[Fleet] Make save_knowledge_base async in streaming state machine by Copilot · Pull Request #252328 · elastic/kibana

Copilot · 2026-02-09T14:28:55Z

Summary

The save_knowledge_base step in the streaming state machine blocks package installation until knowledge base indexing completes, causing timeouts for large packages like security_detection_engine.

Changes

Added isAsync: true to the save_knowledge_base step in streamingStatesDefinition:

save_knowledge_base: {
  onPreTransition: cleanupKnowledgeBaseStep,
  onTransition: stepSaveKnowledgeBase,
  nextState: INSTALL_STATES.UPDATE_SO,
  onPostTransition: updateLatestExecutedState,
  isAsync: true, // Knowledge base indexing runs in background
},

This matches the existing behavior in regularStatesDefinition where the flag was already present. Knowledge base indexing now runs asynchronously without blocking state machine progression.

Added parity test: To ensure consistency between the two state machine definitions, added a unit test that verifies common states have matching isAsync flags between regularStatesDefinition and streamingStatesDefinition. This prevents future drift between the two implementations.

Testing

POST kbn:/api/fleet/epm/packages/security_detection_engine/9.3.2
{
  "force": true
}

Original prompt

This section details on the original issue you should resolve

<issue_title>[Fleet] Make install knowledge base step async for install security detection prebuilt rules</issue_title>
<issue_description>## Description

The step to install knowledge base is not async in the state machine use to install security_detection_engine it should be to avoid timeouts.

Workaround

While this is fixed, if you encounter that issue you could disabled knowledge base from the integration page
#245080

