/* LOGINSIGHT: Aria-style row = raw log line, then field names. Hover a name to highlight the value it extracted inside the log. Discover only. */ .loginsight-raw{ display:block; font:13px/1.5 "SFMono-Regular",Consolas,"Liberation Mono",Menlo,monospace; color:#000; white-space:pre-wrap; word-break:break-word; } .loginsight-fields{ margin-top:5px; font:12px/1.7 system-ui,-apple-system,sans-serif; white-space:normal; word-break:break-word; } .loginsight-fields span{ color:#0b5fff; margin-right:12px; cursor:pointer; } .loginsight-fields span:hover{ text-decoration:underline; color:#0847c4; } .loginsight-fields span.ls-on{ font-weight:700; color:#0847c4; border-bottom:1px solid #0847c4; } .loginsight-fields span.ls-nomatch{ color:#8a8f98; } mark.ls-hl{ background:#b9f6ca; color:#000; padding:0 1px; border-radius:2px; } dl.source[data-ls="1"]{ max-height:none !important; overflow:visible !important; } /* Long logs (e.g. RT_FLOW, 36 fields) wrapped past OSD's height clamp and clipped the field row. truncate:maxHeight is now 0; these rules are belt-and-braces plus a clear separator so the field row is always readable no matter how tall the log line is. */ dl.source.truncate-by-height[data-ls="1"]{ max-height:none !important; overflow:visible !important; display:block !important; } .loginsight-fields{ border-top:1px solid #e3e6eb; padding-top:4px; overflow:visible; } .loginsight-raw{ max-height:none; overflow:visible; } /* Login page brand image: the security plugin renders it as , so a square mark-only SVG expands to fill the whole login card. Constrain it to an icon-sized logo and keep it centred. Selector scoped to .login-wrapper, which only exists on the login page. */ .login-wrapper .euiImage{ display:block !important; width:100% !important; max-width:100% !important; margin:0 !important; text-align:center !important; } .login-wrapper .euiImage__img{ width:64px !important; max-width:64px !important; height:auto !important; display:inline-block !important; margin:0 auto !important; float:none !important; } /* Explorer (Observability > Logs): its

is an EUI *inline* description list, i.e. display:flex;flex-wrap:wrap. Once we replace its children with our raw block + field row, that flex layout would sit them side by side - force block so they stack. */ dl[data-ls="1"]{ display:block !important; max-height:none !important; overflow:visible !important; height:auto !important; } .obsExplorer dl[data-ls="1"]{ max-height:none !important; overflow:visible !important; } .obsExplorer .loginsight-raw{ white-space:pre-wrap; word-break:break-word; } /* Explorer row height (operator screenshot S_29): the Observability doc table sizes rows to the first line and .obsExplorer .truncate-by-height has overflow:hidden, which cut the field-name row in half. Let the whole ancestor chain grow. Scoped to .obsExplorer, so Discover and every other page are unaffected. */ .obsExplorer tr, .obsExplorer td{ height:auto !important; max-height:none !important; } .obsExplorer td{ overflow:visible !important; } .obsExplorer .truncate-by-height{ overflow:visible !important; max-height:none !important; height:auto !important; display:block !important; } .obsExplorer dl[data-ls="1"]{ overflow:visible !important; max-height:none !important; height:auto !important; } .obsExplorer .loginsight-fields{ overflow:visible !important; white-space:normal !important; } .obsExplorer .loginsight-raw{ overflow:visible !important; } /* Explorer sidebar collapse button (injected by ui.js, position:fixed on so it changes no existing element's layout). Styled to match Discover's control. */ .ls-sb-toggle{ position:fixed; z-index:1000; width:20px; height:24px; padding:0; text-align:center; cursor:pointer; border:1px solid #d3dae6; border-radius:4px; background:#fff; color:#0b5fff; font:13px/22px system-ui,-apple-system,sans-serif; box-shadow:0 1px 2px rgba(0,0,0,.14); } .ls-sb-toggle:hover{ background:#f1f4fa; color:#0847c4; } /* Explorer: remove EuiDataGrid's per-cell "interact with cell content" affordance. Source: @elastic/eui data_grid_cell_buttons.js - this build's fork emits the class as ouiDataGridRowCell__expandButton (oui prefix), while the EUI theme CSS uses euiDataGridRowCell__*. The [class*=] substring selector below matches BOTH, so the rule cannot miss because of the prefix. Structure is __expandFlex > (__expandContent | __expandButton): we hide only the BUTTON, never __expandContent, so the raw log + field row remain fully intact. The row-inspect icon in the first column is a different control and is untouched. */ .obsExplorer [class*="DataGridRowCell__expandButton"], .obsExplorer [class*="DataGridRowCell__actionButtonIcon"], .obsExplorer [class*="DataGridRowCell__actions"]{ display:none !important; } /* 7. Aria-style select-text menu in Discover (S_54) */ .ls-selpop{ position:absolute; z-index:12000; min-width:210px; max-width:300px; background:#fff; border:1px solid #d3dae6; border-radius:6px; box-shadow:0 6px 18px rgba(0,0,0,.18); padding:6px 0; font:13px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif; } .ls-selpop-h{ padding:5px 14px 7px; font-weight:700; color:#1a1c21; } .ls-selpop-i{ display:block; width:100%; text-align:left; border:0; background:none; padding:6px 14px; font:inherit; color:#006bb4; cursor:pointer; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; } .ls-selpop-i:hover{ background:#e6f3fa; } .ls-selpop-sep{ height:1px; background:#d3dae6; margin:5px 0; } .ls-selpop-x{ color:#1a1c21; font-weight:600; } /* ---- 11 Aria's per-field Add Filter menu (S_112, S_113) ----------------- */ .loginsight-fields > span .ls-caret{ display:none; margin-left:4px; font-size:10px; line-height:1; opacity:.8; cursor:pointer; vertical-align:middle; } .loginsight-fields > span:hover .ls-caret{ display:inline-block; } .loginsight-fields > span .ls-caret:hover{ opacity:1; } .ls-fieldpop{ min-width:250px; max-width:340px; } /* ---- 12 rows-per-page control, styled like the Explorer's own (S_5/S_6) -- */ /* keep EUI's 12px gutter compensation on the left - zeroing it clipped the control against the panel edge (S_18/S_19) */ .osdDocTable_pagination .ls-rpp{ margin:2px 0 2px 12px; } .ls-rpp-btn{ border:0; background:none; cursor:pointer; padding:2px 4px; font:400 12px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif; color:#343741; display:inline-flex; align-items:center; gap:4px; border-radius:4px; } .ls-rpp-btn:hover{ color:#006bb4; text-decoration:underline; } .ls-rpp-btn:focus{ outline:2px solid #006bb4; outline-offset:1px; } .ls-rpp-caret{ font-size:10px; line-height:1; opacity:.8; } .ls-rpp-pop{ position:fixed; z-index:12000; min-width:132px; padding:4px 0; background:#fff; border:1px solid #d3dae6; border-radius:6px; box-shadow:0 6px 18px rgba(0,0,0,.18); font:400 13px/1.4 -apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif; } .ls-rpp-item{ display:flex; align-items:center; gap:8px; width:100%; text-align:left; border:0; background:none; padding:7px 14px; font:inherit; color:#343741; cursor:pointer; } .ls-rpp-item:hover{ background:#e6f3fa; } .ls-rpp-item-on{ font-weight:600; } .ls-rpp-tick{ width:12px; display:inline-block; color:#006bb4; } /* ---- 13 one scrollbar in Discover, not two -------------------------------- [data-test-subj="discoverTable"] is EUI's horizontal-scroll wrapper (.eui-xScrollWithShadows). Its own horizontal scrollbar consumes ~12px of height, which makes scrollHeight exceed clientHeight by exactly that much and draws a SECOND, useless vertical scrollbar beside dscCanvas - and it steals the wheel while the pointer is over the table. Vertical scrolling belongs to dscCanvas alone; horizontal scrolling here is untouched. Discover only: the attribute exists nowhere else. */ /* superseded by ui.js feature 15: the table now owns the vertical scroll, so it must NOT be overflow-y:hidden. One scrollbar still, and the header can stick. */ [data-test-subj="discoverTable"].eui-xScrollWithShadows{ overflow-y:hidden !important; } /* ---- 14 Discover column titles: titles, not log text ---------------------- They inherited the monospace log face at 12px - the same size as the data they label - so they read as weak. Give them the UI font, uppercase, and a header band, and keep them visible while scrolling a 100-row page. Scoped under [data-test-subj="discoverTable"], which exists only in Discover. */ [data-test-subj="discoverTable"] [data-test-subj="docTable"] thead th{ font-family:"Source Sans 3","Inter UI",-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif !important; font-size:14px !important; font-weight:600 !important; letter-spacing:.2px; color:#1a1c21 !important; background:#f5f7fa !important; border-bottom:1px solid #d3dae6 !important; padding:10px 8px !important; white-space:nowrap; z-index:3; } /* the time column must fit its title without wrapping */ [data-test-subj="discoverTable"] [data-test-subj="docTable"] thead th:nth-child(2){ min-width:190px; } /* ---- 16 the field chips stay on one line ----------------------------------- The blue chips under each log (severity app source_host ...) wrapped onto a second line at narrow widths, splitting words ("facilit / y") and adding a ragged row under every record. Keep them on one line and let the row scroll sideways if it must; the scrollbar itself is hidden so it never adds height. Scoped to Discover's table - the Explorer renders the same chips and is not part of this change. */ [data-test-subj="discoverTable"] .loginsight-fields{ white-space:nowrap; overflow-x:auto; overflow-y:hidden; scrollbar-width:none; } [data-test-subj="discoverTable"] .loginsight-fields::-webkit-scrollbar{ height:0; width:0; } /* ---- 17 clear space under the header, and nowhere else -------------------- With the pager merged onto the title row the table is pulled up by its full height, which left the first log line underlapping the band (S_34: measured -5px). Pad the FIRST row only - operator asked for the gap under the header, not between every record, which would cost a row per screen. */ [data-test-subj="discoverTable"] [data-test-subj="docTable"] tbody tr:first-child td{ padding-top:22px !important; }