public async getTimelineData(
   request: FrameworkRequest,
   options: EventsRequestOptions
 ): Promise<TimelineData> {
   const queryOptions = cloneDeep(options);
   queryOptions.fields = uniq([
     ...queryOptions.fieldRequested,
     ...reduceFields(queryOptions.fields, eventFieldsMap),
   ]);
   delete queryOptions.fieldRequested;
   const response = await this.framework.callWithRequest<EventHit, TermAggregation>(
     request,
     'search',
     buildQuery(queryOptions)
   );
   const { limit } = options.pagination;
   const totalCount = getOr(0, 'hits.total.value', response);
   const hits = response.hits.hits;
   const timelineEdges: TimelineEdges[] = hits.map(hit =>
     formatTimelineData(options.fieldRequested, options.fields, hit, eventFieldsMap)
   );
   const hasNextPage = timelineEdges.length === limit + 1;
   const edges = hasNextPage ? timelineEdges.splice(0, limit) : timelineEdges;
   const lastCursor = get('cursor', last(edges));
   return { edges, totalCount, pageInfo: { hasNextPage, endCursor: lastCursor } };
 }

  public async getEvents(request: FrameworkRequest, options: RequestOptions): Promise<EventsData> {
    const queryOptions = cloneDeep(options);
    queryOptions.fields = reduceFields(options.fields, eventFieldsMap);
    const response = await this.framework.callWithRequest<EventHit, TermAggregation>(
      request,
      'search',
      buildQuery(queryOptions)
    );

    const kpiEventType: KpiItem[] =
      response.aggregations && response.aggregations.count_event_type
        ? response.aggregations.count_event_type.buckets.map(item => ({
            value: item.key,
            count: item.doc_count,
          }))
        : [];
    const { limit } = options.pagination;
    const totalCount = getOr(0, 'hits.total.value', response);
    const hits = response.hits.hits;
    const eventsEdges: EcsEdges[] = hits.map(hit =>
      formatEventsData(options.fields, hit, eventFieldsMap)
    );
    const hasNextPage = eventsEdges.length === limit + 1;
    const edges = hasNextPage ? eventsEdges.splice(0, limit) : eventsEdges;
    const lastCursor = get('cursor', last(edges));
    return { kpiEventType, edges, totalCount, pageInfo: { hasNextPage, endCursor: lastCursor } };
  }

  describe('No pagination', () => {
    const mockNoPaginationResponse = cloneDeep(mockResponse);
    mockNoPaginationResponse.aggregations.top_n_flow_count.value = 10;
    mockNoPaginationResponse.aggregations.top_uni_flow.buckets = mockNoPaginationResponse.aggregations.top_uni_flow.buckets.slice(
      0,
      -1
    );
    const mockCallWithRequest = jest.fn();
    mockCallWithRequest.mockResolvedValue(mockNoPaginationResponse);
    const mockFramework: FrameworkAdapter = {
      version: 'mock',
      callWithRequest: mockCallWithRequest,
      exposeStaticDir: jest.fn(),
      registerGraphQLEndpoint: jest.fn(),
      getIndexPatternsService: jest.fn(),
      getSavedObjectsService: jest.fn(),
    };
    jest.doMock('../framework', () => ({
      callWithRequest: mockCallWithRequest,
    }));

    test('getNetworkTopNFlow', async () => {
      const EsNetworkTopNFlow = new ElasticsearchNetworkAdapter(mockFramework);
      const data: NetworkTopNFlowData = await EsNetworkTopNFlow.getNetworkTopNFlow(
        mockRequest as FrameworkRequest,
        mockOptions
      );
      expect(data.pageInfo.hasNextPage).toBeFalsy();
    });
  });

 beforeEach(() => {
   state = cloneDeep(toggleLockTimeline('timeline', mockGlobalState.inputs));
 });

 test('Packetbeat transformation', async () => {
   const convertData: Schema = cloneDeep(packetbeatSchema).slice(0, 1);
   convertData[0].fields = isArray(convertData[0].fields)
     ? convertData[0].fields!.slice(0, 6)
     : [];
   expect(convertSchemaToAssociativeArray(convertData)).toEqual({
     '@timestamp': {
       description:
         'Date/time when the event originated. For log events this is the date/time when the event was generated, and not when it was read. Required field for all events.',
       example: '2016-05-23T08:05:34.853Z',
       name: '@timestamp',
       type: 'date',
     },
     tags: {
       description: 'List of keywords used to tag each event.',
       example: '["production", "env2"]',
       name: 'tags',
       type: 'keyword',
     },
     labels: {
       description:
         'Key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels.',
       example: '{"env":"production","application":"foo-bar"}',
       name: 'labels',
       type: 'object',
     },
     message: {
       description:
         'For log events the message field contains the log message. In other use cases the message field can be used to concatenate different values which are then freely searchable. If multiple messages exist, they can be combined into one message.',
       example: 'Hello World',
       name: 'message',
       type: 'text',
     },
     agent: {
       description:
         'The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host. Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.',
       name: 'agent',
       type: 'group',
       fields: {
         'agent.version': {
           description: 'Version of the agent.',
           example: '6.0.0-rc2',
           name: 'version',
           type: 'keyword',
         },
         'agent.name': {
           description:
             'Name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.',
           example: 'foo',
           name: 'name',
           type: 'keyword',
         },
         'agent.type': {
           description:
             'Type of the agent. The agent type stays always the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.',
           example: 'filebeat',
           name: 'type',
           type: 'keyword',
         },
         'agent.id': {
           description:
             'Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.',
           example: '8a4f500d',
           name: 'id',
           type: 'keyword',
         },
         'agent.ephemeral_id': {
           description:
             'Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not.',
           example: '8a4f500f',
           name: 'ephemeral_id',
           type: 'keyword',
         },
       },
     },
     client: {
       description:
         'A client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records. For TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term "originator" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields.  Client fields are generally not populated for packet-level events. Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately.',
       name: 'client',
       type: 'group',
       fields: {
         'client.address': {
           description:
             'Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.',
           name: 'address',
           type: 'keyword',
         },
         'client.ip': {
           description:
             'IP address of the client. Can be one or multiple IPv4 or IPv6 addresses.',
           name: 'ip',
           type: 'ip',
         },
         'client.port': {
           description: 'Port of the client.',
           name: 'port',
           type: 'long',
         },
         'client.mac': {
           description: 'MAC address of the client.',
//.........这里部分代码省略.........