diff --git a/docs/api/spaces-management/resolve_copy_saved_objects_conflicts.asciidoc b/docs/api/spaces-management/resolve_copy_saved_objects_conflicts.asciidoc
index 7f35dc3834f00..565d12513815b 100644
--- a/docs/api/spaces-management/resolve_copy_saved_objects_conflicts.asciidoc
+++ b/docs/api/spaces-management/resolve_copy_saved_objects_conflicts.asciidoc
@@ -103,7 +103,7 @@ Execute the <<spaces-api-copy-saved-objects,copy saved objects to space API>>, w
 .Properties of `error`
 [%collapsible%open]
 =======
-      `type`:::::
+      `type`::::
         (string) The type of error. For example, `unsupported_type`, `missing_references`, or `unknown`.
 =======
 ======
diff --git a/docs/apm/api.asciidoc b/docs/apm/api.asciidoc
index 76d898ba0cb11..a8f4f4bf0baaa 100644
--- a/docs/apm/api.asciidoc
+++ b/docs/apm/api.asciidoc
@@ -44,7 +44,7 @@ The following Agent configuration APIs are available:
 
 `service`::
 (required, object) Service identifying the configuration to create or update.
-
++
 .Properties of `service`
 [%collapsible%open]
 ======
@@ -100,7 +100,7 @@ PUT /api/apm/settings/agent-configuration
 ===== Request body
 `service`::
 (required, object) Service identifying the configuration to delete
-
++
 .Properties of `service`
 [%collapsible%open]
 ======
@@ -217,7 +217,7 @@ GET  /api/apm/settings/agent-configuration
 
 `service`::
 (required, object) Service identifying the configuration.
-
++
 .Properties of `service`
 [%collapsible%open]
 ======
diff --git a/docs/apm/transactions.asciidoc b/docs/apm/transactions.asciidoc
index 536ab2ec29c80..5c92afa55109d 100644
--- a/docs/apm/transactions.asciidoc
+++ b/docs/apm/transactions.asciidoc
@@ -103,9 +103,7 @@ The number of requests per bucket is displayed when hovering over the graph, and
 [role="screenshot"]
 image::apm/images/apm-transaction-duration-dist.png[Example view of transactions duration distribution graph]
 
-Most of the requests fall into buckets on the left side of the graph,
-with a long tail of smaller buckets to the right.
-This is a typical distribution, and indicates most of our requests were served quickly - awesome!
+This graph shows a typical distribution, and indicates most of our requests were served quickly - awesome!
 It's the requests on the right, the ones taking longer than average, that we probably want to focus on.
 When you select one of these buckets,
 you're presented with up to ten trace samples.
diff --git a/docs/canvas/canvas-elements.asciidoc b/docs/canvas/canvas-elements.asciidoc
index 163579d5763b2..a25460a20eb50 100644
--- a/docs/canvas/canvas-elements.asciidoc
+++ b/docs/canvas/canvas-elements.asciidoc
@@ -138,7 +138,9 @@ To apply CSS overrides:
 
 . Next to *Element style*, click *+*, then select *CSS*.
 
-. Enter the *CSS*. For example, to center the Markdown element, enter:
+. Enter the *CSS*.
++
+For example, to center the Markdown element, enter:
 +
 [source,text]
 --------------------------------------------------
diff --git a/docs/canvas/canvas-present-workpad.asciidoc b/docs/canvas/canvas-present-workpad.asciidoc
index 486686cd857b5..9cd4ecc9519e1 100644
--- a/docs/canvas/canvas-present-workpad.asciidoc
+++ b/docs/canvas/canvas-present-workpad.asciidoc
@@ -8,7 +8,7 @@ When you are ready to present your workpad, use and enable the presentation opti
 [[view-fullscreen-mode]]
 ==== View your workpad in fullscreen mode
 
-In the upper left corner, click the *Enter fullscreen mode* icon.
+Click the *Enter fullscreen mode* icon.
 
 [role="screenshot"]
 image::images/canvas-fullscreen.png[Fullscreen mode]
@@ -19,7 +19,7 @@ image::images/canvas-fullscreen.png[Fullscreen mode]
 
 Automatically cycle through your workpads pages in fullscreen mode.
 
-. In the upper left corner, click the *Control settings* icon.
+. Click the *Control settings* icon.
 
 . Under *Change cycling interval*, select the interval you want to use.
 +
diff --git a/docs/canvas/canvas-share-workpad.asciidoc b/docs/canvas/canvas-share-workpad.asciidoc
index dbba12865b8ca..ee29926914ad6 100644
--- a/docs/canvas/canvas-share-workpad.asciidoc
+++ b/docs/canvas/canvas-share-workpad.asciidoc
@@ -10,7 +10,7 @@ When you've finished your workpad, you can share it outside of {kib}.
 
 Create a JSON file of your workpad that you can export outside of {kib}.
 
-. From your workpad, click the *Share workpad* icon in the upper left corner.
+. From your workpad, click the *Share workpad* icon.
 
 . Select *Download as JSON*.
 +
@@ -27,7 +27,7 @@ If you have a license that supports the {report-features}, you can create a PDF
 
 For more information, refer to <<reporting-getting-started, Reporting from Kibana>>.
 
-. From your workpad, click the *Share workpad* icon in the upper left corner, then select *PDF reports*.
+. From your workpad, click the *Share workpad* icon, then select *PDF reports*.
 
 . Click *Generate PDF*.
 +
@@ -42,7 +42,7 @@ If you have a license that supports the {report-features}, you can create a POST
 
 For more information, refer to <<automating-report-generation, Automating report generation>>.
 
-. From your workpad, click the *Share workpad* icon in the upper left corner, then select *PDF reports*.
+. From your workpad, click the *Share workpad* icon, then select *PDF reports*.
 
 . Click *Copy POST URL*.
 +
@@ -55,7 +55,7 @@ image::images/canvas-create-URL.gif[Create POST URL]
 
 beta[] Canvas allows you to create _shareables_, which are workpads that you download and securely share on any website. To customize the behavior of the workpad on your website, you can choose to autoplay the pages or hide the workpad toolbar.
 
-. From your workpad, click the *Share this workpad* icon in the upper left corner, then select *Share on a website*.
+. From your workpad, click the *Share this workpad* icon, then select *Share on a website*.
 
 . On the *Share on a website* pane, follow the instructions.
 
diff --git a/docs/dev-tools/searchprofiler/getting-started.asciidoc b/docs/dev-tools/searchprofiler/getting-started.asciidoc
index 2360e4c28ff15..4a87d4b84b783 100644
--- a/docs/dev-tools/searchprofiler/getting-started.asciidoc
+++ b/docs/dev-tools/searchprofiler/getting-started.asciidoc
@@ -3,10 +3,10 @@
 === Getting Started
 
 The {searchprofiler} is automatically enabled in {kib}.  Go to *Dev Tools > Search Profiler*
-to get started. 
+to get started.
 
 {searchprofiler} displays the names of the indices searched, the shards in each index,
-and how long it took for the query to complete. To try it out, replace the default `match_all` query 
+and how long it took for the query to complete. To try it out, replace the default `match_all` query
 with the query you want to profile and click *Profile*.
 
 The following example shows the results of profiling the `match_all` query.
@@ -29,8 +29,8 @@ While the Cumulative Time metric is useful for comparing the performance of your
 indices and shards, it doesn't necessarily represent the actual physical query times.
 ====
 
-You can select the name of the shard and then click *View details* to see more profiling information, 
-including details about the query component(s) that ran on the shard, as well as the timing 
+You can select the name of the shard and then click *View details* to see more profiling information,
+including details about the query component(s) that ran on the shard, as well as the timing
 breakdown of low-level Lucene methods. For more information, see {ref}/search-profile.html#profiling-queries[Profiling queries].
 
 [float]
@@ -40,10 +40,10 @@ By default, all queries executed by the {searchprofiler} are sent
 to `GET /_search`. It searches across your entire cluster (all indices, all types).
 
 If you need to query a specific index or type (or several), you can use the Index
-and Type filters at the top left.
+and Type filters.
 
 In the following example, the query is executed against the indices `test` and `kibana_1`
 and the type `my_type`. This is equivalent making a request to `GET /test,kibana_1/my_type/_search`.
 
 [role="screenshot"]
-image::dev-tools/searchprofiler/images/filter.png["Filtering by index and type"]
\ No newline at end of file
+image::dev-tools/searchprofiler/images/filter.png["Filtering by index and type"]
diff --git a/docs/discover/document-data.asciidoc b/docs/discover/document-data.asciidoc
index 6e9218d66c115..477c2ec90e95c 100644
--- a/docs/discover/document-data.asciidoc
+++ b/docs/discover/document-data.asciidoc
@@ -26,7 +26,7 @@ and click image:images/sort-icon.png[].
 The first click sorts by ascending order, the second click sorts by descending order, and the third
 click removes the field from the sorted fields.
 
-Move a field column:: Hover over the column header and click the move left (<<) or move right icon (>>).
+Move a field column:: Hover over the column header and click the (<<) or (>>) icons.
 Remove&nbsp;a&nbsp;field&nbsp;column&nbsp;:: Hover over the list of *Specified fields*
 and then click *remove*.
 Or, use the (x) control in the column header.
diff --git a/docs/getting-started/tutorial-visualizing.asciidoc b/docs/getting-started/tutorial-visualizing.asciidoc
index a16343aa4850a..acd4d6d908fd4 100644
--- a/docs/getting-started/tutorial-visualizing.asciidoc
+++ b/docs/getting-started/tutorial-visualizing.asciidoc
@@ -180,5 +180,5 @@ The map now looks like this:
 image::images/tutorial-visualize-map-2.png[]
 
 . Navigate the map by clicking and dragging.  Use the controls
-on the left to zoom the map and set filters.
+to zoom the map and set filters.
 . *Save* this map with the name `Map Example`.
diff --git a/docs/infrastructure/view-metrics.asciidoc b/docs/infrastructure/view-metrics.asciidoc
index bbb981acc3ad6..1bd64dde76ee1 100644
--- a/docs/infrastructure/view-metrics.asciidoc
+++ b/docs/infrastructure/view-metrics.asciidoc
@@ -30,11 +30,3 @@ For complete control over the start and end times, click the start time or end t
 === Refresh the metrics
 
 You can click *Refresh* to manually refresh the metrics.
-
-[float]
-[[infra-view-go-to-chart]]
-=== Go to a specific chart
-
-The charts available for this component are shown in a list on the left of the page. Click a chart in the list to quickly go to that chart.
-
-
diff --git a/docs/management/managing-licenses.asciidoc b/docs/management/managing-licenses.asciidoc
index 72accdb5fe2aa..a7ed4e942f3f6 100644
--- a/docs/management/managing-licenses.asciidoc
+++ b/docs/management/managing-licenses.asciidoc
@@ -15,8 +15,7 @@ already activated a trial for 6.0, you cannot start a new trial until
 7.0. You can, however, contact `info@elastic.co` to request an extended trial
 license.
 
-When you activate a new license level, new features appear in the left sidebar
-of the *Management* page.
+When you activate a new license level, new features appear in *Management*.
 
 [role="screenshot"]
 image::images/management-license.png[]
diff --git a/docs/spaces/index.asciidoc b/docs/spaces/index.asciidoc
index fb5ef670692dc..990af3a018b1f 100644
--- a/docs/spaces/index.asciidoc
+++ b/docs/spaces/index.asciidoc
@@ -9,10 +9,10 @@ the dashboards and saved objects that belong to that space.
 {kib} creates a default space for you.
 After you create your own
 spaces, you're asked to choose a space when you log in to Kibana. You can change your
-current space at any time by using the menu in the upper left.
+current space at any time by using the menu.
 
 [role="screenshot"]
-image::spaces/images/change-space.png["Change current space"]
+image::spaces/images/change-space.png["Change current space menu"]
 
 Kibana supports spaces in several ways.  You can:
 
diff --git a/docs/user/dashboard.asciidoc b/docs/user/dashboard.asciidoc
index 490edb9d26338..a17e46c5b3542 100644
--- a/docs/user/dashboard.asciidoc
+++ b/docs/user/dashboard.asciidoc
@@ -93,7 +93,7 @@ In *Edit* mode, you can move, resize, customize, and delete panels to suit your
 * To resize a panel, click the resize control on the lower right and drag
 to the new dimensions.
 
-* To toggle the use of margins and panel titles, use the *Options* menu in the upper left.
+* To toggle the use of margins and panel titles, use the *Options* menu.
 
 * To delete a panel, open the panel menu and select *Delete from dashboard.* Deleting a panel from a
 dashboard does *not* delete the saved visualization or search.
diff --git a/docs/user/discover.asciidoc b/docs/user/discover.asciidoc
index 7de7d73bf1664..4222ba40debb7 100644
--- a/docs/user/discover.asciidoc
+++ b/docs/user/discover.asciidoc
@@ -24,7 +24,7 @@ image::images/Discover-Start.png[Discover]
 === Set up your index pattern
 
 The first thing to do in *Discover* is to select an <<index-patterns, index pattern>>, which
-defines the data you want to explore and visualize. The current index pattern is in the upper left.
+defines the data you want to explore and visualize.
 If you haven't yet created an index pattern, you can add a <<add-sample-data, sample data set>>,
 which has a pre-built index pattern.
 
@@ -69,7 +69,7 @@ image::images/filter-field.png[height=317]
 The sortable documents table
 lists the documents that match your search.
 By default, the table includes columns for the time field and the document `_source`.
-To zero in on a specific field, click *add* next to the field name in the left sidebar.
+To zero in on a specific field, click *add* next to the field name.
 For example, if you add the `currency`, `customer_last_name`, and `day_of_week` fields,
 the document table includes columns for those three fields.
 
diff --git a/docs/visualize/lens.asciidoc b/docs/visualize/lens.asciidoc
index e3f61565453b5..35570ea7ca1dc 100644
--- a/docs/visualize/lens.asciidoc
+++ b/docs/visualize/lens.asciidoc
@@ -32,7 +32,7 @@ Lens supports the following aggregations:
 [[drag-drop]]
 === Drag and drop
 
-The data panel in the left column shows the data fields for the selected time period. When
+The panel shows the data fields for the selected time period. When
 you drag a field from the data panel, Lens highlights where you can drop that field. The first time you drag a data field,
 you'll see two places highlighted in green:
 
@@ -57,7 +57,7 @@ Lens shows you fields based on the <<index-patterns, index patterns>> you have d
 {kib}, and the current time range. When you change the index pattern or time filter,
 the list of fields are updated.
 
-To narrow the list of fields you see in the left panel, you can:
+To narrow the list of fields, you can:
 
 * Enter the field name in *Search field names*.
 
@@ -100,11 +100,7 @@ still allows you to make the change.
 
 Lens allows some customizations of the data for each visualization.
 
-. Change the index pattern.
-
-.. In the left column, click the index pattern name.
-
-.. Select the new index pattern.
+. Click the index pattern name, then select the new index pattern.
 +
 If there is a match, Lens displays the new data. All fields that do not match the index pattern are removed.
 
@@ -147,7 +143,7 @@ Drag and drop your data onto the visualization builder pane.
 
 . On the *New Visualization* window, click *Lens*.
 
-. In the left column, select the *kibana_sample_data_ecommerce* index.
+. Select the *kibana_sample_data_ecommerce* index.
 
 . Click image:images/time-filter-calendar.png[], then click *Last 7 days*. The list of data fields are updated.
 
diff --git a/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts b/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts
index b4a8ff90c3512..34f8c30b51874 100644
--- a/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts
+++ b/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts
@@ -5,59 +5,4 @@
  */
 /* eslint-disable @typescript-eslint/consistent-type-definitions */
 
-import { Filter, Query, TimeRange } from 'src/plugins/data/public';
-import { AnyAction } from 'redux';
-import { LAYER_TYPE } from '../../common/constants';
-import { DataMeta, MapFilters } from '../../common/descriptor_types';
-import {
-  MapCenterAndZoom,
-  MapRefreshConfig,
-} from '../../../../../plugins/maps/common/descriptor_types';
-
-export type SyncContext = {
-  startLoading(dataId: string, requestToken: symbol, meta: DataMeta): void;
-  stopLoading(dataId: string, requestToken: symbol, data: unknown, meta: DataMeta): void;
-  onLoadError(dataId: string, requestToken: symbol, errorMessage: string): void;
-  updateSourceData(newData: unknown): void;
-  isRequestStillActive(dataId: string, requestToken: symbol): boolean;
-  registerCancelCallback(requestToken: symbol, callback: () => void): void;
-  dataFilters: MapFilters;
-};
-
-export function updateSourceProp(
-  layerId: string,
-  propName: string,
-  value: unknown,
-  newLayerType?: LAYER_TYPE
-): void;
-
-export function setGotoWithCenter(config: MapCenterAndZoom): AnyAction;
-
-export function replaceLayerList(layerList: unknown[]): AnyAction;
-
-export type QueryGroup = {
-  filters: Filter[];
-  query?: Query;
-  timeFilters?: TimeRange;
-  refresh?: boolean;
-};
-
-export function setQuery(query: QueryGroup): AnyAction;
-
-export function setRefreshConfig(config: MapRefreshConfig): AnyAction;
-
-export function disableScrollZoom(): AnyAction;
-
-export function disableInteractive(): AnyAction;
-
-export function disableTooltipControl(): AnyAction;
-
-export function hideToolbarOverlay(): AnyAction;
-
-export function hideLayerControl(): AnyAction;
-
-export function hideViewControl(): AnyAction;
-
-export function setHiddenLayers(hiddenLayerIds: string[]): AnyAction;
-
-export function addLayerWithoutDataSync(layerDescriptor: unknown): AnyAction;
+export * from '../../../../../plugins/maps/public/actions/map_actions';
diff --git a/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.js b/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.js
index 8fc32aef54770..5e497ff0736b2 100644
--- a/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.js
+++ b/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.js
@@ -4,10 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import _ from 'lodash';
-import { KibanaTilemapSource } from '../layers/sources/kibana_tilemap_source';
-import { EMSTMSSource } from '../layers/sources/ems_tms_source';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { KibanaTilemapSource } from '../../../../../plugins/maps/public/layers/sources/kibana_tilemap_source';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { EMSTMSSource } from '../../../../../plugins/maps/public/layers/sources/ems_tms_source';
 import { getInjectedVarFunc } from '../kibana_services';
-import { getKibanaTileMap } from '../meta';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getKibanaTileMap } from '../../../../../plugins/maps/public/meta';
 
 export function getInitialLayers(layerListJSON, initialLayers = []) {
   if (layerListJSON) {
diff --git a/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.test.js b/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.test.js
index f41ed26b2a05d..5334beaaf714a 100644
--- a/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.test.js
+++ b/x-pack/legacy/plugins/maps/public/angular/get_initial_layers.test.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('../meta', () => {
+jest.mock('../../../../../plugins/maps/public/meta', () => {
   return {};
 });
 jest.mock('../kibana_services');
@@ -32,7 +32,7 @@ describe('Saved object has layer list', () => {
 
 describe('kibana.yml configured with map.tilemap.url', () => {
   beforeAll(() => {
-    require('../meta').getKibanaTileMap = () => {
+    require('../../../../../plugins/maps/public/meta').getKibanaTileMap = () => {
       return {
         url: 'myTileUrl',
       };
@@ -62,7 +62,7 @@ describe('kibana.yml configured with map.tilemap.url', () => {
 
 describe('EMS is enabled', () => {
   beforeAll(() => {
-    require('../meta').getKibanaTileMap = () => {
+    require('../../../../../plugins/maps/public/meta').getKibanaTileMap = () => {
       return null;
     };
     require('../kibana_services').getInjectedVarFunc = () => key => {
@@ -106,7 +106,7 @@ describe('EMS is enabled', () => {
 
 describe('EMS is not enabled', () => {
   beforeAll(() => {
-    require('../meta').getKibanaTileMap = () => {
+    require('../../../../../plugins/maps/public/meta').getKibanaTileMap = () => {
       return null;
     };
 
diff --git a/x-pack/legacy/plugins/maps/public/angular/services/saved_gis_map.js b/x-pack/legacy/plugins/maps/public/angular/services/saved_gis_map.js
index f846d3d4a617f..990a0613da681 100644
--- a/x-pack/legacy/plugins/maps/public/angular/services/saved_gis_map.js
+++ b/x-pack/legacy/plugins/maps/public/angular/services/saved_gis_map.js
@@ -17,7 +17,8 @@ import {
   getFilters,
 } from '../../selectors/map_selectors';
 import { getIsLayerTOCOpen, getOpenTOCDetails } from '../../selectors/ui_selectors';
-import { convertMapExtentToPolygon } from '../../elasticsearch_geo_utils';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { convertMapExtentToPolygon } from '../../../../../../plugins/maps/public/elasticsearch_geo_utils';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { copyPersistentState } from '../../../../../../plugins/maps/public/reducers/util';
 import { extractReferences, injectReferences } from '../../../common/migrations/references';
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/gis_map/index.d.ts b/x-pack/legacy/plugins/maps/public/connected_components/gis_map/index.d.ts
index 00a9400109dc1..8689d88297171 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/gis_map/index.d.ts
+++ b/x-pack/legacy/plugins/maps/public/connected_components/gis_map/index.d.ts
@@ -6,7 +6,8 @@
 
 import React from 'react';
 import { Filter } from 'src/plugins/data/public';
-import { RenderToolTipContent } from '../../layers/tooltips/tooltip_property';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { RenderToolTipContent } from '../../../../../../plugins/maps/public/layers/tooltips/tooltip_property';
 
 export const GisMap: React.ComponentType<{
   addFilters: ((filters: Filter[]) => void) | null;
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/gis_map/view.js b/x-pack/legacy/plugins/maps/public/connected_components/gis_map/view.js
index 97139103ab7c1..358313b8f5b6d 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/gis_map/view.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/gis_map/view.js
@@ -13,7 +13,8 @@ import { LayerPanel } from '../layer_panel/index';
 import { AddLayerPanel } from '../layer_addpanel/index';
 import { EuiFlexGroup, EuiFlexItem, EuiCallOut } from '@elastic/eui';
 import { ExitFullScreenButton } from 'ui/exit_full_screen';
-import { getIndexPatternsFromIds } from '../../index_pattern_util';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getIndexPatternsFromIds } from '../../../../../../plugins/maps/public/index_pattern_util';
 import { ES_GEO_FIELD_TYPE } from '../../../common/constants';
 import { indexPatterns as indexPatternsUtils } from '../../../../../../../src/plugins/data/public';
 import { i18n } from '@kbn/i18n';
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/import_editor/view.js b/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/import_editor/view.js
index 762409b256286..cb20d80733c33 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/import_editor/view.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/import_editor/view.js
@@ -7,7 +7,8 @@
 import React, { Fragment } from 'react';
 import { EuiSpacer, EuiPanel, EuiButtonEmpty } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { uploadLayerWizardConfig } from '../../../layers/sources/client_file_source';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { uploadLayerWizardConfig } from '../../../../../../../plugins/maps/public/layers/sources/client_file_source';
 
 export const ImportEditor = ({ clearSource, isIndexingTriggered, ...props }) => {
   const editorProperties = getEditorProperties({ isIndexingTriggered, ...props });
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/source_select/source_select.js b/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/source_select/source_select.js
index b34a432bec88c..67cc17ebaa224 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/source_select/source_select.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_addpanel/source_select/source_select.js
@@ -5,7 +5,8 @@
  */
 
 import React, { Fragment } from 'react';
-import { getLayerWizards } from '../../../layers/layer_wizard_registry';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getLayerWizards } from '../../../../../../../plugins/maps/public/layers/layer_wizard_registry';
 import { EuiTitle, EuiSpacer, EuiCard, EuiIcon } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import _ from 'lodash';
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join_expression.js b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join_expression.js
index f7edcf6e85e25..6c080ace4442a 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join_expression.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/join_expression.js
@@ -16,9 +16,11 @@ import {
   EuiFormHelpText,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { SingleFieldSelect } from '../../../../components/single_field_select';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { SingleFieldSelect } from '../../../../../../../../plugins/maps/public/components/single_field_select';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { getTermsFields } from '../../../../index_pattern_util';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getTermsFields } from '../../../../../../../../plugins/maps/public/index_pattern_util';
 import {
   getIndexPatternService,
   getIndexPatternSelectComponent,
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.js b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.js
index 0944d0e602c2f..c6a79a398f9af 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.js
@@ -14,7 +14,8 @@ import {
   EuiFormErrorText,
   EuiFormHelpText,
 } from '@elastic/eui';
-import { MetricsEditor } from '../../../../components/metrics_editor';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { MetricsEditor } from '../../../../../../../../plugins/maps/public/components/metrics_editor';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { AGG_TYPE } from '../../../../../common/constants';
 
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.test.js b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.test.js
index e4e3776c8e92c..d8bf862249448 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.test.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/join_editor/resources/metrics_expression.test.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('../../../../components/metrics_editor', () => ({
+jest.mock('../../../../../../../../plugins/maps/public/components/metric_editor', () => ({
   MetricsEditor: () => {
     return <div>mockMetricsEditor</div>;
   },
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/layer_settings/layer_settings.js b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/layer_settings/layer_settings.js
index eb23607aa2150..bd27450943638 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/layer_settings/layer_settings.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/layer_settings/layer_settings.js
@@ -8,7 +8,8 @@ import React, { Fragment } from 'react';
 
 import { EuiTitle, EuiPanel, EuiFormRow, EuiFieldText, EuiSpacer } from '@elastic/eui';
 
-import { ValidatedRange } from '../../../components/validated_range';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { ValidatedRange } from '../../../../../../../plugins/maps/public/components/validated_range';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { ValidatedDualRange } from '../../../../../../../../src/plugins/kibana_react/public';
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/view.d.ts b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/view.d.ts
index 6d1d076c723ad..cf4fdc7be70c6 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/view.d.ts
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/view.d.ts
@@ -5,10 +5,4 @@
  */
 /* eslint-disable @typescript-eslint/consistent-type-definitions */
 
-import { LAYER_TYPE } from '../../../common/constants';
-
-export type OnSourceChangeArgs = {
-  propName: string;
-  value: unknown;
-  newLayerType?: LAYER_TYPE;
-};
+export * from '../../../../../../plugins/maps/public/connected_components/layer_panel/view';
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/map/features_tooltip/feature_geometry_filter_form.js b/x-pack/legacy/plugins/maps/public/connected_components/map/features_tooltip/feature_geometry_filter_form.js
index 416af95581058..7063c50edad6a 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/map/features_tooltip/feature_geometry_filter_form.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/map/features_tooltip/feature_geometry_filter_form.js
@@ -8,7 +8,8 @@ import React, { Component, Fragment } from 'react';
 import { EuiIcon } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import { createSpatialFilterWithGeometry } from '../../../elasticsearch_geo_utils';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { createSpatialFilterWithGeometry } from '../../../../../../../plugins/maps/public/elasticsearch_geo_utils';
 import { GEO_JSON_TYPE } from '../../../../common/constants';
 import { GeometryFilterForm } from '../../../components/geometry_filter_form';
 import { UrlOverflowService } from 'ui/error_url_overflow';
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/map/mb/draw_control/draw_control.js b/x-pack/legacy/plugins/maps/public/connected_components/map/mb/draw_control/draw_control.js
index 99abe5d108b5a..df2988d399c5b 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/map/mb/draw_control/draw_control.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/map/mb/draw_control/draw_control.js
@@ -16,7 +16,8 @@ import {
   createSpatialFilterWithGeometry,
   getBoundingBoxGeometry,
   roundCoordinates,
-} from '../../../../elasticsearch_geo_utils';
+  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
+} from '../../../../../../../../plugins/maps/public/elasticsearch_geo_utils';
 import { DrawTooltip } from './draw_tooltip';
 
 const mbDrawModes = MapboxDraw.modes;
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/map/mb/utils.js b/x-pack/legacy/plugins/maps/public/connected_components/map/mb/utils.js
index a2850d2bb6c23..a1d1341b7c4f7 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/map/mb/utils.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/map/mb/utils.js
@@ -5,7 +5,13 @@
  */
 
 import _ from 'lodash';
-import { RGBAImage } from './image_utils';
+import {
+  loadSpriteSheetImageData,
+  addSpriteSheetToMapFromImageData,
+  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
+} from '../../../../../../../plugins/maps/public/connected_components/map/mb/utils';
+
+export { loadSpriteSheetImageData, addSpriteSheetToMapFromImageData };
 
 export function removeOrphanedSourcesAndLayers(mbMap, layerList) {
   const mbStyle = mbMap.getStyle();
@@ -95,62 +101,7 @@ export function syncLayerOrderForSingleLayer(mbMap, layerList) {
   });
 }
 
-function getImageData(img) {
-  const canvas = window.document.createElement('canvas');
-  const context = canvas.getContext('2d');
-  if (!context) {
-    throw new Error('failed to create canvas 2d context');
-  }
-  canvas.width = img.width;
-  canvas.height = img.height;
-  context.drawImage(img, 0, 0, img.width, img.height);
-  return context.getImageData(0, 0, img.width, img.height);
-}
-
-export async function loadSpriteSheetImageData(imgUrl) {
-  return new Promise((resolve, reject) => {
-    const image = new Image();
-    if (isCrossOriginUrl(imgUrl)) {
-      image.crossOrigin = 'Anonymous';
-    }
-    image.onload = el => {
-      const imgData = getImageData(el.currentTarget);
-      resolve(imgData);
-    };
-    image.onerror = e => {
-      reject(e);
-    };
-    image.src = imgUrl;
-  });
-}
-
-export function addSpriteSheetToMapFromImageData(json, imgData, mbMap) {
-  for (const imageId in json) {
-    if (!(json.hasOwnProperty(imageId) && !mbMap.hasImage(imageId))) {
-      continue;
-    }
-    const { width, height, x, y, sdf, pixelRatio } = json[imageId];
-    if (typeof width !== 'number' || typeof height !== 'number') {
-      continue;
-    }
-
-    const data = new RGBAImage({ width, height });
-    RGBAImage.copy(imgData, data, { x, y }, { x: 0, y: 0 }, { width, height });
-    mbMap.addImage(imageId, data, { pixelRatio, sdf });
-  }
-}
-
 export async function addSpritesheetToMap(json, imgUrl, mbMap) {
   const imgData = await loadSpriteSheetImageData(imgUrl);
   addSpriteSheetToMapFromImageData(json, imgData, mbMap);
 }
-
-function isCrossOriginUrl(url) {
-  const a = window.document.createElement('a');
-  a.href = url;
-  return (
-    a.protocol !== window.document.location.protocol ||
-    a.host !== window.document.location.host ||
-    a.port !== window.document.location.port
-  );
-}
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/map/mb/view.js b/x-pack/legacy/plugins/maps/public/connected_components/map/mb/view.js
index 2995ea039e7a8..fedc1902d80a2 100644
--- a/x-pack/legacy/plugins/maps/public/connected_components/map/mb/view.js
+++ b/x-pack/legacy/plugins/maps/public/connected_components/map/mb/view.js
@@ -12,7 +12,8 @@ import {
   removeOrphanedSourcesAndLayers,
   addSpritesheetToMap,
 } from './utils';
-import { getGlyphUrl, isRetina } from '../../../meta';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getGlyphUrl, isRetina } from '../../../../../../../plugins/maps/public/meta';
 import { DECIMAL_DEGREES_PRECISION, ZOOM_PRECISION } from '../../../../common/constants';
 import mapboxgl from 'mapbox-gl/dist/mapbox-gl-csp';
 import mbWorkerUrl from '!!file-loader!mapbox-gl/dist/mapbox-gl-csp-worker';
@@ -23,7 +24,11 @@ import sprites1 from '@elastic/maki/dist/sprite@1.png';
 import sprites2 from '@elastic/maki/dist/sprite@2.png';
 import { DrawControl } from './draw_control';
 import { TooltipControl } from './tooltip_control';
-import { clampToLatBounds, clampToLonBounds } from '../../../elasticsearch_geo_utils';
+import {
+  clampToLatBounds,
+  clampToLonBounds,
+  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
+} from '../../../../../../../plugins/maps/public/elasticsearch_geo_utils';
 
 mapboxgl.workerUrl = mbWorkerUrl;
 mapboxgl.setRTLTextPlugin(mbRtlPlugin);
diff --git a/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable.tsx b/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable.tsx
index 9544e8714f265..bdd2d863e6920 100644
--- a/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable.tsx
+++ b/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable.tsx
@@ -57,7 +57,8 @@ import {
 } from '../../../../../plugins/maps/public/reducers/non_serializable_instances';
 import { getMapCenter, getMapZoom, getHiddenLayerIds } from '../selectors/map_selectors';
 import { MAP_SAVED_OBJECT_TYPE } from '../../common/constants';
-import { RenderToolTipContent } from '../layers/tooltips/tooltip_property';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { RenderToolTipContent } from '../../../../../plugins/maps/public/layers/tooltips/tooltip_property';
 
 interface MapEmbeddableConfig {
   editUrl?: string;
diff --git a/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable_factory.ts b/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable_factory.ts
index 5a036ed47fb62..5deb3057a449e 100644
--- a/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable_factory.ts
+++ b/x-pack/legacy/plugins/maps/public/embeddable/map_embeddable_factory.ts
@@ -27,6 +27,11 @@ import { getInitialLayers } from '../angular/get_initial_layers';
 import { mergeInputWithSavedMap } from './merge_input_with_saved_map';
 import '../angular/services/gis_map_saved_object_loader';
 import { bindSetupCoreAndPlugins, bindStartCoreAndPlugins } from '../plugin';
+// @ts-ignore
+import {
+  bindSetupCoreAndPlugins as bindNpSetupCoreAndPlugins,
+  bindStartCoreAndPlugins as bindNpStartCoreAndPlugins,
+} from '../../../../../plugins/maps/public/plugin'; // eslint-disable-line @kbn/eslint/no-restricted-paths
 
 export class MapEmbeddableFactory implements EmbeddableFactoryDefinition {
   type = MAP_SAVED_OBJECT_TYPE;
@@ -40,7 +45,9 @@ export class MapEmbeddableFactory implements EmbeddableFactoryDefinition {
   constructor() {
     // Init required services. Necessary while in legacy
     bindSetupCoreAndPlugins(npSetup.core, npSetup.plugins);
+    bindNpSetupCoreAndPlugins(npSetup.core, npSetup.plugins);
     bindStartCoreAndPlugins(npStart.core, npStart.plugins);
+    bindNpStartCoreAndPlugins(npStart.core, npStart.plugins);
   }
 
   async isEditable() {
diff --git a/x-pack/legacy/plugins/maps/public/index.scss b/x-pack/legacy/plugins/maps/public/index.scss
index 328b2e576e0e6..b2ac514299d80 100644
--- a/x-pack/legacy/plugins/maps/public/index.scss
+++ b/x-pack/legacy/plugins/maps/public/index.scss
@@ -14,4 +14,4 @@
 @import './mapbox_hacks';
 @import './connected_components/index';
 @import './components/index';
-@import './layers/index';
+@import '../../../../plugins/maps/public/layers/index';
diff --git a/x-pack/legacy/plugins/maps/public/index.ts b/x-pack/legacy/plugins/maps/public/index.ts
index 2d13f005f1a70..b69485e251be4 100644
--- a/x-pack/legacy/plugins/maps/public/index.ts
+++ b/x-pack/legacy/plugins/maps/public/index.ts
@@ -26,5 +26,9 @@ export const plugin = (initializerContext: PluginInitializerContext) => {
   return new MapsPlugin();
 };
 
-export { RenderTooltipContentParams, ITooltipProperty } from './layers/tooltips/tooltip_property';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+export {
+  RenderTooltipContentParams,
+  ITooltipProperty,
+} from '../../../../plugins/maps/public/layers/tooltips/tooltip_property';
 export { MapEmbeddable, MapEmbeddableInput } from './embeddable';
diff --git a/x-pack/legacy/plugins/maps/public/kibana_services.js b/x-pack/legacy/plugins/maps/public/kibana_services.js
index 3b0f501dc0f60..a6491fe1aa6d4 100644
--- a/x-pack/legacy/plugins/maps/public/kibana_services.js
+++ b/x-pack/legacy/plugins/maps/public/kibana_services.js
@@ -4,88 +4,26 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { esFilters, search } from '../../../../../src/plugins/data/public';
-const { getRequestInspectorStats, getResponseInspectorStats } = search;
-
-export const SPATIAL_FILTER_TYPE = esFilters.FILTERS.SPATIAL_FILTER;
-export { SearchSource } from '../../../../../src/plugins/data/public';
-
 let indexPatternService;
 export const setIndexPatternService = dataIndexPatterns =>
   (indexPatternService = dataIndexPatterns);
 export const getIndexPatternService = () => indexPatternService;
 
-let autocompleteService;
-export const setAutocompleteService = dataAutoComplete => (autocompleteService = dataAutoComplete);
-export const getAutocompleteService = () => autocompleteService;
-
-let licenseId;
-export const setLicenseId = latestLicenseId => (licenseId = latestLicenseId);
-export const getLicenseId = () => {
-  return licenseId;
-};
-
 let inspector;
 export const setInspector = newInspector => (inspector = newInspector);
 export const getInspector = () => {
   return inspector;
 };
 
-let fileUploadPlugin;
-export const setFileUpload = fileUpload => (fileUploadPlugin = fileUpload);
-export const getFileUploadComponent = () => {
-  return fileUploadPlugin.JsonUploadAndParse;
-};
-
 let getInjectedVar;
 export const setInjectedVarFunc = getInjectedVarFunc => (getInjectedVar = getInjectedVarFunc);
 export const getInjectedVarFunc = () => getInjectedVar;
 
-let uiSettings;
-export const setUiSettings = coreUiSettings => (uiSettings = coreUiSettings);
-export const getUiSettings = () => uiSettings;
-
 let indexPatternSelectComponent;
 export const setIndexPatternSelect = indexPatternSelect =>
   (indexPatternSelectComponent = indexPatternSelect);
 export const getIndexPatternSelectComponent = () => indexPatternSelectComponent;
 
-let coreHttp;
-export const setHttp = http => (coreHttp = http);
-export const getHttp = () => coreHttp;
-
 let dataTimeFilter;
 export const setTimeFilter = timeFilter => (dataTimeFilter = timeFilter);
 export const getTimeFilter = () => dataTimeFilter;
-
-let toast;
-export const setToasts = notificationToast => (toast = notificationToast);
-export const getToasts = () => toast;
-
-export async function fetchSearchSourceAndRecordWithInspector({
-  searchSource,
-  requestId,
-  requestName,
-  requestDesc,
-  inspectorAdapters,
-  abortSignal,
-}) {
-  const inspectorRequest = inspectorAdapters.requests.start(requestName, {
-    id: requestId,
-    description: requestDesc,
-  });
-  let resp;
-  try {
-    inspectorRequest.stats(getRequestInspectorStats(searchSource));
-    searchSource.getSearchRequestBody().then(body => {
-      inspectorRequest.json(body);
-    });
-    resp = await searchSource.fetch({ abortSignal });
-    inspectorRequest.stats(getResponseInspectorStats(searchSource, resp)).ok({ json: resp });
-  } catch (error) {
-    inspectorRequest.error({ error });
-    throw error;
-  }
-
-  return resp;
-}
diff --git a/x-pack/legacy/plugins/maps/public/layers/_index.scss b/x-pack/legacy/plugins/maps/public/layers/_index.scss
deleted file mode 100644
index a2ce58e0381af..0000000000000
--- a/x-pack/legacy/plugins/maps/public/layers/_index.scss
+++ /dev/null
@@ -1 +0,0 @@
-@import './styles/index';
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/_index.scss b/x-pack/legacy/plugins/maps/public/layers/styles/_index.scss
deleted file mode 100644
index b5d9113619c76..0000000000000
--- a/x-pack/legacy/plugins/maps/public/layers/styles/_index.scss
+++ /dev/null
@@ -1,4 +0,0 @@
-@import './components/color_gradient';
-@import './vector/components/style_prop_editor';
-@import './vector/components/color/color_stops';
-@import './vector/components/symbol/icon_select';
diff --git a/x-pack/legacy/plugins/maps/public/plugin.ts b/x-pack/legacy/plugins/maps/public/plugin.ts
index c08ed6fc6da61..0fa7e1106a6df 100644
--- a/x-pack/legacy/plugins/maps/public/plugin.ts
+++ b/x-pack/legacy/plugins/maps/public/plugin.ts
@@ -4,9 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import './layers/layer_wizard_registry';
-import './layers/sources/source_registry';
-import './layers/load_layer_wizards';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import '../../../../plugins/maps/public/layers/layer_wizard_registry';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import '../../../../plugins/maps/public/layers/sources/source_registry';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import '../../../../plugins/maps/public/layers/load_layer_wizards';
 
 import { Plugin, CoreStart, CoreSetup } from 'src/core/public';
 // @ts-ignore
@@ -17,20 +20,17 @@ import { Start as InspectorStartContract } from 'src/plugins/inspector/public';
 import { MapListing } from './components/map_listing';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import {
-  setLicenseId,
   setInspector,
-  setFileUpload,
   setIndexPatternSelect,
-  setHttp,
   setTimeFilter,
-  setUiSettings,
   setInjectedVarFunc,
-  setToasts,
   setIndexPatternService,
-  setAutocompleteService,
 } from './kibana_services';
 // @ts-ignore
-import { setInjectedVarFunc as npSetInjectedVarFunc } from '../../../../plugins/maps/public/kibana_services'; // eslint-disable-line @kbn/eslint/no-restricted-paths
+import {
+  bindSetupCoreAndPlugins as bindNpSetupCoreAndPlugins,
+  bindStartCoreAndPlugins as bindNpStartCoreAndPlugins,
+} from '../../../../plugins/maps/public/plugin'; // eslint-disable-line @kbn/eslint/no-restricted-paths
 import { HomePublicPluginSetup } from '../../../../../src/plugins/home/public';
 import { LicensingPluginSetup } from '../../../../plugins/licensing/public';
 import { featureCatalogueEntry } from './feature_catalogue_entry';
@@ -63,27 +63,17 @@ interface MapsPluginStartDependencies {
 }
 
 export const bindSetupCoreAndPlugins = (core: CoreSetup, plugins: any) => {
-  const { licensing } = plugins;
-  const { injectedMetadata, http } = core;
-  if (licensing) {
-    licensing.license$.subscribe(({ uid }: { uid: string }) => setLicenseId(uid));
-  }
+  const { injectedMetadata } = core;
   setInjectedVarFunc(injectedMetadata.getInjectedVar);
-  setHttp(http);
-  setUiSettings(core.uiSettings);
   setInjectedVarFunc(core.injectedMetadata.getInjectedVar);
-  npSetInjectedVarFunc(core.injectedMetadata.getInjectedVar);
-  setToasts(core.notifications.toasts);
 };
 
 export const bindStartCoreAndPlugins = (core: CoreStart, plugins: any) => {
-  const { file_upload, data, inspector } = plugins;
+  const { data, inspector } = plugins;
   setInspector(inspector);
-  setFileUpload(file_upload);
   setIndexPatternSelect(data.ui.IndexPatternSelect);
   setTimeFilter(data.query.timefilter.timefilter);
   setIndexPatternService(data.indexPatterns);
-  setAutocompleteService(data.autocomplete);
 };
 
 /** @internal */
@@ -96,11 +86,13 @@ export class MapsPlugin implements Plugin<MapsPluginSetup, MapsPluginStart> {
       });
 
     bindSetupCoreAndPlugins(core, np);
+    bindNpSetupCoreAndPlugins(core, np);
 
     np.home.featureCatalogue.register(featureCatalogueEntry);
   }
 
   public start(core: CoreStart, plugins: MapsPluginStartDependencies) {
     bindStartCoreAndPlugins(core, plugins);
+    bindNpStartCoreAndPlugins(core, plugins);
   }
 }
diff --git a/x-pack/legacy/plugins/maps/public/selectors/map_selectors.js b/x-pack/legacy/plugins/maps/public/selectors/map_selectors.js
index 397478cfd1d1b..59346e4c6fb98 100644
--- a/x-pack/legacy/plugins/maps/public/selectors/map_selectors.js
+++ b/x-pack/legacy/plugins/maps/public/selectors/map_selectors.js
@@ -6,11 +6,16 @@
 
 import { createSelector } from 'reselect';
 import _ from 'lodash';
-import { TileLayer } from '../layers/tile_layer';
-import { VectorTileLayer } from '../layers/vector_tile_layer';
-import { VectorLayer } from '../layers/vector_layer';
-import { HeatmapLayer } from '../layers/heatmap_layer';
-import { BlendedVectorLayer } from '../layers/blended_vector_layer';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { TileLayer } from '../../../../../plugins/maps/public/layers/tile_layer';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { VectorTileLayer } from '../../../../../plugins/maps/public/layers/vector_tile_layer';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { VectorLayer } from '../../../../../plugins/maps/public/layers/vector_layer';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { HeatmapLayer } from '../../../../../plugins/maps/public/layers/heatmap_layer';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { BlendedVectorLayer } from '../../../../../plugins/maps/public/layers/blended_vector_layer';
 import { getTimeFilter } from '../kibana_services';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { getInspectorAdapters } from '../../../../../plugins/maps/public/reducers/non_serializable_instances';
@@ -19,8 +24,10 @@ import {
   TRACKED_LAYER_DESCRIPTOR,
   // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 } from '../../../../../plugins/maps/public/reducers/util';
-import { InnerJoin } from '../layers/joins/inner_join';
-import { getSourceByType } from '../layers/sources/source_registry';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { InnerJoin } from '../../../../../plugins/maps/public/layers/joins/inner_join';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getSourceByType } from '../../../../../plugins/maps/public/layers/sources/source_registry';
 
 function createLayerInstance(layerDescriptor, inspectorAdapters) {
   const source = createSourceInstance(layerDescriptor.sourceDescriptor, inspectorAdapters);
diff --git a/x-pack/legacy/plugins/maps/public/selectors/map_selectors.test.js b/x-pack/legacy/plugins/maps/public/selectors/map_selectors.test.js
index 1a5ab633a569f..77bd29259647c 100644
--- a/x-pack/legacy/plugins/maps/public/selectors/map_selectors.test.js
+++ b/x-pack/legacy/plugins/maps/public/selectors/map_selectors.test.js
@@ -4,11 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('../layers/vector_layer', () => {});
-jest.mock('../layers/blended_vector_layer', () => {});
-jest.mock('../layers/heatmap_layer', () => {});
-jest.mock('../layers/vector_tile_layer', () => {});
-jest.mock('../layers/joins/inner_join', () => {});
+jest.mock('../../../../../plugins/maps/public/layers/vector_layer', () => {});
+jest.mock('../../../../../plugins/maps/public/layers/blended_vector_layer', () => {});
+jest.mock('../../../../../plugins/maps/public/layers/heatmap_layer', () => {});
+jest.mock('../../../../../plugins/maps/public/layers/vector_tile_layer', () => {});
+jest.mock('../../../../../plugins/maps/public/layers/joins/inner_join', () => {});
 jest.mock('../../../../../plugins/maps/public/reducers/non_serializable_instances', () => ({
   getInspectorAdapters: () => {
     return {};
diff --git a/x-pack/legacy/plugins/monitoring/common/constants.ts b/x-pack/legacy/plugins/monitoring/common/constants.ts
index 9a4030f3eb214..3a4c7b71dcd03 100644
--- a/x-pack/legacy/plugins/monitoring/common/constants.ts
+++ b/x-pack/legacy/plugins/monitoring/common/constants.ts
@@ -239,11 +239,15 @@ export const ALERT_TYPE_PREFIX = 'monitoring_';
  * This is the alert type id for the license expiration alert
  */
 export const ALERT_TYPE_LICENSE_EXPIRATION = `${ALERT_TYPE_PREFIX}alert_type_license_expiration`;
+/**
+ * This is the alert type id for the cluster state alert
+ */
+export const ALERT_TYPE_CLUSTER_STATE = `${ALERT_TYPE_PREFIX}alert_type_cluster_state`;
 
 /**
  * A listing of all alert types
  */
-export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION];
+export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION, ALERT_TYPE_CLUSTER_STATE];
 
 /**
  * Matches the id for the built-in in email action type
@@ -254,7 +258,7 @@ export const ALERT_ACTION_TYPE_EMAIL = '.email';
 /**
  * The number of alerts that have been migrated
  */
-export const NUMBER_OF_MIGRATED_ALERTS = 1;
+export const NUMBER_OF_MIGRATED_ALERTS = 2;
 
 /**
  * The advanced settings config name for the email address
diff --git a/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js b/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js
index 11fcef73a4b97..95c1af5549198 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js
+++ b/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js
@@ -6,10 +6,15 @@
 
 import React from 'react';
 import chrome from '../../np_imports/ui/chrome';
-import { capitalize } from 'lodash';
+import { capitalize, get } from 'lodash';
 import { formatDateTimeLocal } from '../../../common/formatting';
 import { formatTimestampToDuration } from '../../../common';
-import { CALCULATE_DURATION_SINCE, EUI_SORT_DESCENDING } from '../../../common/constants';
+import {
+  CALCULATE_DURATION_SINCE,
+  EUI_SORT_DESCENDING,
+  ALERT_TYPE_LICENSE_EXPIRATION,
+  ALERT_TYPE_CLUSTER_STATE,
+} from '../../../common/constants';
 import { mapSeverity } from './map_severity';
 import { FormattedAlert } from 'plugins/monitoring/components/alerts/formatted_alert';
 import { EuiMonitoringTable } from 'plugins/monitoring/components/table';
@@ -21,6 +26,8 @@ const linkToCategories = {
   'elasticsearch/indices': 'Elasticsearch Indices',
   'kibana/instances': 'Kibana Instances',
   'logstash/instances': 'Logstash Nodes',
+  [ALERT_TYPE_LICENSE_EXPIRATION]: 'License expiration',
+  [ALERT_TYPE_CLUSTER_STATE]: 'Cluster state',
 };
 const getColumns = (kbnUrl, scope, timezone) => [
   {
@@ -94,19 +101,22 @@ const getColumns = (kbnUrl, scope, timezone) => [
     }),
     field: 'message',
     sortable: true,
-    render: (message, alert) => (
-      <FormattedAlert
-        prefix={alert.prefix}
-        suffix={alert.suffix}
-        message={message}
-        metadata={alert.metadata}
-        changeUrl={target => {
-          scope.$evalAsync(() => {
-            kbnUrl.changePath(target);
-          });
-        }}
-      />
-    ),
+    render: (_message, alert) => {
+      const message = get(alert, 'message.text', get(alert, 'message', ''));
+      return (
+        <FormattedAlert
+          prefix={alert.prefix}
+          suffix={alert.suffix}
+          message={message}
+          metadata={alert.metadata}
+          changeUrl={target => {
+            scope.$evalAsync(() => {
+              kbnUrl.changePath(target);
+            });
+          }}
+        />
+      );
+    },
   },
   {
     name: i18n.translate('xpack.monitoring.alerts.categoryColumnTitle', {
@@ -148,8 +158,8 @@ const getColumns = (kbnUrl, scope, timezone) => [
 export const Alerts = ({ alerts, angular, sorting, pagination, onTableChange }) => {
   const alertsFlattened = alerts.map(alert => ({
     ...alert,
-    status: alert.metadata.severity,
-    category: alert.metadata.link,
+    status: get(alert, 'metadata.severity', get(alert, 'severity', 0)),
+    category: get(alert, 'metadata.link', get(alert, 'type', null)),
   }));
 
   const injector = chrome.dangerouslyGetActiveInjector();
diff --git a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx
index 258a5b68db372..d3cf4b463a2cc 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx
+++ b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { kfetch } from 'ui/kfetch';
 import { AlertsStatus, AlertsStatusProps } from './status';
-import { ALERT_TYPE_PREFIX } from '../../../common/constants';
+import { ALERT_TYPES } from '../../../common/constants';
 import { getSetupModeState } from '../../lib/setup_mode';
 import { mockUseEffects } from '../../jest.helpers';
 
@@ -63,11 +63,7 @@ describe('Status', () => {
 
   it('should render a success message if all alerts have been migrated and in setup mode', async () => {
     (kfetch as jest.Mock).mockReturnValue({
-      data: [
-        {
-          alertTypeId: ALERT_TYPE_PREFIX,
-        },
-      ],
+      data: ALERT_TYPES.map(type => ({ alertTypeId: type })),
     });
 
     (getSetupModeState as jest.Mock).mockReturnValue({
diff --git a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx
index 072a98b123452..5f5329bf7fff8 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx
+++ b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx
@@ -142,7 +142,7 @@ export const AlertsStatus: React.FC<AlertsStatusProps> = (props: AlertsStatusPro
       );
     }
 
-    const allMigrated = kibanaAlerts.length === NUMBER_OF_MIGRATED_ALERTS;
+    const allMigrated = kibanaAlerts.length >= NUMBER_OF_MIGRATED_ALERTS;
     if (allMigrated) {
       if (setupModeEnabled) {
         return (
diff --git a/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js b/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js
index 8455fb8cf3088..d87ff98e79be0 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js
+++ b/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js
@@ -6,14 +6,12 @@
 
 import React, { Fragment } from 'react';
 import moment from 'moment-timezone';
-import chrome from '../../../np_imports/ui/chrome';
 import { FormattedAlert } from 'plugins/monitoring/components/alerts/formatted_alert';
 import { mapSeverity } from 'plugins/monitoring/components/alerts/map_severity';
 import { formatTimestampToDuration } from '../../../../common/format_timestamp_to_duration';
 import {
   CALCULATE_DURATION_SINCE,
   KIBANA_ALERTING_ENABLED,
-  ALERT_TYPE_LICENSE_EXPIRATION,
   CALCULATE_DURATION_UNTIL,
 } from '../../../../common/constants';
 import { formatDateTimeLocal } from '../../../../common/formatting';
@@ -31,6 +29,37 @@ import {
   EuiLink,
 } from '@elastic/eui';
 
+function replaceTokens(alert) {
+  if (!alert.message.tokens) {
+    return alert.message.text;
+  }
+
+  let text = alert.message.text;
+
+  for (const token of alert.message.tokens) {
+    if (token.type === 'time') {
+      text = text.replace(
+        token.startToken,
+        token.isRelative
+          ? formatTimestampToDuration(alert.expirationTime, CALCULATE_DURATION_UNTIL)
+          : moment.tz(alert.expirationTime, moment.tz.guess()).format('LLL z')
+      );
+    } else if (token.type === 'link') {
+      const linkPart = new RegExp(`${token.startToken}(.+?)${token.endToken}`).exec(text);
+      // TODO: we assume this is at the end, which works for now but will not always work
+      const nonLinkText = text.replace(linkPart[0], '');
+      text = (
+        <Fragment>
+          {nonLinkText}
+          <EuiLink href={`#${token.url}`}>{linkPart[1]}</EuiLink>
+        </Fragment>
+      );
+    }
+  }
+
+  return text;
+}
+
 export function AlertsPanel({ alerts, changeUrl }) {
   const goToAlerts = () => changeUrl('/alerts');
 
@@ -58,9 +87,6 @@ export function AlertsPanel({ alerts, changeUrl }) {
       severityIcon.iconType = 'check';
     }
 
-    const injector = chrome.dangerouslyGetActiveInjector();
-    const timezone = injector.get('config').get('dateFormat:tz');
-
     return (
       <EuiCallOut
         key={`alert-item-${index}`}
@@ -83,7 +109,7 @@ export function AlertsPanel({ alerts, changeUrl }) {
               id="xpack.monitoring.cluster.overview.alertsPanel.lastCheckedTimeText"
               defaultMessage="Last checked {updateDateTime} (triggered {duration} ago)"
               values={{
-                updateDateTime: formatDateTimeLocal(item.update_timestamp, timezone),
+                updateDateTime: formatDateTimeLocal(item.update_timestamp),
                 duration: formatTimestampToDuration(item.timestamp, CALCULATE_DURATION_SINCE),
               }}
             />
@@ -96,14 +122,7 @@ export function AlertsPanel({ alerts, changeUrl }) {
   const alertsList = KIBANA_ALERTING_ENABLED
     ? alerts.map((alert, idx) => {
         const callOutProps = mapSeverity(alert.severity);
-        let message = alert.message
-          // scan message prefix and replace relative times
-          // \w: Matches any alphanumeric character from the basic Latin alphabet, including the underscore. Equivalent to [A-Za-z0-9_].
-          .replace(
-            '#relative',
-            formatTimestampToDuration(alert.expirationTime, CALCULATE_DURATION_UNTIL)
-          )
-          .replace('#absolute', moment.tz(alert.expirationTime, moment.tz.guess()).format('LLL z'));
+        const message = replaceTokens(alert);
 
         if (!alert.isFiring) {
           callOutProps.title = i18n.translate(
@@ -118,22 +137,30 @@ export function AlertsPanel({ alerts, changeUrl }) {
           );
           callOutProps.color = 'success';
           callOutProps.iconType = 'check';
-        } else {
-          if (alert.type === ALERT_TYPE_LICENSE_EXPIRATION) {
-            message = (
-              <Fragment>
-                {message}
-                &nbsp;
-                <EuiLink href="#license">Please update your license</EuiLink>
-              </Fragment>
-            );
-          }
         }
 
         return (
-          <EuiCallOut key={idx} {...callOutProps}>
-            <p>{message}</p>
-          </EuiCallOut>
+          <Fragment key={idx}>
+            <EuiCallOut {...callOutProps}>
+              <p>{message}</p>
+              <EuiText size="xs">
+                <p data-test-subj="alertMeta" className="monCallout--meta">
+                  <FormattedMessage
+                    id="xpack.monitoring.cluster.overview.alertsPanel.lastCheckedTimeText"
+                    defaultMessage="Last checked {updateDateTime} (triggered {duration} ago)"
+                    values={{
+                      updateDateTime: formatDateTimeLocal(alert.lastCheckedMS),
+                      duration: formatTimestampToDuration(
+                        alert.triggeredMS,
+                        CALCULATE_DURATION_SINCE
+                      ),
+                    }}
+                  />
+                </p>
+              </EuiText>
+            </EuiCallOut>
+            <EuiSpacer />
+          </Fragment>
         );
       })
     : alerts.map((item, index) => (
diff --git a/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js b/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js
index 7c065a78a8af9..62cc985887e9f 100644
--- a/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js
+++ b/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js
@@ -18,25 +18,37 @@ import { Alerts } from '../../components/alerts';
 import { MonitoringViewBaseEuiTableController } from '../base_eui_table_controller';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiPage, EuiPageBody, EuiPageContent, EuiSpacer, EuiLink } from '@elastic/eui';
-import { CODE_PATH_ALERTS } from '../../../common/constants';
+import { CODE_PATH_ALERTS, KIBANA_ALERTING_ENABLED } from '../../../common/constants';
 
 function getPageData($injector) {
   const globalState = $injector.get('globalState');
   const $http = $injector.get('$http');
   const Private = $injector.get('Private');
-  const url = `../api/monitoring/v1/clusters/${globalState.cluster_uuid}/legacy_alerts`;
+  const url = KIBANA_ALERTING_ENABLED
+    ? `../api/monitoring/v1/alert_status`
+    : `../api/monitoring/v1/clusters/${globalState.cluster_uuid}/legacy_alerts`;
 
   const timeBounds = timefilter.getBounds();
+  const data = {
+    timeRange: {
+      min: timeBounds.min.toISOString(),
+      max: timeBounds.max.toISOString(),
+    },
+  };
+
+  if (!KIBANA_ALERTING_ENABLED) {
+    data.ccs = globalState.ccs;
+  }
 
   return $http
-    .post(url, {
-      ccs: globalState.ccs,
-      timeRange: {
-        min: timeBounds.min.toISOString(),
-        max: timeBounds.max.toISOString(),
-      },
+    .post(url, data)
+    .then(response => {
+      const result = get(response, 'data', []);
+      if (KIBANA_ALERTING_ENABLED) {
+        return result.alerts;
+      }
+      return result;
     })
-    .then(response => get(response, 'data', []))
     .catch(err => {
       const ajaxErrorHandlers = Private(ajaxErrorHandlersProvider);
       return ajaxErrorHandlers(err);
diff --git a/x-pack/legacy/plugins/siem/cypress/integration/detections_timeline.spec.ts b/x-pack/legacy/plugins/siem/cypress/integration/detections_timeline.spec.ts
new file mode 100644
index 0000000000000..2cac6e0f603b9
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/cypress/integration/detections_timeline.spec.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SIGNAL_ID } from '../screens/detections';
+import { PROVIDER_BADGE } from '../screens/timeline';
+
+import {
+  expandFirstSignal,
+  investigateFirstSignalInTimeline,
+  waitForSignalsPanelToBeLoaded,
+} from '../tasks/detections';
+import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
+import { loginAndWaitForPage } from '../tasks/login';
+
+import { DETECTIONS } from '../urls/navigation';
+
+describe('Detections timeline', () => {
+  beforeEach(() => {
+    esArchiverLoad('timeline_signals');
+    loginAndWaitForPage(DETECTIONS);
+  });
+
+  afterEach(() => {
+    esArchiverUnload('timeline_signals');
+  });
+
+  it('Investigate signal in default timeline', () => {
+    waitForSignalsPanelToBeLoaded();
+    expandFirstSignal();
+    cy.get(SIGNAL_ID)
+      .first()
+      .invoke('text')
+      .then(eventId => {
+        investigateFirstSignalInTimeline();
+        cy.get(PROVIDER_BADGE)
+          .invoke('text')
+          .should('eql', `_id: "${eventId}"`);
+      });
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/cypress/objects/timeline.ts b/x-pack/legacy/plugins/siem/cypress/objects/timeline.ts
new file mode 100644
index 0000000000000..bca99bfa9266a
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/cypress/objects/timeline.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+interface Timeline {
+  title: string;
+  query: string;
+}
diff --git a/x-pack/legacy/plugins/siem/cypress/screens/detections.ts b/x-pack/legacy/plugins/siem/cypress/screens/detections.ts
index cb776be8d7b6b..d9ffa5b5a4ab2 100644
--- a/x-pack/legacy/plugins/siem/cypress/screens/detections.ts
+++ b/x-pack/legacy/plugins/siem/cypress/screens/detections.ts
@@ -6,6 +6,8 @@
 
 export const CLOSED_SIGNALS_BTN = '[data-test-subj="closedSignals"]';
 
+export const EXPAND_SIGNAL_BTN = '[data-test-subj="expand-event"]';
+
 export const LOADING_SIGNALS_PANEL = '[data-test-subj="loading-signals-panel"]';
 
 export const MANAGE_SIGNAL_DETECTION_RULES_BTN = '[data-test-subj="manage-signal-detection-rules"]';
@@ -20,8 +22,12 @@ export const OPENED_SIGNALS_BTN = '[data-test-subj="openSignals"]';
 
 export const SELECTED_SIGNALS = '[data-test-subj="selectedSignals"]';
 
+export const SEND_SIGNAL_TO_TIMELINE_BTN = '[data-test-subj="send-signal-to-timeline-button"]';
+
 export const SHOWING_SIGNALS = '[data-test-subj="showingSignals"]';
 
 export const SIGNALS = '[data-test-subj="event"]';
 
+export const SIGNAL_ID = '[data-test-subj="draggable-content-_id"]';
+
 export const SIGNAL_CHECKBOX = '[data-test-subj="select-event-container"] .euiCheckbox__input';
diff --git a/x-pack/legacy/plugins/siem/cypress/screens/timeline.ts b/x-pack/legacy/plugins/siem/cypress/screens/timeline.ts
index fbce585a70f86..53d8273d9ce6b 100644
--- a/x-pack/legacy/plugins/siem/cypress/screens/timeline.ts
+++ b/x-pack/legacy/plugins/siem/cypress/screens/timeline.ts
@@ -14,6 +14,8 @@ export const ID_FIELD = '[data-test-subj="timeline"] [data-test-subj="field-name
 
 export const ID_TOGGLE_FIELD = '[data-test-subj="toggle-field-_id"]';
 
+export const PROVIDER_BADGE = '[data-test-subj="providerBadge"]';
+
 export const SEARCH_OR_FILTER_CONTAINER =
   '[data-test-subj="timeline-search-or-filter-search-container"]';
 
diff --git a/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts b/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts
index abea4a887b8ba..c30a178eab489 100644
--- a/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts
+++ b/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts
@@ -6,11 +6,13 @@
 
 import {
   CLOSED_SIGNALS_BTN,
+  EXPAND_SIGNAL_BTN,
   LOADING_SIGNALS_PANEL,
   MANAGE_SIGNAL_DETECTION_RULES_BTN,
   OPEN_CLOSE_SIGNAL_BTN,
   OPEN_CLOSE_SIGNALS_BTN,
   OPENED_SIGNALS_BTN,
+  SEND_SIGNAL_TO_TIMELINE_BTN,
   SIGNALS,
   SIGNAL_CHECKBOX,
 } from '../screens/detections';
@@ -26,6 +28,12 @@ export const closeSignals = () => {
   cy.get(OPEN_CLOSE_SIGNALS_BTN).click({ force: true });
 };
 
+export const expandFirstSignal = () => {
+  cy.get(EXPAND_SIGNAL_BTN)
+    .first()
+    .click({ force: true });
+};
+
 export const goToClosedSignals = () => {
   cy.get(CLOSED_SIGNALS_BTN).click({ force: true });
 };
@@ -58,6 +66,12 @@ export const selectNumberOfSignals = (numberOfSignals: number) => {
   }
 };
 
+export const investigateFirstSignalInTimeline = () => {
+  cy.get(SEND_SIGNAL_TO_TIMELINE_BTN)
+    .first()
+    .click({ force: true });
+};
+
 export const waitForSignals = () => {
   cy.get(REFRESH_BUTTON)
     .invoke('text')
diff --git a/x-pack/legacy/plugins/siem/public/components/header_global/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/header_global/index.test.tsx
index 098de39bbfef5..56fa0d56f3c3a 100644
--- a/x-pack/legacy/plugins/siem/public/components/header_global/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/header_global/index.test.tsx
@@ -10,6 +10,16 @@ import React from 'react';
 import '../../mock/match_media';
 import { HeaderGlobal } from './index';
 
+jest.mock('react-router-dom', () => ({
+  useLocation: () => ({
+    pathname: '/app/siem#/hosts/allHosts',
+    hash: '',
+    search: '',
+    state: '',
+  }),
+  withRouter: () => jest.fn(),
+}));
+
 jest.mock('ui/new_platform');
 
 // Test will fail because we will to need to mock some core services to make the test work
@@ -19,6 +29,10 @@ jest.mock('../search_bar', () => ({
 }));
 
 describe('HeaderGlobal', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
   test('it renders', () => {
     const wrapper = shallow(<HeaderGlobal />);
 
diff --git a/x-pack/legacy/plugins/siem/public/components/header_global/index.tsx b/x-pack/legacy/plugins/siem/public/components/header_global/index.tsx
index a12fab8a4f5d9..adc2be4f9c365 100644
--- a/x-pack/legacy/plugins/siem/public/components/header_global/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/header_global/index.tsx
@@ -9,6 +9,7 @@ import { pickBy } from 'lodash/fp';
 import React from 'react';
 import styled, { css } from 'styled-components';
 
+import { useLocation } from 'react-router-dom';
 import { gutterTimeline } from '../../lib/helpers';
 import { navTabs } from '../../pages/home/home_navigations';
 import { SiemPageName } from '../../pages/home/types';
@@ -36,63 +37,68 @@ FlexItem.displayName = 'FlexItem';
 interface HeaderGlobalProps {
   hideDetectionEngine?: boolean;
 }
-export const HeaderGlobal = React.memo<HeaderGlobalProps>(({ hideDetectionEngine = false }) => (
-  <Wrapper className="siemHeaderGlobal">
-    <EuiFlexGroup alignItems="center" justifyContent="spaceBetween" wrap>
-      <WithSource sourceId="default">
-        {({ indicesExist }) => (
-          <>
-            <FlexItem>
-              <EuiFlexGroup alignItems="center" responsive={false}>
-                <FlexItem grow={false}>
-                  <EuiLink href={getOverviewUrl()}>
-                    <EuiIcon aria-label={i18n.SIEM} type="securityAnalyticsApp" size="l" />
-                  </EuiLink>
-                </FlexItem>
+export const HeaderGlobal = React.memo<HeaderGlobalProps>(({ hideDetectionEngine = false }) => {
+  const currentLocation = useLocation();
 
-                <FlexItem component="nav">
-                  {indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
-                    <SiemNavigation
-                      display="condensed"
-                      navTabs={
-                        hideDetectionEngine
-                          ? pickBy((_, key) => key !== SiemPageName.detections, navTabs)
-                          : navTabs
-                      }
-                    />
-                  ) : (
-                    <SiemNavigation
-                      display="condensed"
-                      navTabs={pickBy((_, key) => key === SiemPageName.overview, navTabs)}
-                    />
-                  )}
-                </FlexItem>
-              </EuiFlexGroup>
-            </FlexItem>
-
-            <FlexItem grow={false}>
-              <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false} wrap>
-                {indicesExistOrDataTemporarilyUnavailable(indicesExist) && (
+  return (
+    <Wrapper className="siemHeaderGlobal">
+      <EuiFlexGroup alignItems="center" justifyContent="spaceBetween" wrap>
+        <WithSource sourceId="default">
+          {({ indicesExist }) => (
+            <>
+              <FlexItem>
+                <EuiFlexGroup alignItems="center" responsive={false}>
                   <FlexItem grow={false}>
-                    <MlPopover />
+                    <EuiLink href={getOverviewUrl()}>
+                      <EuiIcon aria-label={i18n.SIEM} type="securityAnalyticsApp" size="l" />
+                    </EuiLink>
+                  </FlexItem>
+
+                  <FlexItem component="nav">
+                    {indicesExistOrDataTemporarilyUnavailable(indicesExist) ? (
+                      <SiemNavigation
+                        display="condensed"
+                        navTabs={
+                          hideDetectionEngine
+                            ? pickBy((_, key) => key !== SiemPageName.detections, navTabs)
+                            : navTabs
+                        }
+                      />
+                    ) : (
+                      <SiemNavigation
+                        display="condensed"
+                        navTabs={pickBy((_, key) => key === SiemPageName.overview, navTabs)}
+                      />
+                    )}
                   </FlexItem>
-                )}
+                </EuiFlexGroup>
+              </FlexItem>
 
-                <FlexItem grow={false}>
-                  <EuiButtonEmpty
-                    data-test-subj="add-data"
-                    href="kibana#home/tutorial_directory/siem"
-                    iconType="plusInCircle"
-                  >
-                    {i18n.BUTTON_ADD_DATA}
-                  </EuiButtonEmpty>
-                </FlexItem>
-              </EuiFlexGroup>
-            </FlexItem>
-          </>
-        )}
-      </WithSource>
-    </EuiFlexGroup>
-  </Wrapper>
-));
+              <FlexItem grow={false}>
+                <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false} wrap>
+                  {indicesExistOrDataTemporarilyUnavailable(indicesExist) &&
+                    currentLocation.pathname.includes(`/${SiemPageName.detections}/`) && (
+                      <FlexItem grow={false}>
+                        <MlPopover />
+                      </FlexItem>
+                    )}
+
+                  <FlexItem grow={false}>
+                    <EuiButtonEmpty
+                      data-test-subj="add-data"
+                      href="kibana#home/tutorial_directory/siem"
+                      iconType="plusInCircle"
+                    >
+                      {i18n.BUTTON_ADD_DATA}
+                    </EuiButtonEmpty>
+                  </FlexItem>
+                </EuiFlexGroup>
+              </FlexItem>
+            </>
+          )}
+        </WithSource>
+      </EuiFlexGroup>
+    </Wrapper>
+  );
+});
 HeaderGlobal.displayName = 'HeaderGlobal';
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/__snapshots__/popover_description.test.tsx.snap b/x-pack/legacy/plugins/siem/public/components/ml_popover/__snapshots__/popover_description.test.tsx.snap
index 09e95c5ff59ea..46e61f9e939ee 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/__snapshots__/popover_description.test.tsx.snap
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/__snapshots__/popover_description.test.tsx.snap
@@ -5,7 +5,7 @@ exports[`JobsTableFilters renders correctly against snapshot 1`] = `
   size="s"
 >
   <FormattedMessage
-    defaultMessage="Run any of the Machine Learning jobs below to view anomalous events throughout the SIEM application. We’ve provided a few common detection jobs to get you started. If you wish to add your own custom jobs, simply create and tag them with “SIEM” from the {machineLearning} application for inclusion here."
+    defaultMessage="Run any of the Machine Learning jobs below to prepare for creating signal detection rules that produce signals for detected anomalies, and to view anomalous events throughout the SIEM application. We’ve provided a collection of common detection jobs to get you started. If you wish to add your own custom ML jobs, create and add them to the “SIEM” group from the {machineLearning} application."
     id="xpack.siem.components.mlPopup.anomalyDetectionDescription"
     values={
       Object {
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/ml_popover.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/ml_popover.tsx
index b00eef79ee480..6ea5cba4b37e4 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/ml_popover.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/ml_popover.tsx
@@ -117,7 +117,7 @@ export const MlPopover = React.memo(() => {
             iconSide="right"
             onClick={() => setIsPopoverOpen(!isPopoverOpen)}
           >
-            {i18n.ANOMALY_DETECTION}
+            {i18n.ML_JOB_SETTINGS}
           </EuiButtonEmpty>
         }
         isOpen={isPopoverOpen}
@@ -142,14 +142,14 @@ export const MlPopover = React.memo(() => {
               dispatch({ type: 'refresh' });
             }}
           >
-            {i18n.ANOMALY_DETECTION}
+            {i18n.ML_JOB_SETTINGS}
           </EuiButtonEmpty>
         }
         isOpen={isPopoverOpen}
         closePopover={() => setIsPopoverOpen(!isPopoverOpen)}
       >
         <PopoverContentsDiv data-test-subj="ml-popover-contents">
-          <EuiPopoverTitle>{i18n.ANOMALY_DETECTION_TITLE}</EuiPopoverTitle>
+          <EuiPopoverTitle>{i18n.ML_JOB_SETTINGS}</EuiPopoverTitle>
           <PopoverDescription />
 
           <EuiSpacer />
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx
index 20e8dd2492fef..a491d4b6b769c 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx
@@ -14,7 +14,7 @@ export const PopoverDescriptionComponent = () => (
   <EuiText size="s">
     <FormattedMessage
       id="xpack.siem.components.mlPopup.anomalyDetectionDescription"
-      defaultMessage="Run any of the Machine Learning jobs below to view anomalous events throughout the SIEM application. We’ve provided a few common detection jobs to get you started. If you wish to add your own custom jobs, simply create and tag them with “SIEM” from the {machineLearning} application for inclusion here."
+      defaultMessage="Run any of the Machine Learning jobs below to prepare for creating signal detection rules that produce signals for detected anomalies, and to view anomalous events throughout the SIEM application. We’ve provided a collection of common detection jobs to get you started. If you wish to add your own custom ML jobs, create and add them to the “SIEM” group from the {machineLearning} application."
       values={{
         machineLearning: (
           <EuiLink href={`${useBasePath()}/app/ml`} target="_blank">
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/translations.ts b/x-pack/legacy/plugins/siem/public/components/ml_popover/translations.ts
index 442068dd0e193..613691e55dcfd 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/translations.ts
@@ -6,17 +6,10 @@
 
 import { i18n } from '@kbn/i18n';
 
-export const ANOMALY_DETECTION = i18n.translate(
-  'xpack.siem.components.mlPopup.anomalyDetectionButtonLabel',
+export const ML_JOB_SETTINGS = i18n.translate(
+  'xpack.siem.components.mlPopup.mlJobSettingsButtonLabel',
   {
-    defaultMessage: 'Anomaly detection',
-  }
-);
-
-export const ANOMALY_DETECTION_TITLE = i18n.translate(
-  'xpack.siem.components.mlPopup.anomalyDetectionTitle',
-  {
-    defaultMessage: 'Anomaly detection settings',
+    defaultMessage: 'ML job settings',
   }
 );
 
diff --git a/x-pack/legacy/plugins/siem/public/components/toasters/utils.ts b/x-pack/legacy/plugins/siem/public/components/toasters/utils.ts
index e624144c9826f..e7cc389d4c06b 100644
--- a/x-pack/legacy/plugins/siem/public/components/toasters/utils.ts
+++ b/x-pack/legacy/plugins/siem/public/components/toasters/utils.ts
@@ -37,6 +37,30 @@ export const displayErrorToast = (
   });
 };
 
+/**
+ * Displays a warning toast for the provided title and message
+ *
+ * @param title warning message to display in toaster and modal
+ * @param dispatchToaster provided by useStateToaster()
+ * @param id unique ID if necessary
+ */
+export const displayWarningToast = (
+  title: string,
+  dispatchToaster: React.Dispatch<ActionToaster>,
+  id: string = uuid.v4()
+): void => {
+  const toast: AppToast = {
+    id,
+    title,
+    color: 'warning',
+    iconType: 'help',
+  };
+  dispatchToaster({
+    type: 'addToaster',
+    toast,
+  });
+};
+
 /**
  * Displays a success toast for the provided title and message
  *
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/batch_actions.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/batch_actions.tsx
index 60ad68b8c9141..454ef18e0ae14 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/batch_actions.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/batch_actions.tsx
@@ -14,13 +14,15 @@ import {
   enableRulesAction,
   exportRulesAction,
 } from './actions';
-import { ActionToaster } from '../../../../components/toasters';
+import { ActionToaster, displayWarningToast } from '../../../../components/toasters';
 import { Rule } from '../../../../containers/detection_engine/rules';
+import * as detectionI18n from '../../translations';
 
 interface GetBatchItems {
   closePopover: () => void;
   dispatch: Dispatch<Action>;
   dispatchToaster: Dispatch<ActionToaster>;
+  hasMlPermissions: boolean;
   loadingRuleIds: string[];
   reFetchRules: (refreshPrePackagedRule?: boolean) => void;
   rules: Rule[];
@@ -31,6 +33,7 @@ export const getBatchItems = ({
   closePopover,
   dispatch,
   dispatchToaster,
+  hasMlPermissions,
   loadingRuleIds,
   reFetchRules,
   rules,
@@ -57,7 +60,22 @@ export const getBatchItems = ({
         const deactivatedIds = selectedRuleIds.filter(
           id => !rules.find(r => r.id === id)?.enabled ?? false
         );
-        await enableRulesAction(deactivatedIds, true, dispatch, dispatchToaster);
+
+        const deactivatedIdsNoML = deactivatedIds.filter(
+          id => rules.find(r => r.id === id)?.type !== 'machine_learning' ?? false
+        );
+
+        const mlRuleCount = deactivatedIds.length - deactivatedIdsNoML.length;
+        if (!hasMlPermissions && mlRuleCount > 0) {
+          displayWarningToast(detectionI18n.ML_RULES_UNAVAILABLE(mlRuleCount), dispatchToaster);
+        }
+
+        await enableRulesAction(
+          hasMlPermissions ? deactivatedIds : deactivatedIdsNoML,
+          true,
+          dispatch,
+          dispatchToaster
+        );
       }}
     >
       {i18n.BATCH_ACTION_ACTIVATE_SELECTED}
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/columns.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/columns.tsx
index 9a84d33ab5fdf..80e644f800334 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/columns.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/columns.tsx
@@ -13,6 +13,7 @@ import {
   EuiTableActionsColumnType,
   EuiText,
   EuiHealth,
+  EuiToolTip,
 } from '@elastic/eui';
 import { FormattedRelative } from '@kbn/i18n/react';
 import * as H from 'history';
@@ -36,6 +37,8 @@ import {
 } from './actions';
 import { Action } from './reducer';
 import { LocalizedDateTooltip } from '../../../../components/localized_date_tooltip';
+import * as detectionI18n from '../../translations';
+import { isMlRule } from '../../../../../common/detection_engine/ml_helpers';
 
 export const getActions = (
   dispatch: React.Dispatch<Action>,
@@ -88,6 +91,7 @@ interface GetColumns {
   dispatch: React.Dispatch<Action>;
   dispatchToaster: Dispatch<ActionToaster>;
   history: H.History;
+  hasMlPermissions: boolean;
   hasNoPermissions: boolean;
   loadingRuleIds: string[];
   reFetchRules: (refreshPrePackagedRule?: boolean) => void;
@@ -98,6 +102,7 @@ export const getColumns = ({
   dispatch,
   dispatchToaster,
   history,
+  hasMlPermissions,
   hasNoPermissions,
   loadingRuleIds,
   reFetchRules,
@@ -182,14 +187,25 @@ export const getColumns = ({
       field: 'enabled',
       name: i18n.COLUMN_ACTIVATE,
       render: (value: Rule['enabled'], item: Rule) => (
-        <RuleSwitch
-          data-test-subj="enabled"
-          dispatch={dispatch}
-          id={item.id}
-          enabled={item.enabled}
-          isDisabled={hasNoPermissions}
-          isLoading={loadingRuleIds.includes(item.id)}
-        />
+        <EuiToolTip
+          position="top"
+          content={
+            isMlRule(item.type) && !hasMlPermissions
+              ? detectionI18n.ML_RULES_DISABLED_MESSAGE
+              : undefined
+          }
+        >
+          <RuleSwitch
+            data-test-subj="enabled"
+            dispatch={dispatch}
+            id={item.id}
+            enabled={item.enabled}
+            isDisabled={
+              hasNoPermissions || (isMlRule(item.type) && !hasMlPermissions && !item.enabled)
+            }
+            isLoading={loadingRuleIds.includes(item.id)}
+          />
+        </EuiToolTip>
       ),
       sortable: true,
       width: '95px',
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/index.tsx
index ccdfd1ed1be38..e96ed856208bd 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/index.tsx
@@ -40,6 +40,8 @@ import { getColumns, getMonitoringColumns } from './columns';
 import { showRulesTable } from './helpers';
 import { allRulesReducer, State } from './reducer';
 import { RulesTableFilters } from './rules_table_filters/rules_table_filters';
+import { useMlCapabilities } from '../../../../components/ml_popover/hooks/use_ml_capabilities';
+import { hasMlAdminPermissions } from '../../../../components/ml/permissions/has_ml_admin_permissions';
 
 const SORT_FIELD = 'enabled';
 const initialState: State = {
@@ -111,6 +113,11 @@ export const AllRules = React.memo<AllRulesProps>(
     const { loading: isLoadingRulesStatuses, rulesStatuses } = useRulesStatuses(rules);
     const history = useHistory();
     const [, dispatchToaster] = useStateToaster();
+    const mlCapabilities = useMlCapabilities();
+
+    // TODO: Refactor license check + hasMlAdminPermissions to common check
+    const hasMlPermissions =
+      mlCapabilities.isPlatinumOrTrialLicense && hasMlAdminPermissions(mlCapabilities);
 
     const setRules = useCallback((newRules: Rule[], newPagination: Partial<PaginationOptions>) => {
       dispatch({
@@ -145,6 +152,7 @@ export const AllRules = React.memo<AllRulesProps>(
             closePopover,
             dispatch,
             dispatchToaster,
+            hasMlPermissions,
             loadingRuleIds,
             selectedRuleIds,
             reFetchRules: reFetchRulesData,
@@ -152,7 +160,15 @@ export const AllRules = React.memo<AllRulesProps>(
           })}
         />
       ),
-      [dispatch, dispatchToaster, loadingRuleIds, reFetchRulesData, rules, selectedRuleIds]
+      [
+        dispatch,
+        dispatchToaster,
+        hasMlPermissions,
+        loadingRuleIds,
+        reFetchRulesData,
+        rules,
+        selectedRuleIds,
+      ]
     );
 
     const paginationMemo = useMemo(
@@ -184,6 +200,7 @@ export const AllRules = React.memo<AllRulesProps>(
         dispatch,
         dispatchToaster,
         history,
+        hasMlPermissions,
         hasNoPermissions,
         loadingRuleIds:
           loadingRulesAction != null &&
@@ -192,7 +209,15 @@ export const AllRules = React.memo<AllRulesProps>(
             : [],
         reFetchRules: reFetchRulesData,
       });
-    }, [dispatch, dispatchToaster, history, loadingRuleIds, loadingRulesAction, reFetchRulesData]);
+    }, [
+      dispatch,
+      dispatchToaster,
+      hasMlPermissions,
+      history,
+      loadingRuleIds,
+      loadingRulesAction,
+      reFetchRulesData,
+    ]);
 
     const monitoringColumns = useMemo(() => getMonitoringColumns(), []);
 
