Skip to content

[Files service] handle compressed responses from Elasticsearch#262394

Merged
tsullivan merged 7 commits intoelastic:mainfrom
tsullivan:files-service/handle-compressed
Apr 11, 2026
Merged

[Files service] handle compressed responses from Elasticsearch#262394
tsullivan merged 7 commits intoelastic:mainfrom
tsullivan:files-service/handle-compressed

Conversation

@tsullivan
Copy link
Copy Markdown
Member

@tsullivan tsullivan commented Apr 9, 2026

Fix an issue where Fleet Server diagnostic can not be downloaded if kibana uses elasticsearch.compression: true.

Summary

This change tells ES not to compress responses, for saved file chunks. The Files Service uses asStream: true, which bypasses the client's decompression pipeline. Specifically, this fixes an issue in Fleet Management where diagnostic bundles could not be downloaded when kibana.yml uses elasticsearch.compression: true.

Testing

  1. Set elasticsearch.compression: true in config/kibana.yml
  2. Start a Fleet server in a docker container
  3. Create an Elastic Agent
  4. Generate a Diagnostic archive and try to download it

Screenshots

BEFORE

  • attempting to download a diagnostic doesn't work
  • no helpful server logs

download diagnostic - 01

AFTER

  • downloading a diagnostic works now
  • helpful error logs if needed

download diagnostic - 02

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

  • [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • [ ] Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • [ ] Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.
@tsullivan tsullivan requested a review from a team April 9, 2026 22:18
@tsullivan tsullivan added Team:SharedUX Platform AppEx-SharedUX (formerly Global Experience) t// release_note:fix labels Apr 9, 2026
@tsullivan tsullivan marked this pull request as ready for review April 9, 2026 22:38
@tsullivan tsullivan requested a review from a team as a code owner April 9, 2026 22:38
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/appex-sharedux (Team:SharedUX)

@tsullivan tsullivan added the Team:Fleet Team label for Observability Data Collection Fleet team label Apr 9, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/fleet (Team:Fleet)

@macroscopeapp
Copy link
Copy Markdown
Contributor

macroscopeapp Bot commented Apr 9, 2026

Approvability

Verdict: Would Approve

Straightforward bug fix that adds an HTTP header to prevent compressed responses from breaking CBOR decoding, plus error logging. The author owns both modified files, the change is self-contained with clear intent, and includes test coverage.

No code changes detected at c549e26. Prior analysis still applies.

Macroscope would have approved this PR. A repo admin can enable approvability here.

@juliaElastic
Copy link
Copy Markdown
Contributor

Should we backport this to all open branches?

@tsullivan
Copy link
Copy Markdown
Member Author

Should we backport this to all open branches?

@juliaElastic yes I believe we should backport this to all open branches, because the bug was reported by a customer on 8.19. Thanks!

@tsullivan tsullivan added the backport:all-open Backport to all branches that could still receive a release label Apr 10, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

💔 Build Failed

Failed CI Steps

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [85482c8]

History

@tsullivan tsullivan enabled auto-merge (squash) April 10, 2026 23:44
@tsullivan tsullivan merged commit 1975e27 into elastic:main Apr 11, 2026
18 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.19, 9.2, 9.3, 9.4

https://github.com/elastic/kibana/actions/runs/24270800499

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Apr 11, 2026
…ic#262394)

Fix an issue where Fleet Server diagnostic can not be downloaded if
kibana uses `elasticsearch.compression: true`.

## Summary

This change tells ES not to compress responses, for saved file chunks.
The Files Service uses `asStream: true`, which bypasses the client's
decompression pipeline. Specifically, this fixes an issue in Fleet
Management where diagnostic bundles could not be downloaded when
`kibana.yml` uses `elasticsearch.compression: true`.

## Testing
1. Set `elasticsearch.compression: true` in `config/kibana.yml`
2. Start a Fleet server in a docker container
3. Create an Elastic Agent
4. Generate a Diagnostic archive and try to download it

## Screenshots

**BEFORE**
- attempting to download a diagnostic doesn't work
- no helpful server logs

![download diagnostic -
01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)

**AFTER**
- downloading a diagnostic works now
- helpful error logs if needed

![download diagnostic -
02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)

## Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- ~~[ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~
- ~~[ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials~~
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- ~~[ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~
- ~~[ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.~~
- ~~[ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed~~
- [X] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [X] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit 1975e27)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Apr 11, 2026
…ic#262394)

Fix an issue where Fleet Server diagnostic can not be downloaded if
kibana uses `elasticsearch.compression: true`.

