Skip to content

CLOSED - improper rebase#245447

Closed
wildemat wants to merge 45 commits intoelastic:mainfrom
wildemat:wildemat/search-team/11480/deprecate-ff-part-2
Closed

CLOSED - improper rebase#245447
wildemat wants to merge 45 commits intoelastic:mainfrom
wildemat:wildemat/search-team/11480/deprecate-ff-part-2

Conversation

@wildemat
Copy link
Contributor

@wildemat wildemat commented Dec 5, 2025

improper branch rebase. closing

wildemat and others added 30 commits December 4, 2025 16:46
## Summary

Added super date picker in all cases table, including a `Show all cases`
and `Last 30 days` in custom quick select.




https://github.com/user-attachments/assets/ffcd3aee-e485-484d-af4d-ff9fb269ae26




### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.
Part of elastic#222615

Part of "Dashboards as code" project involves moving reference handling
from client to server. References add complexity to dashboard REST API.
Moving reference handling to server removes references from dashboard
REST API.

This PR registers transformIn and transformOut methods for stats
overview embeddable. On write, dashboard uses `transformIn` to extract
drilldown references. On read, dashboard users `transformOut` to inject
drilldown references. In this way, the REST API and stats overview
embeddable client code no longer need to account for references as all
reference handling is done on the server.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Fixes elastic#244809


<img width="650" height="725" alt="Screenshot 2025-12-04 at 12 41 22"
src="https://github.com/user-attachments/assets/f9ce8d0f-977c-4fe9-9f62-b7dfaed91e7e"
/>

Follow up ticket elastic#245225
## Summary
visual bugfix: adds back `overflow: hidden` to hide the overflow content
when using line clamp for the thinking label

before:
<img width="871" height="277" alt="image"
src="https://github.com/user-attachments/assets/1a570a7b-b82b-4d5f-9098-f7f7f8d21437"
/>
after:
<img width="863" height="219" alt="image"
src="https://github.com/user-attachments/assets/8af262bc-e106-4e84-a880-2ba3962d5486"
/>


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...
## Summary

Small feature to auto focus conversation history input when the popover
is opened


https://github.com/user-attachments/assets/469e3bbf-4e09-4ad7-a454-89efcb626e12


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...
…c#245315)

Closes elastic#245320

## Summary

This PR updates the `observability_agent` plugin name to
`observability_agent_builder` as we have all things agent builder in
this plugin, not only the agent.

The APM plugin folder structure is also updated to reflect Agent
Builder.

### Checklist

- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
…ooter (elastic#244490)

Closes elastic#225710

## Summary

- moved the `Save` and `Save & Test` buttons to the flyout footer for: 
    <details> 
    <summary>Create connector flyout </summary>
<img width="785" height="1242" alt="Screenshot 2025-12-02 at 10 13 13"
src="https://github.com/user-attachments/assets/6d3c5d7d-61a7-4b31-b3a1-a9d8c7aec097"
/>
    </details>
    
   <details> 
    <summary>Edit connector flyout </summary>
<img width="777" height="1239" alt="Screenshot 2025-12-02 at 10 14 36"
src="https://github.com/user-attachments/assets/5f79a85c-d59d-479e-bb6e-49a9a6f8958d"
/>
    </details>
## Summary

In the retention page, if the time picker's period is before the data
stream was created but the stream has documents in that range
(backfilled/delayed data) we get a negative value for the ingestion
rate.

This change ensures we only pick the data stream's creation date when
it's before the time picker's end date


<img width="1883" height="378" alt="Untitled"
src="https://github.com/user-attachments/assets/60bae1cf-ea2c-43db-a029-d006fffd1e0b"
/>
…lastic#245318)

## Summary

This PR fixes an issue where the indicator wrapper would prevent the
underlying button from being fully clickable. This fix still allows for
tooltip to work when hovering over the dot icon.
## Summary

The` (Not)Like `and `(Not)RLike` operators should suggest only Text,
because they perform pattern matching. Their suggestion logic can follow
the same approach used for `Rerank `and `Completion`.
Currently they suggest a bit of everything.


https://github.com/user-attachments/assets/6049ff9a-9c4a-43bb-9291-75b4b7635a4f
## Summary

Closes elastic#236543

Enables by default background search in all the environments.