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/ml_job_description.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/ml_job_description.tsx
index 8276aa3578563..5a9593f1a6de2 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/ml_job_description.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/ml_job_description.tsx
@@ -66,7 +66,9 @@ const Wrapper = styled.div`
 `;
 
 export const MlJobDescription: React.FC<{ job: SiemJob }> = ({ job }) => {
-  const jobUrl = useKibana().services.application.getUrlForApp('ml#/jobs');
+  const jobUrl = useKibana().services.application.getUrlForApp(
+    `ml#/jobs?mlManagement=(jobId:${encodeURI(job.id)})`
+  );
 
   return (
     <Wrapper>
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx
index 3d253b71b53d6..794edf0ab5de7 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx
@@ -4,37 +4,64 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback } from 'react';
+import React, { useCallback, useMemo } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiFormRow,
+  EuiIcon,
   EuiLink,
   EuiSuperSelect,
   EuiText,
 } from '@elastic/eui';
 
+import styled from 'styled-components';
 import { FieldHook, getFieldValidityAndErrorMessage } from '../../../../../shared_imports';
 import { useSiemJobs } from '../../../../../components/ml_popover/hooks/use_siem_jobs';
 import { useKibana } from '../../../../../lib/kibana';
-import { ML_JOB_SELECT_PLACEHOLDER_TEXT } from '../step_define_rule/translations';
+import {
+  ML_JOB_SELECT_PLACEHOLDER_TEXT,
+  ENABLE_ML_JOB_WARNING,
+} from '../step_define_rule/translations';
+import { isJobStarted } from '../../../../../../common/detection_engine/ml_helpers';
+
+const HelpTextWarningContainer = styled.div`
+  margin-top: 10px;
+`;
+
+const MlJobSelectEuiFlexGroup = styled(EuiFlexGroup)`
+  margin-bottom: 5px;
+`;
 
-const HelpText: React.FC<{ href: string }> = ({ href }) => (
-  <FormattedMessage
-    id="xpack.siem.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText"
-    defaultMessage="We've provided a few common jobs to get you started. To add your own custom jobs, assign a group of “siem” to those jobs in the {machineLearning} application to make them appear here."
-    values={{
-      machineLearning: (
-        <EuiLink href={href} target="_blank">
-          <FormattedMessage
-            id="xpack.siem.components.mlJobSelect.machineLearningLink"
-            defaultMessage="Machine Learning"
-          />
-        </EuiLink>
-      ),
-    }}
-  />
+const HelpText: React.FC<{ href: string; showEnableWarning: boolean }> = ({
+  href,
+  showEnableWarning = false,
+}) => (
+  <>
+    <FormattedMessage
+      id="xpack.siem.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText"
+      defaultMessage="We've provided a few common jobs to get you started. To add your own custom jobs, assign a group of “siem” to those jobs in the {machineLearning} application to make them appear here."
+      values={{
+        machineLearning: (
+          <EuiLink href={href} target="_blank">
+            <FormattedMessage
+              id="xpack.siem.components.mlJobSelect.machineLearningLink"
+              defaultMessage="Machine Learning"
+            />
+          </EuiLink>
+        ),
+      }}
+    />
+    {showEnableWarning && (
+      <HelpTextWarningContainer>
+        <EuiText size="xs" color="warning">
+          <EuiIcon type="alert" />
+          <span>{ENABLE_ML_JOB_WARNING}</span>
+        </EuiText>
+      </HelpTextWarningContainer>
+    )}
+  </>
 );
 
 const JobDisplay: React.FC<{ title: string; description: string }> = ({ title, description }) => (
@@ -77,26 +104,37 @@ export const MlJobSelect: React.FC<MlJobSelectProps> = ({ describedByIds = [], f
 
   const options = [placeholderOption, ...jobOptions];
 
+  const isJobRunning = useMemo(() => {
+    // If the selected job is not found in the list, it means the placeholder is selected
+    // and so we don't want to show the warning, thus isJobRunning will be true when 'job == null'
+    const job = siemJobs.find(j => j.id === jobId);
+    return job == null || isJobStarted(job.jobState, job.datafeedState);
+  }, [siemJobs, jobId]);
+
   return (
-    <EuiFormRow
-      label={field.label}
-      helpText={<HelpText href={mlUrl} />}
-      isInvalid={isInvalid}
-      error={errorMessage}
-      data-test-subj="mlJobSelect"
-      describedByIds={describedByIds}
-    >
-      <EuiFlexGroup>
-        <EuiFlexItem>
-          <EuiSuperSelect
-            hasDividers
-            isLoading={isLoading}
-            onChange={handleJobChange}
-            options={options}
-            valueOfSelected={jobId || 'placeholder'}
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiFormRow>
+    <MlJobSelectEuiFlexGroup>
+      <EuiFlexItem>
+        <EuiFormRow
+          label={field.label}
+          helpText={<HelpText href={mlUrl} showEnableWarning={!isJobRunning} />}
+          isInvalid={isInvalid}
+          error={errorMessage}
+          data-test-subj="mlJobSelect"
+          describedByIds={describedByIds}
+        >
+          <EuiFlexGroup>
+            <EuiFlexItem>
+              <EuiSuperSelect
+                hasDividers
+                isLoading={isLoading}
+                onChange={handleJobChange}
+                options={options}
+                valueOfSelected={jobId || 'placeholder'}
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFormRow>
+      </EuiFlexItem>
+    </MlJobSelectEuiFlexGroup>
   );
 };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/translations.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/translations.tsx
index 1d8821aceb249..bbdb2130ce298 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/translations.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/translations.tsx
@@ -62,3 +62,11 @@ export const ML_JOB_SELECT_PLACEHOLDER_TEXT = i18n.translate(
     defaultMessage: 'Select a job',
   }
 );
+
+export const ENABLE_ML_JOB_WARNING = i18n.translate(
+  'xpack.siem.detectionEngine.createRule.stepDefineRule.mlEnableJobWarningTitle',
+  {
+    defaultMessage:
+      'This ML job is not currently running. Please set this job to run via "ML job settings" before activating this rule.',
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/details/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/details/index.tsx
index cb4d88a8bb539..2b648a3b3f825 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/details/index.tsx
@@ -14,6 +14,7 @@ import {
   EuiSpacer,
   EuiTab,
   EuiTabs,
+  EuiToolTip,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { FC, memo, useCallback, useMemo, useState } from 'react';
@@ -66,6 +67,8 @@ import { RuleActionsOverflow } from '../components/rule_actions_overflow';
 import { RuleStatusFailedCallOut } from './status_failed_callout';
 import { FailureHistory } from './failure_history';
 import { RuleStatus } from '../components/rule_status';
+import { useMlCapabilities } from '../../../../components/ml_popover/hooks/use_ml_capabilities';
+import { hasMlAdminPermissions } from '../../../../components/ml/permissions/has_ml_admin_permissions';
 
 enum RuleDetailTabs {
   signals = 'signals',
@@ -114,6 +117,11 @@ const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
           scheduleRuleData: null,
         };
   const [lastSignals] = useSignalInfo({ ruleId });
+  const mlCapabilities = useMlCapabilities();
+
+  // TODO: Refactor license check + hasMlAdminPermissions to common check
+  const hasMlPermissions =
+    mlCapabilities.isPlatinumOrTrialLicense && hasMlAdminPermissions(mlCapabilities);
 
   const title = isLoading === true || rule === null ? <EuiLoadingSpinner size="m" /> : rule.name;
   const subTitle = useMemo(
@@ -259,13 +267,25 @@ const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
                     >
                       <EuiFlexGroup alignItems="center">
                         <EuiFlexItem grow={false}>
-                          <RuleSwitch
-                            id={rule?.id ?? '-1'}
-                            isDisabled={userHasNoPermissions(canUserCRUD)}
-                            enabled={rule?.enabled ?? false}
-                            optionLabel={i18n.ACTIVATE_RULE}
-                            onChange={handleOnChangeEnabledRule}
-                          />
+                          <EuiToolTip
+                            position="top"
+                            content={
+                              rule?.type === 'machine_learning' && !hasMlPermissions
+                                ? detectionI18n.ML_RULES_DISABLED_MESSAGE
+                                : undefined
+                            }
+                          >
+                            <RuleSwitch
+                              id={rule?.id ?? '-1'}
+                              isDisabled={
+                                userHasNoPermissions(canUserCRUD) ||
+                                (!hasMlPermissions && !rule?.enabled)
+                              }
+                              enabled={rule?.enabled ?? false}
+                              optionLabel={i18n.ACTIVATE_RULE}
+                              onChange={handleOnChangeEnabledRule}
+                            />
+                          </EuiToolTip>
                         </EuiFlexItem>
 
                         <EuiFlexItem grow={false}>
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/translations.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/translations.ts
index 39277b3d3c77e..008d660be9d88 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/translations.ts
@@ -86,3 +86,17 @@ export const USER_UNAUTHENTICATED_MSG_BODY = i18n.translate(
       'You do not have the required permissions for viewing the detection engine. For more help, contact your administrator.',
   }
 );
+
+export const ML_RULES_DISABLED_MESSAGE = i18n.translate(
+  'xpack.siem.detectionEngine.mlRulesDisabledMessageTitle',
+  {
+    defaultMessage: 'ML rules require Platinum License and ML Admin Permissions',
+  }
+);
+
+export const ML_RULES_UNAVAILABLE = (totalRules: number) =>
+  i18n.translate('xpack.siem.detectionEngine.mlUnavailableTitle', {
+    values: { totalRules },
+    defaultMessage:
+      '{totalRules} {totalRules, plural, =1 {rule requires} other {rules require}} Machine Learning to enable.',
+  });
diff --git a/x-pack/plugins/ingest_manager/common/constants/agent.ts b/x-pack/plugins/ingest_manager/common/constants/agent.ts
index fe6f7f57e2899..0b462fb4c0319 100644
--- a/x-pack/plugins/ingest_manager/common/constants/agent.ts
+++ b/x-pack/plugins/ingest_manager/common/constants/agent.ts
@@ -5,8 +5,8 @@
  */
 
 export const AGENT_SAVED_OBJECT_TYPE = 'agents';
-
 export const AGENT_EVENT_SAVED_OBJECT_TYPE = 'agent_events';
+export const AGENT_ACTION_SAVED_OBJECT_TYPE = 'agent_actions';
 
 export const AGENT_TYPE_PERMANENT = 'PERMANENT';
 export const AGENT_TYPE_EPHEMERAL = 'EPHEMERAL';
diff --git a/x-pack/plugins/ingest_manager/common/types/models/agent.ts b/x-pack/plugins/ingest_manager/common/types/models/agent.ts
index aa5729a101e11..4d03a30f9a590 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/agent.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/agent.ts
@@ -16,15 +16,21 @@ export type AgentStatus = 'offline' | 'error' | 'online' | 'inactive' | 'warning
 
 export interface NewAgentAction {
   type: 'CONFIG_CHANGE' | 'DATA_DUMP' | 'RESUME' | 'PAUSE';
-  data?: string;
+  data?: any;
   sent_at?: string;
 }
 
 export type AgentAction = NewAgentAction & {
   id: string;
+  agent_id: string;
   created_at: string;
 } & SavedObjectAttributes;
 
+export interface AgentActionSOAttributes extends NewAgentAction, SavedObjectAttributes {
+  created_at: string;
+  agent_id: string;
+}
+
 export interface AgentEvent {
   type: 'STATE' | 'ERROR' | 'ACTION_RESULT' | 'ACTION';
   subtype: // State
@@ -62,7 +68,6 @@ interface AgentBase {
   config_revision?: number;
   config_newest_revision?: number;
   last_checkin?: string;
-  actions: AgentAction[];
 }
 
 export interface Agent extends AgentBase {
diff --git a/x-pack/plugins/ingest_manager/server/constants/index.ts b/x-pack/plugins/ingest_manager/server/constants/index.ts
index f6ee475614c5e..6ac92ca5d2a91 100644
--- a/x-pack/plugins/ingest_manager/server/constants/index.ts
+++ b/x-pack/plugins/ingest_manager/server/constants/index.ts
@@ -20,8 +20,9 @@ export {
   INSTALL_SCRIPT_API_ROUTES,
   SETUP_API_ROUTE,
   // Saved object types
-  AGENT_EVENT_SAVED_OBJECT_TYPE,
   AGENT_SAVED_OBJECT_TYPE,
+  AGENT_EVENT_SAVED_OBJECT_TYPE,
+  AGENT_ACTION_SAVED_OBJECT_TYPE,
   AGENT_CONFIG_SAVED_OBJECT_TYPE,
   DATASOURCE_SAVED_OBJECT_TYPE,
   OUTPUT_SAVED_OBJECT_TYPE,
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts
index a20ba4a880537..76247c338a24f 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.test.ts
@@ -78,7 +78,7 @@ describe('test actions handlers', () => {
       getAgent: jest.fn().mockReturnValueOnce({
         id: 'agent',
       }),
-      updateAgentActions: jest.fn().mockReturnValueOnce(agentAction),
+      createAgentAction: jest.fn().mockReturnValueOnce(agentAction),
     } as jest.Mocked<ActionsService>;
 
     const postNewAgentActionHandler = postNewAgentActionHandlerBuilder(actionsService);
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
index 2b9c230803593..8eb427e5739b0 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/actions_handlers.ts
@@ -28,11 +28,11 @@ export const postNewAgentActionHandlerBuilder = function(
 
       const newAgentAction = request.body.action as NewAgentAction;
 
-      const savedAgentAction = await actionsService.updateAgentActions(
-        soClient,
-        agent,
-        newAgentAction
-      );
+      const savedAgentAction = await actionsService.createAgentAction(soClient, {
+        created_at: new Date().toISOString(),
+        ...newAgentAction,
+        agent_id: agent.id,
+      });
 
       const body: PostNewAgentActionResponse = {
         success: true,
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
index adff1fda11200..89c827abe30ec 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/handlers.ts
@@ -187,8 +187,9 @@ export const postAgentCheckinHandler: RequestHandler<
       action: 'checkin',
       success: true,
       actions: actions.map(a => ({
+        agent_id: agent.id,
         type: a.type,
-        data: a.data ? JSON.parse(a.data) : a.data,
+        data: a.data,
         id: a.id,
         created_at: a.created_at,
       })),
diff --git a/x-pack/plugins/ingest_manager/server/routes/agent/index.ts b/x-pack/plugins/ingest_manager/server/routes/agent/index.ts
index d461027017842..ac27e47db155e 100644
--- a/x-pack/plugins/ingest_manager/server/routes/agent/index.ts
+++ b/x-pack/plugins/ingest_manager/server/routes/agent/index.ts
@@ -122,7 +122,7 @@ export const registerRoutes = (router: IRouter) => {
     },
     postNewAgentActionHandlerBuilder({
       getAgent: AgentService.getAgent,
-      updateAgentActions: AgentService.updateAgentActions,
+      createAgentAction: AgentService.createAgentAction,
     })
   );
 
diff --git a/x-pack/plugins/ingest_manager/server/saved_objects.ts b/x-pack/plugins/ingest_manager/server/saved_objects.ts
index 9f3035e1aac17..6800cb4056700 100644
--- a/x-pack/plugins/ingest_manager/server/saved_objects.ts
+++ b/x-pack/plugins/ingest_manager/server/saved_objects.ts
@@ -10,6 +10,7 @@ import {
   PACKAGES_SAVED_OBJECT_TYPE,
   AGENT_SAVED_OBJECT_TYPE,
   AGENT_EVENT_SAVED_OBJECT_TYPE,
+  AGENT_ACTION_SAVED_OBJECT_TYPE,
   ENROLLMENT_API_KEYS_SAVED_OBJECT_TYPE,
 } from './constants';
 
@@ -38,17 +39,16 @@ export const savedObjectMappings = {
       default_api_key: { type: 'keyword' },
       updated_at: { type: 'date' },
       current_error_events: { type: 'text' },
+    },
+  },
+  [AGENT_ACTION_SAVED_OBJECT_TYPE]: {
+    properties: {
+      agent_id: { type: 'keyword' },
+      type: { type: 'keyword' },
       // FIXME_INGEST https://github.com/elastic/kibana/issues/56554
-      actions: {
-        type: 'nested',
-        properties: {
-          id: { type: 'keyword' },
-          type: { type: 'keyword' },
-          data: { type: 'text' },
-          sent_at: { type: 'date' },
-          created_at: { type: 'date' },
-        },
-      },
+      data: { type: 'flattened' },
+      sent_at: { type: 'date' },
+      created_at: { type: 'date' },
     },
   },
   [AGENT_EVENT_SAVED_OBJECT_TYPE]: {
@@ -148,6 +148,7 @@ export const savedObjectMappings = {
     properties: {
       name: { type: 'keyword' },
       version: { type: 'keyword' },
+      internal: { type: 'boolean' },
       installed: {
         type: 'nested',
         properties: {
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts b/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts
index 3c07463e3af5d..b4c1f09015a69 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/acks.test.ts
@@ -3,29 +3,46 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import Boom from 'boom';
+import { SavedObjectsBulkResponse } from 'kibana/server';
 import { savedObjectsClientMock } from '../../../../../../src/core/server/saved_objects/service/saved_objects_client.mock';
-import { Agent, AgentAction, AgentEvent } from '../../../common/types/models';
+import {
+  Agent,
+  AgentAction,
+  AgentActionSOAttributes,
+  AgentEvent,
+} from '../../../common/types/models';
 import { AGENT_TYPE_PERMANENT } from '../../../common/constants';
 import { acknowledgeAgentActions } from './acks';
-import { isBoom } from 'boom';
 
 describe('test agent acks services', () => {
   it('should succeed on valid and matched actions', async () => {
     const mockSavedObjectsClient = savedObjectsClientMock.create();
+
+    mockSavedObjectsClient.bulkGet.mockReturnValue(
+      Promise.resolve({
+        saved_objects: [
+          {
+            id: 'action1',
+            references: [],
+            type: 'agent_actions',
+            attributes: {
+              type: 'CONFIG_CHANGE',
+              agent_id: 'id',
+              sent_at: '2020-03-14T19:45:02.620Z',
+              timestamp: '2019-01-04T14:32:03.36764-05:00',
+              created_at: '2020-03-14T19:45:02.620Z',
+            },
+          },
+        ],
+      } as SavedObjectsBulkResponse<AgentActionSOAttributes>)
+    );
+
     const agentActions = await acknowledgeAgentActions(
       mockSavedObjectsClient,
       ({
         id: 'id',
         type: AGENT_TYPE_PERMANENT,
-        actions: [
-          {
-            type: 'CONFIG_CHANGE',
-            id: 'action1',
-            sent_at: '2020-03-14T19:45:02.620Z',
-            timestamp: '2019-01-04T14:32:03.36764-05:00',
-            created_at: '2020-03-14T19:45:02.620Z',
-          },
-        ],
       } as unknown) as Agent,
       [
         {
@@ -41,6 +58,7 @@ describe('test agent acks services', () => {
       ({
         type: 'CONFIG_CHANGE',
         id: 'action1',
+        agent_id: 'id',
         sent_at: '2020-03-14T19:45:02.620Z',
         timestamp: '2019-01-04T14:32:03.36764-05:00',
         created_at: '2020-03-14T19:45:02.620Z',
@@ -50,21 +68,26 @@ describe('test agent acks services', () => {
 
   it('should fail for actions that cannot be found on agent actions list', async () => {
     const mockSavedObjectsClient = savedObjectsClientMock.create();
+    mockSavedObjectsClient.bulkGet.mockReturnValue(
+      Promise.resolve({
+        saved_objects: [
+          {
+            id: 'action1',
+            error: {
+              message: 'Not found',
+              statusCode: 404,
+            },
+          },
+        ],
+      } as SavedObjectsBulkResponse<AgentActionSOAttributes>)
+    );
+
     try {
       await acknowledgeAgentActions(
         mockSavedObjectsClient,
         ({
           id: 'id',
           type: AGENT_TYPE_PERMANENT,
-          actions: [
-            {
-              type: 'CONFIG_CHANGE',
-              id: 'action1',
-              sent_at: '2020-03-14T19:45:02.620Z',
-              timestamp: '2019-01-04T14:32:03.36764-05:00',
-              created_at: '2020-03-14T19:45:02.620Z',
-            },
-          ],
         } as unknown) as Agent,
         [
           ({
@@ -78,27 +101,38 @@ describe('test agent acks services', () => {
       );
       expect(true).toBeFalsy();
     } catch (e) {
-      expect(isBoom(e)).toBeTruthy();
+      expect(Boom.isBoom(e)).toBeTruthy();
     }
   });
 
   it('should fail for events that have types not in the allowed acknowledgement type list', async () => {
     const mockSavedObjectsClient = savedObjectsClientMock.create();
+
+    mockSavedObjectsClient.bulkGet.mockReturnValue(
+      Promise.resolve({
+        saved_objects: [
+          {
+            id: 'action1',
+            references: [],
+            type: 'agent_actions',
+            attributes: {
+              type: 'CONFIG_CHANGE',
+              agent_id: 'id',
+              sent_at: '2020-03-14T19:45:02.620Z',
+              timestamp: '2019-01-04T14:32:03.36764-05:00',
+              created_at: '2020-03-14T19:45:02.620Z',
+            },
+          },
+        ],
+      } as SavedObjectsBulkResponse<AgentActionSOAttributes>)
+    );
+
     try {
       await acknowledgeAgentActions(
         mockSavedObjectsClient,
         ({
           id: 'id',
           type: AGENT_TYPE_PERMANENT,
-          actions: [
-            {
-              type: 'CONFIG_CHANGE',
-              id: 'action1',
-              sent_at: '2020-03-14T19:45:02.620Z',
-              timestamp: '2019-01-04T14:32:03.36764-05:00',
-              created_at: '2020-03-14T19:45:02.620Z',
-            },
-          ],
         } as unknown) as Agent,
         [
           ({
@@ -112,7 +146,7 @@ describe('test agent acks services', () => {
       );
       expect(true).toBeFalsy();
     } catch (e) {
-      expect(isBoom(e)).toBeTruthy();
+      expect(Boom.isBoom(e)).toBeTruthy();
     }
   });
 });
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/acks.ts b/x-pack/plugins/ingest_manager/server/services/agents/acks.ts
index cf9a47979ae8b..24c3b322aad7f 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/acks.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/acks.ts
@@ -17,8 +17,14 @@ import {
   AgentEvent,
   AgentEventSOAttributes,
   AgentSOAttributes,
+  AgentActionSOAttributes,
 } from '../../types';
-import { AGENT_EVENT_SAVED_OBJECT_TYPE, AGENT_SAVED_OBJECT_TYPE } from '../../constants';
+import {
+  AGENT_EVENT_SAVED_OBJECT_TYPE,
+  AGENT_SAVED_OBJECT_TYPE,
+  AGENT_ACTION_SAVED_OBJECT_TYPE,
+} from '../../constants';
+import { getAgentActionByIds } from './actions';
 
 const ALLOWED_ACKNOWLEDGEMENT_TYPE: string[] = ['ACTION_RESULT'];
 
@@ -27,50 +33,81 @@ export async function acknowledgeAgentActions(
   agent: Agent,
   agentEvents: AgentEvent[]
 ): Promise<AgentAction[]> {
-  const now = new Date().toISOString();
-
-  const agentActionMap: Map<string, AgentAction> = new Map(
-    agent.actions.map(agentAction => [agentAction.id, agentAction])
-  );
-
-  const matchedUpdatedActions: AgentAction[] = [];
-
-  agentEvents.forEach(agentEvent => {
+  for (const agentEvent of agentEvents) {
     if (!isAllowedType(agentEvent.type)) {
       throw Boom.badRequest(`${agentEvent.type} not allowed for acknowledgment only ACTION_RESULT`);
     }
-    if (agentActionMap.has(agentEvent.action_id!)) {
-      const action = agentActionMap.get(agentEvent.action_id!) as AgentAction;
-      if (!action.sent_at) {
-        action.sent_at = now;
-      }
-      matchedUpdatedActions.push(action);
-    } else {
-      throw Boom.badRequest('all actions should belong to current agent');
+  }
+
+  const actionIds = agentEvents
+    .map(event => event.action_id)
+    .filter(actionId => actionId !== undefined) as string[];
+
+  let actions;
+  try {
+    actions = await getAgentActionByIds(soClient, actionIds);
+  } catch (error) {
+    if (Boom.isBoom(error) && error.output.statusCode === 404) {
+      throw Boom.badRequest(`One or more actions cannot be found`);
+    }
+    throw error;
+  }
+
+  for (const action of actions) {
+    if (action.agent_id !== agent.id) {
+      throw Boom.badRequest(`${action.id} not found`);
     }
-  });
+  }
+
+  if (actions.length === 0) {
+    return [];
+  }
+  const configRevision = getLatestConfigRevison(agent, actions);
 
-  if (matchedUpdatedActions.length > 0) {
-    const configRevision = matchedUpdatedActions.reduce((acc, action) => {
-      if (action.type !== 'CONFIG_CHANGE') {
-        return acc;
-      }
-      const data = action.data ? JSON.parse(action.data as string) : {};
+  await soClient.bulkUpdate<AgentSOAttributes | AgentActionSOAttributes>([
+    buildUpdateAgentConfigRevision(agent.id, configRevision),
+    ...buildUpdateAgentActionSentAt(actionIds),
+  ]);
 
-      if (data?.config?.id !== agent.config_id) {
-        return acc;
-      }
+  return actions;
+}
 
-      return data?.config?.revision > acc ? data?.config?.revision : acc;
-    }, agent.config_revision || 0);
+function getLatestConfigRevison(agent: Agent, actions: AgentAction[]) {
+  return actions.reduce((acc, action) => {
+    if (action.type !== 'CONFIG_CHANGE') {
+      return acc;
+    }
+    const data = action.data || {};
 
-    await soClient.update<AgentSOAttributes>(AGENT_SAVED_OBJECT_TYPE, agent.id, {
-      actions: matchedUpdatedActions,
+    if (data?.config?.id !== agent.config_id) {
+      return acc;
+    }
+
+    return data?.config?.revision > acc ? data?.config?.revision : acc;
+  }, agent.config_revision || 0);
+}
+
+function buildUpdateAgentConfigRevision(agentId: string, configRevision: number) {
+  return {
+    type: AGENT_SAVED_OBJECT_TYPE,
+    id: agentId,
+    attributes: {
       config_revision: configRevision,
-    });
-  }
+    },
+  };
+}
 
-  return matchedUpdatedActions;
+function buildUpdateAgentActionSentAt(
+  actionsIds: string[],
+  sentAt: string = new Date().toISOString()
+) {
+  return actionsIds.map(actionId => ({
+    type: AGENT_ACTION_SAVED_OBJECT_TYPE,
+    id: actionId,
+    attributes: {
+      sent_at: sentAt,
+    },
+  }));
 }
 
 function isAllowedType(eventType: string): boolean {
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts b/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts
index b500aeb825fec..f2e671c6dbaa8 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/actions.test.ts
@@ -4,64 +4,34 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { createAgentAction, updateAgentActions } from './actions';
-import { Agent, AgentAction, NewAgentAction } from '../../../common/types/models';
+import { createAgentAction } from './actions';
+import { SavedObject } from 'kibana/server';
+import { AgentAction, AgentActionSOAttributes } from '../../../common/types/models';
 import { savedObjectsClientMock } from '../../../../../../src/core/server/saved_objects/service/saved_objects_client.mock';
-import { AGENT_TYPE_PERMANENT } from '../../../common/constants';
-
-interface UpdatedActions {
-  actions: AgentAction[];
-}
 
 describe('test agent actions services', () => {
-  it('should update agent current actions with new action', async () => {
+  it('should create a new action', async () => {
     const mockSavedObjectsClient = savedObjectsClientMock.create();
 
-    const newAgentAction: NewAgentAction = {
+    const newAgentAction: AgentActionSOAttributes = {
+      agent_id: 'agentid',
       type: 'CONFIG_CHANGE',
       data: 'data',
       sent_at: '2020-03-14T19:45:02.620Z',
+      created_at: '2020-03-14T19:45:02.620Z',
     };
-
-    await updateAgentActions(
-      mockSavedObjectsClient,
-      ({
-        id: 'id',
-        type: AGENT_TYPE_PERMANENT,
-        actions: [
-          {
-            type: 'CONFIG_CHANGE',
-            id: 'action1',
-            sent_at: '2020-03-14T19:45:02.620Z',
-            timestamp: '2019-01-04T14:32:03.36764-05:00',
-            created_at: '2020-03-14T19:45:02.620Z',
-          },
-        ],
-      } as unknown) as Agent,
-      newAgentAction
+    mockSavedObjectsClient.create.mockReturnValue(
+      Promise.resolve({
+        attributes: {},
+      } as SavedObject)
     );
-
-    const updatedAgentActions = (mockSavedObjectsClient.update.mock
-      .calls[0][2] as unknown) as UpdatedActions;
-
-    expect(updatedAgentActions.actions.length).toEqual(2);
-    const actualAgentAction = updatedAgentActions.actions.find(action => action?.data === 'data');
-    expect(actualAgentAction?.type).toEqual(newAgentAction.type);
-    expect(actualAgentAction?.data).toEqual(newAgentAction.data);
-    expect(actualAgentAction?.sent_at).toEqual(newAgentAction.sent_at);
-  });
-
-  it('should create agent action from new agent action model', async () => {
-    const newAgentAction: NewAgentAction = {
-      type: 'CONFIG_CHANGE',
-      data: 'data',
-      sent_at: '2020-03-14T19:45:02.620Z',
-    };
-    const now = new Date();
-    const agentAction = createAgentAction(now, newAgentAction);
-
-    expect(agentAction.type).toEqual(newAgentAction.type);
-    expect(agentAction.data).toEqual(newAgentAction.data);
-    expect(agentAction.sent_at).toEqual(newAgentAction.sent_at);
+    await createAgentAction(mockSavedObjectsClient, newAgentAction);
+
+    const createdAction = (mockSavedObjectsClient.create.mock
+      .calls[0][1] as unknown) as AgentAction;
+    expect(createdAction).toBeDefined();
+    expect(createdAction?.type).toEqual(newAgentAction.type);
+    expect(createdAction?.data).toEqual(newAgentAction.data);
+    expect(createdAction?.sent_at).toEqual(newAgentAction.sent_at);
   });
 });
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/actions.ts b/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
index 2f8ed9f504453..a8ef0820f8d9f 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/actions.ts
@@ -5,46 +5,52 @@
  */
 
 import { SavedObjectsClientContract } from 'kibana/server';
-import uuid from 'uuid';
-import {
-  Agent,
-  AgentAction,
-  AgentSOAttributes,
-  NewAgentAction,
-} from '../../../common/types/models';
-import { AGENT_SAVED_OBJECT_TYPE } from '../../../common/constants';
-
-export async function updateAgentActions(
+import { Agent, AgentAction, AgentActionSOAttributes } from '../../../common/types/models';
+import { AGENT_ACTION_SAVED_OBJECT_TYPE } from '../../../common/constants';
+import { savedObjectToAgentAction } from './saved_objects';
+
+export async function createAgentAction(
   soClient: SavedObjectsClientContract,
-  agent: Agent,
-  newAgentAction: NewAgentAction
+  newAgentAction: AgentActionSOAttributes
 ): Promise<AgentAction> {
-  const agentAction = createAgentAction(new Date(), newAgentAction);
+  const so = await soClient.create<AgentActionSOAttributes>(AGENT_ACTION_SAVED_OBJECT_TYPE, {
+    ...newAgentAction,
+  });
 
-  agent.actions.push(agentAction);
+  return savedObjectToAgentAction(so);
+}
 
-  await soClient.update<AgentSOAttributes>(AGENT_SAVED_OBJECT_TYPE, agent.id, {
-    actions: agent.actions,
+export async function getAgentActionsForCheckin(
+  soClient: SavedObjectsClientContract,
+  agentId: string
+): Promise<AgentAction[]> {
+  const res = await soClient.find<AgentActionSOAttributes>({
+    type: AGENT_ACTION_SAVED_OBJECT_TYPE,
+    filter: `not ${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.sent_at: * and ${AGENT_ACTION_SAVED_OBJECT_TYPE}.attributes.agent_id:${agentId}`,
   });
 
-  return agentAction;
+  return res.saved_objects.map(savedObjectToAgentAction);
 }
 
-export function createAgentAction(createdAt: Date, newAgentAction: NewAgentAction): AgentAction {
-  const agentAction = {
-    id: uuid.v4(),
-    created_at: createdAt.toISOString(),
-  };
-
-  return Object.assign(agentAction, newAgentAction);
+export async function getAgentActionByIds(
+  soClient: SavedObjectsClientContract,
+  actionIds: string[]
+) {
+  const res = await soClient.bulkGet<AgentActionSOAttributes>(
+    actionIds.map(actionId => ({
+      id: actionId,
+      type: AGENT_ACTION_SAVED_OBJECT_TYPE,
+    }))
+  );
+
+  return res.saved_objects.map(savedObjectToAgentAction);
 }
 
 export interface ActionsService {
   getAgent: (soClient: SavedObjectsClientContract, agentId: string) => Promise<Agent>;
 
-  updateAgentActions: (
+  createAgentAction: (
     soClient: SavedObjectsClientContract,
-    agent: Agent,
-    newAgentAction: NewAgentAction
+    newAgentAction: AgentActionSOAttributes
   ) => Promise<AgentAction>;
 }
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/checkin.test.ts b/x-pack/plugins/ingest_manager/server/services/agents/checkin.test.ts
index d3e10fcb6b63f..d98052ea87e86 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/checkin.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/checkin.test.ts
@@ -14,13 +14,13 @@ function getAgent(data: Partial<Agent>) {
 describe('Agent checkin service', () => {
   describe('shouldCreateConfigAction', () => {
     it('should return false if the agent do not have an assigned config', () => {
-      const res = shouldCreateConfigAction(getAgent({}));
+      const res = shouldCreateConfigAction(getAgent({}), []);
 
       expect(res).toBeFalsy();
     });
 
     it('should return true if this is agent first checkin', () => {
-      const res = shouldCreateConfigAction(getAgent({ config_id: 'config1' }));
+      const res = shouldCreateConfigAction(getAgent({ config_id: 'config1' }), []);
 
       expect(res).toBeTruthy();
     });
@@ -32,7 +32,8 @@ describe('Agent checkin service', () => {
           last_checkin: '2018-01-02T00:00:00',
           config_revision: 1,
           config_newest_revision: 1,
-        })
+        }),
+        []
       );
 
       expect(res).toBeFalsy();
@@ -45,20 +46,21 @@ describe('Agent checkin service', () => {
           last_checkin: '2018-01-02T00:00:00',
           config_revision: 1,
           config_newest_revision: 2,
-          actions: [
-            {
-              id: 'action1',
-              type: 'CONFIG_CHANGE',
-              created_at: new Date().toISOString(),
-              data: JSON.stringify({
-                config: {
-                  id: 'config1',
-                  revision: 2,
-                },
-              }),
-            },
-          ],
-        })
+        }),
+        [
+          {
+            id: 'action1',
+            agent_id: 'agent1',
+            type: 'CONFIG_CHANGE',
+            created_at: new Date().toISOString(),
+            data: JSON.stringify({
+              config: {
+                id: 'config1',
+                revision: 2,
+              },
+            }),
+          },
+        ]
       );
 
       expect(res).toBeFalsy();
@@ -71,31 +73,33 @@ describe('Agent checkin service', () => {
           last_checkin: '2018-01-02T00:00:00',
           config_revision: 1,
           config_newest_revision: 2,
-          actions: [
-            {
-              id: 'action1',
-              type: 'CONFIG_CHANGE',
-              created_at: new Date().toISOString(),
-              data: JSON.stringify({
-                config: {
-                  id: 'config2',
-                  revision: 2,
-                },
-              }),
-            },
-            {
-              id: 'action1',
-              type: 'CONFIG_CHANGE',
-              created_at: new Date().toISOString(),
-              data: JSON.stringify({
-                config: {
-                  id: 'config1',
-                  revision: 1,
-                },
-              }),
-            },
-          ],
-        })
+        }),
+        [
+          {
+            id: 'action1',
+            agent_id: 'agent1',
+            type: 'CONFIG_CHANGE',
+            created_at: new Date().toISOString(),
+            data: JSON.stringify({
+              config: {
+                id: 'config2',
+                revision: 2,
+              },
+            }),
+          },
+          {
+            id: 'action1',
+            agent_id: 'agent1',
+            type: 'CONFIG_CHANGE',
+            created_at: new Date().toISOString(),
+            data: JSON.stringify({
+              config: {
+                id: 'config1',
+                revision: 1,
+              },
+            }),
+          },
+        ]
       );
 
       expect(res).toBeTruthy();
@@ -108,7 +112,8 @@ describe('Agent checkin service', () => {
           last_checkin: '2018-01-02T00:00:00',
           config_revision: 1,
           config_newest_revision: 2,
-        })
+        }),
+        []
       );
 
       expect(res).toBeTruthy();
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/checkin.ts b/x-pack/plugins/ingest_manager/server/services/agents/checkin.ts
index d80fff5d8eceb..9a2b3f22b9431 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/checkin.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/checkin.ts
@@ -5,7 +5,6 @@
  */
 
 import { SavedObjectsClientContract, SavedObjectsBulkCreateObject } from 'src/core/server';
-import uuid from 'uuid';
 import {
   Agent,
   AgentEvent,
@@ -17,6 +16,7 @@ import {
 import { agentConfigService } from '../agent_config';
 import * as APIKeysService from '../api_keys';
 import { AGENT_SAVED_OBJECT_TYPE, AGENT_EVENT_SAVED_OBJECT_TYPE } from '../../constants';
+import { getAgentActionsForCheckin, createAgentAction } from './actions';
 
 export async function agentCheckin(
   soClient: SavedObjectsClientContract,
@@ -34,10 +34,10 @@ export async function agentCheckin(
     last_checkin: new Date().toISOString(),
   };
 
-  const actions = filterActionsForCheckin(agent);
+  const actions = await getAgentActionsForCheckin(soClient, agent.id);
 
   // Generate new agent config if config is updated
-  if (agent.config_id && shouldCreateConfigAction(agent)) {
+  if (agent.config_id && shouldCreateConfigAction(agent, actions)) {
     const config = await agentConfigService.getFullConfig(soClient, agent.config_id);
     if (config) {
       // Assign output API keys
@@ -52,18 +52,14 @@ export async function agentCheckin(
       // Mutate the config to set the api token for this agent
       config.outputs.default.api_key = agent.default_api_key || updateData.default_api_key;
 
-      const configChangeAction: AgentAction = {
-        id: uuid.v4(),
+      const configChangeAction = await createAgentAction(soClient, {
+        agent_id: agent.id,
         type: 'CONFIG_CHANGE',
+        data: { config } as any,
         created_at: new Date().toISOString(),
-        data: JSON.stringify({
-          config,
-        }),
         sent_at: undefined,
-      };
+      });
       actions.push(configChangeAction);
-      // persist new action
-      updateData.actions = actions;
     }
   }
   if (localMetadata) {
@@ -149,7 +145,7 @@ function isActionEvent(event: AgentEvent) {
   );
 }
 
-export function shouldCreateConfigAction(agent: Agent): boolean {
+export function shouldCreateConfigAction(agent: Agent, actions: AgentAction[]): boolean {
   if (!agent.config_id) {
     return false;
   }
@@ -167,7 +163,7 @@ export function shouldCreateConfigAction(agent: Agent): boolean {
     return false;
   }
 
