[Automatic Migrations] Dashboard migration agent initial Implementation by logeekal · Pull Request #232637 · elastic/kibana

logeekal · 2025-08-22T12:34:43Z

Summary

Initial implementation of the dashboard translation agent.

Dashboard migration graph

The Splunk XML is parsed into an array of panels to translate
All individual panels are processed simultaneously.
Query translation to ESQL uses the same logic as rules migrations.
indexPattern selection node implemented using AI Assistant subgraph
Dashboard panels are aggregated in a JSON using predefined visualization templates

Additional changes

Code encapsulation for reusable node helpers
Graph nodes improved (for both rules and dashboards):
- Fixed ECS mapping node bug, which was not properly updating the query with the translated field names.
- Inline query node improved to create all the missing macro and lookup placeholders
- Query validation & fix self-healing loop improved to not remove placeholders
- Query translation prompt improved.
Siem migration client dependencies unified (same for rules and dashboards)
Legacy chat models removed in favour of the generic InferenceChatModel.

About Rules migrations

This PR moves some logic from the rule migration agent to shared agent helpers, to be used by the dashboard migration agent as well.
At the same time, these node helpers (validate_esql, tranlsate_spl_to_esql, inline_spl_query, fix_esql_errors...) have been improved and some bugs have been fixed, as mentioned above.
Hence, this PR not only introduces the dashboard migration agent but also impacts the rules translations, which will receive improvements for free. However, we'll also need to test rule migrations and ensure no regression has been introduced.

Dashboard migration graph

translatePanel sub-graph is executed on a per-panel basis, concurrently.
Panel translations are aggregated in the last aggregateDashboard node to create the elastic dashboard JSON.

Example Trace

https://smith.langchain.com/public/ace2e897-84d8-4cec-8a35-53177816a4a1/r

data service changes filter queries dsl queries agent tools extracted dashboards agent graph initial implementation graph executing fix selectIndexPatterns

logeekal · 2025-08-25T07:12:14Z

❗ Move to Inference Model

As mentioned in this PR : #206710, we no longer need to use per-provider based model and can simply use InferenceChatModel. See if we can make this changes in this PR itself.

elasticmachine · 2025-09-02T18:15:03Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine · 2025-09-02T18:15:04Z

Pinging @elastic/security-solution (Team: SecuritySolution)

…no-cache --fix'

logeekal

Great work @semd . Still not done with full code review but will resume after today's meetings. After going through the trace you shared. I have some comments and questions.

Regarding Empty panel : https://github.com/elastic/kibana/pull/232637/files#r2318624696
~~Why do we need Panel descriptions and panel dashboards in the index?~~ Please ignore. I misunderstood. they are only part of graph.
~~And if we do, we can put them in the index when we import it so that we do not have to parse again.~~
In this particular translatePanel node, the indexPattern is .*, which fails in the dashboard i have linked in the one of the comments below. May be we should specially check it and replace it with placeholder.
If a panel is untranslatable, I think we should add comments paired with title of the panel and why it was untranslatable, similar to Rules.

We can ofcourse discuss these points in the Eng. sync.

...ty_solution/server/lib/siem_migrations/common/task/agent/helpers/inline_spl_query/prompts.ts

...lution/server/lib/siem_migrations/common/task/agent/helpers/translate_spl_to_esql/prompts.ts

...plugins/security_solution/server/lib/siem_migrations/common/task/util/actions_client_chat.ts

...security_solution/server/lib/siem_migrations/common/task/siem_migrations_telemetry_client.ts

...ity/plugins/security_solution/server/lib/siem_migrations/dashboards/api/dashboards/create.ts

...r/lib/siem_migrations/dashboards/task/agent/nodes/aggregate_dashboard/aggregate_dashboard.ts

...r/lib/siem_migrations/dashboards/task/agent/nodes/create_descriptions/create_descriptions.ts

...r/lib/siem_migrations/dashboards/task/agent/nodes/aggregate_dashboard/aggregate_dashboard.ts

…gration_dashboard_agent' into feat/automatic_migration_dashboard_agent

logeekal

Overall code is looking great ✨ . All are minor comments.. Doing some desk testing and will get back.

