Features and enhancements

Alerting and cases

• Add a public API to create, update, and delete case templates (POST, PUT, and DELETE /api/cases/templates), including a dry-run mode that validates a template without saving it #280144.
• Improve the Cases view, cases list, and field library by keeping the case details panel in view as you scroll, saving status and other fields immediately when changed, and adding drag-and-drop field reordering to the field library #282197.
• Add an Agent Builder tool to attach saved dashboards, maps, Discover sessions, and Lens visualizations to a case #279680.

Dashboards and Visualizations

• Restore Defer loading panels below "the fold" (labs:dashboard:deferBelowFold) so off-screen dashboard panels wait to fetch data until they scroll into view. The setting is off by default #284004.

Elastic Observability solution

For the Elastic Observability 9.5.2 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.5.2 release information, refer to Elastic Security Solution Release Notes.

Elasticsearch solution

• Add a toggle to the Manage region preferences modal so you can remove a custom region policy and revert to allowing all regions #282769.

Workflows

• Add step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.
• Enable running a workflow with only the execute privilege, without also requiring the read privilege on the workflow definition #284822.

Fixes

Elastic Agent Builder

• Fix missing screen reader announcements when toggling the Show active only filter on the agent tools page #282276.
• Fix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when you configure cross-cluster search index patterns but the cluster doesn't have the remote cluster client role #281609.
• Fix chat completion streams continuing after you cancel a request, and cap their duration at 10 minutes #285119.
• Fix Agent Builder requests to Google Vertex AI inference endpoints failing when tool schemas include JSON Schema fields that Vertex doesn't accept #284810.
• Fix Agent Builder conversations failing when a prompt contains special tokens such as <|endoftext|>, or when Claude models receive empty text blocks #283177.
• Restore legacy root-level inputs in Agent Builder workflow tool schemas so existing workflow tools keep working #285149.
• Fix concurrent conversations silently dropping a round when two clients replied at the same time. Case attachment requests that now conflict return HTTP 409 instead of appearing to succeed #281887.
• Fix agent custom instructions failing to save because the full edit payload was sent, which broke access control entries #277176.
• Fix visualizations generated from a specified index silently returning an empty chart when the query read from a different source. Agent Builder now retries once and then reports an error #282212.
• Fix the custom answer text field losing focus after you select its radio button when an agent asks a clarifying question #283326.

Alerting and cases

• Fix Cases free-text search failing when a case's extended fields produced too many runtime-field values #284475.
• Fix case Activity recording a row for every unchanged template or global field default when you create a case #284310.
• Fix assigning users to a case creating duplicate activity entries #284035.
• Fix field library toggle filters missing from More filters on the All cases page #283645.
• Fix duplicate required-on-close validation errors when a template references a global field that is also required on close #283922.
• Fix a template $ref field silently dropping its local display and validation overrides #283072.
• Prevent changing a field definition's name or type after creation, which previously orphaned stored case values #282770.
• Resolve case field-definition references without regard to capitalization so renaming a field's casing no longer hides it from templates #282450.
• Fix global case field defaults not being applied to cases created through the API or workflow steps, and prevent the field-migration backfill from overwriting values you've already set or cleared #283185.
• Fix the case details Associated Users and Associated Hosts counts omitting directly attached user and host entities #283036.
• Fix the Alerting V2 update API rejecting a valid change of a signal rule's query format to composed #283754.

Dashboards and Visualizations

• Fix Lens metric trendline breakdown ordering to rank by the trendline's own metric instead of falling back to alphabetical order #283159.
• Fix histogram granularity to preserve the saved bar count instead of resetting to Auto above 7 bars. The effective ceiling remains the histogram:maxBars advanced setting #283058.
• Fix duration format to preserve decimal and compact settings on round-trip, except when using the automatic (auto-approximate) duration format #282815.
• Fix the dashboards list endpoint not sorting by last updated date in descending order when no search query is set #282363.

Data ingestion and Fleet

• Fix deleting a package policy from an agent policy with many agents blocking on a full synchronous redeploy instead of deploying asynchronously #282580.
• Fix Fleet bulk upgrades installing the bundled package version instead of the latest registry version #282829.
• Fix Fleet lookups that treated version-specific policy IDs as base policy IDs, which could return HTTP 404 for Fleet Server policy revisions and miss agents #283071.
• Fix the managed integration enrollment flyout failing to detect enrolled agents assigned to version-specific policies #283434.
• Fix expired Fleet enrollment tokens still showing as Active, and add an Expired status to the enrollment tokens list #284280.
• Fix disabling namespace index templates for a package policy with a custom ILM policy failing with an ILM update error #284818.