With this we get access by default to the background search feature,
this allows users to run long running queries asynchronously while they
continue using Kibana normally.

<img width="1875" height="971" alt="image"
src="https://github.com/user-attachments/assets/fe34fd9d-cc2c-45c8-84d7-4fc76f62f16f"
/>

Users can also access their backgrounded searches and see the current
status of each of them or open them once they are completed.

<img width="1875" height="971" alt="image (1)"
src="https://github.com/user-attachments/assets/8113b476-4719-4bc1-88b3-bddbc224091d"
/>

<img width="1878" height="972" alt="image"
src="https://github.com/user-attachments/assets/25af3be3-e88e-4e51-aca6-fc21cf1660f2"
/>


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.
## Summary

This PR make sure we consistently set the Elasticsearch project type.
There's a priority order for selecting the value:
1. If the Elasticsearch parameter `serverless.project_type` is already
provided (like e.g. in [this test
config](https://github.com/elastic/kibana/blob/main/x-pack/platform/test/serverless/functional/config.logs_essentials.base.ts#L21)),
we go with that value
2. if that's not the case, we check the options for a provided
`esProjectType` (typically comes from the CLI via `yarn es serverless
--projectType=X`)
3. If no Elasticsearch specific project type is provided, we fall back
to determining it from the Kibana project type, where for most projects
there's a 1:1 mapping - for the Kibana `es` project type we're
defaulting to `elasticsearch_general_purpose` which should be in line
with the behavior before this PR.

This change now requires to set the Elasticsearch project type correctly
on the CLI, e.g.
```
yarn es serverless --projectType elasticsearch_general_purpose
```
the `es` Kibana project type is no longer accepted.

### Other details
- The `yarn es serverless` CLI still accepts the `projectType` parameter
for the new `esProjectType` setting, so we're backwards compatible with
any current usage
- Value and type definitions for the project types and project tiers
have been streamlined to avoid duplicated listing of entries
- The Kibana `workplaceai` project type is now associated with the
`workplaceai` Elasticsearch project type
- We decided to keep the Scout runs as is for now (going with Kibana
project types)
…on (elastic#245326)

close elastic/security-team#14960

## Summary

Fixes a runtime error on Kibana Serverless where the `@kbn/workflows`
module fails to load due to a missing file.

## Problem

Files with `.test.` in their filename are excluded from production
builds by the `excludeFileByTags` function in `build_packages_task.ts`.
The Elasticsearch `query_rules.test` API endpoint was being excluded
because its generated filename (`elasticsearch.query_rules.test.gen.ts`)
contained `.test.`, which triggered the build exclusion rule.

This caused the following runtime error on Serverless:

```
Error: Cannot find module './elasticsearch.query_rules.test.gen'
Require stack:
- /usr/share/kibana/node_modules/@kbn/workflows/spec/elasticsearch/generated/index.js
```

## Solution

Updated the ES connector generator to use underscores instead of dots in
filenames while keeping the runtime `type` field unchanged for
compatibility.

| Before | After |
|--------|-------|
| `elasticsearch.query_rules.test.gen.ts` |
`elasticsearch.query_rules_test.gen.ts` |
| ❌ Excluded by build | ✅ Included in build |

The `type` field inside each contract (e.g.,
`'elasticsearch.query_rules.test'`) remains unchanged, so all runtime
lookups continue to work correctly.

## Testing

- [x] Built Kibana locally with `yarn build --skip-os-packages`
- [x] Verified the file exists in the serverless build output
- [x] Verified the `@kbn/workflows` module loads successfully from the
built distribution

## Changes

- Modified `generate_es_connectors.ts` to use underscores in generated
filenames
- Regenerated all ES connector files with the new naming convention

## Risk

Low - This is a filename-only change. The runtime behavior and API
contracts remain identical.