## Summary

This change tells ES not to compress responses, for saved file chunks.
The Files Service uses `asStream: true`, which bypasses the client's
decompression pipeline. Specifically, this fixes an issue in Fleet
Management where diagnostic bundles could not be downloaded when
`kibana.yml` uses `elasticsearch.compression: true`.

## Testing
1. Set `elasticsearch.compression: true` in `config/kibana.yml`
2. Start a Fleet server in a docker container
3. Create an Elastic Agent
4. Generate a Diagnostic archive and try to download it

## Screenshots

**BEFORE**
- attempting to download a diagnostic doesn't work
- no helpful server logs

![download diagnostic -
01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)

**AFTER**
- downloading a diagnostic works now
- helpful error logs if needed

![download diagnostic -
02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)

## Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- ~~[ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~
- ~~[ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials~~
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- ~~[ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~
- ~~[ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.~~
- ~~[ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed~~
- [X] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [X] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit 1975e27)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Apr 11, 2026
…ic#262394)

Fix an issue where Fleet Server diagnostic can not be downloaded if
kibana uses `elasticsearch.compression: true`.

## Summary

This change tells ES not to compress responses, for saved file chunks.
The Files Service uses `asStream: true`, which bypasses the client's
decompression pipeline. Specifically, this fixes an issue in Fleet
Management where diagnostic bundles could not be downloaded when
`kibana.yml` uses `elasticsearch.compression: true`.

## Testing
1. Set `elasticsearch.compression: true` in `config/kibana.yml`
2. Start a Fleet server in a docker container
3. Create an Elastic Agent
4. Generate a Diagnostic archive and try to download it

## Screenshots

**BEFORE**
- attempting to download a diagnostic doesn't work
- no helpful server logs

![download diagnostic -
01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)

**AFTER**
- downloading a diagnostic works now
- helpful error logs if needed

![download diagnostic -
02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)

## Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- ~~[ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~
- ~~[ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials~~
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- ~~[ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~
- ~~[ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.~~
- ~~[ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed~~
- [X] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [X] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit 1975e27)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Apr 11, 2026
…ic#262394)

Fix an issue where Fleet Server diagnostic can not be downloaded if
kibana uses `elasticsearch.compression: true`.

## Summary

This change tells ES not to compress responses, for saved file chunks.
The Files Service uses `asStream: true`, which bypasses the client's
decompression pipeline. Specifically, this fixes an issue in Fleet
Management where diagnostic bundles could not be downloaded when
`kibana.yml` uses `elasticsearch.compression: true`.

## Testing
1. Set `elasticsearch.compression: true` in `config/kibana.yml`
2. Start a Fleet server in a docker container
3. Create an Elastic Agent
4. Generate a Diagnostic archive and try to download it

## Screenshots

**BEFORE**
- attempting to download a diagnostic doesn't work
- no helpful server logs

![download diagnostic -
01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)

**AFTER**
- downloading a diagnostic works now
- helpful error logs if needed

![download diagnostic -
02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)

## Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- ~~[ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~
- ~~[ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials~~
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- ~~[ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~
- ~~[ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.~~
- ~~[ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed~~
- [X] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [X] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

(cherry picked from commit 1975e27)
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 All backports created successfully

Status Branch Result
8.19
9.2
9.3
9.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Apr 11, 2026
…262394) (#262649)

# Backport

This will backport the following commits from `main` to `9.3`:
- [[Files service] handle compressed responses from Elasticsearch
(#262394)](#262394)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Tim
Sullivan","email":"tsullivan@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-04-11T00:52:34Z","message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","Team:SharedUX","backport:all-open","v9.5.0"],"title":"[Files
service] handle compressed responses from
Elasticsearch","number":262394,"url":"https://github.com/elastic/kibana/pull/262394","mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/262394","number":262394,"mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}}]}]
BACKPORT-->

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Apr 11, 2026
…262394) (#262650)

# Backport

This will backport the following commits from `main` to `9.4`:
- [[Files service] handle compressed responses from Elasticsearch
(#262394)](#262394)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Tim
Sullivan","email":"tsullivan@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-04-11T00:52:34Z","message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","Team:SharedUX","backport:all-open","v9.5.0"],"title":"[Files
service] handle compressed responses from
Elasticsearch","number":262394,"url":"https://github.com/elastic/kibana/pull/262394","mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/262394","number":262394,"mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}}]}]
BACKPORT-->

