabane <kevin.lacabane@elastic.co>
Date: Tue, 9 Aug 2022 16:47:36 +0200
Subject: [PATCH 15/15] fix tests

---
 packages/kibana/data_stream/status/sample_event.json | 1 -
 packages/kibana/docs/README.md                       | 1 -
 2 files changed, 2 deletions(-)

diff --git a/packages/kibana/data_stream/status/sample_event.json b/packages/kibana/data_stream/status/sample_event.json
index 85456bde8b4..f40a374e6db 100644
--- a/packages/kibana/data_stream/status/sample_event.json
+++ b/packages/kibana/data_stream/status/sample_event.json
@@ -18,7 +18,6 @@
     },
     "service": {
         "address": "http://kibana:5601/api/status",
-        "name": "kibana",
         "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
         "type": "kibana",
         "version": "7.15.0"
diff --git a/packages/kibana/docs/README.md b/packages/kibana/docs/README.md
index a7d30440727..de827e8b093 100644
--- a/packages/kibana/docs/README.md
+++ b/packages/kibana/docs/README.md
@@ -299,7 +299,6 @@ An example event for `status` looks as following:
     },
     "service": {
         "address": "http://kibana:5601/api/status",
-        "name": "kibana",
         "id": "e7e31ce0-d42c-4829-8465-baf52f0b8334",
         "type": "kibana",
         "version": "7.15.0"