---------

Co-authored-by: Kirill Chernakov <kirill.chernakov@elastic.co>
Co-authored-by: Kirill Chernakov <yakiryous@gmail.com>
Part of elastic#235730
## Summary
* New way  of inserting rows and columns
* Simplified layout
* Rows height has been adjusted
* We are now displaying 50 rows by default.


![lookup](https://github.com/user-attachments/assets/26ea5fc3-2f1b-43e3-8926-2cc33e119d87)


### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Stratou <efstratia.kalafateli@elastic.co>
## Summary

Update Vega dependencies to 6.x.

This pull request updates the project's Vega and Vega-Lite dependencies
to their latest major versions.

**Dependency Upgrades and Import Handling**

- Upgraded `vega`, `vega-lite`, `vega-interpreter`, `vega-tooltip`, and
related libraries to their latest major versions in `package.json`, and
updated their import paths throughout the codebase.

- Removed legacy Webpack and Storybook configuration for the old `vega`
build, including `noParse` rules and aliases, and updated the import
resolver to point to the new `vega-lite` and `vega-tooltip` build
directories.

**Testing and TypeScript Support**

- Added a Jest setup mock for `vega` and `vega-lite` to ensure tests run
correctly with the new versions, and updated Jest transform ignore
patterns to support new Vega-related packages.
- Updated `tsconfig.base.json` to include type definitions for
`vega-lite` and `vega-tooltip`.

**Babel and Build Tools**

- Added `@babel/plugin-syntax-import-attributes` to dependencies and
Babel preset to enable the new import attributes syntax.

**Test Snapshots**

- Updated Vega visualization test snapshots to reflect the new
rendering/output from upgraded dependencies.


---------

Co-authored-by: Tiago Costa <tiago.costa@elastic.co>
…e from the action client (elastic#244619)

Closes elastic#243808

## Summary

Makes the utility function `getAxiosInstanceWithAuth` accessible outside
the plugin via the `actionsClient`.

For a given connector ID, this function validates the secrets and
returns an axios instance properly configured with authentication.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
…hen in UIAM mode (elastic#245063)

## Summary

During the transitional period and staged rollout, Kibana needs to be
able to handle sessions using **either** UIAM or ES native access and
refresh tokens, even when UIAM mode is enabled in Kibana. To achieve
this, in addition to checking the UIAM configuration, Kibana also checks
whether the access token returned by the Elasticsearch SAML realm starts
with the well-known UIAM token prefix: `essu_`.

## How to test

### UIAM mode with UIAM tokens
Start both ES and Kibana in UIAM mode and check if you can log in.
```bash
$ yarn es serverless --projectType security --uiam
$ yarn start --serverless=security --uiam
```

### UIAM mode with ES native tokens
Start only Kibana in UIAM mode and check if you can log in.
```bash
$ yarn es serverless --projectType security
$ yarn start --serverless=security --uiam
```

/cc @slobodanadamovic
## Summary

Closes elastic#242932

Updates from the deprecated `EuiFilterSelectItem` to `EuiSelectable`.

| Select  | Before  | After  |
|---|---|---|
| Field type | <img width="161" height="280" alt="image"
src="https://github.com/user-attachments/assets/e9d5d8d0-0b8c-415b-83b4-587222aab2f9"
/> | <img width="207" height="285" alt="image"
src="https://github.com/user-attachments/assets/897feeb4-285a-4a3c-858b-ad2cef0a98de"
/> |
| Schema type | <img width="179" height="176" alt="image"
src="https://github.com/user-attachments/assets/c2cb3250-e5a4-4e09-9fec-74165c815090"
/> | <img width="202" height="158" alt="image"
src="https://github.com/user-attachments/assets/e8603783-ea8e-4cda-b766-5233a8737fba"
/> |
| Script language | <img width="180" height="132" alt="image"
src="https://github.com/user-attachments/assets/f7aac796-cd1a-4f98-9e6f-0a89ea4ab03f"
/> | <img width="197" height="133" alt="image"
src="https://github.com/user-attachments/assets/c16a429d-41f9-4b78-8e9f-72ccf939b0d7"
/> |

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.
This PR fixes the problem that after adding a condition, it's not
possible to add more processors anymore.