...s/dashboards/task/agent/sub_graphs/translate_panel/nodes/translation_result/process_panel.ts

...hboards/task/agent/sub_graphs/translate_panel/nodes/translation_result/translation_result.ts

...on/server/lib/siem_migrations/dashboards/task/agent/nodes/translate_panel/translate_panel.ts

...y_solution/server/lib/siem_migrations/dashboards/task/dashboard_migrations_task_evaluator.ts

...solution/server/lib/siem_migrations/dashboards/task/dashboard_migrations_telemetry_client.ts

...on/server/lib/siem_migrations/dashboards/task/agent/nodes/translate_panel/translate_panel.ts

logeekal · 2025-09-04T11:56:49Z

..._migrations/dashboards/task/agent/nodes/parse_original_dashboard/parse_original_dashboard.ts

+    const parser = new SplunkXmlDashboardParser(state.original_dashboard.data);
+    const panels = await parser.extractPanels();


Current method works but SplunkXmlDashboardParser has a static method called isSupportedSplunkXml which does a quick regex check without parsing if the dashboard is even support and returns a relevant error.

I think it could be useful to do a quick check before even spending time in parsing and we could even return the relevant error. See if that is of any use.

https://github.com/elastic/security-team/issues/13875#issuecomment-3253899821

logeekal · 2025-09-04T12:26:55Z

@semd , I found only one issue which i think should be fixed before this PR is merged.

If you check a trace like this : https://smith.langchain.com/o/a9ce6102-b198-4b3d-9190-95bedc24ca4f/projects/p/66aedda3-8cfd-4eee-950d-7ba2f93a317e?timeModel=%7B%22duration%22%3A%227d%22%7D&searchModel=%7B%22filter%22%3A%22eq%28is_root%2C+true%29%22%7D&peek=fd40dcdf-824f-4f05-9005-35dd5154c925&peeked_trace=fd40dcdf-824f-4f05-9005-35dd5154c925

Here the dashboard description generation is failing because there are no panels. I think we should have a node like translationResult for the complete dashboard as well instead of just single panels which will assign missing/final/default values.

May be there should be a node which will check panels existence and if not, will simply skip the complete graph based on the conditional check with correct properties such as translation_result : untranslatable

Otherwise fields such as translationResult is not even populated.

semd · 2025-09-04T13:51:32Z

Here the dashboard description generation is failing because there are no panels. I think we should have a node like translationResult for the complete dashboard as well instead of just single panels which will assign missing/final/default values.

May be there should be a node which will check panels existence and if not, will simply skip the complete graph based on the conditional check with correct properties such as translation_result : untranslatable

Otherwise fields such as translationResult is not even populated.

@logeekal
The createDescriptions is not failing, it's the translatePanels that has no work to do and stops without sending anything to the next node. We only need to add a conditionalEdge right after the parse to check if there are panels or not.
The final node that sets the translation_result is the aggregateDashboard.

fixed here: 171664f

Example (evaluation) trace: https://smith.langchain.com/public/213446e7-9819-43c8-a4db-02c20ee3bf2f/r

semd · 2025-09-04T14:15:05Z

Appreciate the feedback, @logeekal.
This change is intentionally a first implementation to unblock the work. To keep it manageable, I’d like to limit the scope and iterate in separate PRs.
Let's keep track of the follow-up work in this separate ticket https://github.com/elastic/security-team/issues/13875

semd · 2025-09-04T14:32:34Z

@logeekal I created a PR on my side so I don't appear as a reviewer, and you can properly approve/request changes. Let's continue there. closing this one.