Developer tools

• Fix Dev Tools Console showing autocomplete suggestions inside non-query triple-quoted strings #282424.

Discover

• Fix formatted numbers showing a sign when the rounded value is zero #282919.
• Fix the percent field formatter rendering NaN when fractional is false #282915.
• Fix server-side date formatting, including CSV exports, keeping the previous timezone or date pattern after you change those settings #282501.

Elastic Observability solution

For the Elastic Observability 9.5.2 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.5.2 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• Prevent leaving the role management page without a confirmation when there are unsaved changes #283525.

Machine learning and inference

• Fix the Data Frame Analytics results explorer not updating when you switch to another job of the same type #284964.
• Fix file upload analysis failing for NDJSON files larger than 5 MB #284960.
• Require administrator privileges to test trained models, and run pipeline simulation as the current user so tests can't access data you shouldn't see #282002.

Workflows

• Warn instead of block enabling a workflow when the editor can't statically prove a foreach collection is an array #283360.

Features and enhancements

Alerting and cases:

• Add limits on case templates and fields (200 templates and 200 fields per owner, and size limits on template and field definitions) to keep large template libraries performant, and clean up the field library editor #281650.
• Store assignee usernames, full names, and email addresses on cases so case analytics dashboards can show assignee details without an extra lookup. Available by default in traditional deployments #281579.

Data management:

• Add an Import from another stream flow in the Data lifecycle tab to reuse another stream's lifecycle configuration #275948.
• Add transition animations to the Streams data lifecycle phase preview so editing or switching lifecycle methods no longer flashes between states #277149.

Elastic Observability solution:

For the Elastic Observability 9.5.1 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution:

For the Elastic Security 9.5.1 release information, refer to Elastic Security Solution Release Notes.

Fixes

Elastic Agent Builder:

• Fix Agent Builder retrying indefinitely on repeated empty responses from Anthropic models, which could exhaust the conversation before surfacing an error #281616.
• Fix Anthropic chat completion requests unexpectedly setting temperature: 0 when no temperature was configured, which could cause errors for Agent Builder and Attack Discovery #281179.
• Fix the attachment input pill border color in Agent Builder chat #282279.
• Fix ES|QL truncating the Tool Success Rate panel in the Agent Builder overview dashboard to 0% whenever there was at least one failure #282026.

Alerting and cases:

• Fix the all cases list and case activity log to render user-picker, toggle, and checkbox field values correctly, and hide markdown-only fields from the column picker #282870.
• Fix duplicate activity entries when setting legacy custom fields #282813.
• Fix the all cases table column selector and template activity log to read from global fields after migrating to case templates #282129.
• Fix duplicate field-definition records being created when a legacy custom field is edited multiple times #282060.
• Fix the case list metrics bar to reflect the current search, filters, and date range instead of showing unfiltered totals #280576.
• Prevent deleting a field definition that is still referenced by an active case template #280493.
• Fix the timestamp field in the alerting rule query sandbox not updating after the first selection #281854.
• Fix bulk-disabling alerting rules leaving their background execution tasks running after the rule shows as disabled #281468.

Dashboards and Visualizations:

• Fix terms formatting to preserve multi-field grouping and column format on round-trip #282760.
• Fix terms include and exclude values to preserve numbers instead of converting them to strings #282752.
• Fix a Lens panel failing to load after duplicating it and then modifying its ad hoc data view, caused by colliding data view IDs #281786.
• Fix a Visualizations API error when reading back an XY chart with an annotation layer backed by an ad hoc data view #281079.
• Fix the Visualizations API dropping the custom name of an ad hoc, form-based data view on round-trip #280546.
• Fix Metric chart values colored by a value outside the configured range to use the default text color instead of blending into the background #280816.
• Disable Fast mode for Basic and Platinum licenses; approximate results in Discover and Dashboards require an Enterprise license #279903.
• Fix the dashboards listing page failing to load when the savedObjects:listingLimit advanced setting exceeds 1,000 #282100.

