Make link to es deprecation logs more useful

.github/CODEOWNERS

@@ -1142,6 +1142,8 @@ x-pack/test_serverless/api_integration/test_suites/common/platform_security @ela
 /x-pack/test_serverless/functional/test_suites/common/examples/unified_field_list_examples @elastic/kibana-data-discovery
 /x-pack/test_serverless/functional/test_suites/common/management/data_views @elastic/kibana-data-discovery
 src/plugins/discover/public/context_awareness/profile_providers/security @elastic/kibana-data-discovery @elastic/security-threat-hunting-investigations
+# TODO: this deprecation_logs folder should be owned by kibana management team after 9.0
+src/plugins/discover/public/context_awareness/profile_providers/common/deprecation_logs @elastic/kibana-data-discovery @elastic/kibana-core
 src/plugins/discover/public/context_awareness/profile_providers/observability @elastic/kibana-data-discovery @elastic/obs-ux-logs-team
 
 # Platform Docs

src/plugins/discover/public/context_awareness/profile_providers/common/deprecation_logs/consts.ts

@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+export const DEPRECATION_LOGS_PROFILE_ID = 'deprecation-logs-profile';
+export const DEPRECATION_LOGS_PATTERN_PREFIX = '.logs-deprecation';

src/plugins/discover/public/context_awareness/profile_providers/common/deprecation_logs/index.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+export { createDeprecationLogsDocumentProfileProvider } from './profile';

src/plugins/discover/public/context_awareness/profile_providers/common/deprecation_logs/profile.test.ts

@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { createStubIndexPattern } from '@kbn/data-views-plugin/common/data_view.stub';
+import { createDataViewDataSource } from '../../../../../common/data_sources';
+import { DataSourceCategory, RootContext, SolutionType } from '../../../profiles';
+import { createDeprecationLogsDocumentProfileProvider } from './profile';
+import type { ContextWithProfileId } from '../../../profile_service';
+import { DEPRECATION_LOGS_PROFILE_ID } from './consts';
+
+describe('deprecationLogsProfileProvider', () => {
+  const deprecationLogsProfileProvider = createDeprecationLogsDocumentProfileProvider();
+  const VALID_INDEX_PATTERN = '.logs-deprecation.elasticsearch-default';
+  const VALID_MIXED_INDEX_PATTERN =
+    '.logs-deprecation.elasticsearch-default,.logs-deprecation.abc,.logs-deprecation.def';
+  const INVALID_MIXED_INDEX_PATTERN = '.logs-deprecation.elasticsearch-default,metrics-*';
+  const INVALID_INDEX_PATTERN = 'my_source-access-*';
+  const ROOT_CONTEXT: ContextWithProfileId<RootContext> = {
+    profileId: DEPRECATION_LOGS_PROFILE_ID,
+    solutionType: SolutionType.Default,
+  };
+  const RESOLUTION_MATCH = {
+    isMatch: true,
+    context: {
+      category: DataSourceCategory.Logs,
+      formatRecord: expect.any(Function),
+    },
+  };
+  const RESOLUTION_MISMATCH = {
+    isMatch: false,
+  };
+
+  it('should match data view sources with an allowed index pattern', () => {
+    const result = deprecationLogsProfileProvider.resolve({
+      rootContext: ROOT_CONTEXT,
+      dataSource: createDataViewDataSource({ dataViewId: VALID_INDEX_PATTERN }),
+      dataView: createStubIndexPattern({ spec: { title: VALID_INDEX_PATTERN } }),
+    });
+    expect(result).toEqual(RESOLUTION_MATCH);
+  });
+
+  it('should match data view sources with a mixed pattern containing allowed index patterns', () => {
+    const result = deprecationLogsProfileProvider.resolve({
+      rootContext: ROOT_CONTEXT,
+      dataSource: createDataViewDataSource({ dataViewId: VALID_MIXED_INDEX_PATTERN }),
+      dataView: createStubIndexPattern({ spec: { title: VALID_MIXED_INDEX_PATTERN } }),
+    });
+    expect(result).toEqual(RESOLUTION_MATCH);
+  });
+
+  it('should NOT match data view sources with not allowed index pattern', () => {
+    const result = deprecationLogsProfileProvider.resolve({
+      rootContext: ROOT_CONTEXT,
+      dataSource: createDataViewDataSource({ dataViewId: INVALID_INDEX_PATTERN }),
+      dataView: createStubIndexPattern({ spec: { title: INVALID_INDEX_PATTERN } }),
+    });
+    expect(result).toEqual(RESOLUTION_MISMATCH);
+  });
+
+  it('should NOT match data view sources with a mixed pattern containing not allowed index patterns', () => {
+    const result = deprecationLogsProfileProvider.resolve({
+      rootContext: ROOT_CONTEXT,
+      dataSource: createDataViewDataSource({ dataViewId: INVALID_MIXED_INDEX_PATTERN }),
+      dataView: createStubIndexPattern({ spec: { title: INVALID_MIXED_INDEX_PATTERN } }),
+    });
+    expect(result).toEqual(RESOLUTION_MISMATCH);
+  });
+});