#234046

elasticmachine · 2025-09-04T14:46:31Z

💔 Build Failed

Buildkite Build
Commit: cc8ebc7

Failed CI Steps

Check Types

History

cc @semd

semd and others added 16 commits August 21, 2025 13:37

abstract task and data clients

e5e9bd7

data service changes

94d839d

filter queries

eba0139

dsl queries

d6b68b6

agent tools extracted

c040df4

dashboards agent graph initial implementation

d64a9c6

graph executing

901abbe

fix selectIndexPatterns

2f3b84d

fix: removed dashboard changes

dee3f06

fix: types

16dd7ee

fix: types after rebase

69edfde

fix: resource retriever types

62a2d60

fix: integration tests

5eaf603

abstract task and data clients

00cd2c5

data service changes filter queries dsl queries agent tools extracted dashboards agent graph initial implementation graph executing fix selectIndexPatterns

Rename RuleTranslationResult --> MigrationTranslationResult

9f516c9

fix: types + async generic classes PR + missing Resources

9f048da

logeekal changed the title ~~Feat/automatic migration dashboard agent~~ [Security Solution] Automatic dashboard migration agent Aug 25, 2025

logeekal changed the title ~~[Security Solution] Automatic dashboard migration agent~~ [Security Solution] Automatic dashboard migration agent initial Implementation Aug 25, 2025

logeekal mentioned this pull request Aug 25, 2025

[Security Solution] Automatic dashboard migration agent initial implementation #231853

Closed

[CI] Auto-commit changed files from 'yarn openapi:generate'

c8e1575

logeekal changed the title ~~[Security Solution] Automatic dashboard migration agent initial Implementation~~ [Automatic Migrations] Dashboard migration agent initial Implementation Aug 25, 2025

logeekal and others added 8 commits August 25, 2025 16:57

fix: types

f66a46c

fix: Task runner as dependency of Evaluator

3d91676

fix: evaluator types

77f8000

fix: remove migration.gen.ts

d7dda52

inference chat model

e1fa012

fix: consolidate resource types

b25713c

fix: evaluator and task types

2278c26

fix: types

6796403

semd requested review from a team as code owners September 2, 2025 18:15

conflicts solved

1a452c6

semd added ci:cloud-deploy Create or update a Cloud deployment ci:cloud-persist-deployment Persist cloud deployment indefinitely ci:cloud-deploy-elser If set, the ML node in the ES cluster will be deployed with considerations towards the ELSER model labels Sep 3, 2025

semd and others added 2 commits September 3, 2025 12:57

fix type errors

88b41f5

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

439e3a6

…no-cache --fix'

logeekal commented Sep 3, 2025

View reviewed changes

semd added 4 commits September 3, 2025 13:28

fix tests

fe033d3

Merge remote-tracking branch 'refs/remotes/logeekal/feat/automatic_mi…

1ac2ba2

…gration_dashboard_agent' into feat/automatic_migration_dashboard_agent

unify prompts

86652af

abstract some classes

bc2f2bc

logeekal commented Sep 4, 2025

View reviewed changes

semd added 2 commits September 4, 2025 13:14

address TODOs left

1045345

add comments

1eef96d

logeekal commented Sep 4, 2025

View reviewed changes

semd added 2 commits September 4, 2025 15:29

fix empty panels scenario

171664f

remove custom invocationConfig from evaluation

cc8ebc7

semd removed ci:cloud-deploy Create or update a Cloud deployment ci:cloud-persist-deployment Persist cloud deployment indefinitely ci:cloud-deploy-elser If set, the ML node in the ES cluster will be deployed with considerations towards the ELSER model labels Sep 4, 2025

semd closed this Sep 4, 2025

		const parser = new SplunkXmlDashboardParser(state.original_dashboard.data);
		const panels = await parser.extractPanels();

Conversation

logeekal commented Aug 22, 2025 • edited by semd Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dashboard migration graph

Additional changes

About Rules migrations

Dashboard migration graph

Example Trace

Uh oh!

logeekal commented Aug 25, 2025

❗ Move to Inference Model

Uh oh!

elasticmachine commented Sep 2, 2025

Uh oh!

elasticmachine commented Sep 2, 2025

Uh oh!

logeekal left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

logeekal left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

logeekal Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

semd Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

logeekal commented Sep 4, 2025

Uh oh!

semd commented Sep 4, 2025

Uh oh!

semd commented Sep 4, 2025

Uh oh!

semd commented Sep 4, 2025

Uh oh!

elasticmachine commented Sep 4, 2025

💔 Build Failed

Failed CI Steps

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

logeekal commented Aug 22, 2025 •

edited by semd

Loading

logeekal left a comment •

edited

Loading

logeekal Sep 4, 2025 •

edited

Loading