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Apr 11, 2026
…262394) (#262648)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[Files service] handle compressed responses from Elasticsearch
(#262394)](#262394)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Tim
Sullivan","email":"tsullivan@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-04-11T00:52:34Z","message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","Team:SharedUX","backport:all-open","v9.5.0"],"title":"[Files
service] handle compressed responses from
Elasticsearch","number":262394,"url":"https://github.com/elastic/kibana/pull/262394","mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/262394","number":262394,"mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}}]}]
BACKPORT-->

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Apr 11, 2026
…#262394) (#262647)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Files service] handle compressed responses from Elasticsearch
(#262394)](#262394)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Tim
Sullivan","email":"tsullivan@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-04-11T00:52:34Z","message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","Team:SharedUX","backport:all-open","v9.5.0"],"title":"[Files
service] handle compressed responses from
Elasticsearch","number":262394,"url":"https://github.com/elastic/kibana/pull/262394","mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/262394","number":262394,"mergeCommit":{"message":"[Files
service] handle compressed responses from Elasticsearch (#262394)\n\nFix
an issue where Fleet Server diagnostic can not be downloaded if\nkibana
uses `elasticsearch.compression: true`.\n\n## Summary\n\nThis change
tells ES not to compress responses, for saved file chunks.\nThe Files
Service uses `asStream: true`, which bypasses the
client's\ndecompression pipeline. Specifically, this fixes an issue in
Fleet\nManagement where diagnostic bundles could not be downloaded
when\n`kibana.yml` uses `elasticsearch.compression: true`.\n\n\n##
Testing\n1. Set `elasticsearch.compression: true` in
`config/kibana.yml`\n2. Start a Fleet server in a docker container\n3.
Create an Elastic Agent\n4. Generate a Diagnostic archive and try to
download it\n\n\n## Screenshots\n\n**BEFORE**\n- attempting to download
a diagnostic doesn't work\n- no helpful server logs\n\n![download
diagnostic
-\n01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)\n\n\n**AFTER**\n-
downloading a diagnostic works now\n- helpful error logs if
needed\n\n![download diagnostic
-\n02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)\n\n\n##
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- ~~[ ] Any text
added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~\n-
~~[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials~~\n- [X] [Unit
or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- ~~[ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~\n-
~~[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.~~\n- ~~[ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed~~\n- [X] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[X] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*`
labels.","sha":"1975e27bdf90b52c7f70e3e20e9cf32a3d934945"}}]}]
BACKPORT-->

Co-authored-by: Tim Sullivan <tsullivan@users.noreply.github.com>
michel-laterman pushed a commit to michel-laterman/kibana that referenced this pull request Apr 13, 2026
…ic#262394)

Fix an issue where Fleet Server diagnostic can not be downloaded if
kibana uses `elasticsearch.compression: true`.

## Summary

This change tells ES not to compress responses, for saved file chunks.
The Files Service uses `asStream: true`, which bypasses the client's
decompression pipeline. Specifically, this fixes an issue in Fleet
Management where diagnostic bundles could not be downloaded when
`kibana.yml` uses `elasticsearch.compression: true`.


## Testing
1. Set `elasticsearch.compression: true` in `config/kibana.yml`
2. Start a Fleet server in a docker container
3. Create an Elastic Agent
4. Generate a Diagnostic archive and try to download it


## Screenshots

**BEFORE**
- attempting to download a diagnostic doesn't work
- no helpful server logs

![download diagnostic -
01](https://github.com/user-attachments/assets/cd8defc7-3826-43a8-af42-659a128e5acb)


**AFTER**
- downloading a diagnostic works now
- helpful error logs if needed

![download diagnostic -
02](https://github.com/user-attachments/assets/0dc4e681-36f6-4fb8-9fe4-fe7fa8aee5db)


## Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- ~~[ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)~~
- ~~[ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials~~
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- ~~[ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~~
- ~~[ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.~~
- ~~[ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed~~
- [X] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [X] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:all-open Backport to all branches that could still receive a release release_note:fix Team:Fleet Team label for Observability Data Collection Fleet team Team:SharedUX Platform AppEx-SharedUX (formerly Global Experience) t// v8.19.15 v9.2.9 v9.3.4 v9.4.0 v9.5.0

5 participants