-  const isActionAlreadyGenerated = !!agent.actions.find(action => {
+  const isActionAlreadyGenerated = !!actions.find(action => {
     if (!action.data || action.type !== 'CONFIG_CHANGE') {
       return false;
     }
@@ -181,7 +177,3 @@ export function shouldCreateConfigAction(agent: Agent): boolean {
 
   return !isActionAlreadyGenerated;
 }
-
-function filterActionsForCheckin(agent: Agent): AgentAction[] {
-  return agent.actions.filter((a: AgentAction) => !a.sent_at);
-}
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts b/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts
index 52547e9bcb0fb..a34d2e03e9b3d 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/enroll.ts
@@ -35,7 +35,6 @@ export async function enroll(
     user_provided_metadata: JSON.stringify(metadata?.userProvided ?? {}),
     local_metadata: JSON.stringify(metadata?.local ?? {}),
     current_error_events: undefined,
-    actions: [],
     access_api_key_id: undefined,
     last_checkin: undefined,
     default_api_key: undefined,
diff --git a/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts b/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts
index dbe268818713d..aa88520740687 100644
--- a/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts
+++ b/x-pack/plugins/ingest_manager/server/services/agents/saved_objects.ts
@@ -4,8 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import Boom from 'boom';
 import { SavedObject } from 'src/core/server';
-import { Agent, AgentSOAttributes } from '../../types';
+import { Agent, AgentSOAttributes, AgentAction, AgentActionSOAttributes } from '../../types';
 
 export function savedObjectToAgent(so: SavedObject<AgentSOAttributes>): Agent {
   if (so.error) {
@@ -24,3 +25,18 @@ export function savedObjectToAgent(so: SavedObject<AgentSOAttributes>): Agent {
     status: undefined,
   };
 }
+
+export function savedObjectToAgentAction(so: SavedObject<AgentActionSOAttributes>): AgentAction {
+  if (so.error) {
+    if (so.error.statusCode === 404) {
+      throw Boom.notFound(so.error.message);
+    }
+
+    throw new Error(so.error.message);
+  }
+
+  return {
+    id: so.id,
+    ...so.attributes,
+  };
+}
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/get.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/get.ts
index d655b81f8cdef..e963ea138dfd5 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/get.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/get.ts
@@ -31,17 +31,17 @@ export async function getPackages(
       Object.assign({}, item, { title: item.title || nameAsTitle(item.name) })
     );
   });
-  const searchObjects = registryItems.map(({ name, version }) => ({
+  // get the installed packages
+  const results = await savedObjectsClient.find<Installation>({
     type: PACKAGES_SAVED_OBJECT_TYPE,
-    id: `${name}-${version}`,
-  }));
-  const results = await savedObjectsClient.bulkGet<Installation>(searchObjects);
-  const savedObjects = results.saved_objects.filter(o => !o.error); // ignore errors for now
+  });
+  // filter out any internal packages
+  const savedObjectsVisible = results.saved_objects.filter(o => !o.attributes.internal);
   const packageList = registryItems
     .map(item =>
       createInstallableFrom(
         item,
-        savedObjects.find(({ id }) => id === `${item.name}-${item.version}`)
+        savedObjectsVisible.find(({ attributes }) => attributes.name === item.name)
       )
     )
     .sort(sortByName);
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
index 3cce238f582f4..82523e37509d1 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/install.ts
@@ -87,7 +87,7 @@ export async function installPackage(options: {
 }): Promise<AssetReference[]> {
   const { savedObjectsClient, pkgkey, callCluster } = options;
   const registryPackageInfo = await Registry.fetchInfo(pkgkey);
-  const { name: pkgName, version: pkgVersion } = registryPackageInfo;
+  const { name: pkgName, version: pkgVersion, internal = false } = registryPackageInfo;
 
   const installKibanaAssetsPromise = installKibanaAssets({
     savedObjectsClient,
@@ -116,6 +116,7 @@ export async function installPackage(options: {
     pkgkey,
     pkgName,
     pkgVersion,
+    internal,
     toSave,
   });
   return toSave;
@@ -145,9 +146,10 @@ export async function saveInstallationReferences(options: {
   pkgkey: string;
   pkgName: string;
   pkgVersion: string;
+  internal: boolean;
   toSave: AssetReference[];
 }) {
-  const { savedObjectsClient, pkgkey, pkgName, pkgVersion, toSave } = options;
+  const { savedObjectsClient, pkgkey, pkgName, pkgVersion, internal, toSave } = options;
   const installation = await getInstallation({ savedObjectsClient, pkgkey });
   const savedRefs = installation?.installed || [];
   const mergeRefsReducer = (current: AssetReference[], pending: AssetReference) => {
@@ -159,7 +161,7 @@ export async function saveInstallationReferences(options: {
   const toInstall = toSave.reduce(mergeRefsReducer, savedRefs);
   await savedObjectsClient.create<Installation>(
     PACKAGES_SAVED_OBJECT_TYPE,
-    { installed: toInstall, name: pkgName, version: pkgVersion },
+    { installed: toInstall, name: pkgName, version: pkgVersion, internal },
     { id: pkgkey, overwrite: true }
   );
 
diff --git a/x-pack/plugins/ingest_manager/server/types/index.tsx b/x-pack/plugins/ingest_manager/server/types/index.tsx
index 59c7f152e5cbc..1cd5622c0c7b0 100644
--- a/x-pack/plugins/ingest_manager/server/types/index.tsx
+++ b/x-pack/plugins/ingest_manager/server/types/index.tsx
@@ -14,6 +14,7 @@ export {
   AgentEvent,
   AgentEventSOAttributes,
   AgentAction,
+  AgentActionSOAttributes,
   Datasource,
   NewDatasource,
   FullAgentConfigDatasource,
diff --git a/x-pack/plugins/ingest_manager/server/types/models/agent.ts b/x-pack/plugins/ingest_manager/server/types/models/agent.ts
index f70b3cf0ed092..f18846348432b 100644
--- a/x-pack/plugins/ingest_manager/server/types/models/agent.ts
+++ b/x-pack/plugins/ingest_manager/server/types/models/agent.ts
@@ -60,6 +60,6 @@ export const NewAgentActionSchema = schema.object({
     schema.literal('RESUME'),
     schema.literal('PAUSE'),
   ]),
-  data: schema.maybe(schema.string()),
+  data: schema.maybe(schema.any()),
   sent_at: schema.maybe(schema.string()),
 });
diff --git a/x-pack/plugins/maps/public/actions/map_actions.d.ts b/x-pack/plugins/maps/public/actions/map_actions.d.ts
new file mode 100644
index 0000000000000..debead3ad5c45
--- /dev/null
+++ b/x-pack/plugins/maps/public/actions/map_actions.d.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+/* eslint-disable @typescript-eslint/consistent-type-definitions */
+
+import { Filter, Query, TimeRange } from 'src/plugins/data/public';
+import { AnyAction } from 'redux';
+import { LAYER_TYPE } from '../../common/constants';
+import {
+  DataMeta,
+  MapFilters,
+  MapCenterAndZoom,
+  MapRefreshConfig,
+} from '../../common/descriptor_types';
+
+export type SyncContext = {
+  startLoading(dataId: string, requestToken: symbol, meta: DataMeta): void;
+  stopLoading(dataId: string, requestToken: symbol, data: unknown, meta: DataMeta): void;
+  onLoadError(dataId: string, requestToken: symbol, errorMessage: string): void;
+  updateSourceData(newData: unknown): void;
+  isRequestStillActive(dataId: string, requestToken: symbol): boolean;
+  registerCancelCallback(requestToken: symbol, callback: () => void): void;
+  dataFilters: MapFilters;
+};
+
+export function updateSourceProp(
+  layerId: string,
+  propName: string,
+  value: unknown,
+  newLayerType?: LAYER_TYPE
+): void;
+
+export function setGotoWithCenter(config: MapCenterAndZoom): AnyAction;
+
+export function replaceLayerList(layerList: unknown[]): AnyAction;
+
+export type QueryGroup = {
+  filters: Filter[];
+  query?: Query;
+  timeFilters?: TimeRange;
+  refresh?: boolean;
+};
+
+export function setQuery(query: QueryGroup): AnyAction;
+
+export function setRefreshConfig(config: MapRefreshConfig): AnyAction;
+
+export function disableScrollZoom(): AnyAction;
+
+export function disableInteractive(): AnyAction;
+
+export function disableTooltipControl(): AnyAction;
+
+export function hideToolbarOverlay(): AnyAction;
+
+export function hideLayerControl(): AnyAction;
+
+export function hideViewControl(): AnyAction;
+
+export function setHiddenLayers(hiddenLayerIds: string[]): AnyAction;
+
+export function addLayerWithoutDataSync(layerDescriptor: unknown): AnyAction;
diff --git a/x-pack/legacy/plugins/maps/public/components/__snapshots__/add_tooltip_field_popover.test.js.snap b/x-pack/plugins/maps/public/components/__snapshots__/add_tooltip_field_popover.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/__snapshots__/add_tooltip_field_popover.test.js.snap
rename to x-pack/plugins/maps/public/components/__snapshots__/add_tooltip_field_popover.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/components/__snapshots__/tooltip_selector.test.js.snap b/x-pack/plugins/maps/public/components/__snapshots__/tooltip_selector.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/__snapshots__/tooltip_selector.test.js.snap
rename to x-pack/plugins/maps/public/components/__snapshots__/tooltip_selector.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/components/__snapshots__/validated_range.test.js.snap b/x-pack/plugins/maps/public/components/__snapshots__/validated_range.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/__snapshots__/validated_range.test.js.snap
rename to x-pack/plugins/maps/public/components/__snapshots__/validated_range.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/components/add_tooltip_field_popover.js b/x-pack/plugins/maps/public/components/add_tooltip_field_popover.js
similarity index 98%
rename from x-pack/legacy/plugins/maps/public/components/add_tooltip_field_popover.js
rename to x-pack/plugins/maps/public/components/add_tooltip_field_popover.js
index 07bc54663c1d8..984ace4fd8708 100644
--- a/x-pack/legacy/plugins/maps/public/components/add_tooltip_field_popover.js
+++ b/x-pack/plugins/maps/public/components/add_tooltip_field_popover.js
@@ -17,7 +17,7 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import { FieldIcon } from '../../../../../../src/plugins/kibana_react/public';
+import { FieldIcon } from '../../../../../src/plugins/kibana_react/public';
 
 const sortByLabel = (a, b) => {
   return a.label.localeCompare(b.label);
diff --git a/x-pack/legacy/plugins/maps/public/components/add_tooltip_field_popover.test.js b/x-pack/plugins/maps/public/components/add_tooltip_field_popover.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/add_tooltip_field_popover.test.js
rename to x-pack/plugins/maps/public/components/add_tooltip_field_popover.test.js
diff --git a/x-pack/legacy/plugins/maps/public/components/metric_editor.js b/x-pack/plugins/maps/public/components/metric_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/metric_editor.js
rename to x-pack/plugins/maps/public/components/metric_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/components/metric_select.js b/x-pack/plugins/maps/public/components/metric_select.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/metric_select.js
rename to x-pack/plugins/maps/public/components/metric_select.js
diff --git a/x-pack/legacy/plugins/maps/public/components/metrics_editor.js b/x-pack/plugins/maps/public/components/metrics_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/metrics_editor.js
rename to x-pack/plugins/maps/public/components/metrics_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/components/no_index_pattern_callout.js b/x-pack/plugins/maps/public/components/no_index_pattern_callout.js
similarity index 85%
rename from x-pack/legacy/plugins/maps/public/components/no_index_pattern_callout.js
rename to x-pack/plugins/maps/public/components/no_index_pattern_callout.js
index 3266f13155ca7..1319607546808 100644
--- a/x-pack/legacy/plugins/maps/public/components/no_index_pattern_callout.js
+++ b/x-pack/plugins/maps/public/components/no_index_pattern_callout.js
@@ -4,14 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import chrome from 'ui/chrome';
-
+import { getHttp } from '../kibana_services';
 import React from 'react';
 import { EuiCallOut, EuiLink } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 export function NoIndexPatternCallout() {
+  const http = getHttp();
   return (
     <EuiCallOut
       title={i18n.translate('xpack.maps.noIndexPattern.messageTitle', {
@@ -24,7 +24,7 @@ export function NoIndexPatternCallout() {
           id="xpack.maps.noIndexPattern.doThisPrefixDescription"
           defaultMessage="You'll need to "
         />
-        <EuiLink href={chrome.addBasePath('/app/kibana#/management/kibana/index_pattern')}>
+        <EuiLink href={http.basePath.prepend('/app/kibana#/management/kibana/index_pattern')}>
           <FormattedMessage
             id="xpack.maps.noIndexPattern.doThisLinkTextDescription"
             defaultMessage="create an index pattern"
@@ -40,7 +40,7 @@ export function NoIndexPatternCallout() {
           id="xpack.maps.noIndexPattern.hintDescription"
           defaultMessage="Don't have any geospatial data sets? "
         />
-        <EuiLink href={chrome.addBasePath('/app/kibana#/home/tutorial_directory/sampleData')}>
+        <EuiLink href={http.basePath.prepend('/app/kibana#/home/tutorial_directory/sampleData')}>
           <FormattedMessage
             id="xpack.maps.noIndexPattern.getStartedLinkText"
             defaultMessage="Get started with some sample data sets."
diff --git a/x-pack/legacy/plugins/maps/public/components/single_field_select.js b/x-pack/plugins/maps/public/components/single_field_select.js
similarity index 95%
rename from x-pack/legacy/plugins/maps/public/components/single_field_select.js
rename to x-pack/plugins/maps/public/components/single_field_select.js
index 98e33454b041b..aadc619b029a8 100644
--- a/x-pack/legacy/plugins/maps/public/components/single_field_select.js
+++ b/x-pack/plugins/maps/public/components/single_field_select.js
@@ -9,7 +9,7 @@ import PropTypes from 'prop-types';
 import React from 'react';
 
 import { EuiComboBox, EuiHighlight, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
-import { FieldIcon } from '../../../../../../src/plugins/kibana_react/public';
+import { FieldIcon } from '../../../../../src/plugins/kibana_react/public';
 
 function fieldsToOptions(fields) {
   if (!fields) {
diff --git a/x-pack/legacy/plugins/maps/public/components/tooltip_selector.js b/x-pack/plugins/maps/public/components/tooltip_selector.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/tooltip_selector.js
rename to x-pack/plugins/maps/public/components/tooltip_selector.js
diff --git a/x-pack/legacy/plugins/maps/public/components/tooltip_selector.test.js b/x-pack/plugins/maps/public/components/tooltip_selector.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/tooltip_selector.test.js
rename to x-pack/plugins/maps/public/components/tooltip_selector.test.js
diff --git a/x-pack/legacy/plugins/maps/public/components/validated_range.js b/x-pack/plugins/maps/public/components/validated_range.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/validated_range.js
rename to x-pack/plugins/maps/public/components/validated_range.js
diff --git a/x-pack/legacy/plugins/maps/public/components/validated_range.test.js b/x-pack/plugins/maps/public/components/validated_range.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/components/validated_range.test.js
rename to x-pack/plugins/maps/public/components/validated_range.test.js
diff --git a/x-pack/plugins/maps/public/connected_components/layer_panel/view.d.ts b/x-pack/plugins/maps/public/connected_components/layer_panel/view.d.ts
new file mode 100644
index 0000000000000..6d1d076c723ad
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/layer_panel/view.d.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+/* eslint-disable @typescript-eslint/consistent-type-definitions */
+
+import { LAYER_TYPE } from '../../../common/constants';
+
+export type OnSourceChangeArgs = {
+  propName: string;
+  value: unknown;
+  newLayerType?: LAYER_TYPE;
+};
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/map/mb/image_utils.js b/x-pack/plugins/maps/public/connected_components/map/mb/image_utils.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/connected_components/map/mb/image_utils.js
rename to x-pack/plugins/maps/public/connected_components/map/mb/image_utils.js
diff --git a/x-pack/plugins/maps/public/connected_components/map/mb/utils.js b/x-pack/plugins/maps/public/connected_components/map/mb/utils.js
new file mode 100644
index 0000000000000..15aacfbf1f38d
--- /dev/null
+++ b/x-pack/plugins/maps/public/connected_components/map/mb/utils.js
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RGBAImage } from './image_utils';
+
+function getImageData(img) {
+  const canvas = window.document.createElement('canvas');
+  const context = canvas.getContext('2d');
+  if (!context) {
+    throw new Error('failed to create canvas 2d context');
+  }
+  canvas.width = img.width;
+  canvas.height = img.height;
+  context.drawImage(img, 0, 0, img.width, img.height);
+  return context.getImageData(0, 0, img.width, img.height);
+}
+
+function isCrossOriginUrl(url) {
+  const a = window.document.createElement('a');
+  a.href = url;
+  return (
+    a.protocol !== window.document.location.protocol ||
+    a.host !== window.document.location.host ||
+    a.port !== window.document.location.port
+  );
+}
+
+export async function loadSpriteSheetImageData(imgUrl) {
+  return new Promise((resolve, reject) => {
+    const image = new Image();
+    if (isCrossOriginUrl(imgUrl)) {
+      image.crossOrigin = 'Anonymous';
+    }
+    image.onload = el => {
+      const imgData = getImageData(el.currentTarget);
+      resolve(imgData);
+    };
+    image.onerror = e => {
+      reject(e);
+    };
+    image.src = imgUrl;
+  });
+}
+
+export function addSpriteSheetToMapFromImageData(json, imgData, mbMap) {
+  for (const imageId in json) {
+    if (!(json.hasOwnProperty(imageId) && !mbMap.hasImage(imageId))) {
+      continue;
+    }
+    const { width, height, x, y, sdf, pixelRatio } = json[imageId];
+    if (typeof width !== 'number' || typeof height !== 'number') {
+      continue;
+    }
+
+    const data = new RGBAImage({ width, height });
+    RGBAImage.copy(imgData, data, { x, y }, { x: 0, y: 0 }, { width, height });
+    mbMap.addImage(imageId, data, { pixelRatio, sdf });
+  }
+}
diff --git a/x-pack/legacy/plugins/maps/public/elasticsearch_geo_utils.js b/x-pack/plugins/maps/public/elasticsearch_geo_utils.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/elasticsearch_geo_utils.js
rename to x-pack/plugins/maps/public/elasticsearch_geo_utils.js
diff --git a/x-pack/legacy/plugins/maps/public/elasticsearch_geo_utils.test.js b/x-pack/plugins/maps/public/elasticsearch_geo_utils.test.js
similarity index 99%
rename from x-pack/legacy/plugins/maps/public/elasticsearch_geo_utils.test.js
rename to x-pack/plugins/maps/public/elasticsearch_geo_utils.test.js
index fb4b0a6e29e6c..5db7556be4639 100644
--- a/x-pack/legacy/plugins/maps/public/elasticsearch_geo_utils.test.js
+++ b/x-pack/plugins/maps/public/elasticsearch_geo_utils.test.js
@@ -20,7 +20,7 @@ import {
   convertMapExtentToPolygon,
   roundCoordinates,
 } from './elasticsearch_geo_utils';
-import { indexPatterns } from '../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../src/plugins/data/public';
 
 const geoFieldName = 'location';
 const mapExtent = {
diff --git a/x-pack/legacy/plugins/maps/public/index_pattern_util.js b/x-pack/plugins/maps/public/index_pattern_util.js
similarity index 95%
rename from x-pack/legacy/plugins/maps/public/index_pattern_util.js
rename to x-pack/plugins/maps/public/index_pattern_util.js
index 30a0a6826db83..6cb02c7605e28 100644
--- a/x-pack/legacy/plugins/maps/public/index_pattern_util.js
+++ b/x-pack/plugins/maps/public/index_pattern_util.js
@@ -5,7 +5,7 @@
  */
 
 import { getIndexPatternService } from './kibana_services';
-import { indexPatterns } from '../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../src/plugins/data/public';
 import { ES_GEO_FIELD_TYPE } from '../common/constants';
 
 export async function getIndexPatternsFromIds(indexPatternIds = []) {
diff --git a/x-pack/legacy/plugins/maps/public/index_pattern_util.test.js b/x-pack/plugins/maps/public/index_pattern_util.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/index_pattern_util.test.js
rename to x-pack/plugins/maps/public/index_pattern_util.test.js
diff --git a/x-pack/plugins/maps/public/kibana_services.js b/x-pack/plugins/maps/public/kibana_services.js
index 1073e44fa711e..d2ddecfdf915b 100644
--- a/x-pack/plugins/maps/public/kibana_services.js
+++ b/x-pack/plugins/maps/public/kibana_services.js
@@ -3,7 +3,89 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { esFilters, search } from '../../../../src/plugins/data/public';
+
+export { SearchSource } from '../../../../src/plugins/data/public';
+
+export const SPATIAL_FILTER_TYPE = esFilters.FILTERS.SPATIAL_FILTER;
+const { getRequestInspectorStats, getResponseInspectorStats } = search;
+
+let indexPatternService;
+export const setIndexPatternService = dataIndexPatterns =>
+  (indexPatternService = dataIndexPatterns);
+export const getIndexPatternService = () => indexPatternService;
+
+let autocompleteService;
+export const setAutocompleteService = dataAutoComplete => (autocompleteService = dataAutoComplete);
+export const getAutocompleteService = () => autocompleteService;
+
+let licenseId;
+export const setLicenseId = latestLicenseId => (licenseId = latestLicenseId);
+export const getLicenseId = () => {
+  return licenseId;
+};
+
+let inspector;
+export const setInspector = newInspector => (inspector = newInspector);
+export const getInspector = () => {
+  return inspector;
+};
+
+let fileUploadPlugin;
+export const setFileUpload = fileUpload => (fileUploadPlugin = fileUpload);
+export const getFileUploadComponent = () => {
+  return fileUploadPlugin.JsonUploadAndParse;
+};
 
 let getInjectedVar;
 export const setInjectedVarFunc = getInjectedVarFunc => (getInjectedVar = getInjectedVarFunc);
 export const getInjectedVarFunc = () => getInjectedVar;
+
+let uiSettings;
+export const setUiSettings = coreUiSettings => (uiSettings = coreUiSettings);
+export const getUiSettings = () => uiSettings;
+
+let indexPatternSelectComponent;
+export const setIndexPatternSelect = indexPatternSelect =>
+  (indexPatternSelectComponent = indexPatternSelect);
+export const getIndexPatternSelectComponent = () => indexPatternSelectComponent;
+
+let coreHttp;
+export const setHttp = http => (coreHttp = http);
+export const getHttp = () => coreHttp;
+
+let dataTimeFilter;
+export const setTimeFilter = timeFilter => (dataTimeFilter = timeFilter);
+export const getTimeFilter = () => dataTimeFilter;
+
+let toast;
+export const setToasts = notificationToast => (toast = notificationToast);
+export const getToasts = () => toast;
+
+export async function fetchSearchSourceAndRecordWithInspector({
+  searchSource,
+  requestId,
+  requestName,
+  requestDesc,
+  inspectorAdapters,
+  abortSignal,
+}) {
+  const inspectorRequest = inspectorAdapters.requests.start(requestName, {
+    id: requestId,
+    description: requestDesc,
+  });
+  let resp;
+  try {
+    inspectorRequest.stats(getRequestInspectorStats(searchSource));
+    searchSource.getSearchRequestBody().then(body => {
+      inspectorRequest.json(body);
+    });
+    resp = await searchSource.fetch({ abortSignal });
+    inspectorRequest.stats(getResponseInspectorStats(searchSource, resp)).ok({ json: resp });
+  } catch (error) {
+    inspectorRequest.error({ error });
+    throw error;
+  }
+
+  return resp;
+}
diff --git a/x-pack/plugins/maps/public/layers/_index.scss b/x-pack/plugins/maps/public/layers/_index.scss
new file mode 100644
index 0000000000000..29a5761255278
--- /dev/null
+++ b/x-pack/plugins/maps/public/layers/_index.scss
@@ -0,0 +1 @@
+@import 'styles/index';
diff --git a/x-pack/legacy/plugins/maps/public/layers/blended_vector_layer.ts b/x-pack/plugins/maps/public/layers/blended_vector_layer.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/blended_vector_layer.ts
rename to x-pack/plugins/maps/public/layers/blended_vector_layer.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/fields/ems_file_field.ts b/x-pack/plugins/maps/public/layers/fields/ems_file_field.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/fields/ems_file_field.ts
rename to x-pack/plugins/maps/public/layers/fields/ems_file_field.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/fields/es_agg_field.test.ts b/x-pack/plugins/maps/public/layers/fields/es_agg_field.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/fields/es_agg_field.test.ts
rename to x-pack/plugins/maps/public/layers/fields/es_agg_field.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/fields/es_agg_field.ts b/x-pack/plugins/maps/public/layers/fields/es_agg_field.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/fields/es_agg_field.ts
rename to x-pack/plugins/maps/public/layers/fields/es_agg_field.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/fields/es_doc_field.ts b/x-pack/plugins/maps/public/layers/fields/es_doc_field.ts
similarity index 96%
rename from x-pack/legacy/plugins/maps/public/layers/fields/es_doc_field.ts
rename to x-pack/plugins/maps/public/layers/fields/es_doc_field.ts
index 4401452841a46..b7647d881fcf6 100644
--- a/x-pack/legacy/plugins/maps/public/layers/fields/es_doc_field.ts
+++ b/x-pack/plugins/maps/public/layers/fields/es_doc_field.ts
@@ -8,8 +8,8 @@ import { FIELD_ORIGIN } from '../../../common/constants';
 import { ESTooltipProperty } from '../tooltips/es_tooltip_property';
 import { ITooltipProperty, TooltipProperty } from '../tooltips/tooltip_property';
 import { COLOR_PALETTE_MAX_SIZE } from '../../../common/constants';
-import { indexPatterns } from '../../../../../../../src/plugins/data/public';
-import { IFieldType } from '../../../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../../../src/plugins/data/public';
+import { IFieldType } from '../../../../../../src/plugins/data/public';
 import { IField, AbstractField } from './field';
 import { IESSource } from '../sources/es_source';
 import { IVectorSource } from '../sources/vector_source';
diff --git a/x-pack/legacy/plugins/maps/public/layers/fields/field.ts b/x-pack/plugins/maps/public/layers/fields/field.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/fields/field.ts
rename to x-pack/plugins/maps/public/layers/fields/field.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/fields/kibana_region_field.ts b/x-pack/plugins/maps/public/layers/fields/kibana_region_field.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/fields/kibana_region_field.ts
rename to x-pack/plugins/maps/public/layers/fields/kibana_region_field.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/fields/top_term_percentage_field.ts b/x-pack/plugins/maps/public/layers/fields/top_term_percentage_field.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/fields/top_term_percentage_field.ts
rename to x-pack/plugins/maps/public/layers/fields/top_term_percentage_field.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/heatmap_layer.js b/x-pack/plugins/maps/public/layers/heatmap_layer.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/heatmap_layer.js
rename to x-pack/plugins/maps/public/layers/heatmap_layer.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/joins/inner_join.js b/x-pack/plugins/maps/public/layers/joins/inner_join.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/joins/inner_join.js
rename to x-pack/plugins/maps/public/layers/joins/inner_join.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/joins/inner_join.test.js b/x-pack/plugins/maps/public/layers/joins/inner_join.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/joins/inner_join.test.js
rename to x-pack/plugins/maps/public/layers/joins/inner_join.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/joins/join.ts b/x-pack/plugins/maps/public/layers/joins/join.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/joins/join.ts
rename to x-pack/plugins/maps/public/layers/joins/join.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/layer.d.ts b/x-pack/plugins/maps/public/layers/layer.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/layer.d.ts
rename to x-pack/plugins/maps/public/layers/layer.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/layer.js b/x-pack/plugins/maps/public/layers/layer.js
similarity index 99%
rename from x-pack/legacy/plugins/maps/public/layers/layer.js
rename to x-pack/plugins/maps/public/layers/layer.js
index e9616be89b601..26bce872b3c2c 100644
--- a/x-pack/legacy/plugins/maps/public/layers/layer.js
+++ b/x-pack/plugins/maps/public/layers/layer.js
@@ -15,7 +15,7 @@ import {
 } from '../../common/constants';
 import uuid from 'uuid/v4';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { copyPersistentState } from '../../../../../plugins/maps/public/reducers/util.js';
+import { copyPersistentState } from '../reducers/util.js';
 import { i18n } from '@kbn/i18n';
 
 export class AbstractLayer {
diff --git a/x-pack/legacy/plugins/maps/public/layers/layer_wizard_registry.ts b/x-pack/plugins/maps/public/layers/layer_wizard_registry.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/layer_wizard_registry.ts
rename to x-pack/plugins/maps/public/layers/layer_wizard_registry.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/load_layer_wizards.js b/x-pack/plugins/maps/public/layers/load_layer_wizards.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/load_layer_wizards.js
rename to x-pack/plugins/maps/public/layers/load_layer_wizards.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/client_file_source/create_client_file_source_editor.js b/x-pack/plugins/maps/public/layers/sources/client_file_source/create_client_file_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/client_file_source/create_client_file_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/client_file_source/create_client_file_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/client_file_source/geojson_file_source.js b/x-pack/plugins/maps/public/layers/sources/client_file_source/geojson_file_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/client_file_source/geojson_file_source.js
rename to x-pack/plugins/maps/public/layers/sources/client_file_source/geojson_file_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/client_file_source/index.js b/x-pack/plugins/maps/public/layers/sources/client_file_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/client_file_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/client_file_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/create_source_editor.js b/x-pack/plugins/maps/public/layers/sources/ems_file_source/create_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/create_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/ems_file_source/create_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.d.ts b/x-pack/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.js b/x-pack/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.js
rename to x-pack/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.test.js b/x-pack/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.test.js
rename to x-pack/plugins/maps/public/layers/sources/ems_file_source/ems_file_source.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/index.js b/x-pack/plugins/maps/public/layers/sources/ems_file_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/ems_file_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/update_source_editor.js b/x-pack/plugins/maps/public/layers/sources/ems_file_source/update_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_file_source/update_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/ems_file_source/update_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.js b/x-pack/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.js
rename to x-pack/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.test.js b/x-pack/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.test.js
rename to x-pack/plugins/maps/public/layers/sources/ems_tms_source/ems_tms_source.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/index.js b/x-pack/plugins/maps/public/layers/sources/ems_tms_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/ems_tms_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/tile_service_select.js b/x-pack/plugins/maps/public/layers/sources/ems_tms_source/tile_service_select.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/tile_service_select.js
rename to x-pack/plugins/maps/public/layers/sources/ems_tms_source/tile_service_select.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/update_source_editor.js b/x-pack/plugins/maps/public/layers/sources/ems_tms_source/update_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_tms_source/update_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/ems_tms_source/update_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/ems_unavailable_message.js b/x-pack/plugins/maps/public/layers/sources/ems_unavailable_message.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/ems_unavailable_message.js
rename to x-pack/plugins/maps/public/layers/sources/ems_unavailable_message.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_agg_source.d.ts b/x-pack/plugins/maps/public/layers/sources/es_agg_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_agg_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/es_agg_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_agg_source.js b/x-pack/plugins/maps/public/layers/sources/es_agg_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_agg_source.js
rename to x-pack/plugins/maps/public/layers/sources/es_agg_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_agg_source.test.ts b/x-pack/plugins/maps/public/layers/sources/es_agg_source.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_agg_source.test.ts
rename to x-pack/plugins/maps/public/layers/sources/es_agg_source.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.test.ts b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.test.ts
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/convert_to_geojson.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/create_source_editor.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/create_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/create_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/create_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.d.ts b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.test.ts b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.test.ts
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/es_geo_grid_source.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.test.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.test.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/geo_tile_utils.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/index.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/render_as_select.tsx b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/render_as_select.tsx
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/render_as_select.tsx
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/render_as_select.tsx
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/resolution_editor.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/resolution_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/resolution_editor.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/resolution_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/update_source_editor.js b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/update_source_editor.js
similarity index 97%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/update_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/update_source_editor.js
index 269c2a8b8633a..cd494db3897fb 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_geo_grid_source/update_source_editor.js
+++ b/x-pack/plugins/maps/public/layers/sources/es_geo_grid_source/update_source_editor.js
@@ -14,7 +14,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiPanel, EuiSpacer, EuiTitle } from '@elastic/eui';
 import { isMetricCountable } from '../../util/is_metric_countable';
-import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../../../../src/plugins/data/public';
 
 export class UpdateSourceEditor extends Component {
   state = {
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.js b/x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.js
rename to x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.test.ts b/x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.test.ts
rename to x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/convert_to_lines.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/create_source_editor.js b/x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/create_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/create_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/create_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/es_pew_pew_source.js b/x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/es_pew_pew_source.js
similarity index 98%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/es_pew_pew_source.js
rename to x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/es_pew_pew_source.js
index da2b663746b9d..ea3a2d2fe634d 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/es_pew_pew_source.js
+++ b/x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/es_pew_pew_source.js
@@ -25,7 +25,7 @@ import { convertToLines } from './convert_to_lines';
 import { AbstractESAggSource } from '../es_agg_source';
 import { DynamicStyleProperty } from '../../styles/vector/properties/dynamic_style_property';
 import { COLOR_GRADIENTS } from '../../styles/color_utils';
-import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../../../../src/plugins/data/public';
 import { registerSource } from '../source_registry';
 
 const MAX_GEOTILE_LEVEL = 29;
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/update_source_editor.js b/x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/update_source_editor.js
similarity index 96%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/update_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/update_source_editor.js
index ce1f53c33ba53..dea59a1c82f8a 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_pew_pew_source/update_source_editor.js
+++ b/x-pack/plugins/maps/public/layers/sources/es_pew_pew_source/update_source_editor.js
@@ -11,7 +11,7 @@ import { getIndexPatternService } from '../../../kibana_services';
 import { i18n } from '@kbn/i18n';
 import { EuiPanel, EuiTitle, EuiSpacer } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../../../../src/plugins/data/public';
 
 export class UpdateSourceEditor extends Component {
   state = {
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap b/x-pack/plugins/maps/public/layers/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap b/x-pack/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/constants.js b/x-pack/plugins/maps/public/layers/sources/es_search_source/constants.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/constants.js
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/constants.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js b/x-pack/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
similarity index 98%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
index 73bea574ace28..aeb3835354f07 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
+++ b/x-pack/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
@@ -15,7 +15,7 @@ import { NoIndexPatternCallout } from '../../../components/no_index_pattern_call
 import { i18n } from '@kbn/i18n';
 import { ES_GEO_FIELD_TYPE, SCALING_TYPES } from '../../../../common/constants';
 import { DEFAULT_FILTER_BY_MAP_BOUNDS } from './constants';
-import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../../../../src/plugins/data/public';
 import { ScalingForm } from './scaling_form';
 import { getTermsFields } from '../../../index_pattern_util';
 
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.d.ts b/x-pack/plugins/maps/public/layers/sources/es_search_source/es_search_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/es_search_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.js b/x-pack/plugins/maps/public/layers/sources/es_search_source/es_search_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.js
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/es_search_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.test.ts b/x-pack/plugins/maps/public/layers/sources/es_search_source/es_search_source.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.test.ts
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/es_search_source.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/index.js b/x-pack/plugins/maps/public/layers/sources/es_search_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/load_index_settings.js b/x-pack/plugins/maps/public/layers/sources/es_search_source/load_index_settings.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/load_index_settings.js
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/load_index_settings.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.test.tsx b/x-pack/plugins/maps/public/layers/sources/es_search_source/scaling_form.test.tsx
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.test.tsx
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/scaling_form.test.tsx
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx b/x-pack/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx
similarity index 97%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx
index c5950f1132974..d86fc6d4026e6 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx
+++ b/x-pack/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx
@@ -22,8 +22,6 @@ import { SingleFieldSelect } from '../../../components/single_field_select';
 // @ts-ignore
 import { indexPatternService } from '../../../kibana_services';
 // @ts-ignore
-import { getTermsFields, getSourceFields } from '../../../index_pattern_util';
-// @ts-ignore
 import { ValidatedRange } from '../../../components/validated_range';
 import {
   DEFAULT_MAX_INNER_RESULT_WINDOW,
@@ -33,7 +31,7 @@ import {
 } from '../../../../common/constants';
 // @ts-ignore
 import { loadIndexSettings } from './load_index_settings';
-import { IFieldType } from '../../../../../../../../src/plugins/data/public';
+import { IFieldType } from '../../../../../../../src/plugins/data/public';
 import { OnSourceChangeArgs } from '../../../connected_components/layer_panel/view';
 
 interface Props {
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js b/x-pack/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
similarity index 98%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
index 9c92ec5801e49..cb6255afd0a42 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
+++ b/x-pack/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
@@ -16,7 +16,7 @@ import { getTermsFields, getSourceFields } from '../../../index_pattern_util';
 import { SORT_ORDER } from '../../../../common/constants';
 import { ESDocField } from '../../fields/es_doc_field';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
+import { indexPatterns } from '../../../../../../../src/plugins/data/public';
 import { ScalingForm } from './scaling_form';
 
 export class UpdateSourceEditor extends Component {
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js b/x-pack/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js
rename to x-pack/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_source.d.ts b/x-pack/plugins/maps/public/layers/sources/es_source.d.ts
similarity index 92%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/es_source.d.ts
index ffd1d343b59e0..65851d0e7bd38 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_source.d.ts
+++ b/x-pack/plugins/maps/public/layers/sources/es_source.d.ts
@@ -6,7 +6,7 @@
 
 import { AbstractVectorSource } from './vector_source';
 import { IVectorSource } from './vector_source';
-import { IndexPattern, SearchSource } from '../../../../../../../src/plugins/data/public';
+import { IndexPattern, SearchSource } from '../../../../../../src/plugins/data/public';
 import { VectorSourceRequestMeta } from '../../../common/descriptor_types';
 
 export interface IESSource extends IVectorSource {
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_source.js b/x-pack/plugins/maps/public/layers/sources/es_source.js
similarity index 99%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_source.js
rename to x-pack/plugins/maps/public/layers/sources/es_source.js
index 441d52d23398a..d90a802a38344 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_source.js
+++ b/x-pack/plugins/maps/public/layers/sources/es_source.js
@@ -17,7 +17,7 @@ import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 import uuid from 'uuid/v4';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { copyPersistentState } from '../../../../../../plugins/maps/public/reducers/util';
+import { copyPersistentState } from '../../reducers/util';
 import { ES_GEO_FIELD_TYPE } from '../../../common/constants';
 import { DataRequestAbortError } from '../util/data_request';
 import { expandToTileBoundaries } from './es_geo_grid_source/geo_tile_utils';
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_term_source.d.ts b/x-pack/plugins/maps/public/layers/sources/es_term_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_term_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/es_term_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_term_source.js b/x-pack/plugins/maps/public/layers/sources/es_term_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_term_source.js
rename to x-pack/plugins/maps/public/layers/sources/es_term_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_term_source.test.js b/x-pack/plugins/maps/public/layers/sources/es_term_source.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/es_term_source.test.js
rename to x-pack/plugins/maps/public/layers/sources/es_term_source.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/create_source_editor.js b/x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/create_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/create_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/create_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/index.js b/x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.d.ts b/x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.js b/x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.js
rename to x-pack/plugins/maps/public/layers/sources/kibana_regionmap_source/kibana_regionmap_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/kibana_tilemap_source/create_source_editor.js b/x-pack/plugins/maps/public/layers/sources/kibana_tilemap_source/create_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/kibana_tilemap_source/create_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/kibana_tilemap_source/create_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/kibana_tilemap_source/index.js b/x-pack/plugins/maps/public/layers/sources/kibana_tilemap_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/kibana_tilemap_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/kibana_tilemap_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/kibana_tilemap_source/kibana_tilemap_source.js b/x-pack/plugins/maps/public/layers/sources/kibana_tilemap_source/kibana_tilemap_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/kibana_tilemap_source/kibana_tilemap_source.js
rename to x-pack/plugins/maps/public/layers/sources/kibana_tilemap_source/kibana_tilemap_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/source.d.ts b/x-pack/plugins/maps/public/layers/sources/source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/source.js b/x-pack/plugins/maps/public/layers/sources/source.js
similarity index 96%
rename from x-pack/legacy/plugins/maps/public/layers/sources/source.js
rename to x-pack/plugins/maps/public/layers/sources/source.js
index b6b6c10831bb5..368de421e23ce 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/source.js
+++ b/x-pack/plugins/maps/public/layers/sources/source.js
@@ -5,7 +5,7 @@
  */
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { copyPersistentState } from '../../../../../../plugins/maps/public/reducers/util';
+import { copyPersistentState } from '../../reducers/util';
 
 export class AbstractSource {
   static isIndexingSource = false;
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/source_registry.ts b/x-pack/plugins/maps/public/layers/sources/source_registry.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/source_registry.ts
rename to x-pack/plugins/maps/public/layers/sources/source_registry.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/tms_source.d.ts b/x-pack/plugins/maps/public/layers/sources/tms_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/tms_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/tms_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/tms_source.js b/x-pack/plugins/maps/public/layers/sources/tms_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/tms_source.js
rename to x-pack/plugins/maps/public/layers/sources/tms_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/vector_feature_types.js b/x-pack/plugins/maps/public/layers/sources/vector_feature_types.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/vector_feature_types.js
rename to x-pack/plugins/maps/public/layers/sources/vector_feature_types.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/vector_source.d.ts b/x-pack/plugins/maps/public/layers/sources/vector_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/vector_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/vector_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/vector_source.js b/x-pack/plugins/maps/public/layers/sources/vector_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/vector_source.js
rename to x-pack/plugins/maps/public/layers/sources/vector_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/wms_source/index.js b/x-pack/plugins/maps/public/layers/sources/wms_source/index.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/wms_source/index.js
rename to x-pack/plugins/maps/public/layers/sources/wms_source/index.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_client.js b/x-pack/plugins/maps/public/layers/sources/wms_source/wms_client.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_client.js
rename to x-pack/plugins/maps/public/layers/sources/wms_source/wms_client.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_client.test.js b/x-pack/plugins/maps/public/layers/sources/wms_source/wms_client.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_client.test.js
rename to x-pack/plugins/maps/public/layers/sources/wms_source/wms_client.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_create_source_editor.js b/x-pack/plugins/maps/public/layers/sources/wms_source/wms_create_source_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_create_source_editor.js
rename to x-pack/plugins/maps/public/layers/sources/wms_source/wms_create_source_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_source.js b/x-pack/plugins/maps/public/layers/sources/wms_source/wms_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/wms_source/wms_source.js
rename to x-pack/plugins/maps/public/layers/sources/wms_source/wms_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/xyz_tms_source.d.ts b/x-pack/plugins/maps/public/layers/sources/xyz_tms_source.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/xyz_tms_source.d.ts
rename to x-pack/plugins/maps/public/layers/sources/xyz_tms_source.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/xyz_tms_source.js b/x-pack/plugins/maps/public/layers/sources/xyz_tms_source.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/xyz_tms_source.js
rename to x-pack/plugins/maps/public/layers/sources/xyz_tms_source.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/xyz_tms_source.test.ts b/x-pack/plugins/maps/public/layers/sources/xyz_tms_source.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/sources/xyz_tms_source.test.ts
rename to x-pack/plugins/maps/public/layers/sources/xyz_tms_source.test.ts
diff --git a/x-pack/plugins/maps/public/layers/styles/_index.scss b/x-pack/plugins/maps/public/layers/styles/_index.scss
new file mode 100644
index 0000000000000..a1c4c297a3ac1
--- /dev/null
+++ b/x-pack/plugins/maps/public/layers/styles/_index.scss
@@ -0,0 +1,4 @@
+@import 'components/color_gradient';
+@import 'vector/components/style_prop_editor';
+@import 'vector/components/color/color_stops';
+@import 'vector/components/symbol/icon_select';
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/abstract_style.js b/x-pack/plugins/maps/public/layers/styles/abstract_style.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/abstract_style.js
rename to x-pack/plugins/maps/public/layers/styles/abstract_style.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/color_utils.js b/x-pack/plugins/maps/public/layers/styles/color_utils.js
similarity index 98%
rename from x-pack/legacy/plugins/maps/public/layers/styles/color_utils.js
rename to x-pack/plugins/maps/public/layers/styles/color_utils.js
index 09c7d76db1691..23b61b07bf871 100644
--- a/x-pack/legacy/plugins/maps/public/layers/styles/color_utils.js
+++ b/x-pack/plugins/maps/public/layers/styles/color_utils.js
@@ -10,7 +10,7 @@ import chroma from 'chroma-js';
 import { euiPaletteColorBlind } from '@elastic/eui/lib/services';
 import { ColorGradient } from './components/color_gradient';
 import { COLOR_PALETTE_MAX_SIZE } from '../../../common/constants';
-import { vislibColorMaps } from '../../../../../../../src/plugins/charts/public';
+import { vislibColorMaps } from '../../../../../../src/plugins/charts/public';
 
 const GRADIENT_INTERVALS = 8;
 
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/color_utils.test.js b/x-pack/plugins/maps/public/layers/styles/color_utils.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/color_utils.test.js
rename to x-pack/plugins/maps/public/layers/styles/color_utils.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/components/_color_gradient.scss b/x-pack/plugins/maps/public/layers/styles/components/_color_gradient.scss
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/components/_color_gradient.scss
rename to x-pack/plugins/maps/public/layers/styles/components/_color_gradient.scss
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/components/color_gradient.js b/x-pack/plugins/maps/public/layers/styles/components/color_gradient.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/components/color_gradient.js
rename to x-pack/plugins/maps/public/layers/styles/components/color_gradient.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/components/ranged_style_legend_row.js b/x-pack/plugins/maps/public/layers/styles/components/ranged_style_legend_row.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/components/ranged_style_legend_row.js
rename to x-pack/plugins/maps/public/layers/styles/components/ranged_style_legend_row.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/__snapshots__/heatmap_style_editor.test.js.snap b/x-pack/plugins/maps/public/layers/styles/heatmap/components/__snapshots__/heatmap_style_editor.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/__snapshots__/heatmap_style_editor.test.js.snap
rename to x-pack/plugins/maps/public/layers/styles/heatmap/components/__snapshots__/heatmap_style_editor.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/heatmap_constants.js b/x-pack/plugins/maps/public/layers/styles/heatmap/components/heatmap_constants.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/heatmap_constants.js
rename to x-pack/plugins/maps/public/layers/styles/heatmap/components/heatmap_constants.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.js b/x-pack/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.js
rename to x-pack/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.test.js b/x-pack/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.test.js
rename to x-pack/plugins/maps/public/layers/styles/heatmap/components/heatmap_style_editor.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/legend/heatmap_legend.js b/x-pack/plugins/maps/public/layers/styles/heatmap/components/legend/heatmap_legend.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/heatmap/components/legend/heatmap_legend.js
rename to x-pack/plugins/maps/public/layers/styles/heatmap/components/legend/heatmap_legend.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/heatmap/heatmap_style.js b/x-pack/plugins/maps/public/layers/styles/heatmap/heatmap_style.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/heatmap/heatmap_style.js
rename to x-pack/plugins/maps/public/layers/styles/heatmap/heatmap_style.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/_style_prop_editor.scss b/x-pack/plugins/maps/public/layers/styles/vector/components/_style_prop_editor.scss
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/_style_prop_editor.scss
rename to x-pack/plugins/maps/public/layers/styles/vector/components/_style_prop_editor.scss
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/_color_stops.scss b/x-pack/plugins/maps/public/layers/styles/vector/components/color/_color_stops.scss
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/_color_stops.scss
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/_color_stops.scss
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_map_select.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/color_map_select.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_map_select.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/color_map_select.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops_categorical.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops_categorical.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops_categorical.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops_categorical.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops_ordinal.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops_ordinal.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops_ordinal.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops_ordinal.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops_utils.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops_utils.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/color_stops_utils.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/color_stops_utils.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/dynamic_color_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/dynamic_color_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/dynamic_color_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/dynamic_color_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/mb_validated_color_picker.tsx b/x-pack/plugins/maps/public/layers/styles/vector/components/color/mb_validated_color_picker.tsx
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/mb_validated_color_picker.tsx
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/mb_validated_color_picker.tsx
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/static_color_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/static_color_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/static_color_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/static_color_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/vector_style_color_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/color/vector_style_color_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/color/vector_style_color_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/color/vector_style_color_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_meta/categorical_field_meta_popover.tsx b/x-pack/plugins/maps/public/layers/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
rename to x-pack/plugins/maps/public/layers/styles/vector/components/field_meta/categorical_field_meta_popover.tsx
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_meta/field_meta_popover.tsx b/x-pack/plugins/maps/public/layers/styles/vector/components/field_meta/field_meta_popover.tsx
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_meta/field_meta_popover.tsx
rename to x-pack/plugins/maps/public/layers/styles/vector/components/field_meta/field_meta_popover.tsx
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx b/x-pack/plugins/maps/public/layers/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
rename to x-pack/plugins/maps/public/layers/styles/vector/components/field_meta/ordinal_field_meta_popover.tsx
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_select.js b/x-pack/plugins/maps/public/layers/styles/vector/components/field_select.js
similarity index 97%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_select.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/field_select.js
index 2f5de507657a5..ed2e7a4eab7ec 100644
--- a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/field_select.js
+++ b/x-pack/plugins/maps/public/layers/styles/vector/components/field_select.js
@@ -10,7 +10,7 @@ import React from 'react';
 import { EuiComboBox, EuiHighlight, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { FIELD_ORIGIN } from '../../../../../common/constants';
 import { i18n } from '@kbn/i18n';
-import { FieldIcon } from '../../../../../../../../../src/plugins/kibana_react/public';
+import { FieldIcon } from '../../../../../../../../src/plugins/kibana_react/public';
 
 function renderOption(option, searchValue, contentClassName) {
   return (
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/get_vector_style_label.js b/x-pack/plugins/maps/public/layers/styles/vector/components/get_vector_style_label.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/get_vector_style_label.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/get_vector_style_label.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/dynamic_label_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/label/dynamic_label_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/dynamic_label_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/label/dynamic_label_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/static_label_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/label/static_label_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/static_label_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/label/static_label_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_border_size_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_border_size_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_border_size_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_border_size_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/label/vector_style_label_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/__snapshots__/vector_icon.test.js.snap b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/__snapshots__/vector_icon.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/__snapshots__/vector_icon.test.js.snap
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/__snapshots__/vector_icon.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/category.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/category.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/category.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/category.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/circle_icon.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/circle_icon.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/circle_icon.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/circle_icon.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/extract_color_from_style_property.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/extract_color_from_style_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/extract_color_from_style_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/extract_color_from_style_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/line_icon.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/line_icon.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/line_icon.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/line_icon.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/polygon_icon.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/polygon_icon.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/polygon_icon.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/polygon_icon.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/symbol_icon.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/symbol_icon.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/symbol_icon.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/symbol_icon.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.test.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.test.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/vector_icon.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/vector_style_legend.js b/x-pack/plugins/maps/public/layers/styles/vector/components/legend/vector_style_legend.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/legend/vector_style_legend.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/legend/vector_style_legend.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/orientation/dynamic_orientation_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/orientation/dynamic_orientation_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/orientation/dynamic_orientation_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/orientation/dynamic_orientation_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/orientation/orientation_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/orientation/orientation_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/orientation/orientation_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/orientation/orientation_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/orientation/static_orientation_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/orientation/static_orientation_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/orientation/static_orientation_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/orientation/static_orientation_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/dynamic_size_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/size/dynamic_size_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/dynamic_size_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/size/dynamic_size_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/size_range_selector.js b/x-pack/plugins/maps/public/layers/styles/vector/components/size/size_range_selector.js
similarity index 92%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/size_range_selector.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/size/size_range_selector.js
index 5de7b462136e1..ec847e2a5384e 100644
--- a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/size_range_selector.js
+++ b/x-pack/plugins/maps/public/layers/styles/vector/components/size/size_range_selector.js
@@ -6,7 +6,7 @@
 
 import React from 'react';
 import PropTypes from 'prop-types';
-import { ValidatedDualRange } from '../../../../../../../../../../src/plugins/kibana_react/public';
+import { ValidatedDualRange } from '../../../../../../../../../src/plugins/kibana_react/public';
 import { MIN_SIZE, MAX_SIZE } from '../../vector_style_defaults';
 import { i18n } from '@kbn/i18n';
 
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/static_size_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/size/static_size_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/static_size_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/size/static_size_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/vector_style_size_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/size/vector_style_size_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/size/vector_style_size_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/size/vector_style_size_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/stop_input.js b/x-pack/plugins/maps/public/layers/styles/vector/components/stop_input.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/stop_input.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/stop_input.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/style_map_select.js b/x-pack/plugins/maps/public/layers/styles/vector/components/style_map_select.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/style_map_select.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/style_map_select.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/style_option_shapes.js b/x-pack/plugins/maps/public/layers/styles/vector/components/style_option_shapes.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/style_option_shapes.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/style_option_shapes.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/style_prop_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/style_prop_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/style_prop_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/style_prop_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/__snapshots__/icon_select.test.js.snap b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/__snapshots__/icon_select.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/__snapshots__/icon_select.test.js.snap
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/__snapshots__/icon_select.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/_icon_select.scss b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/_icon_select.scss
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/_icon_select.scss
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/_icon_select.scss
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/dynamic_icon_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/dynamic_icon_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/dynamic_icon_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/dynamic_icon_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_map_select.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_map_select.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_map_select.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_map_select.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.test.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.test.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_select.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.test.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.test.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/icon_stops.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/static_icon_form.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/static_icon_form.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/static_icon_form.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/static_icon_form.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_icon_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_icon_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_icon_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_icon_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_symbolize_as_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_symbolize_as_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_symbolize_as_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/symbol/vector_style_symbolize_as_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/components/vector_style_editor.js b/x-pack/plugins/maps/public/layers/styles/vector/components/vector_style_editor.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/components/vector_style_editor.js
rename to x-pack/plugins/maps/public/layers/styles/vector/components/vector_style_editor.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/__snapshots__/dynamic_color_property.test.js.snap b/x-pack/plugins/maps/public/layers/styles/vector/properties/__snapshots__/dynamic_color_property.test.js.snap
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/__snapshots__/dynamic_color_property.test.js.snap
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/__snapshots__/dynamic_color_property.test.js.snap
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/components/categorical_legend.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/components/categorical_legend.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/components/categorical_legend.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/components/categorical_legend.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/components/ordinal_legend.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/components/ordinal_legend.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/components/ordinal_legend.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/components/ordinal_legend.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.test.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.test.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_color_property.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_icon_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_icon_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_icon_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_icon_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_orientation_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_orientation_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_orientation_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_orientation_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_size_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_size_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_size_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_size_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.d.ts b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.d.ts
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_style_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_text_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_text_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/dynamic_text_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/dynamic_text_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/label_border_size_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/label_border_size_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/label_border_size_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/label_border_size_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_color_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/static_color_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_color_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/static_color_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_icon_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/static_icon_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_icon_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/static_icon_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_orientation_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/static_orientation_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_orientation_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/static_orientation_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_size_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/static_size_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_size_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/static_size_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_style_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/static_style_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_style_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/static_style_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_text_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/static_text_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/static_text_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/static_text_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/style_property.ts b/x-pack/plugins/maps/public/layers/styles/vector/properties/style_property.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/style_property.ts
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/style_property.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/symbolize_as_property.js b/x-pack/plugins/maps/public/layers/styles/vector/properties/symbolize_as_property.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/properties/symbolize_as_property.js
rename to x-pack/plugins/maps/public/layers/styles/vector/properties/symbolize_as_property.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/style_meta.ts b/x-pack/plugins/maps/public/layers/styles/vector/style_meta.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/style_meta.ts
rename to x-pack/plugins/maps/public/layers/styles/vector/style_meta.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/style_util.js b/x-pack/plugins/maps/public/layers/styles/vector/style_util.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/style_util.js
rename to x-pack/plugins/maps/public/layers/styles/vector/style_util.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/style_util.test.js b/x-pack/plugins/maps/public/layers/styles/vector/style_util.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/style_util.test.js
rename to x-pack/plugins/maps/public/layers/styles/vector/style_util.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/symbol_utils.js b/x-pack/plugins/maps/public/layers/styles/vector/symbol_utils.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/symbol_utils.js
rename to x-pack/plugins/maps/public/layers/styles/vector/symbol_utils.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/symbol_utils.test.js b/x-pack/plugins/maps/public/layers/styles/vector/symbol_utils.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/symbol_utils.test.js
rename to x-pack/plugins/maps/public/layers/styles/vector/symbol_utils.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style.d.ts b/x-pack/plugins/maps/public/layers/styles/vector/vector_style.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style.d.ts
rename to x-pack/plugins/maps/public/layers/styles/vector/vector_style.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style.js b/x-pack/plugins/maps/public/layers/styles/vector/vector_style.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style.js
rename to x-pack/plugins/maps/public/layers/styles/vector/vector_style.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style.test.js b/x-pack/plugins/maps/public/layers/styles/vector/vector_style.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style.test.js
rename to x-pack/plugins/maps/public/layers/styles/vector/vector_style.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style_defaults.ts b/x-pack/plugins/maps/public/layers/styles/vector/vector_style_defaults.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/styles/vector/vector_style_defaults.ts
rename to x-pack/plugins/maps/public/layers/styles/vector/vector_style_defaults.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/tile_layer.d.ts b/x-pack/plugins/maps/public/layers/tile_layer.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/tile_layer.d.ts
rename to x-pack/plugins/maps/public/layers/tile_layer.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/tile_layer.js b/x-pack/plugins/maps/public/layers/tile_layer.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/tile_layer.js
rename to x-pack/plugins/maps/public/layers/tile_layer.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/tile_layer.test.ts b/x-pack/plugins/maps/public/layers/tile_layer.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/tile_layer.test.ts
rename to x-pack/plugins/maps/public/layers/tile_layer.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/tooltips/es_agg_tooltip_property.ts b/x-pack/plugins/maps/public/layers/tooltips/es_agg_tooltip_property.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/tooltips/es_agg_tooltip_property.ts
rename to x-pack/plugins/maps/public/layers/tooltips/es_agg_tooltip_property.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/tooltips/es_tooltip_property.ts b/x-pack/plugins/maps/public/layers/tooltips/es_tooltip_property.ts
similarity index 95%
rename from x-pack/legacy/plugins/maps/public/layers/tooltips/es_tooltip_property.ts
rename to x-pack/plugins/maps/public/layers/tooltips/es_tooltip_property.ts
index 8fd7e173435ce..5c35009881920 100644
--- a/x-pack/legacy/plugins/maps/public/layers/tooltips/es_tooltip_property.ts
+++ b/x-pack/plugins/maps/public/layers/tooltips/es_tooltip_property.ts
@@ -7,8 +7,8 @@
 import _ from 'lodash';
 import { ITooltipProperty } from './tooltip_property';
 import { IField } from '../fields/field';
-import { esFilters, IFieldType, IndexPattern } from '../../../../../../../src/plugins/data/public';
-import { PhraseFilter } from '../../../../../../../src/plugins/data/public';
+import { esFilters, IFieldType, IndexPattern } from '../../../../../../src/plugins/data/public';
+import { PhraseFilter } from '../../../../../../src/plugins/data/public';
 
 export class ESTooltipProperty implements ITooltipProperty {
   private readonly _tooltipProperty: ITooltipProperty;
diff --git a/x-pack/legacy/plugins/maps/public/layers/tooltips/join_tooltip_property.ts b/x-pack/plugins/maps/public/layers/tooltips/join_tooltip_property.ts
similarity index 96%
rename from x-pack/legacy/plugins/maps/public/layers/tooltips/join_tooltip_property.ts
rename to x-pack/plugins/maps/public/layers/tooltips/join_tooltip_property.ts
index 02f0920ce3c61..4af236f6e9e36 100644
--- a/x-pack/legacy/plugins/maps/public/layers/tooltips/join_tooltip_property.ts
+++ b/x-pack/plugins/maps/public/layers/tooltips/join_tooltip_property.ts
@@ -6,7 +6,7 @@
 
 import { ITooltipProperty } from './tooltip_property';
 import { IJoin } from '../joins/join';
-import { PhraseFilter } from '../../../../../../../src/plugins/data/public';
+import { PhraseFilter } from '../../../../../../src/plugins/data/public';
 
 export class JoinTooltipProperty implements ITooltipProperty {
   private readonly _tooltipProperty: ITooltipProperty;
diff --git a/x-pack/legacy/plugins/maps/public/layers/tooltips/tooltip_property.ts b/x-pack/plugins/maps/public/layers/tooltips/tooltip_property.ts
similarity index 92%
rename from x-pack/legacy/plugins/maps/public/layers/tooltips/tooltip_property.ts
rename to x-pack/plugins/maps/public/layers/tooltips/tooltip_property.ts
index 46e27bbd770a1..7d680dfe9cae0 100644
--- a/x-pack/legacy/plugins/maps/public/layers/tooltips/tooltip_property.ts
+++ b/x-pack/plugins/maps/public/layers/tooltips/tooltip_property.ts
@@ -5,8 +5,8 @@
  */
 
 import _ from 'lodash';
-import { PhraseFilter } from '../../../../../../../src/plugins/data/public';
-import { TooltipFeature } from '../../../../../../plugins/maps/common/descriptor_types';
+import { PhraseFilter } from '../../../../../../src/plugins/data/public';
+import { TooltipFeature } from '../../../../../plugins/maps/common/descriptor_types';
 
 export interface ITooltipProperty {
   getPropertyKey(): string;
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/assign_feature_ids.test.ts b/x-pack/plugins/maps/public/layers/util/assign_feature_ids.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/assign_feature_ids.test.ts
rename to x-pack/plugins/maps/public/layers/util/assign_feature_ids.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/assign_feature_ids.ts b/x-pack/plugins/maps/public/layers/util/assign_feature_ids.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/assign_feature_ids.ts
rename to x-pack/plugins/maps/public/layers/util/assign_feature_ids.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/can_skip_fetch.test.js b/x-pack/plugins/maps/public/layers/util/can_skip_fetch.test.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/can_skip_fetch.test.js
rename to x-pack/plugins/maps/public/layers/util/can_skip_fetch.test.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/can_skip_fetch.ts b/x-pack/plugins/maps/public/layers/util/can_skip_fetch.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/can_skip_fetch.ts
rename to x-pack/plugins/maps/public/layers/util/can_skip_fetch.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/data_request.ts b/x-pack/plugins/maps/public/layers/util/data_request.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/data_request.ts
rename to x-pack/plugins/maps/public/layers/util/data_request.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/es_agg_utils.test.ts b/x-pack/plugins/maps/public/layers/util/es_agg_utils.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/es_agg_utils.test.ts
rename to x-pack/plugins/maps/public/layers/util/es_agg_utils.test.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/es_agg_utils.ts b/x-pack/plugins/maps/public/layers/util/es_agg_utils.ts
similarity index 95%
rename from x-pack/legacy/plugins/maps/public/layers/util/es_agg_utils.ts
rename to x-pack/plugins/maps/public/layers/util/es_agg_utils.ts
index 9d4f24f80d6cd..329a2a6fc64fb 100644
--- a/x-pack/legacy/plugins/maps/public/layers/util/es_agg_utils.ts
+++ b/x-pack/plugins/maps/public/layers/util/es_agg_utils.ts
@@ -5,7 +5,7 @@
  */
 import { i18n } from '@kbn/i18n';
 import _ from 'lodash';
-import { IndexPattern, IFieldType } from '../../../../../../../src/plugins/data/public';
+import { IndexPattern, IFieldType } from '../../../../../../src/plugins/data/public';
 import { TOP_TERM_PERCENTAGE_SUFFIX } from '../../../common/constants';
 
 export function getField(indexPattern: IndexPattern, fieldName: string) {
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/is_metric_countable.ts b/x-pack/plugins/maps/public/layers/util/is_metric_countable.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/is_metric_countable.ts
rename to x-pack/plugins/maps/public/layers/util/is_metric_countable.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/is_refresh_only_query.ts b/x-pack/plugins/maps/public/layers/util/is_refresh_only_query.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/is_refresh_only_query.ts
rename to x-pack/plugins/maps/public/layers/util/is_refresh_only_query.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/util/mb_filter_expressions.ts b/x-pack/plugins/maps/public/layers/util/mb_filter_expressions.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/util/mb_filter_expressions.ts
rename to x-pack/plugins/maps/public/layers/util/mb_filter_expressions.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/vector_layer.d.ts b/x-pack/plugins/maps/public/layers/vector_layer.d.ts
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/vector_layer.d.ts
rename to x-pack/plugins/maps/public/layers/vector_layer.d.ts
diff --git a/x-pack/legacy/plugins/maps/public/layers/vector_layer.js b/x-pack/plugins/maps/public/layers/vector_layer.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/vector_layer.js
rename to x-pack/plugins/maps/public/layers/vector_layer.js
diff --git a/x-pack/legacy/plugins/maps/public/layers/vector_tile_layer.js b/x-pack/plugins/maps/public/layers/vector_tile_layer.js
similarity index 100%
rename from x-pack/legacy/plugins/maps/public/layers/vector_tile_layer.js
rename to x-pack/plugins/maps/public/layers/vector_tile_layer.js
diff --git a/x-pack/legacy/plugins/maps/public/meta.js b/x-pack/plugins/maps/public/meta.js
similarity index 76%
rename from x-pack/legacy/plugins/maps/public/meta.js
rename to x-pack/plugins/maps/public/meta.js
index 4d81785ff7a0a..d4612554cf00b 100644
--- a/x-pack/legacy/plugins/maps/public/meta.js
+++ b/x-pack/plugins/maps/public/meta.js
@@ -11,20 +11,19 @@ import {
   EMS_GLYPHS_PATH,
   EMS_APP_NAME,
 } from '../common/constants';
-import chrome from 'ui/chrome';
 import { i18n } from '@kbn/i18n';
 import { EMSClient } from '@elastic/ems-client';
-import { getLicenseId } from './kibana_services';
+import { getInjectedVarFunc, getLicenseId } from './kibana_services';
 import fetch from 'node-fetch';
 
 const GIS_API_RELATIVE = `../${GIS_API_PATH}`;
 
 export function getKibanaRegionList() {
-  return chrome.getInjected('regionmapLayers');
+  return getInjectedVarFunc()('regionmapLayers');
 }
 
 export function getKibanaTileMap() {
-  return chrome.getInjected('tilemap');
+  return getInjectedVarFunc()('tilemap');
 }
 
 function relativeToAbsolute(url) {
@@ -41,27 +40,27 @@ let emsClient = null;
 let latestLicenseId = null;
 export function getEMSClient() {
   if (!emsClient) {
-    const isEmsEnabled = chrome.getInjected('isEmsEnabled', true);
+    const isEmsEnabled = getInjectedVarFunc()('isEmsEnabled', true);
     if (isEmsEnabled) {
-      const proxyElasticMapsServiceInMaps = chrome.getInjected(
+      const proxyElasticMapsServiceInMaps = getInjectedVarFunc()(
         'proxyElasticMapsServiceInMaps',
         false
       );
       const proxyPath = '';
       const tileApiUrl = proxyElasticMapsServiceInMaps
         ? relativeToAbsolute(`${GIS_API_RELATIVE}/${EMS_TILES_CATALOGUE_PATH}`)
-        : chrome.getInjected('emsTileApiUrl');
+        : getInjectedVarFunc()('emsTileApiUrl');
       const fileApiUrl = proxyElasticMapsServiceInMaps
         ? relativeToAbsolute(`${GIS_API_RELATIVE}/${EMS_FILES_CATALOGUE_PATH}`)
-        : chrome.getInjected('emsFileApiUrl');
+        : getInjectedVarFunc()('emsFileApiUrl');
 
       emsClient = new EMSClient({
         language: i18n.getLocale(),
-        appVersion: chrome.getInjected('kbnPkgVersion'),
+        appVersion: getInjectedVarFunc()('kbnPkgVersion'),
         appName: EMS_APP_NAME,
         tileApiUrl,
         fileApiUrl,
-        landingPageUrl: chrome.getInjected('emsLandingPageUrl'),
+        landingPageUrl: getInjectedVarFunc()('emsLandingPageUrl'),
         fetchFunction: fetchFunction, //import this from client-side, so the right instance is returned (bootstrapped from common/* would not work
         proxyPath,
       });
@@ -87,13 +86,13 @@ export function getEMSClient() {
 }
 
 export function getGlyphUrl() {
-  if (!chrome.getInjected('isEmsEnabled', true)) {
+  if (!getInjectedVarFunc()('isEmsEnabled', true)) {
     return '';
   }
-  return chrome.getInjected('proxyElasticMapsServiceInMaps', false)
+  return getInjectedVarFunc()('proxyElasticMapsServiceInMaps', false)
     ? relativeToAbsolute(`../${GIS_API_PATH}/${EMS_TILES_CATALOGUE_PATH}/${EMS_GLYPHS_PATH}`) +
         `/{fontstack}/{range}`
-    : chrome.getInjected('emsFontLibraryUrl', true);
+    : getInjectedVarFunc()('emsFontLibraryUrl', true);
 }
 
 export function isRetina() {
diff --git a/x-pack/legacy/plugins/maps/public/meta.test.js b/x-pack/plugins/maps/public/meta.test.js
similarity index 57%
rename from x-pack/legacy/plugins/maps/public/meta.test.js
rename to x-pack/plugins/maps/public/meta.test.js
index 64dd73fe109ff..d83f2adb35ef7 100644
--- a/x-pack/legacy/plugins/maps/public/meta.test.js
+++ b/x-pack/plugins/maps/public/meta.test.js
@@ -9,39 +9,24 @@ import { getEMSClient } from './meta';
 
 jest.mock('@elastic/ems-client');
 
-jest.mock('ui/chrome', () => ({
-  getBasePath: () => {
-    return '<basepath>';
-  },
-  getInjected(key) {
-    if (key === 'proxyElasticMapsServiceInMaps') {
-      return false;
-    } else if (key === 'isEmsEnabled') {
-      return true;
-    } else if (key === 'emsFileApiUrl') {
-      return 'https://file-api';
-    } else if (key === 'emsTileApiUrl') {
-      return 'https://tile-api';
-    }
-  },
-  getUiSettingsClient: () => {
-    return {
-      get: () => {
-        return '';
-      },
+describe('default use without proxy', () => {
+  beforeEach(() => {
+    require('./kibana_services').getInjectedVarFunc = () => key => {
+      if (key === 'proxyElasticMapsServiceInMaps') {
+        return false;
+      } else if (key === 'isEmsEnabled') {
+        return true;
+      } else if (key === 'emsFileApiUrl') {
+        return 'https://file-api';
+      } else if (key === 'emsTileApiUrl') {
+        return 'https://tile-api';
+      }
     };
-  },
-}));
-
-jest.mock('./kibana_services', () => {
-  return {
-    getLicenseId() {
+    require('./kibana_services').getLicenseId = () => {
       return 'foobarlicenseid';
-    },
-  };
-});
+    };
+  });
 
-describe('default use without proxy', () => {
   it('should construct EMSClient with absolute file and tile API urls', async () => {
     getEMSClient();
     const mockEmsClientCall = EMSClient.mock.calls[0];
diff --git a/x-pack/plugins/maps/public/plugin.ts b/x-pack/plugins/maps/public/plugin.ts
index 506b0c426f0fa..9437c2512ded4 100644
--- a/x-pack/plugins/maps/public/plugin.ts
+++ b/x-pack/plugins/maps/public/plugin.ts
@@ -8,6 +8,20 @@ import { Plugin, CoreSetup, CoreStart } from 'src/core/public';
 import { Setup as InspectorSetupContract } from 'src/plugins/inspector/public';
 // @ts-ignore
 import { MapView } from './inspector/views/map_view';
+import {
+  setAutocompleteService,
+  setFileUpload,
+  setHttp,
+  setIndexPatternSelect,
+  setIndexPatternService,
+  setInjectedVarFunc,
+  setInspector,
+  setLicenseId,
+  setTimeFilter,
+  setToasts,
+  setUiSettings,
+  // @ts-ignore
+} from './kibana_services';
 
 export interface MapsPluginSetupDependencies {
   inspector: InspectorSetupContract;
@@ -15,6 +29,29 @@ export interface MapsPluginSetupDependencies {
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface MapsPluginStartDependencies {}
 
+export const bindSetupCoreAndPlugins = (core: CoreSetup, plugins: any) => {
+  const { licensing } = plugins;
+  const { injectedMetadata, http } = core;
+  if (licensing) {
+    licensing.license$.subscribe(({ uid }: { uid: string }) => setLicenseId(uid));
+  }
+  setInjectedVarFunc(injectedMetadata.getInjectedVar);
+  setHttp(http);
+  setUiSettings(core.uiSettings);
+  setInjectedVarFunc(core.injectedMetadata.getInjectedVar);
+  setToasts(core.notifications.toasts);
+};
+
+export const bindStartCoreAndPlugins = (core: CoreStart, plugins: any) => {
+  const { file_upload, data, inspector } = plugins;
+  setInspector(inspector);
+  setFileUpload(file_upload);
+  setIndexPatternSelect(data.ui.IndexPatternSelect);
+  setTimeFilter(data.query.timefilter.timefilter);
+  setIndexPatternService(data.indexPatterns);
+  setAutocompleteService(data.autocomplete);
+};
+
 /**
  * These are the interfaces with your public contracts. You should export these
  * for other plugins to use in _their_ `SetupDeps`/`StartDeps` interfaces.
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/classification_exploration/results_table.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/classification_exploration/results_table.tsx
index fbdb47c87c7ef..9758dd969b443 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/classification_exploration/results_table.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/classification_exploration/results_table.tsx
@@ -211,6 +211,7 @@ export const ResultsTable: FC<Props> = React.memo(
           switch (type) {
             case ES_FIELD_TYPES.BOOLEAN:
               column.dataType = ES_FIELD_TYPES.BOOLEAN;
+              column.render = d => (d ? 'true' : 'false');
               break;
             case ES_FIELD_TYPES.DATE:
               column.align = 'right';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/regression_exploration/results_table.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/regression_exploration/results_table.tsx
index 8d53a9278a1af..a35be5400f46b 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/regression_exploration/results_table.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/regression_exploration/results_table.tsx
@@ -213,6 +213,7 @@ export const ResultsTable: FC<Props> = React.memo(
           switch (type) {
             case ES_FIELD_TYPES.BOOLEAN:
               column.dataType = ES_FIELD_TYPES.BOOLEAN;
+              column.render = d => (d ? 'true' : 'false');
               break;
             case ES_FIELD_TYPES.DATE:
               column.align = 'right';
diff --git a/x-pack/plugins/monitoring/common/constants.ts b/x-pack/plugins/monitoring/common/constants.ts
index 9a4030f3eb214..3a4c7b71dcd03 100644
--- a/x-pack/plugins/monitoring/common/constants.ts
+++ b/x-pack/plugins/monitoring/common/constants.ts
@@ -239,11 +239,15 @@ export const ALERT_TYPE_PREFIX = 'monitoring_';
  * This is the alert type id for the license expiration alert
  */
 export const ALERT_TYPE_LICENSE_EXPIRATION = `${ALERT_TYPE_PREFIX}alert_type_license_expiration`;
+/**
+ * This is the alert type id for the cluster state alert
+ */
+export const ALERT_TYPE_CLUSTER_STATE = `${ALERT_TYPE_PREFIX}alert_type_cluster_state`;
 
 /**
  * A listing of all alert types
  */
-export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION];
+export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION, ALERT_TYPE_CLUSTER_STATE];
 
 /**
  * Matches the id for the built-in in email action type
@@ -254,7 +258,7 @@ export const ALERT_ACTION_TYPE_EMAIL = '.email';
 /**
  * The number of alerts that have been migrated
  */
-export const NUMBER_OF_MIGRATED_ALERTS = 1;
+export const NUMBER_OF_MIGRATED_ALERTS = 2;
 
 /**
  * The advanced settings config name for the email address
diff --git a/x-pack/plugins/monitoring/server/alerts/cluster_state.test.ts b/x-pack/plugins/monitoring/server/alerts/cluster_state.test.ts
new file mode 100644
index 0000000000000..6a9ca88437347
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/alerts/cluster_state.test.ts
@@ -0,0 +1,186 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Logger } from 'src/core/server';
+import { savedObjectsClientMock } from 'src/core/server/mocks';
+import { getClusterState } from './cluster_state';
+import { AlertServices } from '../../../alerting/server';
+import { ALERT_TYPE_CLUSTER_STATE } from '../../common/constants';
+import { AlertCommonParams, AlertCommonState, AlertClusterStatePerClusterState } from './types';
+import { getPreparedAlert } from '../lib/alerts/get_prepared_alert';
+import { executeActions } from '../lib/alerts/cluster_state.lib';
+import { AlertClusterStateState } from './enums';
+
+jest.mock('../lib/alerts/cluster_state.lib', () => ({
+  executeActions: jest.fn(),
+  getUiMessage: jest.fn(),
+}));
+
+jest.mock('../lib/alerts/get_prepared_alert', () => ({
+  getPreparedAlert: jest.fn(() => {
+    return {
+      emailAddress: 'foo@foo.com',
+    };
+  }),
+}));
+
+interface MockServices {
+  callCluster: jest.Mock;
+  alertInstanceFactory: jest.Mock;
+  savedObjectsClient: jest.Mock;
+}
+
+describe('getClusterState', () => {
+  const services: MockServices | AlertServices = {
+    callCluster: jest.fn(),
+    alertInstanceFactory: jest.fn(),
+    savedObjectsClient: savedObjectsClientMock.create(),
+  };
+
+  const params: AlertCommonParams = {
+    dateFormat: 'YYYY',
+    timezone: 'UTC',
+  };
+
+  const emailAddress = 'foo@foo.com';
+  const clusterUuid = 'kdksdfj434';
+  const clusterName = 'monitoring_test';
+  const cluster = { clusterUuid, clusterName };
+
+  async function setupAlert(
+    previousState: AlertClusterStateState,
+    newState: AlertClusterStateState
+  ): Promise<AlertCommonState> {
+    const logger: Logger = {
+      warn: jest.fn(),
+      log: jest.fn(),
+      debug: jest.fn(),
+      trace: jest.fn(),
+      error: jest.fn(),
+      fatal: jest.fn(),
+      info: jest.fn(),
+      get: jest.fn(),
+    };
+    const getLogger = (): Logger => logger;
+    const ccrEnabled = false;
+    (getPreparedAlert as jest.Mock).mockImplementation(() => ({
+      emailAddress,
+      data: [
+        {
+          state: newState,
+          clusterUuid,
+        },
+      ],
+      clusters: [cluster],
+    }));
+
+    const alert = getClusterState(null as any, null as any, getLogger, ccrEnabled);
+    const state: AlertCommonState = {
+      [clusterUuid]: {
+        state: previousState,
+        ui: {
+          isFiring: false,
+          severity: 0,
+          message: null,
+          resolvedMS: 0,
+          lastCheckedMS: 0,
+          triggeredMS: 0,
+        },
+      } as AlertClusterStatePerClusterState,
+    };
+
+    return (await alert.executor({ services, params, state } as any)) as AlertCommonState;
+  }
+
+  afterEach(() => {
+    (executeActions as jest.Mock).mockClear();
+  });
+
+  it('should configure the alert properly', () => {
+    const alert = getClusterState(null as any, null as any, jest.fn(), false);
+    expect(alert.id).toBe(ALERT_TYPE_CLUSTER_STATE);
+    expect(alert.actionGroups).toEqual([{ id: 'default', name: 'Default' }]);
+  });
+
+  it('should alert if green -> yellow', async () => {
+    const result = await setupAlert(AlertClusterStateState.Green, AlertClusterStateState.Yellow);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Yellow,
+      emailAddress
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Yellow);
+    expect(clusterResult.ui.isFiring).toBe(true);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should alert if yellow -> green', async () => {
+    const result = await setupAlert(AlertClusterStateState.Yellow, AlertClusterStateState.Green);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Green,
+      emailAddress,
+      true
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Green);
+    expect(clusterResult.ui.resolvedMS).toBeGreaterThan(0);
+  });
+
+  it('should alert if green -> red', async () => {
+    const result = await setupAlert(AlertClusterStateState.Green, AlertClusterStateState.Red);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Red,
+      emailAddress
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Red);
+    expect(clusterResult.ui.isFiring).toBe(true);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should alert if red -> green', async () => {
+    const result = await setupAlert(AlertClusterStateState.Red, AlertClusterStateState.Green);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Green,
+      emailAddress,
+      true
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Green);
+    expect(clusterResult.ui.resolvedMS).toBeGreaterThan(0);
+  });
+
+  it('should not alert if red -> yellow', async () => {
+    const result = await setupAlert(AlertClusterStateState.Red, AlertClusterStateState.Yellow);
+    expect(executeActions).not.toHaveBeenCalled();
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Red);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should not alert if yellow -> red', async () => {
+    const result = await setupAlert(AlertClusterStateState.Yellow, AlertClusterStateState.Red);
+    expect(executeActions).not.toHaveBeenCalled();
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Yellow);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should not alert if green -> green', async () => {
+    const result = await setupAlert(AlertClusterStateState.Green, AlertClusterStateState.Green);
+    expect(executeActions).not.toHaveBeenCalled();
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Green);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/alerts/cluster_state.ts b/x-pack/plugins/monitoring/server/alerts/cluster_state.ts
new file mode 100644
index 0000000000000..9a5805b8af7ce
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/alerts/cluster_state.ts
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment-timezone';
+import { i18n } from '@kbn/i18n';
+import { Logger, ICustomClusterClient, UiSettingsServiceStart } from 'src/core/server';
+import { ALERT_TYPE_CLUSTER_STATE } from '../../common/constants';
+import { AlertType } from '../../../alerting/server';
+import { executeActions, getUiMessage } from '../lib/alerts/cluster_state.lib';
+import {
+  AlertCommonExecutorOptions,
+  AlertCommonState,
+  AlertClusterStatePerClusterState,
+  AlertCommonCluster,
+} from './types';
+import { AlertClusterStateState } from './enums';
+import { getPreparedAlert } from '../lib/alerts/get_prepared_alert';
+import { fetchClusterState } from '../lib/alerts/fetch_cluster_state';
+
+export const getClusterState = (
+  getUiSettingsService: () => Promise<UiSettingsServiceStart>,
+  monitoringCluster: ICustomClusterClient,
+  getLogger: (...scopes: string[]) => Logger,
+  ccsEnabled: boolean
+): AlertType => {
+  const logger = getLogger(ALERT_TYPE_CLUSTER_STATE);
+  return {
+    id: ALERT_TYPE_CLUSTER_STATE,
+    name: 'Monitoring Alert - Cluster Status',
+    actionGroups: [
+      {
+        id: 'default',
+        name: i18n.translate('xpack.monitoring.alerts.clusterState.actionGroups.default', {
+          defaultMessage: 'Default',
+        }),
+      },
+    ],
+    defaultActionGroupId: 'default',
+    async executor({
+      services,
+      params,
+      state,
+    }: AlertCommonExecutorOptions): Promise<AlertCommonState> {
+      logger.debug(
+        `Firing alert with params: ${JSON.stringify(params)} and state: ${JSON.stringify(state)}`
+      );
+
+      const preparedAlert = await getPreparedAlert(
+        ALERT_TYPE_CLUSTER_STATE,
+        getUiSettingsService,
+        monitoringCluster,
+        logger,
+        ccsEnabled,
+        services,
+        fetchClusterState
+      );
+
+      if (!preparedAlert) {
+        return state;
+      }
+
+      const { emailAddress, data: states, clusters } = preparedAlert;
+
+      const result: AlertCommonState = { ...state };
+      const defaultAlertState: AlertClusterStatePerClusterState = {
+        state: AlertClusterStateState.Green,
+        ui: {
+          isFiring: false,
+          message: null,
+          severity: 0,
+          resolvedMS: 0,
+          triggeredMS: 0,
+          lastCheckedMS: 0,
+        },
+      };
+
+      for (const clusterState of states) {
+        const alertState: AlertClusterStatePerClusterState =
+          (state[clusterState.clusterUuid] as AlertClusterStatePerClusterState) ||
+          defaultAlertState;
+        const cluster = clusters.find(
+          (c: AlertCommonCluster) => c.clusterUuid === clusterState.clusterUuid
+        );
+        if (!cluster) {
+          logger.warn(`Unable to find cluster for clusterUuid='${clusterState.clusterUuid}'`);
+          continue;
+        }
+        const isNonGreen = clusterState.state !== AlertClusterStateState.Green;
+        const severity = clusterState.state === AlertClusterStateState.Red ? 2100 : 1100;
+
+        const ui = alertState.ui;
+        let triggered = ui.triggeredMS;
+        let resolved = ui.resolvedMS;
+        let message = ui.message || {};
+        let lastState = alertState.state;
+        const instance = services.alertInstanceFactory(ALERT_TYPE_CLUSTER_STATE);
+
+        if (isNonGreen) {
+          if (lastState === AlertClusterStateState.Green) {
+            logger.debug(`Cluster state changed from green to ${clusterState.state}`);
+            executeActions(instance, cluster, clusterState.state, emailAddress);
+            lastState = clusterState.state;
+            triggered = moment().valueOf();
+          }
+          message = getUiMessage(clusterState.state);
+          resolved = 0;
+        } else if (!isNonGreen && lastState !== AlertClusterStateState.Green) {
+          logger.debug(`Cluster state changed from ${lastState} to green`);
+          executeActions(instance, cluster, clusterState.state, emailAddress, true);
+          lastState = clusterState.state;
+          message = getUiMessage(clusterState.state, true);
+          resolved = moment().valueOf();
+        }
+
+        result[clusterState.clusterUuid] = {
+          state: lastState,
+          ui: {
+            message,
+            isFiring: isNonGreen,
+            severity,
+            resolvedMS: resolved,
+            triggeredMS: triggered,
+            lastCheckedMS: moment().valueOf(),
+          },
+        } as AlertClusterStatePerClusterState;
+      }
+
+      return result;
+    },
+  };
+};
diff --git a/x-pack/plugins/monitoring/server/alerts/enums.ts b/x-pack/plugins/monitoring/server/alerts/enums.ts
new file mode 100644
index 0000000000000..ccff588743af1
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/alerts/enums.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export enum AlertClusterStateState {
+  Green = 'green',
+  Red = 'red',
+  Yellow = 'yellow',
+}
+
+export enum AlertCommonPerClusterMessageTokenType {
+  Time = 'time',
+  Link = 'link',
+}
diff --git a/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts b/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts
index 0773af6e7f070..92047e300bc1f 100644
--- a/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts
@@ -6,42 +6,31 @@
 
 import moment from 'moment-timezone';
 import { getLicenseExpiration } from './license_expiration';
-import {
-  ALERT_TYPE_LICENSE_EXPIRATION,
-  MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS,
-} from '../../common/constants';
+import { ALERT_TYPE_LICENSE_EXPIRATION } from '../../common/constants';
 import { Logger } from 'src/core/server';
-import { AlertServices, AlertInstance } from '../../../alerting/server';
+import { AlertServices } from '../../../alerting/server';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
 import {
-  AlertState,
-  AlertClusterState,
-  AlertParams,
-  LicenseExpirationAlertExecutorOptions,
+  AlertCommonParams,
+  AlertCommonState,
+  AlertLicensePerClusterState,
+  AlertLicense,
 } from './types';
-import { SavedObject, SavedObjectAttributes } from 'src/core/server';
-import { SavedObjectsClientContract } from 'src/core/server';
-
-function fillLicense(license: any, clusterUuid?: string) {
-  return {
-    hits: {
-      hits: [
-        {
-          _source: {
-            license,
-            cluster_uuid: clusterUuid,
-          },
-        },
-      ],
-    },
-  };
-}
-
-const clusterUuid = 'a4545jhjb';
-const params: AlertParams = {
-  dateFormat: 'YYYY',
-  timezone: 'UTC',
-};
+import { executeActions } from '../lib/alerts/license_expiration.lib';
+import { PreparedAlert, getPreparedAlert } from '../lib/alerts/get_prepared_alert';
+
+jest.mock('../lib/alerts/license_expiration.lib', () => ({
+  executeActions: jest.fn(),
+  getUiMessage: jest.fn(),
+}));
+
+jest.mock('../lib/alerts/get_prepared_alert', () => ({
+  getPreparedAlert: jest.fn(() => {
+    return {
+      emailAddress: 'foo@foo.com',
+    };
+  }),
+}));
 
 interface MockServices {
   callCluster: jest.Mock;
@@ -49,428 +38,169 @@ interface MockServices {
   savedObjectsClient: jest.Mock;
 }
 
-const alertExecutorOptions: LicenseExpirationAlertExecutorOptions = {
-  alertId: '',
-  startedAt: new Date(),
-  services: {
-    callCluster: (path: string, opts: any) => new Promise(resolve => resolve()),
-    alertInstanceFactory: (id: string) => new AlertInstance(),
-    savedObjectsClient: {} as jest.Mocked<SavedObjectsClientContract>,
-  },
-  params: {},
-  state: {},
-  spaceId: '',
-  name: '',
-  tags: [],
-  previousStartedAt: null,
-  createdBy: null,
-  updatedBy: null,
-};
-
 describe('getLicenseExpiration', () => {
-  const emailAddress = 'foo@foo.com';
-  const getUiSettingsService: any = () => ({
-    asScopedToClient: (): any => ({
-      get: () => new Promise(resolve => resolve(emailAddress)),
-    }),
-  });
-  const monitoringCluster: any = null;
-  const logger: Logger = {
-    warn: jest.fn(),
-    log: jest.fn(),
-    debug: jest.fn(),
-    trace: jest.fn(),
-    error: jest.fn(),
-    fatal: jest.fn(),
-    info: jest.fn(),
-    get: jest.fn(),
+  const services: MockServices | AlertServices = {
+    callCluster: jest.fn(),
+    alertInstanceFactory: jest.fn(),
+    savedObjectsClient: savedObjectsClientMock.create(),
   };
-  const getLogger = (): Logger => logger;
-  const ccrEnabled = false;
 
-  afterEach(() => {
-    (logger.warn as jest.Mock).mockClear();
-  });
-
-  it('should have the right id and actionGroups', () => {
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-    expect(alert.id).toBe(ALERT_TYPE_LICENSE_EXPIRATION);
-    expect(alert.actionGroups).toEqual([{ id: 'default', name: 'Default' }]);
-  });
+  const params: AlertCommonParams = {
+    dateFormat: 'YYYY',
+    timezone: 'UTC',
+  };
 
-  it('should return the state if no license is provided', async () => {
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
+  const emailAddress = 'foo@foo.com';
+  const clusterUuid = 'kdksdfj434';
+  const clusterName = 'monitoring_test';
+  const dateFormat = 'YYYY-MM-DD';
+  const cluster = { clusterUuid, clusterName };
+  const defaultUiState = {
+    isFiring: false,
+    severity: 0,
+    message: null,
+    resolvedMS: 0,
+    lastCheckedMS: 0,
+    triggeredMS: 0,
+  };
 
-    const services: MockServices | AlertServices = {
-      callCluster: jest.fn(),
-      alertInstanceFactory: jest.fn(),
-      savedObjectsClient: savedObjectsClientMock.create(),
+  async function setupAlert(
+    license: AlertLicense | null,
+    expiredCheckDateMS: number,
+    preparedAlertResponse: PreparedAlert | null | undefined = undefined
+  ): Promise<AlertCommonState> {
+    const logger: Logger = {
+      warn: jest.fn(),
+      log: jest.fn(),
+      debug: jest.fn(),
+      trace: jest.fn(),
+      error: jest.fn(),
+      fatal: jest.fn(),
+      info: jest.fn(),
+      get: jest.fn(),
     };
-    const state = { foo: 1 };
-
-    const result = await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    });
-
-    expect(result).toEqual(state);
-  });
+    const getLogger = (): Logger => logger;
+    const ccrEnabled = false;
+    (getPreparedAlert as jest.Mock).mockImplementation(() => {
+      if (preparedAlertResponse !== undefined) {
+        return preparedAlertResponse;
+      }
 
-  it('should log a warning if no email is provided', async () => {
-    const customGetUiSettingsService: any = () => ({
-      asScopedToClient: () => ({
-        get: () => null,
-      }),
+      return {
+        emailAddress,
+        data: [license],
+        clusters: [cluster],
+        dateFormat,
+      };
     });
-    const alert = getLicenseExpiration(
-      customGetUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
 
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense({
-                  status: 'good',
-                  type: 'basic',
-                  expiry_date_in_millis: moment()
-                    .add(7, 'days')
-                    .valueOf(),
-                })
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory: jest.fn(),
-      savedObjectsClient: savedObjectsClientMock.create(),
+    const alert = getLicenseExpiration(null as any, null as any, getLogger, ccrEnabled);
+    const state: AlertCommonState = {
+      [clusterUuid]: {
+        expiredCheckDateMS,
+        ui: { ...defaultUiState },
+      } as AlertLicensePerClusterState,
     };
 
-    const state = {};
+    return (await alert.executor({ services, params, state } as any)) as AlertCommonState;
+  }
 
-    await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    });
-
-    expect((logger.warn as jest.Mock).mock.calls.length).toBe(1);
-    expect(logger.warn).toHaveBeenCalledWith(
-      `Unable to send email for ${ALERT_TYPE_LICENSE_EXPIRATION} because there is no email configured.`
-    );
+  afterEach(() => {
+    (executeActions as jest.Mock).mockClear();
+    (getPreparedAlert as jest.Mock).mockClear();
   });
 
-  it('should fire actions if going to expire', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
+  it('should have the right id and actionGroups', () => {
+    const alert = getLicenseExpiration(null as any, null as any, jest.fn(), false);
+    expect(alert.id).toBe(ALERT_TYPE_LICENSE_EXPIRATION);
+    expect(alert.actionGroups).toEqual([{ id: 'default', name: 'Default' }]);
+  });
 
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
+  it('should return the state if no license is provided', async () => {
+    const result = await setupAlert(null, 0, null);
+    expect(result[clusterUuid].ui).toEqual(defaultUiState);
+  });
 
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'gold',
-                    expiry_date_in_millis: moment()
-                      .add(7, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
+  it('should fire actions if going to expire', async () => {
+    const expiryDateMS = moment()
+      .add(7, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'gold',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const state = {};
-
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
-
+    const result = await setupAlert(license, 0);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
     expect(newState.expiredCheckDateMS > 0).toBe(true);
-    expect(scheduleActions.mock.calls.length).toBe(1);
-    expect(scheduleActions.mock.calls[0][1].subject).toBe(
-      'NEW X-Pack Monitoring: License Expiration'
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      moment.utc(expiryDateMS),
+      dateFormat,
+      emailAddress
     );
-    expect(scheduleActions.mock.calls[0][1].to).toBe(emailAddress);
   });
 
   it('should fire actions if the user fixed their license', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'gold',
-                    expiry_date_in_millis: moment()
-                      .add(120, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
-    };
-
-    const state: AlertState = {
-      [clusterUuid]: {
-        expiredCheckDateMS: moment()
-          .subtract(1, 'day')
-          .valueOf(),
-        ui: { isFiring: true, severity: 0, message: null, resolvedMS: 0, expirationTime: 0 },
-      },
+    const expiryDateMS = moment()
+      .add(365, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'gold',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
+    const result = await setupAlert(license, 100);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
     expect(newState.expiredCheckDateMS).toBe(0);
-    expect(scheduleActions.mock.calls.length).toBe(1);
-    expect(scheduleActions.mock.calls[0][1].subject).toBe(
-      'RESOLVED X-Pack Monitoring: License Expiration'
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      moment.utc(expiryDateMS),
+      dateFormat,
+      emailAddress,
+      true
     );
-    expect(scheduleActions.mock.calls[0][1].to).toBe(emailAddress);
   });
 
   it('should not fire actions for trial license that expire in more than 14 days', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'trial',
-                    expiry_date_in_millis: moment()
-                      .add(15, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
+    const expiryDateMS = moment()
+      .add(20, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'trial',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const state = {};
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
-    expect(newState.expiredCheckDateMS).toBe(undefined);
-    expect(scheduleActions).not.toHaveBeenCalled();
+    const result = await setupAlert(license, 0);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
+    expect(newState.expiredCheckDateMS).toBe(0);
+    expect(executeActions).not.toHaveBeenCalled();
   });
 
   it('should fire actions for trial license that in 14 days or less', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'trial',
-                    expiry_date_in_millis: moment()
-                      .add(13, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
+    const expiryDateMS = moment()
+      .add(7, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'trial',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const state = {};
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
+    const result = await setupAlert(license, 0);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
     expect(newState.expiredCheckDateMS > 0).toBe(true);
-    expect(scheduleActions.mock.calls.length).toBe(1);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      moment.utc(expiryDateMS),
+      dateFormat,
+      emailAddress
+    );
   });
 });
diff --git a/x-pack/plugins/monitoring/server/alerts/license_expiration.ts b/x-pack/plugins/monitoring/server/alerts/license_expiration.ts
index 93397ff3641ae..2e5356150086b 100644
--- a/x-pack/plugins/monitoring/server/alerts/license_expiration.ts
+++ b/x-pack/plugins/monitoring/server/alerts/license_expiration.ts
@@ -5,24 +5,20 @@
  */
 
 import moment from 'moment-timezone';
-import { get } from 'lodash';
 import { Logger, ICustomClusterClient, UiSettingsServiceStart } from 'src/core/server';
 import { i18n } from '@kbn/i18n';
-import { ALERT_TYPE_LICENSE_EXPIRATION, INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
+import { ALERT_TYPE_LICENSE_EXPIRATION } from '../../common/constants';
 import { AlertType } from '../../../../plugins/alerting/server';
 import { fetchLicenses } from '../lib/alerts/fetch_licenses';
-import { fetchDefaultEmailAddress } from '../lib/alerts/fetch_default_email_address';
-import { fetchClusters } from '../lib/alerts/fetch_clusters';
-import { fetchAvailableCcs } from '../lib/alerts/fetch_available_ccs';
 import {
-  AlertLicense,
-  AlertState,
-  AlertClusterState,
-  AlertClusterUiState,
-  LicenseExpirationAlertExecutorOptions,
+  AlertCommonState,
+  AlertLicensePerClusterState,
+  AlertCommonExecutorOptions,
+  AlertCommonCluster,
+  AlertLicensePerClusterUiState,
 } from './types';
-import { getCcsIndexPattern } from '../lib/alerts/get_ccs_index_pattern';
 import { executeActions, getUiMessage } from '../lib/alerts/license_expiration.lib';
+import { getPreparedAlert } from '../lib/alerts/get_prepared_alert';
 
 const EXPIRES_DAYS = [60, 30, 14, 7];
 
@@ -32,14 +28,6 @@ export const getLicenseExpiration = (
   getLogger: (...scopes: string[]) => Logger,
   ccsEnabled: boolean
 ): AlertType => {
-  async function getCallCluster(services: any): Promise<any> {
-    if (!monitoringCluster) {
-      return services.callCluster;
-    }
-
-    return monitoringCluster.callAsInternalUser;
-  }
-
   const logger = getLogger(ALERT_TYPE_LICENSE_EXPIRATION);
   return {
     id: ALERT_TYPE_LICENSE_EXPIRATION,
@@ -53,54 +41,50 @@ export const getLicenseExpiration = (
       },
     ],
     defaultActionGroupId: 'default',
-    async executor({
-      services,
-      params,
-      state,
-    }: LicenseExpirationAlertExecutorOptions): Promise<any> {
+    async executor({ services, params, state }: AlertCommonExecutorOptions): Promise<any> {
       logger.debug(
         `Firing alert with params: ${JSON.stringify(params)} and state: ${JSON.stringify(state)}`
       );
 
-      const callCluster = await getCallCluster(services);
-
-      // Support CCS use cases by querying to find available remote clusters
-      // and then adding those to the index pattern we are searching against
-      let esIndexPattern = INDEX_PATTERN_ELASTICSEARCH;
-      if (ccsEnabled) {
-        const availableCcs = await fetchAvailableCcs(callCluster);
-        if (availableCcs.length > 0) {
-          esIndexPattern = getCcsIndexPattern(esIndexPattern, availableCcs);
-        }
-      }
-
-      const clusters = await fetchClusters(callCluster, esIndexPattern);
+      const preparedAlert = await getPreparedAlert(
+        ALERT_TYPE_LICENSE_EXPIRATION,
+        getUiSettingsService,
+        monitoringCluster,
+        logger,
+        ccsEnabled,
+        services,
+        fetchLicenses
+      );
 
-      // Fetch licensing information from cluster_stats documents
-      const licenses: AlertLicense[] = await fetchLicenses(callCluster, clusters, esIndexPattern);
-      if (licenses.length === 0) {
-        logger.warn(`No license found for ${ALERT_TYPE_LICENSE_EXPIRATION}.`);
+      if (!preparedAlert) {
         return state;
       }
 
-      const uiSettings = (await getUiSettingsService()).asScopedToClient(
-        services.savedObjectsClient
-      );
-      const dateFormat: string = await uiSettings.get<string>('dateFormat');
-      const timezone: string = await uiSettings.get<string>('dateFormat:tz');
-      const emailAddress = await fetchDefaultEmailAddress(uiSettings);
-      if (!emailAddress) {
-        // TODO: we can do more here
-        logger.warn(
-          `Unable to send email for ${ALERT_TYPE_LICENSE_EXPIRATION} because there is no email configured.`
-        );
-        return;
-      }
+      const { emailAddress, data: licenses, clusters, dateFormat } = preparedAlert;
 
-      const result: AlertState = { ...state };
+      const result: AlertCommonState = { ...state };
+      const defaultAlertState: AlertLicensePerClusterState = {
+        expiredCheckDateMS: 0,
+        ui: {
+          isFiring: false,
+          message: null,
+          severity: 0,
+          resolvedMS: 0,
+          lastCheckedMS: 0,
+          triggeredMS: 0,
+        },
+      };
 
       for (const license of licenses) {
-        const licenseState: AlertClusterState = state[license.clusterUuid] || {};
+        const alertState: AlertLicensePerClusterState =
+          (state[license.clusterUuid] as AlertLicensePerClusterState) || defaultAlertState;
+        const cluster = clusters.find(
+          (c: AlertCommonCluster) => c.clusterUuid === license.clusterUuid
+        );
+        if (!cluster) {
+          logger.warn(`Unable to find cluster for clusterUuid='${license.clusterUuid}'`);
+          continue;
+        }
         const $expiry = moment.utc(license.expiryDateMS);
         let isExpired = false;
         let severity = 0;
@@ -123,31 +107,26 @@ export const getLicenseExpiration = (
           }
         }
 
-        const ui: AlertClusterUiState = get<AlertClusterUiState>(licenseState, 'ui', {
-          isFiring: false,
-          message: null,
-          severity: 0,
-          resolvedMS: 0,
-          expirationTime: 0,
-        });
+        const ui = alertState.ui;
+        let triggered = ui.triggeredMS;
         let resolved = ui.resolvedMS;
         let message = ui.message;
-        let expiredCheckDate = licenseState.expiredCheckDateMS;
+        let expiredCheckDate = alertState.expiredCheckDateMS;
         const instance = services.alertInstanceFactory(ALERT_TYPE_LICENSE_EXPIRATION);
 
         if (isExpired) {
-          if (!licenseState.expiredCheckDateMS) {
+          if (!alertState.expiredCheckDateMS) {
             logger.debug(`License will expire soon, sending email`);
-            executeActions(instance, license, $expiry, dateFormat, emailAddress);
-            expiredCheckDate = moment().valueOf();
+            executeActions(instance, cluster, $expiry, dateFormat, emailAddress);
+            expiredCheckDate = triggered = moment().valueOf();
           }
-          message = getUiMessage(license, timezone);
+          message = getUiMessage();
           resolved = 0;
-        } else if (!isExpired && licenseState.expiredCheckDateMS) {
+        } else if (!isExpired && alertState.expiredCheckDateMS) {
           logger.debug(`License expiration has been resolved, sending email`);
-          executeActions(instance, license, $expiry, dateFormat, emailAddress, true);
+          executeActions(instance, cluster, $expiry, dateFormat, emailAddress, true);
           expiredCheckDate = 0;
-          message = getUiMessage(license, timezone, true);
+          message = getUiMessage(true);
           resolved = moment().valueOf();
         }
 
@@ -159,8 +138,10 @@ export const getLicenseExpiration = (
             isFiring: expiredCheckDate > 0,
             severity,
             resolvedMS: resolved,
-          },
-        };
+            triggeredMS: triggered,
+            lastCheckedMS: moment().valueOf(),
+          } as AlertLicensePerClusterUiState,
+        } as AlertLicensePerClusterState;
       }
 
       return result;
diff --git a/x-pack/plugins/monitoring/server/alerts/types.d.ts b/x-pack/plugins/monitoring/server/alerts/types.d.ts
index ff47d6f2ad4dc..b689d008b51a7 100644
--- a/x-pack/plugins/monitoring/server/alerts/types.d.ts
+++ b/x-pack/plugins/monitoring/server/alerts/types.d.ts
@@ -5,41 +5,79 @@
  */
 import { Moment } from 'moment';
 import { AlertExecutorOptions } from '../../../alerting/server';
+import { AlertClusterStateState, AlertCommonPerClusterMessageTokenType } from './enums';
 
 export interface AlertLicense {
   status: string;
   type: string;
   expiryDateMS: number;
   clusterUuid: string;
-  clusterName: string;
 }
 
-export interface AlertState {
-  [clusterUuid: string]: AlertClusterState;
+export interface AlertClusterState {
+  state: AlertClusterStateState;
+  clusterUuid: string;
+}
+
+export interface AlertCommonState {
+  [clusterUuid: string]: AlertCommonPerClusterState;
 }
 
-export interface AlertClusterState {
-  expiredCheckDateMS: number | Moment;
-  ui: AlertClusterUiState;
+export interface AlertCommonPerClusterState {
+  ui: AlertCommonPerClusterUiState;
 }
 
-export interface AlertClusterUiState {
+export interface AlertClusterStatePerClusterState extends AlertCommonPerClusterState {
+  state: AlertClusterStateState;
+}
+
+export interface AlertLicensePerClusterState extends AlertCommonPerClusterState {
+  expiredCheckDateMS: number;
+}
+
+export interface AlertCommonPerClusterUiState {
   isFiring: boolean;
   severity: number;
-  message: string | null;
+  message: AlertCommonPerClusterMessage | null;
   resolvedMS: number;
+  lastCheckedMS: number;
+  triggeredMS: number;
+}
+
+export interface AlertCommonPerClusterMessage {
+  text: string; // Do this. #link this is a link #link
+  tokens?: AlertCommonPerClusterMessageToken[];
+}
+
+export interface AlertCommonPerClusterMessageToken {
+  startToken: string;
+  endToken?: string;
+  type: AlertCommonPerClusterMessageTokenType;
+}
+
+export interface AlertCommonPerClusterMessageLinkToken extends AlertCommonPerClusterMessageToken {
+  url?: string;
+}
+
+export interface AlertCommonPerClusterMessageTimeToken extends AlertCommonPerClusterMessageToken {
+  isRelative: boolean;
+  isAbsolute: boolean;
+}
+
+export interface AlertLicensePerClusterUiState extends AlertCommonPerClusterUiState {
   expirationTime: number;
 }
 
-export interface AlertCluster {
+export interface AlertCommonCluster {
   clusterUuid: string;
+  clusterName: string;
 }
 
-export interface LicenseExpirationAlertExecutorOptions extends AlertExecutorOptions {
-  state: AlertState;
+export interface AlertCommonExecutorOptions extends AlertExecutorOptions {
+  state: AlertCommonState;
 }
 
-export interface AlertParams {
+export interface AlertCommonParams {
   dateFormat: string;
   timezone: string;
 }
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.test.ts
new file mode 100644
index 0000000000000..81e375734cc50
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.test.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { executeActions, getUiMessage } from './cluster_state.lib';
+import { AlertClusterStateState } from '../../alerts/enums';
+import { AlertCommonPerClusterMessageLinkToken } from '../../alerts/types';
+
+describe('clusterState lib', () => {
+  describe('executeActions', () => {
+    const clusterName = 'clusterA';
+    const instance: any = { scheduleActions: jest.fn() };
+    const license: any = { clusterName };
+    const status = AlertClusterStateState.Green;
+    const emailAddress = 'test@test.com';
+
+    beforeEach(() => {
+      instance.scheduleActions.mockClear();
+    });
+
+    it('should schedule actions when firing', () => {
+      executeActions(instance, license, status, emailAddress, false);
+      expect(instance.scheduleActions).toHaveBeenCalledWith('default', {
+        subject: 'NEW X-Pack Monitoring: Cluster Status',
+        message: `Allocate missing replica shards for cluster '${clusterName}'`,
+        to: emailAddress,
+      });
+    });
+
+    it('should have a different message for red state', () => {
+      executeActions(instance, license, AlertClusterStateState.Red, emailAddress, false);
+      expect(instance.scheduleActions).toHaveBeenCalledWith('default', {
+        subject: 'NEW X-Pack Monitoring: Cluster Status',
+        message: `Allocate missing primary and replica shards for cluster '${clusterName}'`,
+        to: emailAddress,
+      });
+    });
+
+    it('should schedule actions when resolved', () => {
+      executeActions(instance, license, status, emailAddress, true);
+      expect(instance.scheduleActions).toHaveBeenCalledWith('default', {
+        subject: 'RESOLVED X-Pack Monitoring: Cluster Status',
+        message: `This cluster alert has been resolved: Allocate missing replica shards for cluster '${clusterName}'`,
+        to: emailAddress,
+      });
+    });
+  });
+
+  describe('getUiMessage', () => {
+    it('should return a message when firing', () => {
+      const message = getUiMessage(AlertClusterStateState.Red, false);
+      expect(message.text).toBe(
+        `Elasticsearch cluster status is red. #start_linkAllocate missing primary and replica shards#end_link`
+      );
+      expect(message.tokens && message.tokens.length).toBe(1);
+      expect(message.tokens && message.tokens[0].startToken).toBe('#start_link');
+      expect(message.tokens && message.tokens[0].endToken).toBe('#end_link');
+      expect(
+        message.tokens && (message.tokens[0] as AlertCommonPerClusterMessageLinkToken).url
+      ).toBe('elasticsearch/indices');
+    });
+
+    it('should return a message when resolved', () => {
+      const message = getUiMessage(AlertClusterStateState.Green, true);
+      expect(message.text).toBe(`Elasticsearch cluster status is green.`);
+      expect(message.tokens).not.toBeDefined();
+    });
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.ts b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.ts
new file mode 100644
index 0000000000000..ae66d603507ca
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+import { AlertInstance } from '../../../../alerting/server';
+import {
+  AlertCommonCluster,
+  AlertCommonPerClusterMessage,
+  AlertCommonPerClusterMessageLinkToken,
+} from '../../alerts/types';
+import { AlertClusterStateState, AlertCommonPerClusterMessageTokenType } from '../../alerts/enums';
+
+const RESOLVED_SUBJECT = i18n.translate('xpack.monitoring.alerts.clusterStatus.resolvedSubject', {
+  defaultMessage: 'RESOLVED X-Pack Monitoring: Cluster Status',
+});
+
+const NEW_SUBJECT = i18n.translate('xpack.monitoring.alerts.clusterStatus.newSubject', {
+  defaultMessage: 'NEW X-Pack Monitoring: Cluster Status',
+});
+
+const RED_STATUS_MESSAGE = i18n.translate('xpack.monitoring.alerts.clusterStatus.redMessage', {
+  defaultMessage: 'Allocate missing primary and replica shards',
+});
+
+const YELLOW_STATUS_MESSAGE = i18n.translate(
+  'xpack.monitoring.alerts.clusterStatus.yellowMessage',
+  {
+    defaultMessage: 'Allocate missing replica shards',
+  }
+);
+
+export function executeActions(
+  instance: AlertInstance,
+  cluster: AlertCommonCluster,
+  status: AlertClusterStateState,
+  emailAddress: string,
+  resolved: boolean = false
+) {
+  const message =
+    status === AlertClusterStateState.Red ? RED_STATUS_MESSAGE : YELLOW_STATUS_MESSAGE;
+  if (resolved) {
+    instance.scheduleActions('default', {
+      subject: RESOLVED_SUBJECT,
+      message: `This cluster alert has been resolved: ${message} for cluster '${cluster.clusterName}'`,
+      to: emailAddress,
+    });
+  } else {
+    instance.scheduleActions('default', {
+      subject: NEW_SUBJECT,
+      message: `${message} for cluster '${cluster.clusterName}'`,
+      to: emailAddress,
+    });
+  }
+}
+
+export function getUiMessage(
+  status: AlertClusterStateState,
+  resolved: boolean = false
+): AlertCommonPerClusterMessage {
+  if (resolved) {
+    return {
+      text: i18n.translate('xpack.monitoring.alerts.clusterStatus.ui.resolvedMessage', {
+        defaultMessage: `Elasticsearch cluster status is green.`,
+      }),
+    };
+  }
+  const message =
+    status === AlertClusterStateState.Red ? RED_STATUS_MESSAGE : YELLOW_STATUS_MESSAGE;
+  return {
+    text: i18n.translate('xpack.monitoring.alerts.clusterStatus.ui.firingMessage', {
+      defaultMessage: `Elasticsearch cluster status is {status}. #start_link{message}#end_link`,
+      values: {
+        status,
+        message,
+      },
+    }),
+    tokens: [
+      {
+        startToken: '#start_link',
+        endToken: '#end_link',
+        type: AlertCommonPerClusterMessageTokenType.Link,
+        url: 'elasticsearch/indices',
+      } as AlertCommonPerClusterMessageLinkToken,
+    ],
+  };
+}
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.test.ts
new file mode 100644
index 0000000000000..642ae3c39a027
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { fetchClusterState } from './fetch_cluster_state';
+
+describe('fetchClusterState', () => {
+  it('should return the cluster state', async () => {
+    const status = 'green';
+    const clusterUuid = 'sdfdsaj34434';
+    const callCluster = jest.fn(() => ({
+      hits: {
+        hits: [
+          {
+            _source: {
+              cluster_state: {
+                status,
+              },
+              cluster_uuid: clusterUuid,
+            },
+          },
+        ],
+      },
+    }));
+
+    const clusters = [{ clusterUuid, clusterName: 'foo' }];
+    const index = '.monitoring-es-*';
+
+    const state = await fetchClusterState(callCluster, clusters, index);
+    expect(state).toEqual([
+      {
+        state: status,
+        clusterUuid,
+      },
+    ]);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.ts
new file mode 100644
index 0000000000000..66ea30d5f2e96
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { get } from 'lodash';
+import { AlertCommonCluster, AlertClusterState } from '../../alerts/types';
+
+export async function fetchClusterState(
+  callCluster: any,
+  clusters: AlertCommonCluster[],
+  index: string
+): Promise<AlertClusterState[]> {
+  const params = {
+    index,
+    filterPath: ['hits.hits._source.cluster_state.status', 'hits.hits._source.cluster_uuid'],
+    body: {
+      size: 1,
+      sort: [{ timestamp: { order: 'desc' } }],
+      query: {
+        bool: {
+          filter: [
+            {
+              terms: {
+                cluster_uuid: clusters.map(cluster => cluster.clusterUuid),
+              },
+            },
+            {
+              term: {
+                type: 'cluster_stats',
+              },
+            },
+            {
+              range: {
+                timestamp: {
+                  gte: 'now-2m',
+                },
+              },
+            },
+          ],
+        },
+      },
+    },
+  };
+
+  const response = await callCluster('search', params);
+  return get<any>(response, 'hits.hits', []).map((hit: any) => {
+    return {
+      state: get(hit, '_source.cluster_state.status'),
+      clusterUuid: get(hit, '_source.cluster_uuid'),
+    };
+  });
+}
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts
index 78eb9773df15f..7a9b61f37707b 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts
@@ -6,21 +6,51 @@
 import { fetchClusters } from './fetch_clusters';
 
 describe('fetchClusters', () => {
+  const clusterUuid = '1sdfds734';
+  const clusterName = 'monitoring';
+
   it('return a list of clusters', async () => {
     const callCluster = jest.fn().mockImplementation(() => ({
-      aggregations: {
-        clusters: {
-          buckets: [
-            {
-              key: 'clusterA',
+      hits: {
+        hits: [
+          {
+            _source: {
+              cluster_uuid: clusterUuid,
+              cluster_name: clusterName,
+            },
+          },
+        ],
+      },
+    }));
+    const index = '.monitoring-es-*';
+    const result = await fetchClusters(callCluster, index);
+    expect(result).toEqual([{ clusterUuid, clusterName }]);
+  });
+
+  it('return the metadata name if available', async () => {
+    const metadataName = 'custom-monitoring';
+    const callCluster = jest.fn().mockImplementation(() => ({
+      hits: {
+        hits: [
+          {
+            _source: {
+              cluster_uuid: clusterUuid,
+              cluster_name: clusterName,
+              cluster_settings: {
+                cluster: {
+                  metadata: {
+                    display_name: metadataName,
+                  },
+                },
+              },
             },
-          ],
-        },
+          },
+        ],
       },
     }));
     const index = '.monitoring-es-*';
     const result = await fetchClusters(callCluster, index);
-    expect(result).toEqual([{ clusterUuid: 'clusterA' }]);
+    expect(result).toEqual([{ clusterUuid, clusterName: metadataName }]);
   });
 
   it('should limit the time period in the query', async () => {
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts
index 8ef7339618a2c..d1513ac16fb15 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts
@@ -4,18 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { get } from 'lodash';
-import { AlertCluster } from '../../alerts/types';
+import { AlertCommonCluster } from '../../alerts/types';
 
-interface AggregationResult {
-  key: string;
-}
-
-export async function fetchClusters(callCluster: any, index: string): Promise<AlertCluster[]> {
+export async function fetchClusters(
+  callCluster: any,
+  index: string
+): Promise<AlertCommonCluster[]> {
   const params = {
     index,
-    filterPath: 'aggregations.clusters.buckets',
+    filterPath: [
+      'hits.hits._source.cluster_settings.cluster.metadata.display_name',
+      'hits.hits._source.cluster_uuid',
+      'hits.hits._source.cluster_name',
+    ],
     body: {
-      size: 0,
+      size: 1000,
       query: {
         bool: {
           filter: [
@@ -34,19 +37,21 @@ export async function fetchClusters(callCluster: any, index: string): Promise<Al
           ],
         },
       },
-      aggs: {
-        clusters: {
-          terms: {
-            field: 'cluster_uuid',
-            size: 1000,
-          },
-        },
+      collapse: {
+        field: 'cluster_uuid',
       },
     },
   };
 
   const response = await callCluster('search', params);
-  return get(response, 'aggregations.clusters.buckets', []).map((bucket: AggregationResult) => ({
-    clusterUuid: bucket.key,
-  }));
+  return get(response, 'hits.hits', []).map((hit: any) => {
+    const clusterName: string =
+      get(hit, '_source.cluster_settings.cluster.metadata.display_name') ||
+      get(hit, '_source.cluster_name') ||
+      get(hit, '_source.cluster_uuid');
+    return {
+      clusterUuid: get(hit, '_source.cluster_uuid'),
+      clusterName,
+    };
+  });
 }
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts
index dd6c074e68b1f..9dcb4ffb82a5f 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts
@@ -6,28 +6,28 @@
 import { fetchLicenses } from './fetch_licenses';
 
 describe('fetchLicenses', () => {
+  const clusterName = 'MyCluster';
+  const clusterUuid = 'clusterA';
+  const license = {
+    status: 'active',
+    expiry_date_in_millis: 1579532493876,
+    type: 'basic',
+  };
+
   it('return a list of licenses', async () => {
-    const clusterName = 'MyCluster';
-    const clusterUuid = 'clusterA';
-    const license = {
-      status: 'active',
-      expiry_date_in_millis: 1579532493876,
-      type: 'basic',
-    };
     const callCluster = jest.fn().mockImplementation(() => ({
       hits: {
         hits: [
           {
             _source: {
               license,
-              cluster_name: clusterName,
               cluster_uuid: clusterUuid,
             },
           },
         ],
       },
     }));
-    const clusters = [{ clusterUuid }];
+    const clusters = [{ clusterUuid, clusterName }];
     const index = '.monitoring-es-*';
     const result = await fetchLicenses(callCluster, clusters, index);
     expect(result).toEqual([
@@ -36,15 +36,13 @@ describe('fetchLicenses', () => {
         type: license.type,
         expiryDateMS: license.expiry_date_in_millis,
         clusterUuid,
-        clusterName,
       },
     ]);
   });
 
   it('should only search for the clusters provided', async () => {
-    const clusterUuid = 'clusterA';
     const callCluster = jest.fn();
-    const clusters = [{ clusterUuid }];
+    const clusters = [{ clusterUuid, clusterName }];
     const index = '.monitoring-es-*';
     await fetchLicenses(callCluster, clusters, index);
     const params = callCluster.mock.calls[0][1];
@@ -52,54 +50,11 @@ describe('fetchLicenses', () => {
   });
 
   it('should limit the time period in the query', async () => {
-    const clusterUuid = 'clusterA';
     const callCluster = jest.fn();
-    const clusters = [{ clusterUuid }];
+    const clusters = [{ clusterUuid, clusterName }];
     const index = '.monitoring-es-*';
     await fetchLicenses(callCluster, clusters, index);
     const params = callCluster.mock.calls[0][1];
     expect(params.body.query.bool.filter[2].range.timestamp.gte).toBe('now-2m');
   });
-
-  it('should give priority to the metadata name', async () => {
-    const clusterName = 'MyCluster';
-    const clusterUuid = 'clusterA';
-    const license = {
-      status: 'active',
-      expiry_date_in_millis: 1579532493876,
-      type: 'basic',
-    };
-    const callCluster = jest.fn().mockImplementation(() => ({
-      hits: {
-        hits: [
-          {
-            _source: {
-              license,
-              cluster_name: 'fakeName',
-              cluster_uuid: clusterUuid,
-              cluster_settings: {
-                cluster: {
-                  metadata: {
-                    display_name: clusterName,
-                  },
-                },
-              },
-            },
-          },
-        ],
-      },
-    }));
-    const clusters = [{ clusterUuid }];
-    const index = '.monitoring-es-*';
-    const result = await fetchLicenses(callCluster, clusters, index);
-    expect(result).toEqual([
-      {
-        status: license.status,
-        type: license.type,
-        expiryDateMS: license.expiry_date_in_millis,
-        clusterUuid,
-        clusterName,
-      },
-    ]);
-  });
 });
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts
index 31a68e8aa9c3e..5b05c907e796e 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts
@@ -4,21 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { get } from 'lodash';
-import { AlertLicense, AlertCluster } from '../../alerts/types';
+import { AlertLicense, AlertCommonCluster } from '../../alerts/types';
 
 export async function fetchLicenses(
   callCluster: any,
-  clusters: AlertCluster[],
+  clusters: AlertCommonCluster[],
   index: string
 ): Promise<AlertLicense[]> {
   const params = {
     index,
-    filterPath: [
-      'hits.hits._source.license.*',
-      'hits.hits._source.cluster_settings.cluster.metadata.display_name',
-      'hits.hits._source.cluster_uuid',
-      'hits.hits._source.cluster_name',
-    ],
+    filterPath: ['hits.hits._source.license.*', 'hits.hits._source.cluster_uuid'],
     body: {
       size: 1,
       sort: [{ timestamp: { order: 'desc' } }],
@@ -50,17 +45,12 @@ export async function fetchLicenses(
 
   const response = await callCluster('search', params);
   return get<any>(response, 'hits.hits', []).map((hit: any) => {
-    const clusterName: string =
-      get(hit, '_source.cluster_settings.cluster.metadata.display_name') ||
-      get(hit, '_source.cluster_name') ||
-      get(hit, '_source.cluster_uuid');
     const rawLicense: any = get(hit, '_source.license', {});
     const license: AlertLicense = {
       status: rawLicense.status,
       type: rawLicense.type,
       expiryDateMS: rawLicense.expiry_date_in_millis,
       clusterUuid: get(hit, '_source.cluster_uuid'),
-      clusterName,
     };
     return license;
   });
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.test.ts
new file mode 100644
index 0000000000000..a3bcb61afacd6
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.test.ts
@@ -0,0 +1,122 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { fetchStatus } from './fetch_status';
+import { AlertCommonPerClusterState } from '../../alerts/types';
+
+describe('fetchStatus', () => {
+  const alertType = 'monitoringTest';
+  const log = { warn: jest.fn() };
+  const start = 0;
+  const end = 0;
+  const id = 1;
+  const defaultUiState = {
+    isFiring: false,
+    severity: 0,
+    message: null,
+    resolvedMS: 0,
+    lastCheckedMS: 0,
+    triggeredMS: 0,
+  };
+  const alertsClient = {
+    find: jest.fn(() => ({
+      total: 1,
+      data: [
+        {
+          id,
+        },
+      ],
+    })),
+    getAlertState: jest.fn(() => ({
+      alertTypeState: {
+        state: {
+          ui: defaultUiState,
+        } as AlertCommonPerClusterState,
+      },
+    })),
+  };
+
+  afterEach(() => {
+    (alertsClient.find as jest.Mock).mockClear();
+    (alertsClient.getAlertState as jest.Mock).mockClear();
+  });
+
+  it('should fetch from the alerts client', async () => {
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status).toEqual([]);
+  });
+
+  it('should return alerts that are firing', async () => {
+    alertsClient.getAlertState = jest.fn(() => ({
+      alertTypeState: {
+        state: {
+          ui: {
+            ...defaultUiState,
+            isFiring: true,
+          },
+        } as AlertCommonPerClusterState,
+      },
+    }));
+
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status.length).toBe(1);
+    expect(status[0].type).toBe(alertType);
+    expect(status[0].isFiring).toBe(true);
+  });
+
+  it('should return alerts that have been resolved in the time period', async () => {
+    alertsClient.getAlertState = jest.fn(() => ({
+      alertTypeState: {
+        state: {
+          ui: {
+            ...defaultUiState,
+            resolvedMS: 1500,
+          },
+        } as AlertCommonPerClusterState,
+      },
+    }));
+
+    const customStart = 1000;
+    const customEnd = 2000;
+
+    const status = await fetchStatus(
+      alertsClient as any,
+      [alertType],
+      customStart,
+      customEnd,
+      log as any
+    );
+    expect(status.length).toBe(1);
+    expect(status[0].type).toBe(alertType);
+    expect(status[0].isFiring).toBe(false);
+  });
+
+  it('should pass in the right filter to the alerts client', async () => {
+    await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect((alertsClient.find as jest.Mock).mock.calls[0][0].options.filter).toBe(
+      `alert.attributes.alertTypeId:${alertType}`
+    );
+  });
+
+  it('should return nothing if no alert state is found', async () => {
+    alertsClient.getAlertState = jest.fn(() => ({
+      alertTypeState: null,
+    })) as any;
+
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status).toEqual([]);
+  });
+
+  it('should return nothing if no alerts are found', async () => {
+    alertsClient.find = jest.fn(() => ({
+      total: 0,
+      data: [],
+    })) as any;
+
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status).toEqual([]);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts
index 9f7c1d5a994d2..bf6ee965d3b2f 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts
@@ -4,81 +4,53 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import moment from 'moment';
-import { get } from 'lodash';
-import { AlertClusterState } from '../../alerts/types';
-import { ALERT_TYPES, LOGGING_TAG } from '../../../common/constants';
+import { Logger } from '../../../../../../src/core/server';
+import { AlertCommonPerClusterState } from '../../alerts/types';
+import { AlertsClient } from '../../../../alerting/server';
 