How to test
POST kbn:/api/fleet/epm/packages/security_detection_engine/9.3.2
{
    "force": true
}
 ```</issue_description>

<agent_instructions>In fleet state machine there is a save_knowledge_base that should be async (isAsync) true could you fix that</agent_instructions>

## Comments on the Issue (you are @copilot in this section)

<comments>
<comment_new><author>@elasticmachine</author><body>
Pinging @elastic/fleet (Team:Fleet)</body></comment_new>
</comments>

Fixes [Fleet] Make install knowledge base step async for install security detection prebuilt rules #251925

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

…to prevent timeouts Co-authored-by: nchaulet <1336873+nchaulet@users.noreply.github.com>

nchaulet · 2026-02-09T15:29:38Z

@copilot Could you add a test for that, I think adding a unit test that check parity between the two state machine will be great

Export regularStatesDefinition and streamingStatesDefinition to make them testable, and add a unit test that verifies common states have matching isAsync flags between both state machines. Co-authored-by: nchaulet <1336873+nchaulet@users.noreply.github.com>

Copilot · 2026-02-09T15:33:39Z

@copilot Could you add a test for that, I think adding a unit test that check parity between the two state machine will be great

Added a parity test in commit 8068376. The test verifies that common states (create_restart_installation, install_kibana_assets, save_archive_entries_from_assets_map, save_knowledge_base, update_so) have matching isAsync flags between regularStatesDefinition and streamingStatesDefinition.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

iojs.org
- Triggering command: /usr/bin/curl curl -q --fail --compressed -L -s REDACTED -o - (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

nchaulet

LGTM 🚀

Supplementing

LGTM 🚀

nchaulet · 2026-02-10T13:19:02Z

/ci

nchaulet · 2026-02-10T14:40:43Z

@elasticmachine run docs-build

elasticmachine · 2026-02-10T15:10:52Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 8068376

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #113 / discover/esql discover esql controls when adding an ES|QL panel with controls in dashboards and exploring it in discover should retain the controls and their state
[job] [logs] FTR Configs #137 / serverless observability UI - telemetry discover/observabilitySolution/context_awareness/telemetry telemetry context should set EBT context for telemetry events when logs data source profile and reset

Metrics [docs]

✅ unchanged

cc @nchaulet @Copilot

kibanamachine · 2026-02-10T15:19:57Z

Starting backport for target branches: 9.3

https://github.com/elastic/kibana/actions/runs/21870774132

…astic#252328) (cherry picked from commit 34ea966)

kibanamachine · 2026-02-10T15:27:55Z

💚 All backports created successfully

Status	Branch	Result
✅	9.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

* commit '7dcc1fe3c205d2de0c3ca3f65804f21de09013c3': (285 commits) Enrich kbn-check-saved-objects-cli README with CI and manual usage docs (elastic#252557) [Discover] Add feature flag to make ESQL the default query mode (elastic#252268) Add maskProps.headerZindexLocation above to inspect component flyout (elastic#252543) [Security Solution][Atack/Alerts] Flyout header: Assignees (elastic#252190) Upgrade EUI to v112.3.0 (elastic#252315) [Fleet] Make save_knowledge_base async in streaming state machine (elastic#252328) Upgrade @smithy/config-resolver 4.3.0 → 4.4.6 (elastic#252457) [Lens as API] Add colorMapping support for XY charts (ES|QL data layers) (elastic#252051) [WorkplaceAI] Add Google Drive data source and connector (elastic#250677) [Scout] Move GlobalSearch FTR tests to Scout (elastic#252201) [EDR Workflows] Fix osquery pack results display when agent clock is skewed (elastic#251417) [Observability Onboarding] Apply integrations limit after dedup in parseIntegrationsTSV (elastic#252486) [Entity Analytics] Update `host.ip` aggregation to remove painless script (elastic#252426) Address `@elastic/eui/require-table-caption` lint violations across `@elastic/obs-presentation-team` files (elastic#251050) Consolidate JSON stringify dependencies (elastic#251890) [index mgmt] Use esql instead of query dsl to get the index count (elastic#252422) Add Usage API Plugin (elastic#252434) Cases All Templates page (elastic#250372) [Agent Builder] Default value for optional params in ESQL tools (elastic#238472) [Fleet] Add upgrade_details.metadata.reason to AgentResponseSchema (elastic#252485) ...

…ne (#252328) (#252561) # Backport This will backport the following commits from `main` to `9.3`: - [[Fleet] Make save_knowledge_base async in streaming state machine (#252328)](#252328)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

Initial plan

94bc774

Copilot AI assigned Copilot and nchaulet Feb 9, 2026

Copilot started work on behalf of nchaulet February 9, 2026 14:29 View session

Add isAsync flag to save_knowledge_base in streamingStatesDefinition …

12b4786

…to prevent timeouts Co-authored-by: nchaulet <1336873+nchaulet@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Make install knowledge base step async for security detection engine~~ Feb 9, 2026

Copilot finished work on behalf of nchaulet February 9, 2026 14:56

Copilot AI requested a review from nchaulet February 9, 2026 14:56

nchaulet marked this pull request as ready for review February 9, 2026 15:24

nchaulet requested a review from a team as a code owner February 9, 2026 15:24

kibanamachine added the 💝community label Feb 9, 2026

nchaulet requested a review from Supplementing February 9, 2026 15:24

nchaulet added release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team backport:version Backport to applied version labels v9.3.1 labels Feb 9, 2026

Copilot started work on behalf of nchaulet February 9, 2026 15:30 View session

nchaulet approved these changes Feb 9, 2026

View reviewed changes

Copilot finished work on behalf of nchaulet February 9, 2026 16:55

Supplementing approved these changes Feb 10, 2026

View reviewed changes

nchaulet enabled auto-merge (squash) February 10, 2026 13:50

nchaulet merged commit 34ea966 into main Feb 10, 2026
15 checks passed

nchaulet deleted the copilot/make-install-knowledge-base-async branch February 10, 2026 15:19

kibanamachine added the v9.4.0 label Feb 10, 2026

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 10, 2026

[Fleet] Make save_knowledge_base async in streaming state machine (el…

749dbdf

…astic#252328) (cherry picked from commit 34ea966)

kibanamachine mentioned this pull request Feb 10, 2026

[9.3] [Fleet] Make save_knowledge_base async in streaming state machine (#252328) #252561

Merged

kibanamachine added the v9.3.0 label Feb 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Fleet] Make save_knowledge_base async in streaming state machine#252328

[Fleet] Make save_knowledge_base async in streaming state machine#252328
nchaulet merged 3 commits intomainfrom
copilot/make-install-knowledge-base-async

Copilot AI commented Feb 9, 2026 •

edited by kibanamachine

Loading

nchaulet commented Feb 9, 2026

Copilot AI commented Feb 9, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

nchaulet left a comment

Supplementing left a comment

nchaulet commented Feb 10, 2026

nchaulet commented Feb 10, 2026

elasticmachine commented Feb 10, 2026

Uh oh!

kibanamachine commented Feb 10, 2026

kibanamachine commented Feb 10, 2026

Labels

5 participants

Conversation

Copilot AI commented Feb 9, 2026 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Workaround

How to test

nchaulet commented Feb 9, 2026

Copilot AI commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

nchaulet left a comment

Choose a reason for hiding this comment

Supplementing left a comment

Choose a reason for hiding this comment

nchaulet commented Feb 10, 2026

nchaulet commented Feb 10, 2026

elasticmachine commented Feb 10, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Uh oh!

kibanamachine commented Feb 10, 2026

kibanamachine commented Feb 10, 2026

💚 All backports created successfully

Questions ?

Labels

5 participants

Copilot AI commented Feb 9, 2026 •

edited by kibanamachine

Loading

Copilot AI commented Feb 9, 2026 •

edited

Loading