Data ingestion and Fleet:

• Increase the maximum number of hosts allowed on Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs from 10 to 100 #282397.
• Remove the proxy configuration option from Kafka outputs, which never supported it #282313.
• Fix a layout flash and unexpected switch to the Fleet app when you select Add integration from the Integrations app #281493.
• Fix enrollment API keys ignoring the requested expiration so tokens never expired regardless of the value you set #281324.
• Fix Fleet-managed OpenTelemetry metrics data streams to use time series index mode by default for integration packages #281295.
• Fix managed OTLP API keys being created without the required APM privileges, which caused the managed OTLP endpoint to reject events #281261.
• Fix the agent policy filter on the agents list page to match agents assigned to version-specific policies #281195.
• Fix Fleet Server detection to recognize agents assigned to version-specific Fleet Server policies, which could leave the onboarding screen showing indefinitely #281092.
• Fix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.
• Fix the agent policy download endpoint returning an HTTP 500 error for policies that reuse the same permissions object in more than one place #280669.

Data management:

• Fix ILM Explain data not returning results for hidden and system indices in Index Management #282137.

Discover:

• Fix the Short Dots transform dropping single-character path segments, for example rendering a.b.c as a.c #281930.
• Align the null-value label for server-side date fields with the client so CSV exports and the UI both show (null) #281367.
• Fix the Date Nanos formatter ignoring the configured date format for numeric values, such as aggregation results #281343.
• Fix Geo point degrees-minutes-seconds output rounding near-zero coordinates up to a full degree #281336.
• Fix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, this applies only to reports created or re-saved after upgrading; existing schedules keep their previous behavior until recreated #278305.
• Fix cascading drilldowns failing on ES|QL TS queries in Discover #280580.

Elastic Observability solution:

For the Elastic Observability 9.5.1 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution:

For the Elastic Security 9.5.1 release information, refer to Elastic Security Solution Release Notes.

Elasticsearch solution:

• Fix connector log filters showing (null) instead of the connector or agent ID on the agentless connector's View logs page #281155.
• Fix the cursor jumping to the end of the field when editing an inference endpoint ID #280894.
• Reject Query Rules and Synonyms set and rule IDs containing invalid characters before they reach Elasticsearch #276710.

ES|QL editor:

• Fix PromQL queries dropping value columns after the first pipe, keeping only grouping labels #280538.
• Fix autocomplete suggesting continuation columns after TS_INFO and METRICS_INFO, which replace the table with metadata rows #280524.

Machine learning and inference:

• Strengthen trained model ID checks so the infer, update, and stop APIs can't be used to access a different model's deployment #280511.

Workflows:

• Fix custom workflow steps, including security.enableRule and security.disableRule, calling Kibana APIs in the default space instead of the workflow's own space #280986.

Features and enhancements

Elastic Agent Builder

• Create skills in Agent Builder chat, preview drafts in attachments, and save them from the conversation #265883.
• Enable Agent Builder to pause and ask up to five clarifying multiple-choice questions before acting, then resume after you answer #274672.
• Share private agents with selected people using per-agent access control alongside Public, Shared, and Private visibility #267530.
• Add an embeddable Agent Builder conversation input that opens Agent Builder and sends the message with attachments preserved #272166.
• Enable Agent Builder tracing by default so you can view trace waterfalls for each response, use the built-in traces skill, and monitor activity in the overview dashboard while excluding sensitive prompts and tool parameters by default #276174.
• Add install, open, and delete controls to the Agent Builder Traces option on the GenAI Settings page, and prevent deleted dashboards from being reinstalled when Kibana restarts #276643.
• Set a resizable custom width for Agent Builder attachment canvas flyouts in full-screen view and overlay mode in the sidebar #265200.
• Add optional connector_ids to the Agent Builder conversation API to limit which connectors a request can use #267333.
• Show permitted system indices and aliases in Agent Builder index selection, including alerts, ML anomaly results, SLOs, the entity store, exception lists, SIEM signals, and Stack Monitoring #265819.
• Run several Agent Builder conversations at the same time, and track each conversation's status in the chats panel with In progress, Awaiting your input, Unread, and Error indicators #267980 #271689.
• Route low-effort Agent Builder operations such as ES|QL generation and conversation title generation to a configurable fast model, set per feature in Feature settings, with automatic fallback to the default model #265520 #274849 #275607.