This happened because `isWhereBlockSchema` would return false for a
well-formed where-block if it contains an invalid processor, which is
the case when adding a new processor (because the default grok state has
an empty field name, which is not valid as per the schema). This broke
the validation logic.

By using `isWhereBlock` it makes the check cheaper and also doesn't fail
on invalid children. Also added a test for this.
jedrazb and others added 15 commits December 5, 2025 16:39
…or Security Solution Scout-related code (elastic#245361)

## Summary

Adds `@elastic/security-engineering-productivity` as a code owner for
Security Solution Scout-related code to improve onboarding and ensure
best practices during the initial adoption phase.

## Changes

- Added `@elastic/security-engineering-productivity` as a code owner for
`x-pack/solutions/security/packages/kbn-scout-security` (alongside
existing `@elastic/appex-qa` ownership)
- Added code ownership for
`/x-pack/solutions/security/plugins/security_solution/test/scout`
directory

## Motivation

These ownership updates will:
- Improve onboarding by ensuring the Security Engineering Productivity
team is notified of Scout-related changes
- Help maintain best practices through consistent review and guidance
during the initial adoption period
- Provide teams with support and mentorship as they learn the new tool
and testing patterns

## Note on Test Ownership

The ownership of the Scout test directory is intended to be
**temporary**. Once all teams have a solid understanding of best
practices and are comfortable with the new tool, we plan to transfer
ownership back to the respective feature teams. This temporary ownership
structure ensures consistent quality and knowledge transfer during the
transition period.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## Summary

Upgrades node-forge from `1.3.2` to `1.3.3`

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...
## Summary

Override index stats `docs_total_size_in_bytes`,
`docs_total_size_in_bytes_primaries`, `docs_count`, and
`docs_count_primaries` values with serverless metering info when running
on serverless.

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [ ] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.
Resolves elastic#244697
Resolves elastic#244678

## Summary

This PR bumps the SLO resources version to 3.6, meaning only new SLOs or
SLOs updated with a breaking change or reseted will use the new index
settings and ingest pipelines.

This PR changes the date_index_name date rounding processor to daily
instead of monthly. Customers can always use `slo-rollup-global@custom`
ingest pipeline to override this settings if necessary.

We also added index sorting on the SLI index settings using [id,
revision, instanceId] which are the first ordered keys referenced by the
summary transform. This will help tremendously the composite aggs made
by this transform.

On the overview cluster, where each daily index has about 20M documents
with a size of 20GB, the write_load decreased compared to the write_load
of previous indices who were not using the index (but who had way more
documents, e.g. monthly instead of daily rollup), so we cannot really
compare apples to apples... But at least the overview cluster is not
overwhelmed with this settings.
And from @henrikno testing with a 300gb index, the query ran by the
summary transform went from 2min to 2s using this settings.

<img width="1344" height="432" alt="image"
src="https://github.com/user-attachments/assets/3ba8067a-eeca-4909-9e65-ad6b4ef2a635"
/>



### Testing

- [ ] Make sure the migration works correctly, e.g. existing SLOs are
still using v3.5 resources, but new SLOs uses the v3.6 resources.

## Release notes

- SLI rolled-up data for SLO is split daily instead of monthly by
default. Override is possible through a global custom pipeline.
…ic#245372)

## Summary
the `Create lookup Index` command now takes priority in the sorting
order and appears before the indexes that are sorted alphabetically

<img width="634" height="253" alt="lookup"
src="https://github.com/user-attachments/assets/c988f45c-c0d7-4778-a720-d178e4ce0202"
/>
@elasticmachine
Copy link
Contributor

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

  • Click to trigger kibana-pull-request for this PR!
  • Click to trigger kibana-deploy-project-from-pr for this PR!
  • Click to trigger kibana-deploy-cloud-from-pr for this PR!
  • Click to trigger kibana-entity-store-performance-from-pr for this PR!
@wildemat wildemat closed this Dec 5, 2025
@wildemat wildemat changed the title [Getting Started] Deprecate feature flag (part 2 of 2) Dec 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment