[Synthetics] Add synthetics/api input + api / api.network data streams

packages/synthetics/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.7.0"
+  changes:
+    - description: Add `synthetics/api` input type and `api` / `api.network` data streams to support API Journey monitors.
+      type: enhancement
+      link: https://github.com/elastic/kibana/pull/270874
 - version: "1.6.1"
   changes:
     - description: Add monitor interval field to synthetics package

packages/synthetics/data_stream/api/agent/stream/api.yml.hbs

@@ -0,0 +1,59 @@
+__ui: {{__ui}}
+type: {{type}}
+name: {{name}}
+{{#if id}}
+id: {{id}}
+{{/if}}
+{{#if origin}}
+origin: {{origin}}
+{{/if}}
+{{#if location_id}}
+run_from.id: {{location_id}}
+{{/if}}
+{{#if location_name}}
+run_from.geo.name: {{location_name}}
+{{/if}}
+enabled: {{enabled}}
+{{#if service.name}}
+service.name: {{service.name}}
+{{/if}}
+schedule: {{schedule}}
+timeout: {{timeout}}
+{{#if tags}}
+tags: {{tags}}
+{{/if}}
+{{#if source.inline.script}}
+source.inline.script: {{source.inline.script}}
+{{/if}}
+{{#if source.inline.encoding}}
+source.inline.encoding: {{source.inline.encoding}}
+{{/if}}
+{{#if source.project.content}}
+source.project.content: {{source.project.content}}
+{{/if}}
+{{#if params}}
+params: {{params}}
+{{/if}}
+{{#if playwright_options}}
+playwright_options: {{playwright_options}}
+{{/if}}
+{{#if filter_journeys.match}}
+filter_journeys.match: {{filter_journeys.match}}
+{{/if}}
+{{#if filter_journeys.tags}}
+filter_journeys.tags: {{filter_journeys.tags}}
+{{/if}}
+{{#if ignore_https_errors}}
+ignore_https_errors: {{ignore_https_errors}}
+{{/if}}
+{{#if max_attempts}}
+max_attempts: {{max_attempts}}
+{{/if}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
+{{#if maintenance_windows}}
+maintenance_windows:
+{{maintenance_windows}}
+{{/if}}

packages/synthetics/data_stream/api/elasticsearch/ilm/default_policy.json

@@ -0,0 +1,23 @@
+{
+    "policy": {
+        "phases": {
+            "hot": {
+                "actions": {
+                    "rollover": {
+                        "max_age": "30d",
+                        "max_primary_shard_size": "50gb"
+                    },
+                    "set_priority": {
+                        "priority": 100
+                    }
+                }
+            },
+            "delete": {
+                "min_age": "365d",
+                "actions": {
+                    "delete": {}
+                }
+            }
+        }
+    }
+}

packages/synthetics/data_stream/api/fields/base-fields.yml

@@ -0,0 +1,14 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+  value: synthetics
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset name.
+  value: api
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
+- name: '@timestamp'
+  type: date
+  description: Event timestamp.

packages/synthetics/data_stream/api/fields/beat.yml

@@ -0,0 +1,6 @@
+- name: fields
+  type: object
+  object_type: keyword
+  description: >
+    Contains user configurable fields.
+

packages/synthetics/data_stream/api/fields/cloud.yml

@@ -0,0 +1,6 @@
+- name: cloud.image.id
+  example: ami-abcd1234
+  type: keyword
+  description: >
+    Image ID for the cloud instance.
+

packages/synthetics/data_stream/api/fields/common.yml

@@ -0,0 +1,170 @@
+- name: config_id
+  type: keyword
+  description: The id of run_once monitor, when initiated from the Monitor Management flow
+- name: test_run_id
+  type: keyword
+  description: The id of run_once monitor, when initiated from the Monitor Overview page
+- name: run_once
+  type: boolean
+  description: Whether the monitor is a run_once monitor
+- name: service.name
+  type: keyword
+  description: APM service name this monitor is linked to
+- name: meta
+  type: object
+  object_type: keyword
+  description: >
+    The meta fields allow you to add additional information to a monitor.
+
+- name: monitor
+  type: group
+  description: >
+    Common monitor fields.
+
+  fields:
+    - name: type
+      type: constant_keyword
+      value: api
+      description: >
+        The monitor type.
+
+    - name: name
+      type: keyword
+      description: >
+        The monitors configured name
+
+      multi_fields:
+        - name: text
+          type: text
+          analyzer: simple
+    - name: id
+      type: keyword
+      description: >
+        The monitors full job ID as used by heartbeat.
+
+      multi_fields:
+        - name: text
+          type: text
+          analyzer: simple
+    - name: duration
+      type: group
+      description: Total monitoring test duration
+      fields:
+        - name: us
+          type: long
+          description: Duration in microseconds
+    - name: ip
+      type: ip
+      description: >
+        IP of service being monitored. If service is monitored by hostname, the `ip` field contains the resolved ip address for the current host.
+
+    - name: status
+      type: keyword
+      description: >
+        Indicator if monitor could validate the service to be available.
+
+    - name: check_group
+      type: keyword
+      description: >
+        A token unique to a simultaneously invoked group of checks as in the case where multiple IPs are checked for a single DNS entry.
+
+    - name: timespan
+      type: date_range
+      description: >
+        Time range this ping reported starting at the instant the check was started, ending at the start of the next scheduled check.
+
+    - name: interval
+      type: integer
+      description: >
+        Interval of the monitor in seconds. This is the interval at which the monitor is scheduled to run.
+
+    - name: fleet_managed
+      type: boolean
+      description: >
+        True if monitor is created with the Fleet integration UI
+
+    - name: origin
+      type: keyword
+      description: >
+        The source of this monitor configuration, usually either "ui", or "project"
+
+    - name: project
+      type: group
+      description: >
+        Project info for this monitor
+
+      fields:
+        - name: id
+          type: keyword
+          description: Project ID
+        - name: name
+          type: text
+          description: Project name
+- name: state
+  type: group
+  description: "Present in the last event emitted during a check. If a monitor checks multiple endpoints, as is the case with `mode: all`."
+  fields:
+    - name: id
+      type: keyword
+      description: >
+        ID of this state
+
+    - name: started_at
+      type: date
+      description: >
+        First time state with this ID was seen
+
+    - name: duration_ms
+      type: long
+      description: >
+        Length of time this state has existed in millis
+
+    - name: status
+      type: keyword
+      description: >
+        The current status, "up", "down", or "flapping" any state can change into flapping.
+
+    - name: checks
+      type: integer
+      description: total checks run
+    - name: up
+      type: integer
+      description: total up checks run
+    - name: down
+      type: integer
+      description: total down checks run
+    - name: flap_history
+      enabled: false
+    - name: ends
+      type: group
+      description: the state that was ended by this state
+      fields:
+        - name: id
+          type: keyword
+          description: >
+            ID of this state
+
+        - name: started_at
+          type: date
+          description: >
+            First time state with this ID was seen
+
+        - name: duration_ms
+          type: long
+          description: >
+            Length of time this state has existed in millis
+
+        - name: status
+          type: keyword
+          description: >
+            The current status, "up", "down", or "flapping" any state can change into flapping.
+
+        - name: checks
+          type: integer
+          description: total checks run
+        - name: up
+          type: integer
+          description: total up checks run
+        - name: down
+          type: integer
+          description: total down checks run

packages/synthetics/data_stream/api/fields/docker.yml

@@ -0,0 +1,9 @@
+- name: docker
+  type: group
+  fields:
+    - name: container.labels # TODO: How to map these?
+      type: object
+      object_type: keyword
+      description: >
+        Image labels.
+