src/plugins/discover/public/context_awareness/profile_providers/common/deprecation_logs/profile.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { isOfAggregateQueryType } from '@kbn/es-query';
+import { getIndexPatternFromESQLQuery } from '@kbn/esql-utils';
+import { DataSourceCategory } from '../../../profiles';
+import { DataSourceType, isDataSourceType } from '../../../../../common/data_sources';
+import { type DataSourceProfileProvider } from '../../../profiles';
+import { DEPRECATION_LOGS_PATTERN_PREFIX, DEPRECATION_LOGS_PROFILE_ID } from './consts';
+
+export const createDeprecationLogsDocumentProfileProvider = (): DataSourceProfileProvider<{
+  formatRecord: (flattenedRecord: Record<string, unknown>) => string;
+}> => ({
+  profileId: DEPRECATION_LOGS_PROFILE_ID,
+  profile: {
+    getDefaultAppState: () => () => ({
+      columns: [
+        { name: 'log.level' },
+        { name: 'message' },
+        { name: 'elasticsearch.http.request.x_opaque_id' },
+        { name: 'elasticsearch.cluster.name' },
+        { name: 'elasticsearch.event.category' },
+      ],
+    }),
+  },
+  resolve: (params) => {
+    let indexPattern: string | undefined;
+
+    if (isDataSourceType(params.dataSource, DataSourceType.Esql)) {
+      if (!isOfAggregateQueryType(params.query)) {
+        return { isMatch: false };
+      }
+
+      indexPattern = getIndexPatternFromESQLQuery(params.query.esql);
+    } else if (isDataSourceType(params.dataSource, DataSourceType.DataView) && params.dataView) {
+      indexPattern = params.dataView.getIndexPattern();
+    }
+
+    if (!checkAllIndicesInPatternAreDeprecationLogs(indexPattern)) {
+      return { isMatch: false };
+    }
+
+    return {
+      isMatch: true,
+      context: {
+        category: DataSourceCategory.Logs,
+        formatRecord: (record) => JSON.stringify(record, null, 2),
+      },
+    };
+  },
+});
+
+/*
+  This function returns true if the index pattern belongs to deprecation logs.
+  It also considers multiple patterns separated by commas.
+*/
+const checkAllIndicesInPatternAreDeprecationLogs = (indexPattern: string | undefined): boolean => {
+  if (!indexPattern) {
+    return false;
+  }
+  const indexPatternArray = indexPattern.split(',');
+  const result = indexPatternArray.reduce(
+    (acc, val) => acc && val.startsWith(DEPRECATION_LOGS_PATTERN_PREFIX),
+    true
+  );
+  return result;
+};

src/plugins/discover/public/context_awareness/profile_providers/register_profile_providers.ts

@@ -28,6 +28,7 @@ import {
 } from './profile_provider_services';
 import type { DiscoverServices } from '../../build_services';
 import { createObservabilityRootProfileProvider } from './observability/observability_root_profile';
+import { createDeprecationLogsDocumentProfileProvider } from './common/deprecation_logs';
 
 /**
  * Register profile providers for root, data source, and document contexts to the profile profile services
@@ -133,6 +134,7 @@ const createRootProfileProviders = (providerServices: ProfileProviderServices) =
  */
 const createDataSourceProfileProviders = (providerServices: ProfileProviderServices) => [
   createExampleDataSourceProfileProvider(),
+  createDeprecationLogsDocumentProfileProvider(),
   ...createObservabilityLogsDataSourceProfileProviders(providerServices),
 ];