Alerting and cases

• Enable Cases as Data by default so you can analyze cases, activity, and attachments through dedicated indices and a prebuilt Case Analytics data view that stays current as custom fields change without replacing the space's default data view #279831 #280001.
• Enable the redesigned Cases list, details, and settings pages by default #279367.
• Snooze and unsnooze individual alerts with optional expiry or auto-unsnooze conditions #264090.
• Add a Stack Alerts feature privilege so roles can read and act on alerts without rule management access #273804.
• Add an Inspect action to view and run the Elasticsearch query used by custom threshold rules from the rule details page #262354.
• Move the unified Rules page into Stack Management so navigation context remains visible #269568.
• Search, summarize, and update cases from Agent Builder chat with a cases skill, tools, and case attachments #271438.
• Add Add to chat and Summarize case actions to the case details page #276635 #279105.
• Attach Lens visualizations to cases from Attach saved object #274959 #277040.
• Attach Discover sessions, dashboards, and maps to cases #272423.
• Redesign case attachments with a unified Attachments tab, collapsible sections and item counts by type, Type and Author filters, Refresh, and an Attach action on the Activity and Attachments tabs #270518 #272759 #269560.
• Add a warning when a selected file already exists in a case #279327.
• Extract case observables automatically when alerts are added through the API, workflows, or Agent Builder #273455.
• Improve case templates with toggle fields, unique template names, and a simplified default starter template #277626.
• Split the case template editor into Fields and Configuration tabs #277269.
• Add autocomplete and inline validation to the case template YAML editor #279346.
• Set default connectors and case settings in case templates #275690.
• Add a display-only Markdown field type to case templates #278329.
• Add public Cases APIs to discover applicable extended_fields and apply template defaults when creating a case #279684 #280143.
• Add xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control Elasticsearch index.mapping.total_fields.limit on .alerts-* indices and templates #274024.

Connectivity

• Add a OneDrive connector to search files, browse drives, and read file content in Agent Builder and Workflows #275244.
• Add a Box connector to search files and folders and read file content in Agent Builder and Workflows #271306.
• Add an Outlook connector to search and browse email messages and download attachments in Agent Builder and Workflows #266766.
• Add a Snowflake connector to run SQL queries, explore databases and tables, and search with Cortex Search in Agent Builder and Workflows #264827.
• Add an Azure Blob Storage connector to list containers and blobs, read blob content, and search storage in Agent Builder and Workflows #259439.
• Add a HubSpot connector to search and retrieve contacts, companies, deals, tickets, and engagements in Agent Builder and Workflows #257675.
• Add a Sublime Security connector to investigate and act on email threats in Agent Builder and Workflows #279707.
• Add a Filter by feature control to the create-connector flyout, and show the HTTP connector in standard connector lists #271686.
• Improve authentication options for Agent Builder connectors by listing recommended methods first with a Recommended badge and hiding legacy options when you create new connectors #273410.
• Add secretQueryParams support to the HTTP connector so encrypted query parameters are stored in connector secrets and injected into request URLs #258291.
• Add Slack (v2) connector actions for looking up conversation history, channel details, workspace users, and users by email in Agent Builder and Workflows #273548.
• Enable OAuth authorization for the GitHub and Slack (v2) connectors so you can connect using your own OAuth apps #259549.
• Add OAuth Client Credentials (Private Key JWT) authentication to the SharePoint Online connector so you can authenticate with a certificate instead of a client secret #268847.

Dashboards and Visualizations

• Make the Dashboards and Visualizations APIs generally available, with breaking request and response schema changes detailed in Kibana 9.5.0 breaking changes.
• Make dashboards and visualizations in Agent Builder chat generally available.
• Add and remove Options list, Range slider, and Time slider controls on dashboards from Agent Builder chat #275584.
• Create and edit custom Vega visualizations in Agent Builder chat #275257.
• Add Links panel support to the Dashboards API #268965.
• Add access_control.access_mode support to PUT /api/dashboards/{id} for updating dashboard permissions #266700.
• Add a Write a query values source for filter controls so you can pre-filter options-list and range-slider values with ES|QL #266492.
• Highlight related dashboard panels when you select an ES|QL control label #264426.
• Add feedback when filters or drilldowns cannot apply to computed values on ES|QL XY, heatmap, and partition charts #269722.
• Show unavailable filter and drilldown actions with an explanation when a ES|QL data table column is not filterable #269635.
• Make the Fast mode approximation option applicable to Vega visualizations that use an ES|QL query #276999.
• Apply the dashboard time range, query bar, filters, and controls to Vega panels that use ES|QL #277120 #280070.
• Add a Use global filters layer setting to ES|QL visualizations in Lens #264613.
• Add background trendlines to ES|QL metric visualizations #272499.
• Add a Density option to Lens Metric charts, with Default used for new charts and Compact preserved for existing ones #265526.
• Add Style template presets (Top, Middle, Bottom, Custom) to Lens Metric charts #265304.
• Place unpinned controls above the top dashboard section instead of below it #273089.
• Change the default Include empty rows setting in Lens to depend on visualization type #271856.
• Update the dashboard empty state in edit mode to card-style actions aligned with Add to dashboard #269407.
• Set numeric Lens heatmap Y-axis buckets to descending sort by default for natural numeric order #268961.
• Add a Go to dashboard button to the dashboard save toast when saving from outside the Dashboard app #268326.
• Re-enable Go to Discover drilldowns for ES|QL Lens charts, carrying filters and the query bar state #267245.
• Record dashboard create, update, delete, view, and refresh actions as structured user activity events #265821.
• Redesign Add to dashboard with New and From library tabs, featured items, and a renamed Vega entry #264457.
• Update default Lens annotation colors to improve contrast with chart palettes while preserving colors you set #262507.
• Add spacing above collapsible dashboard section headers to clarify which panels belong to each section #274377.
• Increase the maximum combined panels, sections, and pinned controls on a dashboard from 100 to 1,000 #272931.

Data ingestion and Fleet

• Add opt-in namespace-level customization for integrations so you can apply a {namespace}@custom component template (for example, production@custom) to a namespace's data streams, backed by dedicated namespace-level index templates #262568.
• Add an ILM policy picker to Data retention settings in the integration policy editor so you can assign an ILM policy to an integration namespace (requires opt-in for namespace-level customization) #275197.
• Add bulk revoke and delete actions and status and agent policy filters to the Enrollment tokens page in Fleet #265916.
• Add a Cancel unenrollment action in the agent activity flyout so you can cancel a scheduled automatic unenrollment of inactive agents during the grace period #271270.
• Add Remove collector actions for OpAMP collectors in Fleet, including bulk removal, as a technical preview #268711.
• Show dedicated Health, Info, and Config tabs and the collector configuration view on the details page for OpAMP-managed collectors in Fleet as a technical preview #278816.
• Add an Elastic Agent and OTel Contrib Collector runtime selector to the Add Collector flyout as a technical preview #280137.
• Enable automatic installation of dependencies for composable integration packages during package installation #263762.
• Rename user-facing Cloud Connector copy to Federated Identity across Fleet federated-identity onboarding flows #261353.
• Enable OpenTelemetry-based permission verification for Federated Identity setups in Fleet by default #265619.
• Replace the Status filter on Browse integrations with a More filter, and hide deprecated integrations and content packs by default #277812.
• Add an optional dryRun parameter to Fleet bulk agent API endpoints so you can preview affected agent counts without creating actions #276377.
• Remove the Give feedback button from the Fleet top navigation #273641.
• Update the Add Collector flyout in Fleet to generate collector configs that ship through the Elastic Cloud Managed OTLP Endpoint when available #270324.
• Add Condition fields to integration, input, and stream settings in the package policy editor #270315.
• Add support for using a remote Elasticsearch output as the exporter target for OpenTelemetry integrations as a technical preview #270267.
• Add a data_stream.type variable to the simplified package policy API so input-only packages can route data to a different index prefix (for example, logs-* instead of metrics-*) #269895.

Data management

• Add ES|QL Data Federation management UI in Stack Management. This feature enables you to create and manage external data sources (Amazon S3 initially) and query datasets using ES|QL #265681.
  • This is an experimental feature and is not enabled by default. To try it out, set esql.federation.enabled: true in your Elasticsearch configuration and xpack.dataFederation.enabled: true in your Kibana configuration.
• Add hot, frozen, and delete phases to Data lifecycle in the index and component template wizards, and add a unified editor for successful and failed data lifecycles in data stream details #273960 #273965 #275740.
• Add min_age, min_docs, min_size, min_primary_shard_docs, and min_primary_shard_size rollover conditions to Index Lifecycle Management hot-phase actions #270398.
• Add Force merge index and Force merge on clone settings for searchable snapshots in the Index Lifecycle Management policy editor for hot, cold, and frozen phases #264698.

Developer tools

• Add response filtering in Dev Tools Console so you can filter output with JQ expression or Regular expression mode #272078.

Discover

• Add Save to Dashboard in Discover so you can save sessions directly to a dashboard from the save modal #260092.
• Add a change point chart view for ES|QL change-point results #265331.
• Show a Change point chart in the row flyout for ES|QL change-point result rows #271793.
• Remove the Technical preview badge from change point views in Discover and on the Change point detection page #274950.
• Show sparkline charts in the table for ES|QL queries that return a Sparkline column #268785.
• Integrate Agent Builder with ES|QL Discover for data analysis, context sync, drill-down queries, and Run in new tab #261970.
• Improve Agent Builder time-over-time analysis in Discover by overlaying the selected and preceding time ranges as separate lines on the same time axis #270338.
• Render inline highlighting in Discover for ES|QL TOP_SNIPPETS results when the highlight option is enabled #271519.
• Add tab-scoped actions to Discover's application menu, including inspect and mode switching #269590.
• Open background-search Inspect details in a child flyout from Background searches in Discover #250252.

Elastic Observability solution

For the Elastic Observability 9.5.0 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.5.0 release information, refer to Elastic Security Solution Release Notes.

Elasticsearch solution

• Add a trial usage badge with period progress and a Manage subscription link to the Search homepage #268598.
• Add Elastic Cloud, Usage, and Organization links to the Search homepage header on Elastic Cloud deployments #267434.
• Add Out-of-range date handling to the MongoDB native connector so syncs clamp or convert out-of-range dates instead of failing #277685.

ES|QL editor

• Enable Fast mode in Discover and Dashboards to run eligible ES|QL STATS queries faster by using approximate results #276384.
• Add AI-driven inline code completion in the ES|QL editor, including ghost hints and Undo AI fix / Keep AI fix review actions #256857.
• Add Fix with AI quick-fix actions for ES|QL validation errors in the editor #269455.
• Enable Natural language to ES|QL in the ES|QL editor when your subscription level includes this feature #266561.
• Warn when a closed lookup index is referenced in LOOKUP JOIN instead of offering Create lookup index #274534.
• Sort columns in the Lookup Index editor #273734.
• Replace free-text filtering with KQL search and autocomplete in the Lookup Index editor #271284.
• Make the ES|QL FUSE command generally available #273994.
• Improve recommended ES|QL queries for remote-cluster sources #273292.

Kibana platform

• Add a customization modal for reordering and hiding solution navigation items, with personalized preferences preserved across sessions #270276.
• Add a new date range picker in Discover and Dashboards that accepts flexible relative and absolute time ranges in plain text #260163.
• Add nine commonly used presets to the time picker, including Yesterday, Last 3 hours, and This week until now #270254.
• Add display language selection (Beta) to the profile and user menu #260835.
• Use the browser Accept-Language header to select the UI language on all deployment types when no profile language or locale cookie is set #275996.
• Persist your last selected space in the user profile and restore it on the next visit when Remember last selected space is enabled #268053.
• Set the theme:darkMode default to System so Kibana matches your OS appearance on first visit #273826.
• Search within Inspect flyouts for request and response details, background searches, and saved objects #269744.
• Add UI in Snapshot and Restore to view and set the persistent.repositories.default_repository cluster setting #265592.
• Add create, read, update, and delete routes at /api/tags for saved-object tags while keeping legacy /api/saved_objects_tagging routes deprecated #266220.
• Enforce the form-action Content Security Policy directive, previously available only in report-only mode #267937.
• Add notifications.connectors.default.email as a Docker environment variable #272761.

Machine learning and inference

• Replace the standalone Select data view page with an inline data source picker on AIOps and Data Visualizer pages #266672.
• Show warnings on the Feature settings page when assigned models or endpoints are unavailable #262262.
• Add Manage region preferences to the Elastic Inference Service page, including a Geographies tab for restricting inference routing by geography or cloud region and region availability badges in model details #278461 #277331.
• Add a read-only privilege tier for browsing inference endpoints and Feature settings in Model Management without write access #272204.
• Add Feature settings entries for ai.prompt, ai.summarize, and ai.classify workflow steps so each step can use a model configured per space #268945.
• Show Preview, Deprecated, and End-of-life badges on Elastic Inference Service models and the Feature settings page, with callouts when assigned models are deprecated or past end of life #268083.
• Restructure Feature settings with Use AI features, Global model, and Feature specific models toggles and clearer save validation #266184.
• Improve the Add inference endpoint and Edit inference endpoint flyouts with clearer task-type selection, always-visible endpoint ID, and a footer Save button that remains unavailable until the form passes validation #262143.
• Hide the Elasticsearch service provider from the Add inference endpoint flyout on the External Inference page #261851.
• Prefer Jina Embeddings v5 when installing Elastic documentation on Elastic Inference Service, with ELSER as a fallback #275461.
• Add Token usage tracking for inference calls, and install a token usage dashboard when you enable the setting in GenAI Settings #260956.
• Add SPARKLINE to the recommended ES|QL query for Identify patterns in Log Pattern Analysis #269438.
• Add model memory estimation to the edit-job flyout for anomaly detection and data frame analytics jobs, with Apply on Model memory limit #266590.
• Route anomaly detection and data frame analytics feedback through the shared Give feedback experience with ML-specific questions #265015.
• Restore Start deployment and Update deployment for rerank trained models, and tailor the deployment flyout for rerank models #261119.

Workflows

• Integrate Agent Builder into the Elastic Workflows YAML editor: open the sidebar automatically with What do you want to automate?, and align workflow attachment and diff previews with the editor #276297 #275765 #278343.
• Add human-in-the-loop approval and external input steps to approve, reject, or submit structured input in Kibana or through signed links and Slack notifications #275273.
• Add a built-in Agent Builder tool to list recent workflow runs without an execution ID #269335.
• Add a cases.removeTags workflow step to remove tags from a case in one step #268465.
• Add a cases.pushCases workflow step to push cases to their external connectors #267539.
• Add case workflow triggers so workflows can start when cases are created, updated, change status, receive attachments, or receive comments #257284.
• Make Elastic Workflows version history generally available, recording every save so you can compare versions and restore a previous definition #276311.
• Add a queue concurrency strategy so excess runs wait in a durable backlog until a slot opens, with configurable queue-size and queue-ttl #268596.
• Add a date range filter when you select a historical workflow or step execution for replay or testing #266706.
• Show a read-only workflow graph in the editor when Elastic Workflows: Experimental Features is enabled in Advanced Settings #276383.
• Sort the Name and Enabled columns in the Elastic Workflows list #271286.
• Add optional descriptions to ai.classify step categories to provide richer classification context #271134.
• Support built-in JSON Schema input types with $ref: '#/kibana/definitions/' in workflow YAML for validation, autocomplete, and automatically filled manual-run inputs #270006.
• Combine Triggers and Steps into one Triggers and Steps column in the workflows list #269454.
• Add go-to-definition in the workflow YAML editor for template references to steps, inputs, constants, and variables #259339.
• Make the search.rerank workflow step available across Kibana deployments so you can reorder documents by relevance using a rerank inference endpoint #263706.

The 9.4.4 release contains fixes for potential security vulnerabilities. For details, go to security announcements.

Features and enhancements

Alerting

• Adds a cases.pushCases workflow step that pushes the given cases to their external connectors.

Data ingestion and Fleet

• Adds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes.
• Supports overriding data_stream.type in the simplified package policy API for input-only packages, so collected data can be routed to a different index prefix with matching agent index permissions.

Elastic Observability solution

For the Elastic Observability 9.4.4 release information, refer to Elastic Observability Solution Release Notes.

Elasticsearch solution

• Adds a MongoDB connector datetime_conversion setting so syncs can clamp, convert, or error on dates outside the supported range instead of always aborting.

Fixes

Alerting

• Improves the Cases file upload modal with human-readable size limits, clearer unsupported-type messaging, per-file size checks, and error state that clears when a new file is selected.
• Fixes OAuth client credentials token parsing so any 2xx response is treated as success.
• Defaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value.
• Fixes ES|QL query rules dropping parentheses when appending a limit, which could change calculated results.
• Fixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly.
• Extracts observables automatically when alerts are attached to a case through the comments API.
• Preserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values.

Connectivity

• Fixes the Google Drive connector so it can find and read files owned by a shared drive.

Dashboards and Visualizations

• Limits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window.
• Fixes startup crashes from occurring when upgrading Kibana if a previous version's node.options file was preserved, caused by server-side imports of the browser-only @elastic/charts library.
• Fixes horizontal padding in the Lens dimension editor.
• Fixes the filter popover so that closing the context menu when saving a dashboard doesn't discard changes.
• Fixes invisible field names in the Lens field picker when in dark mode.
• Fixes incorrect color rendering for non-custom palettes in Lens metric charts.
• Fixes color rendering in Lens gauge charts so a color band no longer extends past the configured range, and palette continuity is preserved on save.