 export async function fetchStatus(
-  callCluster: any,
+  alertsClient: AlertsClient,
+  alertTypes: string[],
   start: number,
   end: number,
-  clusterUuid: string,
-  server: any
+  log: Logger
 ): Promise<any[]> {
-  // TODO: this shouldn't query task manager directly but rather
-  // use an api exposed by the alerting/actions plugin
-  // See https://github.com/elastic/kibana/issues/48442
   const statuses = await Promise.all(
-    ALERT_TYPES.map(
+    alertTypes.map(
       type =>
         new Promise(async (resolve, reject) => {
-          try {
-            const params = {
-              index: '.kibana_task_manager',
-              filterPath: ['hits.hits._source.task.state'],
-              body: {
-                size: 1,
-                sort: [{ updated_at: { order: 'desc' } }],
-                query: {
-                  bool: {
-                    filter: [
-                      {
-                        term: {
-                          'task.taskType': `alerting:${type}`,
-                        },
-                      },
-                    ],
-                  },
-                },
-              },
-            };
-
-            const response = await callCluster('search', params);
-            const state = get(response, 'hits.hits[0]._source.task.state', '{}');
-            const clusterState: AlertClusterState = get<AlertClusterState>(
-              JSON.parse(state),
-              `alertTypeState.${clusterUuid}`,
-              {
-                expiredCheckDateMS: 0,
-                ui: {
-                  isFiring: false,
-                  message: null,
-                  severity: 0,
-                  resolvedMS: 0,
-                  expirationTime: 0,
-                },
-              }
-            );
-            const isInBetween = moment(clusterState.ui.resolvedMS).isBetween(start, end);
-            if (clusterState.ui.isFiring || isInBetween) {
-              return resolve({
-                type,
-                ...clusterState.ui,
-              });
-            }
+          // We need to get the id from the alertTypeId
+          const alerts = await alertsClient.find({
+            options: {
+              filter: `alert.attributes.alertTypeId:${type}`,
+            },
+          });
+          if (alerts.total === 0) {
             return resolve(false);
-          } catch (err) {
-            const reason = get(err, 'body.error.type');
-            if (reason === 'index_not_found_exception') {
-              server.log(
-                ['error', LOGGING_TAG],
-                `Unable to fetch alerts. Alerts depends on task manager, which has not been started yet.`
-              );
-            } else {
-              server.log(['error', LOGGING_TAG], err.message);
-            }
+          }
+
+          if (alerts.total !== 1) {
+            log.warn(`Found more than one alert for type ${type} which is unexpected.`);
+          }
+
+          const id = alerts.data[0].id;
+
+          // Now that we have the id, we can get the state
+          const states = await alertsClient.getAlertState({ id });
+          if (!states || !states.alertTypeState) {
+            log.warn(`No alert states found for type ${type} which is unexpected.`);
             return resolve(false);
           }
+
+          const state = Object.values(states.alertTypeState)[0] as AlertCommonPerClusterState;
+          const isInBetween = moment(state.ui.resolvedMS).isBetween(start, end);
+          if (state.ui.isFiring || isInBetween) {
+            return resolve({
+              type,
+              ...state.ui,
+            });
+          }
+          return resolve(false);
         })
     )
   );
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.test.ts
new file mode 100644
index 0000000000000..1840a2026a753
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.test.ts
@@ -0,0 +1,163 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getPreparedAlert } from './get_prepared_alert';
+import { fetchClusters } from './fetch_clusters';
+import { fetchDefaultEmailAddress } from './fetch_default_email_address';
+
+jest.mock('./fetch_clusters', () => ({
+  fetchClusters: jest.fn(),
+}));
+
+jest.mock('./fetch_default_email_address', () => ({
+  fetchDefaultEmailAddress: jest.fn(),
+}));
+
+describe('getPreparedAlert', () => {
+  const uiSettings = { get: jest.fn() };
+  const alertType = 'test';
+  const getUiSettingsService = async () => ({
+    asScopedToClient: () => uiSettings,
+  });
+  const monitoringCluster = null;
+  const logger = { warn: jest.fn() };
+  const ccsEnabled = false;
+  const services = {
+    callCluster: jest.fn(),
+    savedObjectsClient: null,
+  };
+  const emailAddress = 'foo@foo.com';
+  const data = [{ foo: 1 }];
+  const dataFetcher = () => data;
+  const clusterName = 'MonitoringCluster';
+  const clusterUuid = 'sdf34sdf';
+  const clusters = [{ clusterName, clusterUuid }];
+
+  afterEach(() => {
+    (uiSettings.get as jest.Mock).mockClear();
+    (services.callCluster as jest.Mock).mockClear();
+    (fetchClusters as jest.Mock).mockClear();
+    (fetchDefaultEmailAddress as jest.Mock).mockClear();
+  });
+
+  beforeEach(() => {
+    (fetchClusters as jest.Mock).mockImplementation(() => clusters);
+    (fetchDefaultEmailAddress as jest.Mock).mockImplementation(() => emailAddress);
+  });
+
+  it('should return fields as expected', async () => {
+    (uiSettings.get as jest.Mock).mockImplementation(() => {
+      return emailAddress;
+    });
+
+    const alert = await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      ccsEnabled,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect(alert && alert.emailAddress).toBe(emailAddress);
+    expect(alert && alert.data).toBe(data);
+  });
+
+  it('should add ccs if specified', async () => {
+    const ccsClusterName = 'remoteCluster';
+    (services.callCluster as jest.Mock).mockImplementation(() => {
+      return {
+        [ccsClusterName]: {
+          connected: true,
+        },
+      };
+    });
+
+    await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect((fetchClusters as jest.Mock).mock.calls[0][1].includes(ccsClusterName)).toBe(true);
+  });
+
+  it('should ignore ccs if no remote clusters are available', async () => {
+    const ccsClusterName = 'remoteCluster';
+    (services.callCluster as jest.Mock).mockImplementation(() => {
+      return {
+        [ccsClusterName]: {
+          connected: false,
+        },
+      };
+    });
+
+    await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect((fetchClusters as jest.Mock).mock.calls[0][1].includes(ccsClusterName)).toBe(false);
+  });
+
+  it('should pass in the clusters into the data fetcher', async () => {
+    const customDataFetcher = jest.fn(() => data);
+
+    await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      customDataFetcher as any
+    );
+
+    expect((customDataFetcher as jest.Mock).mock.calls[0][1]).toBe(clusters);
+  });
+
+  it('should return nothing if the data fetcher returns nothing', async () => {
+    const customDataFetcher = jest.fn(() => []);
+
+    const result = await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      customDataFetcher as any
+    );
+
+    expect(result).toBe(null);
+  });
+
+  it('should return nothing if there is no email address', async () => {
+    (fetchDefaultEmailAddress as jest.Mock).mockImplementation(() => null);
+
+    const result = await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect(result).toBe(null);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.ts b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.ts
new file mode 100644
index 0000000000000..83a9e26e4c589
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Logger, ICustomClusterClient, UiSettingsServiceStart } from 'kibana/server';
+import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { AlertServices } from '../../../../alerting/server';
+import { AlertCommonCluster } from '../../alerts/types';
+import { INDEX_PATTERN_ELASTICSEARCH } from '../../../common/constants';
+import { fetchAvailableCcs } from './fetch_available_ccs';
+import { getCcsIndexPattern } from './get_ccs_index_pattern';
+import { fetchClusters } from './fetch_clusters';
+import { fetchDefaultEmailAddress } from './fetch_default_email_address';
+
+export interface PreparedAlert {
+  emailAddress: string;
+  clusters: AlertCommonCluster[];
+  data: any[];
+  timezone: string;
+  dateFormat: string;
+}
+
+async function getCallCluster(
+  monitoringCluster: ICustomClusterClient,
+  services: Pick<AlertServices, 'callCluster'>
+): Promise<any> {
+  if (!monitoringCluster) {
+    return services.callCluster;
+  }
+
+  return monitoringCluster.callAsInternalUser;
+}
+
+export async function getPreparedAlert(
+  alertType: string,
+  getUiSettingsService: () => Promise<UiSettingsServiceStart>,
+  monitoringCluster: ICustomClusterClient,
+  logger: Logger,
+  ccsEnabled: boolean,
+  services: Pick<AlertServices, 'callCluster' | 'savedObjectsClient'>,
+  dataFetcher: (
+    callCluster: CallCluster,
+    clusters: AlertCommonCluster[],
+    esIndexPattern: string
+  ) => Promise<any>
+): Promise<PreparedAlert | null> {
+  const callCluster = await getCallCluster(monitoringCluster, services);
+
+  // Support CCS use cases by querying to find available remote clusters
+  // and then adding those to the index pattern we are searching against
+  let esIndexPattern = INDEX_PATTERN_ELASTICSEARCH;
+  if (ccsEnabled) {
+    const availableCcs = await fetchAvailableCcs(callCluster);
+    if (availableCcs.length > 0) {
+      esIndexPattern = getCcsIndexPattern(esIndexPattern, availableCcs);
+    }
+  }
+
+  const clusters = await fetchClusters(callCluster, esIndexPattern);
+
+  // Fetch the specific data
+  const data = await dataFetcher(callCluster, clusters, esIndexPattern);
+  if (data.length === 0) {
+    logger.warn(`No data found for ${alertType}.`);
+    return null;
+  }
+
+  const uiSettings = (await getUiSettingsService()).asScopedToClient(services.savedObjectsClient);
+  const dateFormat: string = await uiSettings.get<string>('dateFormat');
+  const timezone: string = await uiSettings.get<string>('dateFormat:tz');
+  const emailAddress = await fetchDefaultEmailAddress(uiSettings);
+  if (!emailAddress) {
+    // TODO: we can do more here
+    logger.warn(`Unable to send email for ${alertType} because there is no email configured.`);
+    return null;
+  }
+
+  return {
+    emailAddress,
+    data,
+    clusters,
+    dateFormat,
+    timezone,
+  };
+}
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts
index 1a2eb1e44be84..6c0301b6cc347 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts
@@ -39,17 +39,26 @@ describe('licenseExpiration lib', () => {
   });
 
   describe('getUiMessage', () => {
-    const timezone = 'Europe/London';
-    const license: any = { expiryDateMS: moment.tz('2020-01-20 08:00:00', timezone).utc() };
-
     it('should return a message when firing', () => {
-      const message = getUiMessage(license, timezone, false);
-      expect(message).toBe(`This cluster's license is going to expire in #relative at #absolute.`);
+      const message = getUiMessage(false);
+      expect(message.text).toBe(
+        `This cluster's license is going to expire in #relative at #absolute. #start_linkPlease update your license#end_link`
+      );
+      // LOL How do I avoid this in TS????
+      if (!message.tokens) {
+        return expect(false).toBe(true);
+      }
+      expect(message.tokens.length).toBe(3);
+      expect(message.tokens[0].startToken).toBe('#relative');
+      expect(message.tokens[1].startToken).toBe('#absolute');
+      expect(message.tokens[2].startToken).toBe('#start_link');
+      expect(message.tokens[2].endToken).toBe('#end_link');
     });
 
     it('should return a message when resolved', () => {
-      const message = getUiMessage(license, timezone, true);
-      expect(message).toBe(`This cluster's license is active.`);
+      const message = getUiMessage(true);
+      expect(message.text).toBe(`This cluster's license is active.`);
+      expect(message.tokens).not.toBeDefined();
     });
   });
 });
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts
index 41b68d69bbd25..a590021a2f29b 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts
@@ -6,7 +6,13 @@
 import { Moment } from 'moment-timezone';
 import { i18n } from '@kbn/i18n';
 import { AlertInstance } from '../../../../alerting/server';
-import { AlertLicense } from '../../alerts/types';
+import {
+  AlertCommonPerClusterMessageLinkToken,
+  AlertCommonPerClusterMessageTimeToken,
+  AlertCommonCluster,
+  AlertCommonPerClusterMessage,
+} from '../../alerts/types';
+import { AlertCommonPerClusterMessageTokenType } from '../../alerts/enums';
 
 const RESOLVED_SUBJECT = i18n.translate(
   'xpack.monitoring.alerts.licenseExpiration.resolvedSubject',
@@ -21,7 +27,7 @@ const NEW_SUBJECT = i18n.translate('xpack.monitoring.alerts.licenseExpiration.ne
 
 export function executeActions(
   instance: AlertInstance,
-  license: AlertLicense,
+  cluster: AlertCommonCluster,
   $expiry: Moment,
   dateFormat: string,
   emailAddress: string,
@@ -31,14 +37,14 @@ export function executeActions(
     instance.scheduleActions('default', {
       subject: RESOLVED_SUBJECT,
       message: `This cluster alert has been resolved: Cluster '${
-        license.clusterName
+        cluster.clusterName
       }' license was going to expire on ${$expiry.format(dateFormat)}.`,
       to: emailAddress,
     });
   } else {
     instance.scheduleActions('default', {
       subject: NEW_SUBJECT,
-      message: `Cluster '${license.clusterName}' license is going to expire on ${$expiry.format(
+      message: `Cluster '${cluster.clusterName}' license is going to expire on ${$expiry.format(
         dateFormat
       )}. Please update your license.`,
       to: emailAddress,
@@ -46,13 +52,43 @@ export function executeActions(
   }
 }
 
-export function getUiMessage(license: AlertLicense, timezone: string, resolved: boolean = false) {
+export function getUiMessage(resolved: boolean = false): AlertCommonPerClusterMessage {
   if (resolved) {
-    return i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.resolvedMessage', {
-      defaultMessage: `This cluster's license is active.`,
-    });
+    return {
+      text: i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.resolvedMessage', {
+        defaultMessage: `This cluster's license is active.`,
+      }),
+    };
   }
-  return i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.firingMessage', {
-    defaultMessage: `This cluster's license is going to expire in #relative at #absolute.`,
+  const linkText = i18n.translate('xpack.monitoring.alerts.licenseExpiration.linkText', {
+    defaultMessage: 'Please update your license',
   });
+  return {
+    text: i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.firingMessage', {
+      defaultMessage: `This cluster's license is going to expire in #relative at #absolute. #start_link{linkText}#end_link`,
+      values: {
+        linkText,
+      },
+    }),
+    tokens: [
+      {
+        startToken: '#relative',
+        type: AlertCommonPerClusterMessageTokenType.Time,
+        isRelative: true,
+        isAbsolute: false,
+      } as AlertCommonPerClusterMessageTimeToken,
+      {
+        startToken: '#absolute',
+        type: AlertCommonPerClusterMessageTokenType.Time,
+        isAbsolute: true,
+        isRelative: false,
+      } as AlertCommonPerClusterMessageTimeToken,
+      {
+        startToken: '#start_link',
+        endToken: '#end_link',
+        type: AlertCommonPerClusterMessageTokenType.Link,
+        url: 'license',
+      } as AlertCommonPerClusterMessageLinkToken,
+    ],
+  };
 }
diff --git a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
index c5091c36c3bbe..1bddede52207b 100644
--- a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
+++ b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
@@ -29,6 +29,7 @@ import {
   CODE_PATH_BEATS,
   CODE_PATH_APM,
   KIBANA_ALERTING_ENABLED,
+  ALERT_TYPES,
 } from '../../../common/constants';
 import { getApmsForClusters } from '../apm/get_apms_for_clusters';
 import { i18n } from '@kbn/i18n';
@@ -102,15 +103,8 @@ export async function getClustersFromRequest(
 
     if (isInCodePath(codePaths, [CODE_PATH_ALERTS])) {
       if (KIBANA_ALERTING_ENABLED) {
-        const { callWithRequest } = req.server.plugins.elasticsearch.getCluster('monitoring');
-        const callCluster = (...args) => callWithRequest(req, ...args);
-        cluster.alerts = await fetchStatus(
-          callCluster,
-          start,
-          end,
-          cluster.cluster_uuid,
-          req.server
-        );
+        const alertsClient = req.getAlertsClient ? req.getAlertsClient() : null;
+        cluster.alerts = await fetchStatus(alertsClient, ALERT_TYPES, start, end, req.logger);
       } else {
         cluster.alerts = await alertsClusterSearch(
           req,
diff --git a/x-pack/plugins/monitoring/server/plugin.ts b/x-pack/plugins/monitoring/server/plugin.ts
index 24d8bcaa4397c..784226dca66fe 100644
--- a/x-pack/plugins/monitoring/server/plugin.ts
+++ b/x-pack/plugins/monitoring/server/plugin.ts
@@ -47,6 +47,7 @@ import {
   PluginSetupContract as AlertingPluginSetupContract,
 } from '../../alerting/server';
 import { getLicenseExpiration } from './alerts/license_expiration';
+import { getClusterState } from './alerts/cluster_state';
 import { InfraPluginSetup } from '../../infra/server';
 
 export interface LegacyAPI {
@@ -154,6 +155,17 @@ export class Plugin {
           config.ui.ccs.enabled
         )
       );
+      plugins.alerting.registerType(
+        getClusterState(
+          async () => {
+            const coreStart = (await core.getStartServices())[0];
+            return coreStart.uiSettings;
+          },
+          cluster,
+          this.getLogger,
+          config.ui.ccs.enabled
+        )
+      );
     }
 
     // Initialize telemetry
diff --git a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js
index 56922bd8e87e2..d5a43d32f600a 100644
--- a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js
+++ b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js
@@ -8,8 +8,12 @@ import { schema } from '@kbn/config-schema';
 import { isFunction } from 'lodash';
 import {
   ALERT_TYPE_LICENSE_EXPIRATION,
+  ALERT_TYPE_CLUSTER_STATE,
   MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS,
+  ALERT_TYPES,
 } from '../../../../../common/constants';
+import { handleError } from '../../../../lib/errors';
+import { fetchStatus } from '../../../../lib/alerts/fetch_status';
 
 async function createAlerts(req, alertsClient, { selectedEmailActionId }) {
   const createdAlerts = [];
@@ -17,7 +21,21 @@ async function createAlerts(req, alertsClient, { selectedEmailActionId }) {
   // Create alerts
   const ALERT_TYPES = {
     [ALERT_TYPE_LICENSE_EXPIRATION]: {
-      schedule: { interval: '10s' },
+      schedule: { interval: '1m' },
+      actions: [
+        {
+          group: 'default',
+          id: selectedEmailActionId,
+          params: {
+            subject: '{{context.subject}}',
+            message: `{{context.message}}`,
+            to: ['{{context.to}}'],
+          },
+        },
+      ],
+    },
+    [ALERT_TYPE_CLUSTER_STATE]: {
+      schedule: { interval: '1m' },
       actions: [
         {
           group: 'default',
@@ -86,4 +104,37 @@ export function createKibanaAlertsRoute(server) {
       return { alerts, emailResponse };
     },
   });
+
+  server.route({
+    method: 'POST',
+    path: '/api/monitoring/v1/alert_status',
+    config: {
+      validate: {
+        payload: schema.object({
+          timeRange: schema.object({
+            min: schema.string(),
+            max: schema.string(),
+          }),
+        }),
+      },
+    },
+    async handler(req, headers) {
+      const alertsClient = isFunction(req.getAlertsClient) ? req.getAlertsClient() : null;
+      if (!alertsClient) {
+        return headers.response().code(404);
+      }
+
+      const start = req.payload.timeRange.min;
+      const end = req.payload.timeRange.max;
+      let alerts;
+
+      try {
+        alerts = await fetchStatus(alertsClient, ALERT_TYPES, start, end, req.logger);
+      } catch (err) {
+        throw handleError(err, req);
+      }
+
+      return { alerts };
+    },
+  });
 }
diff --git a/x-pack/plugins/transform/public/app/components/pivot_preview/pivot_preview.tsx b/x-pack/plugins/transform/public/app/components/pivot_preview/pivot_preview.tsx
index c0c85f74418fc..c50df0366d698 100644
--- a/x-pack/plugins/transform/public/app/components/pivot_preview/pivot_preview.tsx
+++ b/x-pack/plugins/transform/public/app/components/pivot_preview/pivot_preview.tsx
@@ -245,6 +245,10 @@ export const PivotPreview: FC<PivotPreviewProps> = React.memo(
           return formatHumanReadableDateTimeSeconds(moment(cellValue).unix() * 1000);
         }
 
+        if (previewMappings.properties[columnId].type === ES_FIELD_TYPES.BOOLEAN) {
+          return cellValue ? 'true' : 'false';
+        }
+
         return cellValue;
       };
     }, [pageData, pagination.pageIndex, pagination.pageSize, previewMappings.properties]);
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/source_index_preview/source_index_preview.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/source_index_preview/source_index_preview.tsx
index c56263b721032..bcdeb7ddb0d36 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/source_index_preview/source_index_preview.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/source_index_preview/source_index_preview.tsx
@@ -105,6 +105,9 @@ export const SourceIndexPreview: React.FC<Props> = React.memo(({ indexPattern, q
       let schema;
 
       switch (field?.type) {
+        case KBN_FIELD_TYPES.BOOLEAN:
+          schema = 'boolean';
+          break;
         case KBN_FIELD_TYPES.DATE:
           schema = 'datetime';
           break;
@@ -190,6 +193,10 @@ export const SourceIndexPreview: React.FC<Props> = React.memo(({ indexPattern, q
         return formatHumanReadableDateTimeSeconds(moment(cellValue).unix() * 1000);
       }
 
+      if (field?.type === KBN_FIELD_TYPES.BOOLEAN) {
+        return cellValue ? 'true' : 'false';
+      }
+
       return cellValue;
     };
   }, [data, indexPattern.fields, pagination.pageIndex, pagination.pageSize]);
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 023a97274b957..79c1bbc49810b 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -13548,9 +13548,7 @@
     "xpack.siem.components.mlPopover.jobsTable.filters.searchFilterPlaceholder": "例: rare_process_linux",
     "xpack.siem.components.mlPopover.jobsTable.filters.showAllJobsLabel": "Elastic ジョブ",
     "xpack.siem.components.mlPopover.jobsTable.filters.showSiemJobsLabel": "カスタムジョブ",
-    "xpack.siem.components.mlPopup.anomalyDetectionButtonLabel": "異常検知",
     "xpack.siem.components.mlPopup.anomalyDetectionDescription": "下のいずれかの機械学習ジョブを実行して、SIEM アプリケーション全体の異常イベントを表示することができます。始めに使えるように、いくつかの一般的な検出ジョブが提供されています。独自のカスタムジョブを追加する場合は、{machineLearning} アプリケーションでジョブを作成して「SIEM」でタグ付けすると、ここに追加されます。",
-    "xpack.siem.components.mlPopup.anomalyDetectionTitle": "異常検知設定",
     "xpack.siem.components.mlPopup.cloudLink": "クラウド展開",
     "xpack.siem.components.mlPopup.errors.createJobFailureTitle": "ジョブ作成エラー",
     "xpack.siem.components.mlPopup.errors.startJobFailureTitle": "ジョブ開始エラー",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index b359014e95e70..77bf8f1467783 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -13552,9 +13552,7 @@
     "xpack.siem.components.mlPopover.jobsTable.filters.searchFilterPlaceholder": "例如 rare_process_linux",
     "xpack.siem.components.mlPopover.jobsTable.filters.showAllJobsLabel": "Elastic 作业",
     "xpack.siem.components.mlPopover.jobsTable.filters.showSiemJobsLabel": "定制作业",
-    "xpack.siem.components.mlPopup.anomalyDetectionButtonLabel": "异常检测",
     "xpack.siem.components.mlPopup.anomalyDetectionDescription": "运行以下任何 Machine Learning 作业以查看该 SIEM 应用程序的所有异常事件。我们提供若干可让您入门的常规检测作业。如果您希望添加自己的定制作业，只需从用于纳入定制作业的 {machineLearning} 应用程序中创建定制作业并使用“SIEM”标记它们。",
-    "xpack.siem.components.mlPopup.anomalyDetectionTitle": "异常检测设置",
     "xpack.siem.components.mlPopup.cloudLink": "云部署",
     "xpack.siem.components.mlPopup.errors.createJobFailureTitle": "创建作业失败",
     "xpack.siem.components.mlPopup.errors.startJobFailureTitle": "启动作业失败",
diff --git a/x-pack/test/api_integration/apis/fleet/agents/acks.ts b/x-pack/test/api_integration/apis/fleet/agents/acks.ts
index a2eba2c23c39d..f08ce33d8b60f 100644
--- a/x-pack/test/api_integration/apis/fleet/agents/acks.ts
+++ b/x-pack/test/api_integration/apis/fleet/agents/acks.ts
@@ -178,7 +178,7 @@ export default function(providerContext: FtrProviderContext) {
           ],
         })
         .expect(400);
-      expect(apiResponse.message).to.eql('all actions should belong to current agent');
+      expect(apiResponse.message).to.eql('One or more actions cannot be found');
     });
 
     it('should return a 400 when request event list contains action types that are not allowed for acknowledgement', async () => {
diff --git a/x-pack/test/api_integration/apis/fleet/agents/actions.ts b/x-pack/test/api_integration/apis/fleet/agents/actions.ts
index f27b932cff5cb..cf0641acf9e1c 100644
--- a/x-pack/test/api_integration/apis/fleet/agents/actions.ts
+++ b/x-pack/test/api_integration/apis/fleet/agents/actions.ts
@@ -28,28 +28,15 @@ export default function(providerContext: FtrProviderContext) {
         .send({
           action: {
             type: 'CONFIG_CHANGE',
-            data: 'action_data',
+            data: { data: 'action_data' },
             sent_at: '2020-03-18T19:45:02.620Z',
           },
         })
         .expect(200);
 
       expect(apiResponse.success).to.be(true);
-      expect(apiResponse.item.data).to.be('action_data');
+      expect(apiResponse.item.data).to.eql({ data: 'action_data' });
       expect(apiResponse.item.sent_at).to.be('2020-03-18T19:45:02.620Z');
-
-      const { body: agentResponse } = await supertest
-        .get(`/api/ingest_manager/fleet/agents/agent1`)
-        .set('kbn-xsrf', 'xx')
-        .expect(200);
-
-      const updatedAction = agentResponse.item.actions.find(
-        (itemAction: Record<string, string>) => itemAction?.data === 'action_data'
-      );
-
-      expect(updatedAction.type).to.be('CONFIG_CHANGE');
-      expect(updatedAction.data).to.be('action_data');
-      expect(updatedAction.sent_at).to.be('2020-03-18T19:45:02.620Z');
     });
 
