[ES body removal] @elastic/security-defend-workflows

[afharo]

Summary

in preparation for 9.0, we're trying to remove the deprecated body param in the ES client.

To make it easier to review, the changes have been split into multiple PRs, trying to group them per code owner as much as possible.

However, unfortunately, due to cross-dependencies, your team may be pinged more than once. Apologies for that additional noise.

What changes?

Nothing changes internally. The ES client already places everything where it should be when performing the request to ES (URL vs. query string vs. body params).

The main change is in the usage: when using the JS ES client, developers don't need to identify what goes in the body and what goes in the URL. All settings are provided at the root level. So, in summary, the change is:

const response = await client.search({
  index: 'test',
-  body: {
    query: {
      match_all: {}
    }
-  }
})

For this reason, enabling the "Hide whitespace changes" option when reviewing is recommended.

Some exceptions to this rule:

• Bulk APIs replace the body array with operations array (direct replacement)
• Index Put Settings API replace body array with settings (direct replacement)

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: c0064a7

Failed CI Steps

• Check Types

History

• 💔 Build #262105 failed 42e70d4

cc @afharo

[afharo]

Closing in favor of #208776