     it('should return a 400 when request does not have type information', async () => {
@@ -58,7 +45,7 @@ export default function(providerContext: FtrProviderContext) {
         .set('kbn-xsrf', 'xx')
         .send({
           action: {
-            data: 'action_data',
+            data: { data: 'action_data' },
             sent_at: '2020-03-18T19:45:02.620Z',
           },
         })
@@ -75,7 +62,7 @@ export default function(providerContext: FtrProviderContext) {
         .send({
           action: {
             type: 'CONFIG_CHANGE',
-            data: 'action_data',
+            data: { data: 'action_data' },
             sent_at: '2020-03-18T19:45:02.620Z',
           },
         })
diff --git a/x-pack/test/functional/es_archives/fleet/agents/data.json b/x-pack/test/functional/es_archives/fleet/agents/data.json
index 9b29767d5162d..1ffb119ca1023 100644
--- a/x-pack/test/functional/es_archives/fleet/agents/data.json
+++ b/x-pack/test/functional/es_archives/fleet/agents/data.json
@@ -12,30 +12,7 @@
         "config_id": "1",
         "type": "PERMANENT",
         "local_metadata": "{}",
-        "user_provided_metadata": "{}",
-        "actions": [{
-          "id": "37ed51ff-e80f-4f2a-a62d-f4fa975e7d85",
-          "created_at": "2019-09-04T15:04:07+0000",
-          "type": "RESUME"
-        },
-        {
-          "id": "b400439c-bbbf-43d5-83cb-cf8b7e32506f",
-          "type": "PAUSE",
-          "created_at": "2019-09-04T15:01:07+0000",
-          "sent_at": "2019-09-04T15:03:07+0000"
-        },
-        {
-          "created_at" : "2020-03-15T03:47:15.129Z",
-          "id" : "48cebde1-c906-4893-b89f-595d943b72a1",
-          "type" : "CONFIG_CHANGE",
-          "sent_at": "2020-03-04T15:03:07+0000"
-        },
-        {
-          "created_at" : "2020-03-16T03:47:15.129Z",
-          "id" : "48cebde1-c906-4893-b89f-595d943b72a2",
-          "type" : "CONFIG_CHANGE",
-          "sent_at": "2020-03-04T15:03:07+0000"
-        }]
+        "user_provided_metadata": "{}"
       }
     }
   }
@@ -54,8 +31,7 @@
         "shared_id": "agent2_filebeat",
         "type": "PERMANENT",
         "local_metadata": "{}",
-        "user_provided_metadata": "{}",
-        "actions": []
+        "user_provided_metadata": "{}"
       }
     }
   }
@@ -74,8 +50,7 @@
         "shared_id": "agent3_metricbeat",
         "type": "PERMANENT",
         "local_metadata": "{}",
-        "user_provided_metadata": "{}",
-        "actions": []
+        "user_provided_metadata": "{}"
       }
     }
   }
@@ -94,8 +69,7 @@
         "shared_id": "agent4_metricbeat",
         "type": "PERMANENT",
         "local_metadata": "{}",
-        "user_provided_metadata": "{}",
-        "actions": []
+        "user_provided_metadata": "{}"
       }
     }
   }
@@ -157,3 +131,71 @@
     }
   }
 }
+
+{
+  "type": "doc",
+  "value": {
+    "id": "agent_actions:37ed51ff-e80f-4f2a-a62d-f4fa975e7d85",
+    "index": ".kibana",
+    "source": {
+      "type": "agent_actions",
+      "agent_actions": {
+        "agent_id": "agent1",
+        "created_at": "2019-09-04T15:04:07+0000",
+        "type": "RESUME",
+        "sent_at": "2019-09-04T15:03:07+0000"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "agent_actions:b400439c-bbbf-43d5-83cb-cf8b7e32506f",
+    "index": ".kibana",
+    "source": {
+      "type": "agent_actions",
+      "agent_actions": {
+        "agent_id": "agent1",
+        "type": "PAUSE",
+        "created_at": "2019-09-04T15:01:07+0000",
+        "sent_at": "2019-09-04T15:03:07+0000"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "agent_actions:48cebde1-c906-4893-b89f-595d943b72a1",
+    "index": ".kibana",
+    "source": {
+      "type": "agent_actions",
+      "agent_actions": {
+        "agent_id": "agent1",
+        "type": "CONFIG_CHANGE",
+        "created_at": "2020-03-15T03:47:15.129Z",
+        "sent_at": "2020-03-04T15:03:07+0000"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "agent_actions:48cebde1-c906-4893-b89f-595d943b72a2",
+    "index": ".kibana",
+    "source": {
+      "type": "agent_actions",
+      "agent_actions": {
+        "agent_id": "agent1",
+        "type": "CONFIG_CHANGE",
+        "created_at": "2020-03-15T03:47:15.129Z",
+        "sent_at": "2020-03-04T15:03:07+0000"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/fleet/agents/mappings.json b/x-pack/test/functional/es_archives/fleet/agents/mappings.json
index 0f632b7333ee7..31ae161049303 100644
--- a/x-pack/test/functional/es_archives/fleet/agents/mappings.json
+++ b/x-pack/test/functional/es_archives/fleet/agents/mappings.json
@@ -9,58 +9,168 @@
       "dynamic": "strict",
       "_meta": {
         "migrationMappingPropertyHashes": {
+          "outputs": "aee9782e0d500b867859650a36280165",
           "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
-          "server": "ec97f1c5da1a19609a60874e5af1100c",
           "visualization": "52d7a13ad68a150c4525b292d23e12cc",
           "references": "7997cf5a56cc02bdc9c93361bde732b0",
           "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
-          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
-          "policies": "1a096b98c98c2efebfdba77cefcfe54a",
           "type": "2f4316de49999235636386fe51dc06c1",
-          "lens": "21c3ea0763beb1ecb0162529706b88c5",
-          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
           "infrastructure-ui-source": "ddc0ecb18383f6b26101a2fadb2dab0c",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "application_usage_totals": "c897e4310c5f24b07caaff3db53ae2c1",
+          "action": "6e96ac5e648f57523879661ea72525b7",
+          "agent_configs": "38abaf89513877745c359e7700c0c66a",
+          "dashboard": "d00f614b29a80360e1190193fd333bab",
+          "metrics-explorer-view": "53c5365793677328df0ccb6138bf3cdd",
+          "siem-detection-engine-rule-actions": "90eee2e4635260f4be0a1da8f5bc0aa0",
+          "agent_events": "3231653fafe4ef3196fe3b32ab774bf2",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "application_usage_transactional": "965839e75f809fefe04f92dc4d99722a",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "inventory-view": "9ecce5b58867403613d82fe496470b34",
+          "enrollment_api_keys": "28b91e20b105b6f928e2012600085d8f",
+          "upgrade-assistant-reindex-operation": "a53a20fe086b72c9a86da3cc12dad8a6",
+          "cases-comments": "c2061fb929f585df57425102fa928b4b",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "datasources": "d4bc0c252b2b5683ff21ea32d00acffc",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "server": "ec97f1c5da1a19609a60874e5af1100c",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "lens": "21c3ea0763beb1ecb0162529706b88c5",
           "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
           "search": "181661168bbadd1eff5902361e2a0d5c",
           "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "cases-configure": "42711cbb311976c0687853f4c1354572",
           "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "alert": "7b44fba6773e37c806ce290ea9b7024e",
+          "siem-detection-engine-rule-status": "ae783f41c6937db6b7a2ef5c93a9e9b0",
           "map": "23d7aa4a720d4938ccde3983f87bd58d",
-          "dashboard": "d00f614b29a80360e1190193fd333bab",
-          "apm-services-telemetry": "07ee1939fa4302c62ddc052ec03fed90",
-          "metrics-explorer-view": "53c5365793677328df0ccb6138bf3cdd",
-          "epm": "abf5b64aa599932bd181efc86dce14a7",
-          "siem-ui-timeline": "6485ab095be8d15246667b98a1a34295",
-          "agent_events": "8060c5567d33f6697164e1fd5c81b8ed",
-          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
-          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "uptime-dynamic-settings": "b6289473c8985c79b6c47eebc19a0ca5",
+          "epm-package": "75d12cd13c867fd713d7dfb27366bc20",
+          "apm-telemetry": "3525d7c22c42bc80f5e6e9cb3f2b26a2",
+          "cases": "08b8b110dbca273d37e8aef131ecab61",
+          "siem-ui-timeline": "ac8020190f5950dd3250b6499144e7fb",
           "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
           "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
           "url": "c7f66a0df8b1b52f17c28c4adb111105",
-          "apm-indices": "c69b68f3fe2bf27b4788d4191c1d6011",
-          "agents": "1c8e942384219bd899f381fd40e407d7",
+          "agents": "c3eeb7b9d97176f15f6d126370ab23c7",
           "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
-          "inventory-view": "84b320fd67209906333ffce261128462",
-          "enrollment_api_keys": "90e66b79e8e948e9c15434fdb3ae576e",
-          "upgrade-assistant-reindex-operation": "a53a20fe086b72c9a86da3cc12dad8a6",
           "index-pattern": "66eccb05066c5a89924f48a9e9736499",
-          "canvas-element": "7390014e1091044523666d97247392fc",
-          "datasources": "2fed9e9883b9622cd59a73ee5550ef4f",
-          "maps-telemetry": "a4229f8b16a6820c6d724b7e0c1f729d",
+          "maps-telemetry": "268da3a48066123fc5baf35abaa55014",
           "namespace": "2f4316de49999235636386fe51dc06c1",
-          "telemetry": "358ffaa88ba34a97d55af0933a117de4",
+          "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
+          "agent_actions": "ed270b46812f0fa1439366c428a2cf17",
           "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
           "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
-          "config": "87aca8fdb053154f11383fce3dbf3edf",
-          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
-          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327"
+          "config": "ae24d22d5986d04124cc6568f771066f",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215"
         }
       },
       "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "type": "object",
+              "enabled": false
+            },
+            "name": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "type": "object",
+              "enabled": false
+            }
+          }
+        },
+        "agent_actions": {
+          "properties": {
+            "agent_id": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "data": {
+              "type": "flattened"
+            },
+            "sent_at": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "agent_configs": {
+          "properties": {
+            "datasources": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "id": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "text"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "updated_on": {
+              "type": "keyword"
+            }
+          }
+        },
         "agent_events": {
           "properties": {
+            "action_id": {
+              "type": "keyword"
+            },
             "agent_id": {
               "type": "keyword"
             },
+            "config_id": {
+              "type": "keyword"
+            },
             "data": {
               "type": "text"
             },
@@ -70,6 +180,9 @@
             "payload": {
               "type": "text"
             },
+            "stream_id": {
+              "type": "keyword"
+            },
             "subtype": {
               "type": "keyword"
             },
@@ -86,29 +199,24 @@
             "access_api_key_id": {
               "type": "keyword"
             },
-            "actions": {
-              "type": "nested",
-              "properties": {
-                "created_at": {
-                  "type": "date"
-                },
-                "data": {
-                  "type": "text"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "sent_at": {
-                  "type": "date"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
             "active": {
               "type": "boolean"
             },
+            "config_id": {
+              "type": "keyword"
+            },
+            "config_newest_revision": {
+              "type": "integer"
+            },
+            "config_revision": {
+              "type": "integer"
+            },
+            "current_error_events": {
+              "type": "text"
+            },
+            "default_api_key": {
+              "type": "keyword"
+            },
             "enrolled_at": {
               "type": "date"
             },
@@ -121,9 +229,6 @@
             "local_metadata": {
               "type": "text"
             },
-            "config_id": {
-              "type": "keyword"
-            },
             "shared_id": {
               "type": "keyword"
             },
@@ -136,21 +241,95 @@
             "user_provided_metadata": {
               "type": "text"
             },
-            "current_error_events": {
-              "type": "text"
-            },
             "version": {
               "type": "keyword"
             }
           }
         },
-        "apm-indices": {
+        "alert": {
           "properties": {
-            "apm_oss": {
+            "actions": {
+              "type": "nested",
               "properties": {
-                "apmAgentConfigurationIndex": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
                   "type": "keyword"
                 },
+                "params": {
+                  "type": "object",
+                  "enabled": false
+                }
+              }
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "params": {
+              "type": "object",
+              "enabled": false
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
                 "errorIndices": {
                   "type": "keyword"
                 },
@@ -173,33 +352,779 @@
             }
           }
         },
-        "apm-services-telemetry": {
+        "apm-telemetry": {
           "properties": {
-            "has_any_services": {
-              "type": "boolean"
-            },
-            "services_per_agent": {
+            "agents": {
               "properties": {
                 "dotnet": {
-                  "type": "long",
-                  "null_value": 0
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
                 },
                 "go": {
-                  "type": "long",
-                  "null_value": 0
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
                 },
                 "java": {
-                  "type": "long",
-                  "null_value": 0
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
                 },
                 "js-base": {
-                  "type": "long",
-                  "null_value": 0
-                },
-                "nodejs": {
-                  "type": "long",
-                  "null_value": 0
-                },
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "nodejs": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "python": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "ruby": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "rum-js": {
+                  "properties": {
+                    "agent": {
+                      "properties": {
+                        "version": {
+                          "type": "keyword",
+                          "ignore_above": 1024
+                        }
+                      }
+                    },
+                    "service": {
+                      "properties": {
+                        "framework": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "language": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        },
+                        "runtime": {
+                          "properties": {
+                            "composite": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "name": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            },
+                            "version": {
+                              "type": "keyword",
+                              "ignore_above": 1024
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "cardinality": {
+              "properties": {
+                "transaction": {
+                  "properties": {
+                    "name": {
+                      "properties": {
+                        "all_agents": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "rum": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "user_agent": {
+                  "properties": {
+                    "original": {
+                      "properties": {
+                        "all_agents": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "rum": {
+                          "properties": {
+                            "1d": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "counts": {
+              "properties": {
+                "agent_configuration": {
+                  "properties": {
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "error": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "max_error_groups_per_service": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "max_transaction_groups_per_service": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "metric": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "onboarding": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "services": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "sourcemap": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "span": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "traces": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "transaction": {
+                  "properties": {
+                    "1d": {
+                      "type": "long"
+                    },
+                    "all": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "has_any_services": {
+              "type": "boolean"
+            },
+            "indices": {
+              "properties": {
+                "all": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "docs": {
+                          "properties": {
+                            "count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "store": {
+                          "properties": {
+                            "size_in_bytes": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "shards": {
+                  "properties": {
+                    "total": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "integrations": {
+              "properties": {
+                "ml": {
+                  "properties": {
+                    "all_jobs_count": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "retainment": {
+              "properties": {
+                "error": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "metric": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "onboarding": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "span": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "transaction": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "services_per_agent": {
+              "properties": {
+                "dotnet": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "go": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "java": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "js-base": {
+                  "type": "long",
+                  "null_value": 0
+                },
+                "nodejs": {
+                  "type": "long",
+                  "null_value": 0
+                },
                 "python": {
                   "type": "long",
                   "null_value": 0
@@ -213,6 +1138,155 @@
                   "null_value": 0
                 }
               }
+            },
+            "tasks": {
+              "properties": {
+                "agent_configuration": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "agents": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "cardinality": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "groupings": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "indices_stats": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "integrations": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "processor_events": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "services": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                },
+                "versions": {
+                  "properties": {
+                    "took": {
+                      "properties": {
+                        "ms": {
+                          "type": "long"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "version": {
+              "properties": {
+                "apm_server": {
+                  "properties": {
+                    "major": {
+                      "type": "long"
+                    },
+                    "minor": {
+                      "type": "long"
+                    },
+                    "patch": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "application_usage_totals": {
+          "properties": {
+            "appId": {
+              "type": "keyword"
+            },
+            "minutesOnScreen": {
+              "type": "float"
+            },
+            "numberOfClicks": {
+              "type": "long"
+            }
+          }
+        },
+        "application_usage_transactional": {
+          "properties": {
+            "appId": {
+              "type": "keyword"
+            },
+            "minutesOnScreen": {
+              "type": "float"
+            },
+            "numberOfClicks": {
+              "type": "long"
+            },
+            "timestamp": {
+              "type": "date"
             }
           }
         },
@@ -244,22 +1318,253 @@
             }
           }
         },
-        "canvas-workpad": {
-          "dynamic": "false",
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "type": "text",
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "external_service": {
+              "properties": {
+                "connector_id": {
+                  "type": "keyword"
+                },
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector_id": {
+              "type": "keyword"
+            },
+            "connector_name": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-user-actions": {
           "properties": {
-            "@created": {
-              "type": "date"
+            "action": {
+              "type": "keyword"
             },
-            "@timestamp": {
+            "action_at": {
               "type": "date"
             },
-            "name": {
-              "type": "text",
-              "fields": {
-                "keyword": {
+            "action_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "username": {
                   "type": "keyword"
                 }
               }
+            },
+            "action_field": {
+              "type": "keyword"
+            },
+            "new_value": {
+              "type": "text"
+            },
+            "old_value": {
+              "type": "text"
             }
           }
         },
@@ -327,81 +1632,76 @@
         },
         "datasources": {
           "properties": {
-            "id": {
-              "type": "keyword"
-            },
-            "name": {
+            "config_id": {
               "type": "keyword"
             },
-            "package": {
-              "properties": {
-                "assets": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "description": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "keyword"
-                },
-                "title": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
+            "description": {
+              "type": "text"
             },
-            "read_alias": {
-              "type": "keyword"
+            "enabled": {
+              "type": "boolean"
             },
-            "streams": {
+            "inputs": {
+              "type": "nested",
               "properties": {
                 "config": {
                   "type": "flattened"
                 },
-                "id": {
+                "enabled": {
+                  "type": "boolean"
+                },
+                "processors": {
                   "type": "keyword"
                 },
-                "input": {
+                "streams": {
+                  "type": "nested",
                   "properties": {
                     "config": {
                       "type": "flattened"
                     },
-                    "fields": {
-                      "type": "flattened"
-                    },
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "ilm_policy": {
+                    "dataset": {
                       "type": "keyword"
                     },
-                    "index_template": {
-                      "type": "keyword"
+                    "enabled": {
+                      "type": "boolean"
                     },
-                    "ingest_pipelines": {
+                    "id": {
                       "type": "keyword"
                     },
-                    "type": {
+                    "processors": {
                       "type": "keyword"
                     }
                   }
                 },
-                "output_id": {
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "output_id": {
+              "type": "keyword"
+            },
+            "package": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                },
+                "title": {
                   "type": "keyword"
                 },
-                "processors": {
+                "version": {
                   "type": "keyword"
                 }
               }
+            },
+            "revision": {
+              "type": "integer"
             }
           }
         },
@@ -416,49 +1716,18 @@
             "api_key_id": {
               "type": "keyword"
             },
+            "config_id": {
+              "type": "keyword"
+            },
             "created_at": {
               "type": "date"
             },
-            "enrollment_rules": {
-              "type": "nested",
-              "properties": {
-                "created_at": {
-                  "type": "date"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "ip_ranges": {
-                  "type": "keyword"
-                },
-                "types": {
-                  "type": "keyword"
-                },
-                "updated_at": {
-                  "type": "date"
-                },
-                "window_duration": {
-                  "type": "nested",
-                  "properties": {
-                    "from": {
-                      "type": "date"
-                    },
-                    "to": {
-                      "type": "date"
-                    }
-                  }
-                }
-              }
-            },
             "expire_at": {
               "type": "date"
             },
             "name": {
               "type": "keyword"
             },
-            "config_id": {
-              "type": "keyword"
-            },
             "type": {
               "type": "keyword"
             },
@@ -467,7 +1736,7 @@
             }
           }
         },
-        "epm": {
+        "epm-package": {
           "properties": {
             "installed": {
               "type": "nested",
@@ -479,6 +1748,12 @@
                   "type": "keyword"
                 }
               }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
             }
           }
         },
@@ -631,6 +1906,26 @@
                 }
               }
             },
+            "customMetrics": {
+              "type": "nested",
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
             "customOptions": {
               "type": "nested",
               "properties": {
@@ -665,6 +1960,18 @@
             },
             "metric": {
               "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                },
                 "type": {
                   "type": "keyword"
                 }
@@ -792,9 +2099,19 @@
                 }
               }
             },
+            "indexPatternsWithGeoFieldCount": {
+              "type": "long"
+            },
             "mapsTotalCount": {
               "type": "long"
             },
+            "settings": {
+              "properties": {
+                "showMapVisualizationTypes": {
+                  "type": "boolean"
+                }
+              }
+            },
             "timeCaptured": {
               "type": "date"
             }
@@ -894,30 +2211,33 @@
         "namespace": {
           "type": "keyword"
         },
-        "policies": {
+        "outputs": {
           "properties": {
-            "datasources": {
+            "api_key": {
               "type": "keyword"
             },
-            "description": {
-              "type": "text"
-            },
-            "id": {
+            "ca_sha256": {
               "type": "keyword"
             },
-            "label": {
-              "type": "keyword"
+            "config": {
+              "type": "flattened"
             },
-            "name": {
-              "type": "text"
+            "fleet_enroll_password": {
+              "type": "binary"
             },
-            "status": {
+            "fleet_enroll_username": {
+              "type": "binary"
+            },
+            "hosts": {
               "type": "keyword"
             },
-            "updated_by": {
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
               "type": "keyword"
             },
-            "updated_on": {
+            "type": {
               "type": "keyword"
             }
           }
@@ -1011,6 +2331,73 @@
             }
           }
         },
+        "siem-detection-engine-rule-actions": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "action_type_id": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "type": "object",
+                  "dynamic": "true"
+                }
+              }
+            },
+            "alertThrottle": {
+              "type": "keyword"
+            },
+            "ruleAlertId": {
+              "type": "keyword"
+            },
+            "ruleThrottle": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-status": {
+          "properties": {
+            "alertId": {
+              "type": "keyword"
+            },
+            "bulkCreateTimeDurations": {
+              "type": "float"
+            },
+            "gap": {
+              "type": "text"
+            },
+            "lastFailureAt": {
+              "type": "date"
+            },
+            "lastFailureMessage": {
+              "type": "text"
+            },
+            "lastLookBackDate": {
+              "type": "date"
+            },
+            "lastSuccessAt": {
+              "type": "date"
+            },
+            "lastSuccessMessage": {
+              "type": "text"
+            },
+            "searchAfterTimeDurations": {
+              "type": "float"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "statusDate": {
+              "type": "date"
+            }
+          }
+        },
         "siem-ui-timeline": {
           "properties": {
             "columns": {
@@ -1145,6 +2532,9 @@
             "description": {
               "type": "text"
             },
+            "eventType": {
+              "type": "keyword"
+            },
             "favorite": {
               "properties": {
                 "favoriteDate": {
@@ -1349,6 +2739,9 @@
         },
         "telemetry": {
           "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
             "enabled": {
               "type": "boolean"
             },
@@ -1356,12 +2749,16 @@
               "type": "date"
             },
             "lastVersionChecked": {
-              "type": "keyword",
-              "ignore_above": 256
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
             },
             "sendUsageFrom": {
-              "type": "keyword",
-              "ignore_above": 256
+              "type": "keyword"
             },
             "userHasSeenNotice": {
               "type": "boolean"
@@ -1409,6 +2806,13 @@
             }
           }
         },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
         "type": {
           "type": "keyword"
         },
@@ -1485,6 +2889,13 @@
             }
           }
         },
+        "uptime-dynamic-settings": {
+          "properties": {
+            "heartbeatIndices": {
+              "type": "keyword"
+            }
+          }
+        },
         "url": {
           "properties": {
             "accessCount": {
diff --git a/x-pack/test/siem_cypress/es_archives/timeline_signals/data.json.gz b/x-pack/test/siem_cypress/es_archives/timeline_signals/data.json.gz
new file mode 100644
index 0000000000000..485d9868efd21
Binary files /dev/null and b/x-pack/test/siem_cypress/es_archives/timeline_signals/data.json.gz differ
diff --git a/x-pack/test/siem_cypress/es_archives/timeline_signals/mappings.json b/x-pack/test/siem_cypress/es_archives/timeline_signals/mappings.json
new file mode 100644
index 0000000000000..a1a9e7bfeae7f
--- /dev/null
+++ b/x-pack/test/siem_cypress/es_archives/timeline_signals/mappings.json
@@ -0,0 +1,9063 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "c0c235fba02ebd2a2412bcda79009b58",
+          "action_task_params": "a9d49f184ee89641044be0ca2950fa3a",
+          "alert": "e588043a01d3d43477e7cad7efa0f5d8",
+          "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
+          "apm-services-telemetry": "07ee1939fa4302c62ddc052ec03fed90",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "config": "87aca8fdb053154f11383fce3dbf3edf",
+          "dashboard": "d00f614b29a80360e1190193fd333bab",
+          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
+          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
+          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
+          "infrastructure-ui-source": "ddc0ecb18383f6b26101a2fadb2dab0c",
+          "inventory-view": "84b320fd67209906333ffce261128462",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "lens": "21c3ea0763beb1ecb0162529706b88c5",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "23d7aa4a720d4938ccde3983f87bd58d",
+          "maps-telemetry": "268da3a48066123fc5baf35abaa55014",
+          "metrics-explorer-view": "53c5365793677328df0ccb6138bf3cdd",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "181661168bbadd1eff5902361e2a0d5c",
+          "server": "ec97f1c5da1a19609a60874e5af1100c",
+          "siem-detection-engine-rule-status": "0367e4d775814b56a4bee29384f9aafe",
+          "siem-ui-timeline": "ac8020190f5950dd3250b6499144e7fb",
+          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
+          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "telemetry": "358ffaa88ba34a97d55af0933a117de4",
+          "timelion-sheet": "9a2a2748877c7a7b582fef201ab1d4cf",
+          "tsvb-validation-telemetry": "3a37ef6c8700ae6fc97d5c7da00e9215",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-reindex-operation": "a53a20fe086b72c9a86da3cc12dad8a6",
+          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
+          "visualization": "52d7a13ad68a150c4525b292d23e12cc"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "name": {
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "apm-indices": {
+          "properties": {
+            "apm_oss": {
+              "properties": {
+                "errorIndices": {
+                  "type": "keyword"
+                },
+                "metricsIndices": {
+                  "type": "keyword"
+                },
+                "onboardingIndices": {
+                  "type": "keyword"
+                },
+                "sourcemapIndices": {
+                  "type": "keyword"
+                },
+                "spanIndices": {
+                  "type": "keyword"
+                },
+                "transactionIndices": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "apm-services-telemetry": {
+          "properties": {
+            "has_any_services": {
+              "type": "boolean"
+            },
+            "services_per_agent": {
+              "properties": {
+                "dotnet": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "go": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "java": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "js-base": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "nodejs": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "python": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "ruby": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "rum-js": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "true",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "type": "text"
+            },
+            "panelsJSON": {
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "type": "keyword"
+                },
+                "pause": {
+                  "type": "boolean"
+                },
+                "section": {
+                  "type": "integer"
+                },
+                "value": {
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "type": "boolean"
+            },
+            "timeTo": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "file-upload-telemetry": {
+          "properties": {
+            "filesUploadedTotalCount": {
+              "type": "long"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "index-pattern": {
+          "properties": {
+            "fieldFormatMap": {
+              "type": "text"
+            },
+            "fields": {
+              "type": "text"
+            },
+            "intervalName": {
+              "type": "keyword"
+            },
+            "notExpandable": {
+              "type": "boolean"
+            },
+            "sourceFilters": {
+              "type": "text"
+            },
+            "timeFieldName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "typeMeta": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "fields": {
+              "properties": {
+                "container": {
+                  "type": "keyword"
+                },
+                "host": {
+                  "type": "keyword"
+                },
+                "pod": {
+                  "type": "keyword"
+                },
+                "tiebreaker": {
+                  "type": "keyword"
+                },
+                "timestamp": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "logAlias": {
+              "type": "keyword"
+            },
+            "logColumns": {
+              "properties": {
+                "fieldColumn": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "messageColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "timestampColumn": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              },
+              "type": "nested"
+            },
+            "metricAlias": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "inventory-view": {
+          "properties": {
+            "autoBounds": {
+              "type": "boolean"
+            },
+            "autoReload": {
+              "type": "boolean"
+            },
+            "boundsOverride": {
+              "properties": {
+                "max": {
+                  "type": "integer"
+                },
+                "min": {
+                  "type": "integer"
+                }
+              }
+            },
+            "customOptions": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "text": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "filterQuery": {
+              "properties": {
+                "expression": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "groupBy": {
+              "properties": {
+                "field": {
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "metric": {
+              "properties": {
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "nodeType": {
+              "type": "keyword"
+            },
+            "time": {
+              "type": "integer"
+            },
+            "view": {
+              "type": "keyword"
+            }
+          }
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "expression": {
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "bounds": {
+              "type": "geo_shape"
+            },
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "properties": {
+            "attributesPerMap": {
+              "properties": {
+                "dataSourcesCount": {
+                  "properties": {
+                    "avg": {
+                      "type": "long"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "min": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "emsVectorLayersCount": {
+                  "dynamic": "true",
+                  "type": "object"
+                },
+                "layerTypesCount": {
+                  "dynamic": "true",
+                  "type": "object"
+                },
+                "layersCount": {
+                  "properties": {
+                    "avg": {
+                      "type": "long"
+                    },
+                    "max": {
+                      "type": "long"
+                    },
+                    "min": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "indexPatternsWithGeoFieldCount": {
+              "type": "long"
+            },
+            "mapsTotalCount": {
+              "type": "long"
+            },
+            "settings": {
+              "properties": {
+                "showMapVisualizationTypes": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "timeCaptured": {
+              "type": "date"
+            }
+          }
+        },
+        "metrics-explorer-view": {
+          "properties": {
+            "chartOptions": {
+              "properties": {
+                "stack": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "yAxisMode": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "currentTimerange": {
+              "properties": {
+                "from": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "options": {
+              "properties": {
+                "aggregation": {
+                  "type": "keyword"
+                },
+                "filterQuery": {
+                  "type": "keyword"
+                },
+                "groupBy": {
+                  "type": "keyword"
+                },
+                "limit": {
+                  "type": "integer"
+                },
+                "metrics": {
+                  "properties": {
+                    "aggregation": {
+                      "type": "keyword"
+                    },
+                    "color": {
+                      "type": "keyword"
+                    },
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "label": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                }
+              }
+            }
+          }
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "dashboard": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "index-pattern": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "search": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "visualization": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-telemetry": {
+          "properties": {
+            "file_data_visualizer": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "columns": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "sort": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "uuid": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-status": {
+          "properties": {
+            "alertId": {
+              "type": "keyword"
+            },
+            "lastFailureAt": {
+              "type": "date"
+            },
+            "lastFailureMessage": {
+              "type": "text"
+            },
+            "lastSuccessAt": {
+              "type": "date"
+            },
+            "lastSuccessMessage": {
+              "type": "text"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "statusDate": {
+              "type": "date"
+            }
+          }
+        },
+        "siem-ui-timeline": {
+          "properties": {
+            "columns": {
+              "properties": {
+                "aggregatable": {
+                  "type": "boolean"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "columnHeaderType": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "text"
+                },
+                "example": {
+                  "type": "text"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "indexes": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "placeholder": {
+                  "type": "text"
+                },
+                "searchable": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "dataProviders": {
+              "properties": {
+                "and": {
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "excluded": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "kqlQuery": {
+                      "type": "text"
+                    },
+                    "name": {
+                      "type": "text"
+                    },
+                    "queryMatch": {
+                      "properties": {
+                        "displayField": {
+                          "type": "text"
+                        },
+                        "displayValue": {
+                          "type": "text"
+                        },
+                        "field": {
+                          "type": "text"
+                        },
+                        "operator": {
+                          "type": "text"
+                        },
+                        "value": {
+                          "type": "text"
+                        }
+                      }
+                    }
+                  }
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "excluded": {
+                  "type": "boolean"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kqlQuery": {
+                  "type": "text"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "queryMatch": {
+                  "properties": {
+                    "displayField": {
+                      "type": "text"
+                    },
+                    "displayValue": {
+                      "type": "text"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "operator": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "dateRange": {
+              "properties": {
+                "end": {
+                  "type": "date"
+                },
+                "start": {
+                  "type": "date"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "eventType": {
+              "type": "keyword"
+            },
+            "favorite": {
+              "properties": {
+                "favoriteDate": {
+                  "type": "date"
+                },
+                "fullName": {
+                  "type": "text"
+                },
+                "keySearch": {
+                  "type": "text"
+                },
+                "userName": {
+                  "type": "text"
+                }
+              }
+            },
+            "filters": {
+              "properties": {
+                "exists": {
+                  "type": "text"
+                },
+                "match_all": {
+                  "type": "text"
+                },
+                "meta": {
+                  "properties": {
+                    "alias": {
+                      "type": "text"
+                    },
+                    "controlledBy": {
+                      "type": "text"
+                    },
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "formattedValue": {
+                      "type": "text"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "type": "keyword"
+                    },
+                    "negate": {
+                      "type": "boolean"
+                    },
+                    "params": {
+                      "type": "text"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "missing": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "range": {
+                  "type": "text"
+                },
+                "script": {
+                  "type": "text"
+                }
+              }
+            },
+            "kqlMode": {
+              "type": "keyword"
+            },
+            "kqlQuery": {
+              "properties": {
+                "filterQuery": {
+                  "properties": {
+                    "kuery": {
+                      "properties": {
+                        "expression": {
+                          "type": "text"
+                        },
+                        "kind": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "serializedQuery": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "savedQueryId": {
+              "type": "keyword"
+            },
+            "sort": {
+              "properties": {
+                "columnId": {
+                  "type": "keyword"
+                },
+                "sortDirection": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-note": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "note": {
+              "type": "text"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-pinned-event": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "timelineId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "telemetry": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "ignore_above": 256,
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "ignore_above": 256,
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "timelion-sheet": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "timelion_chart_height": {
+              "type": "integer"
+            },
+            "timelion_columns": {
+              "type": "integer"
+            },
+            "timelion_interval": {
+              "type": "keyword"
+            },
+            "timelion_other_interval": {
+              "type": "keyword"
+            },
+            "timelion_rows": {
+              "type": "integer"
+            },
+            "timelion_sheet": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "tsvb-validation-telemetry": {
+          "properties": {
+            "failedRequests": {
+              "type": "long"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-reindex-operation": {
+          "dynamic": "true",
+          "properties": {
+            "indexName": {
+              "type": "keyword"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            },
+            "ui_open": {
+              "properties": {
+                "cluster": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "indices": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "overview": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            },
+            "ui_reindex": {
+              "properties": {
+                "close": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "open": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "start": {
+                  "null_value": 0,
+                  "type": "long"
+                },
+                "stop": {
+                  "null_value": 0,
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "type": "text"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".siem-signals-default": {
+        "is_write_index": true
+      }
+    },
+    "index": ".siem-signals-default-000001",
+    "mappings": {
+      "dynamic": "false",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "doc_values": false,
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "integer"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "signal": {
+          "properties": {
+            "ancestors": {
+              "properties": {
+                "depth": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "rule": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "original_event": {
+              "properties": {
+                "action": {
+                  "type": "keyword"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "code": {
+                  "type": "keyword"
+                },
+                "created": {
+                  "type": "date"
+                },
+                "dataset": {
+                  "type": "keyword"
+                },
+                "duration": {
+                  "type": "long"
+                },
+                "end": {
+                  "type": "date"
+                },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                },
+                "module": {
+                  "type": "keyword"
+                },
+                "original": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "outcome": {
+                  "type": "keyword"
+                },
+                "provider": {
+                  "type": "keyword"
+                },
+                "risk_score": {
+                  "type": "float"
+                },
+                "risk_score_norm": {
+                  "type": "float"
+                },
+                "sequence": {
+                  "type": "long"
+                },
+                "severity": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "timezone": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "original_time": {
+              "type": "date"
+            },
+            "parent": {
+              "properties": {
+                "depth": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "index": {
+                  "type": "keyword"
+                },
+                "rule": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "rule": {
+              "properties": {
+                "created_at": {
+                  "type": "date"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "keyword"
+                },
+                "enabled": {
+                  "type": "keyword"
+                },
+                "false_positives": {
+                  "type": "keyword"
+                },
+                "filters": {
+                  "type": "object"
+                },
+                "from": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "immutable": {
+                  "type": "keyword"
+                },
+                "index": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "language": {
+                  "type": "keyword"
+                },
+                "max_signals": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "keyword"
+                },
+                "output_index": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "type": "keyword"
+                },
+                "references": {
+                  "type": "keyword"
+                },
+                "risk_score": {
+                  "type": "keyword"
+                },
+                "rule_id": {
+                  "type": "keyword"
+                },
+                "saved_id": {
+                  "type": "keyword"
+                },
+                "severity": {
+                  "type": "keyword"
+                },
+                "size": {
+                  "type": "keyword"
+                },
+                "tags": {
+                  "type": "keyword"
+                },
+                "threat": {
+                  "properties": {
+                    "framework": {
+                      "type": "keyword"
+                    },
+                    "tactic": {
+                      "properties": {
+                        "id": {
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "type": "keyword"
+                        },
+                        "reference": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "technique": {
+                      "properties": {
+                        "id": {
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "type": "keyword"
+                        },
+                        "reference": {
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "timeline_id": {
+                  "type": "keyword"
+                },
+                "timeline_title": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "date"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "transaction": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "lifecycle": {
+          "name": ".siem-signals-default",
+          "rollover_alias": ".siem-signals-default"
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "auditbeat-7.6.2": {
+        "is_write_index": true
+      }
+    },
+    "index": "auditbeat-7.6.2-2020.03.20-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "auditbeat",
+        "version": "7.6.2"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "auditd": {
+          "properties": {
+            "data": {
+              "properties": {
+                "a0": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a2": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a[0-3]": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "acct": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "acl": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "added": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "addr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "apparmor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "arch": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "argc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_backlog_limit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_backlog_wait_time": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_failure": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "banners": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bool": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bus": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "capability": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cgroup": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "changed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cipher": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "compat": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "daddr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "default-context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "device": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dir": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "direction": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dmac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "enforcing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entries": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fam": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "feature": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "flags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "format": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "grantors": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "grp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hook": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hostname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "icmp_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "igid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "img-ctx": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inif": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ino": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode_uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "invalid_context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ioctlcmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ip": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ipid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ipx-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "items": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "iuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kind": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ksize": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "laddr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "len": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "lport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "macproto": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "maj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "major": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "minor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "model": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nargs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-chardev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-disk": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-log_passwd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-mem": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-rng": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-vcpu": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_lock": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-fam": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-grp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-pid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oauid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ocomm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oflag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-chardev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-disk": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-log_passwd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-mem": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-rng": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-vcpu": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_enforcing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_lock": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_prom": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_val": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "op": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "outif": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "parent": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "per": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "perm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "perm_mask": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "permissive": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pfs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "printer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "prom": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "proto": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "qbytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reason": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "removed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "res": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resrc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sauid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "scontext": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "selected-context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seperm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seperms": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seqno": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seresult": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sig": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sigev_signo": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "smac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "socket": {
+                  "properties": {
+                    "addr": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "family": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "port": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "saddr": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "spid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "success": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "syscall": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "table": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tclass": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tcontext": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "terminal": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tty": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uri": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "val": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "virt": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm-ctx": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm-pid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "watch": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "paths": {
+              "properties": {
+                "dev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "item": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nametype": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "objtype": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ogid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ouid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rdev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "session": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "summary": {
+              "properties": {
+                "actor": {
+                  "properties": {
+                    "primary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "secondary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "how": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "object": {
+                  "properties": {
+                    "primary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "secondary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "fields": {
+                "raw": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "selinux": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "setgid": {
+              "type": "boolean"
+            },
+            "setuid": {
+              "type": "boolean"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geoip": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "blake2b_256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "blake2b_384": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "blake2b_512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha224": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha384": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_224": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_384": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512_224": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512_256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "xxh64": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jolokia": {
+          "properties": {
+            "agent": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "secured": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "blake2b_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "xxh64": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "socket": {
+          "properties": {
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "host": {
+                  "properties": {
+                    "architecture": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "boottime": {
+                      "type": "date"
+                    },
+                    "containerized": {
+                      "type": "boolean"
+                    },
+                    "hostname": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ip": {
+                      "type": "ip"
+                    },
+                    "mac": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "os": {
+                      "properties": {
+                        "codename": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "family": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "kernel": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "platform": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "timezone": {
+                      "properties": {
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "offset": {
+                          "properties": {
+                            "sec": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "uptime": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "package": {
+                  "properties": {
+                    "arch": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "entity_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "installtime": {
+                      "type": "date"
+                    },
+                    "license": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "release": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "size": {
+                      "type": "long"
+                    },
+                    "summary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "url": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "dir": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "gid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "group": {
+                      "type": "object"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "password": {
+                      "properties": {
+                        "last_changed": {
+                          "type": "date"
+                        },
+                        "type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "shell": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "uid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user_information": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name_map": {
+              "type": "object"
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "selinux": {
+              "properties": {
+                "category": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "lifecycle": {
+          "name": "auditbeat",
+          "rollover_alias": "auditbeat-7.6.2"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "query": {
+          "default_field": [
+            "message",
+            "tags",
+            "agent.ephemeral_id",
+            "agent.id",
+            "agent.name",
+            "agent.type",
+            "agent.version",
+            "as.organization.name",
+            "client.address",
+            "client.as.organization.name",
+            "client.domain",
+            "client.geo.city_name",
+            "client.geo.continent_name",
+            "client.geo.country_iso_code",
+            "client.geo.country_name",
+            "client.geo.name",
+            "client.geo.region_iso_code",
+            "client.geo.region_name",
+            "client.mac",
+            "client.registered_domain",
+            "client.top_level_domain",
+            "client.user.domain",
+            "client.user.email",
+            "client.user.full_name",
+            "client.user.group.domain",
+            "client.user.group.id",
+            "client.user.group.name",
+            "client.user.hash",
+            "client.user.id",
+            "client.user.name",
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "container.id",
+            "container.image.name",
+            "container.image.tag",
+            "container.name",
+            "container.runtime",
+            "destination.address",
+            "destination.as.organization.name",
+            "destination.domain",
+            "destination.geo.city_name",
+            "destination.geo.continent_name",
+            "destination.geo.country_iso_code",
+            "destination.geo.country_name",
+            "destination.geo.name",
+            "destination.geo.region_iso_code",
+            "destination.geo.region_name",
+            "destination.mac",
+            "destination.registered_domain",
+            "destination.top_level_domain",
+            "destination.user.domain",
+            "destination.user.email",
+            "destination.user.full_name",
+            "destination.user.group.domain",
+            "destination.user.group.id",
+            "destination.user.group.name",
+            "destination.user.hash",
+            "destination.user.id",
+            "destination.user.name",
+            "dns.answers.class",
+            "dns.answers.data",
+            "dns.answers.name",
+            "dns.answers.type",
+            "dns.header_flags",
+            "dns.id",
+            "dns.op_code",
+            "dns.question.class",
+            "dns.question.name",
+            "dns.question.registered_domain",
+            "dns.question.subdomain",
+            "dns.question.top_level_domain",
+            "dns.question.type",
+            "dns.response_code",
+            "dns.type",
+            "ecs.version",
+            "error.code",
+            "error.id",
+            "error.message",
+            "error.stack_trace",
+            "error.type",
+            "event.action",
+            "event.category",
+            "event.code",
+            "event.dataset",
+            "event.hash",
+            "event.id",
+            "event.kind",
+            "event.module",
+            "event.original",
+            "event.outcome",
+            "event.provider",
+            "event.timezone",
+            "event.type",
+            "file.device",
+            "file.directory",
+            "file.extension",
+            "file.gid",
+            "file.group",
+            "file.hash.md5",
+            "file.hash.sha1",
+            "file.hash.sha256",
+            "file.hash.sha512",
+            "file.inode",
+            "file.mode",
+            "file.name",
+            "file.owner",
+            "file.path",
+            "file.target_path",
+            "file.type",
+            "file.uid",
+            "geo.city_name",
+            "geo.continent_name",
+            "geo.country_iso_code",
+            "geo.country_name",
+            "geo.name",
+            "geo.region_iso_code",
+            "geo.region_name",
+            "group.domain",
+            "group.id",
+            "group.name",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha256",
+            "hash.sha512",
+            "host.architecture",
+            "host.geo.city_name",
+            "host.geo.continent_name",
+            "host.geo.country_iso_code",
+            "host.geo.country_name",
+            "host.geo.name",
+            "host.geo.region_iso_code",
+            "host.geo.region_name",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.full",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.type",
+            "host.user.domain",
+            "host.user.email",
+            "host.user.full_name",
+            "host.user.group.domain",
+            "host.user.group.id",
+            "host.user.group.name",
+            "host.user.hash",
+            "host.user.id",
+            "host.user.name",
+            "http.request.body.content",
+            "http.request.method",
+            "http.request.referrer",
+            "http.response.body.content",
+            "http.version",
+            "log.level",
+            "log.logger",
+            "log.origin.file.name",
+            "log.origin.function",
+            "log.original",
+            "log.syslog.facility.name",
+            "log.syslog.severity.name",
+            "network.application",
+            "network.community_id",
+            "network.direction",
+            "network.iana_number",
+            "network.name",
+            "network.protocol",
+            "network.transport",
+            "network.type",
+            "observer.geo.city_name",
+            "observer.geo.continent_name",
+            "observer.geo.country_iso_code",
+            "observer.geo.country_name",
+            "observer.geo.name",
+            "observer.geo.region_iso_code",
+            "observer.geo.region_name",
+            "observer.hostname",
+            "observer.mac",
+            "observer.name",
+            "observer.os.family",
+            "observer.os.full",
+            "observer.os.kernel",
+            "observer.os.name",
+            "observer.os.platform",
+            "observer.os.version",
+            "observer.product",
+            "observer.serial_number",
+            "observer.type",
+            "observer.vendor",
+            "observer.version",
+            "organization.id",
+            "organization.name",
+            "os.family",
+            "os.full",
+            "os.kernel",
+            "os.name",
+            "os.platform",
+            "os.version",
+            "package.architecture",
+            "package.checksum",
+            "package.description",
+            "package.install_scope",
+            "package.license",
+            "package.name",
+            "package.path",
+            "package.version",
+            "process.args",
+            "text",
+            "process.executable",
+            "process.hash.md5",
+            "process.hash.sha1",
+            "process.hash.sha256",
+            "process.hash.sha512",
+            "process.name",
+            "text",
+            "text",
+            "text",
+            "text",
+            "text",
+            "process.thread.name",
+            "process.title",
+            "process.working_directory",
+            "server.address",
+            "server.as.organization.name",
+            "server.domain",
+            "server.geo.city_name",
+            "server.geo.continent_name",
+            "server.geo.country_iso_code",
+            "server.geo.country_name",
+            "server.geo.name",
+            "server.geo.region_iso_code",
+            "server.geo.region_name",
+            "server.mac",
+            "server.registered_domain",
+            "server.top_level_domain",
+            "server.user.domain",
+            "server.user.email",
+            "server.user.full_name",
+            "server.user.group.domain",
+            "server.user.group.id",
+            "server.user.group.name",
+            "server.user.hash",
+            "server.user.id",
+            "server.user.name",
+            "service.ephemeral_id",
+            "service.id",
+            "service.name",
+            "service.node.name",
+            "service.state",
+            "service.type",
+            "service.version",
+            "source.address",
+            "source.as.organization.name",
+            "source.domain",
+            "source.geo.city_name",
+            "source.geo.continent_name",
+            "source.geo.country_iso_code",
+            "source.geo.country_name",
+            "source.geo.name",
+            "source.geo.region_iso_code",
+            "source.geo.region_name",
+            "source.mac",
+            "source.registered_domain",
+            "source.top_level_domain",
+            "source.user.domain",
+            "source.user.email",
+            "source.user.full_name",
+            "source.user.group.domain",
+            "source.user.group.id",
+            "source.user.group.name",
+            "source.user.hash",
+            "source.user.id",
+            "source.user.name",
+            "threat.framework",
+            "threat.tactic.id",
+            "threat.tactic.name",
+            "threat.tactic.reference",
+            "threat.technique.id",
+            "threat.technique.name",
+            "threat.technique.reference",
+            "tracing.trace.id",
+            "tracing.transaction.id",
+            "url.domain",
+            "url.extension",
+            "url.fragment",
+            "url.full",
+            "url.original",
+            "url.password",
+            "url.path",
+            "url.query",
+            "url.registered_domain",
+            "url.scheme",
+            "url.top_level_domain",
+            "url.username",
+            "user.domain",
+            "user.email",
+            "user.full_name",
+            "user.group.domain",
+            "user.group.id",
+            "user.group.name",
+            "user.hash",
+            "user.id",
+            "user.name",
+            "user_agent.device.name",
+            "user_agent.name",
+            "text",
+            "user_agent.original",
+            "user_agent.os.family",
+            "user_agent.os.full",
+            "user_agent.os.kernel",
+            "user_agent.os.name",
+            "user_agent.os.platform",
+            "user_agent.os.version",
+            "user_agent.version",
+            "text",
+            "agent.hostname",
+            "timeseries.instance",
+            "cloud.project.id",
+            "cloud.image.id",
+            "host.os.build",
+            "host.os.codename",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.replicaset.name",
+            "kubernetes.deployment.name",
+            "kubernetes.statefulset.name",
+            "kubernetes.container.name",
+            "kubernetes.container.image",
+            "jolokia.agent.version",
+            "jolokia.agent.id",
+            "jolokia.server.product",
+            "jolokia.server.version",
+            "jolokia.server.vendor",
+            "jolokia.url",
+            "raw",
+            "file.origin",
+            "file.selinux.user",
+            "file.selinux.role",
+            "file.selinux.domain",
+            "file.selinux.level",
+            "user.audit.id",
+            "user.audit.name",
+            "user.effective.id",
+            "user.effective.name",
+            "user.effective.group.id",
+            "user.effective.group.name",
+            "user.filesystem.id",
+            "user.filesystem.name",
+            "user.filesystem.group.id",
+            "user.filesystem.group.name",
+            "user.saved.id",
+            "user.saved.name",
+            "user.saved.group.id",
+            "user.saved.group.name",
+            "user.selinux.user",
+            "user.selinux.role",
+            "user.selinux.domain",
+            "user.selinux.level",
+            "user.selinux.category",
+            "source.path",
+            "destination.path",
+            "auditd.message_type",
+            "auditd.session",
+            "auditd.result",
+            "auditd.summary.actor.primary",
+            "auditd.summary.actor.secondary",
+            "auditd.summary.object.type",
+            "auditd.summary.object.primary",
+            "auditd.summary.object.secondary",
+            "auditd.summary.how",
+            "auditd.paths.inode",
+            "auditd.paths.dev",
+            "auditd.paths.obj_user",
+            "auditd.paths.obj_role",
+            "auditd.paths.obj_domain",
+            "auditd.paths.obj_level",
+            "auditd.paths.objtype",
+            "auditd.paths.ouid",
+            "auditd.paths.rdev",
+            "auditd.paths.nametype",
+            "auditd.paths.ogid",
+            "auditd.paths.item",
+            "auditd.paths.mode",
+            "auditd.paths.name",
+            "auditd.data.action",
+            "auditd.data.minor",
+            "auditd.data.acct",
+            "auditd.data.addr",
+            "auditd.data.cipher",
+            "auditd.data.id",
+            "auditd.data.entries",
+            "auditd.data.kind",
+            "auditd.data.ksize",
+            "auditd.data.spid",
+            "auditd.data.arch",
+            "auditd.data.argc",
+            "auditd.data.major",
+            "auditd.data.unit",
+            "auditd.data.table",
+            "auditd.data.terminal",
+            "auditd.data.grantors",
+            "auditd.data.direction",
+            "auditd.data.op",
+            "auditd.data.tty",
+            "auditd.data.syscall",
+            "auditd.data.data",
+            "auditd.data.family",
+            "auditd.data.mac",
+            "auditd.data.pfs",
+            "auditd.data.items",
+            "auditd.data.a0",
+            "auditd.data.a1",
+            "auditd.data.a2",
+            "auditd.data.a3",
+            "auditd.data.hostname",
+            "auditd.data.lport",
+            "auditd.data.rport",
+            "auditd.data.exit",
+            "auditd.data.fp",
+            "auditd.data.laddr",
+            "auditd.data.sport",
+            "auditd.data.capability",
+            "auditd.data.nargs",
+            "auditd.data.new-enabled",
+            "auditd.data.audit_backlog_limit",
+            "auditd.data.dir",
+            "auditd.data.cap_pe",
+            "auditd.data.model",
+            "auditd.data.new_pp",
+            "auditd.data.old-enabled",
+            "auditd.data.oauid",
+            "auditd.data.old",
+            "auditd.data.banners",
+            "auditd.data.feature",
+            "auditd.data.vm-ctx",
+            "auditd.data.opid",
+            "auditd.data.seperms",
+            "auditd.data.seresult",
+            "auditd.data.new-rng",
+            "auditd.data.old-net",
+            "auditd.data.sigev_signo",
+            "auditd.data.ino",
+            "auditd.data.old_enforcing",
+            "auditd.data.old-vcpu",
+            "auditd.data.range",
+            "auditd.data.res",
+            "auditd.data.added",
+            "auditd.data.fam",
+            "auditd.data.nlnk-pid",
+            "auditd.data.subj",
+            "auditd.data.a[0-3]",
+            "auditd.data.cgroup",
+            "auditd.data.kernel",
+            "auditd.data.ocomm",
+            "auditd.data.new-net",
+            "auditd.data.permissive",
+            "auditd.data.class",
+            "auditd.data.compat",
+            "auditd.data.fi",
+            "auditd.data.changed",
+            "auditd.data.msg",
+            "auditd.data.dport",
+            "auditd.data.new-seuser",
+            "auditd.data.invalid_context",
+            "auditd.data.dmac",
+            "auditd.data.ipx-net",
+            "auditd.data.iuid",
+            "auditd.data.macproto",
+            "auditd.data.obj",
+            "auditd.data.ipid",
+            "auditd.data.new-fs",
+            "auditd.data.vm-pid",
+            "auditd.data.cap_pi",
+            "auditd.data.old-auid",
+            "auditd.data.oses",
+            "auditd.data.fd",
+            "auditd.data.igid",
+            "auditd.data.new-disk",
+            "auditd.data.parent",
+            "auditd.data.len",
+            "auditd.data.oflag",
+            "auditd.data.uuid",
+            "auditd.data.code",
+            "auditd.data.nlnk-grp",
+            "auditd.data.cap_fp",
+            "auditd.data.new-mem",
+            "auditd.data.seperm",
+            "auditd.data.enforcing",
+            "auditd.data.new-chardev",
+            "auditd.data.old-rng",
+            "auditd.data.outif",
+            "auditd.data.cmd",
+            "auditd.data.hook",
+            "auditd.data.new-level",
+            "auditd.data.sauid",
+            "auditd.data.sig",
+            "auditd.data.audit_backlog_wait_time",
+            "auditd.data.printer",
+            "auditd.data.old-mem",
+            "auditd.data.perm",
+            "auditd.data.old_pi",
+            "auditd.data.state",
+            "auditd.data.format",
+            "auditd.data.new_gid",
+            "auditd.data.tcontext",
+            "auditd.data.maj",
+            "auditd.data.watch",
+            "auditd.data.device",
+            "auditd.data.grp",
+            "auditd.data.bool",
+            "auditd.data.icmp_type",
+            "auditd.data.new_lock",
+            "auditd.data.old_prom",
+            "auditd.data.acl",
+            "auditd.data.ip",
+            "auditd.data.new_pi",
+            "auditd.data.default-context",
+            "auditd.data.inode_gid",
+            "auditd.data.new-log_passwd",
+            "auditd.data.new_pe",
+            "auditd.data.selected-context",
+            "auditd.data.cap_fver",
+            "auditd.data.file",
+            "auditd.data.net",
+            "auditd.data.virt",
+            "auditd.data.cap_pp",
+            "auditd.data.old-range",
+            "auditd.data.resrc",
+            "auditd.data.new-range",
+            "auditd.data.obj_gid",
+            "auditd.data.proto",
+            "auditd.data.old-disk",
+            "auditd.data.audit_failure",
+            "auditd.data.inif",
+            "auditd.data.vm",
+            "auditd.data.flags",
+            "auditd.data.nlnk-fam",
+            "auditd.data.old-fs",
+            "auditd.data.old-ses",
+            "auditd.data.seqno",
+            "auditd.data.fver",
+            "auditd.data.qbytes",
+            "auditd.data.seuser",
+            "auditd.data.cap_fe",
+            "auditd.data.new-vcpu",
+            "auditd.data.old-level",
+            "auditd.data.old_pp",
+            "auditd.data.daddr",
+            "auditd.data.old-role",
+            "auditd.data.ioctlcmd",
+            "auditd.data.smac",
+            "auditd.data.apparmor",
+            "auditd.data.fe",
+            "auditd.data.perm_mask",
+            "auditd.data.ses",
+            "auditd.data.cap_fi",
+            "auditd.data.obj_uid",
+            "auditd.data.reason",
+            "auditd.data.list",
+            "auditd.data.old_lock",
+            "auditd.data.bus",
+            "auditd.data.old_pe",
+            "auditd.data.new-role",
+            "auditd.data.prom",
+            "auditd.data.uri",
+            "auditd.data.audit_enabled",
+            "auditd.data.old-log_passwd",
+            "auditd.data.old-seuser",
+            "auditd.data.per",
+            "auditd.data.scontext",
+            "auditd.data.tclass",
+            "auditd.data.ver",
+            "auditd.data.new",
+            "auditd.data.val",
+            "auditd.data.img-ctx",
+            "auditd.data.old-chardev",
+            "auditd.data.old_val",
+            "auditd.data.success",
+            "auditd.data.inode_uid",
+            "auditd.data.removed",
+            "auditd.data.socket.port",
+            "auditd.data.socket.saddr",
+            "auditd.data.socket.addr",
+            "auditd.data.socket.family",
+            "auditd.data.socket.path",
+            "geoip.continent_name",
+            "geoip.city_name",
+            "geoip.region_name",
+            "geoip.country_iso_code",
+            "hash.blake2b_256",
+            "hash.blake2b_384",
+            "hash.blake2b_512",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha224",
+            "hash.sha256",
+            "hash.sha384",
+            "hash.sha3_224",
+            "hash.sha3_256",
+            "hash.sha3_384",
+            "hash.sha3_512",
+            "hash.sha512",
+            "hash.sha512_224",
+            "hash.sha512_256",
+            "hash.xxh64",
+            "event.origin",
+            "user.entity_id",
+            "user.terminal",
+            "process.entity_id",
+            "process.hash.blake2b_256",
+            "process.hash.blake2b_384",
+            "process.hash.blake2b_512",
+            "process.hash.sha224",
+            "process.hash.sha384",
+            "process.hash.sha3_224",
+            "process.hash.sha3_256",
+            "process.hash.sha3_384",
+            "process.hash.sha3_512",
+            "process.hash.sha512_224",
+            "process.hash.sha512_256",
+            "process.hash.xxh64",
+            "socket.entity_id",
+            "system.audit.host.timezone.name",
+            "system.audit.host.hostname",
+            "system.audit.host.id",
+            "system.audit.host.architecture",
+            "system.audit.host.mac",
+            "system.audit.host.os.codename",
+            "system.audit.host.os.platform",
+            "system.audit.host.os.name",
+            "system.audit.host.os.family",
+            "system.audit.host.os.version",
+            "system.audit.host.os.kernel",
+            "system.audit.package.entity_id",
+            "system.audit.package.name",
+            "system.audit.package.version",
+            "system.audit.package.release",
+            "system.audit.package.arch",
+            "system.audit.package.license",
+            "system.audit.package.summary",
+            "system.audit.package.url",
+            "system.audit.user.name",
+            "system.audit.user.uid",
+            "system.audit.user.gid",
+            "system.audit.user.dir",
+            "system.audit.user.shell",
+            "system.audit.user.user_information",
+            "system.audit.user.password.type",
+            "fields.*"
+          ]
+        },
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
\ No newline at end of file