Data ingestion and Fleet

• Fixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled.
• Fixes integration policy updates always bumping associated agent policy revisions, even when bumpRevision is false.
• Deletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade.
• Fixes adding content connectors from Integrations so the enrollment flyout links to connector setup instead of waiting for incoming data.
• Fixes integration rollback for version-specific policies so variants are cleaned up, agents return to the parent policy, and auto-install no longer re-upgrades rolled back packages.
• Fixes OpenTelemetry profile integrations to use the profiles input type and stop Fleet from managing their data streams.
• Improves Fleet setup performance at scale by reconciling agent policy enrollment keys and revisions with bulk aggregations instead of per-policy Elasticsearch queries.

Data management

• Fixes the Add lifecycle policy dialog crashing Index Management for indices without aliases.

Developer tools

• Fixes Console autocomplete so nested object fields and multi-fields in index mapping bodies suggest mapping options again.
• Fixes Console requests that combine comments with triple-quote strings failing with x_content_e_o_f_exception.
• Fixes a Windows-specific code editor issue that could corrupt multi-line edited text after refresh.
• Fixes the Console Copy button silently failing to copy response output.
• Fixes Console autocomplete matching an incorrect API endpoint when a URL matches both a literal path and a parameterized path.
• Improves Console ES|QL source autocomplete by reusing a fresh source list instead of refetching it on every keystroke.

Discover

• Fixes an error when saving text field values that look like JSON objects in lookup index editing.
• Fixes a false validation error for ip and version fields used with the IN operator in ES|QL.

Elastic Observability solution

For the Elastic Observability 9.4.4 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.4.4 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• Fixes kibana-frontend page-load transaction names to use low-cardinality /app/{appId} labels instead of raw URLs.
• Fixes the Kibana JSON logger producing objects with a large number of numbered keys.

Machine Learning

• Prevents removing all spaces from a machine learning job or trained model through the spaces update APIs.
• Restricts the clear audit messages API so users can only clear messages for jobs they can access, and only against valid notification indices.
• Fixes xpack.productDocBase.artifactRepositoryProxyUrl being silently ignored when installing product documentation through a proxy.
• Fixes unbounded string and array schema validation by adding maxLength and maxSize limits.
• Makes winlog.event_data.LogonType optional for the security_auth anomaly detection jobs so they can run on non-Windows authentication logs.
• Fixes a crash in ES|QL query correction when an LLM generates a multi-line WHERE clause.

Workflows

• Fixes scheduled trigger YAML insertion so nested input type fields are not mistaken for triggers.
• Fixes relative timestamps that showed 1 month ago for executions only a few days old after a calendar month boundary.
• Fixes validation and autocomplete for Liquid {% for %} loops in workflow YAML.
• Fixes Workflows validation so elasticsearch.search steps accept object-form sort.

The 9.4.2 release contains fixes for potential security vulnerabilities. Check our security advisory for more details.

Features and enhancements

Search

• Improves the Add inference endpoint and Edit inference endpoint flyouts with clearer titles, a footer Save button, task type descriptions in the selector, always-visible endpoint ID and API reference fields, and inline validation for required fields.

Fixes

Alerting and cases

• Fixes an issue that caused rules with large action parameter payloads to fail when saving or executing.
• Fixes case workflow templates resolving from the wrong owner.
• Fixes phrase search in the All Cases view.

Connectivity

• Fixes the email connector to reject malformed email addresses that mail servers would reject, preventing unnecessary SMTP connection attempts.
• Fixes HTTP connector TLS options when connecting through proxies.
• Fixes client-side navigation in the content connectors UI to honor server.basePath and space URL prefixes, preventing 404s on connector detail tabs and after creation.

Dashboards and Visualizations

• Fixes the links panel transform to remove an unsupported enhancements property.
• Fixes the Lens API so XY charts with legends at the top or bottom return the correct configuration.
• Fixes the Visualization API to correctly show default datatable colored badges.
• Fixes gauge chart min, max, and goal configuration to reject unsupported reference-based metric operations that require a date histogram.

Data ingestion and Fleet

• Parses top-level elasticsearch fields in integration packages on upgrade or reinstall.
• Fixes the agent enrollment Confirm incoming data step timing out for integrations that ingest backdated data by checking event.ingested instead of @timestamp.

Discover

• Preserves the expanded document selection after refresh when comparing documents in Discover.

ES|QL editor

• Allows null in CASE() expressions combined with other types.

Elastic Observability solution

For the Elastic Observability 9.4.2 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.4.2 release information, refer to Elastic Security Solution Release Notes.

Management

• Fixes missing modal and popover labels for screen readers across Stack Management UIs.

Machine Learning

• Fixes File upload not disabling data view creation when the user lacks data view creation capabilities.

Workflows

• Makes the with block optional in workflow YAML for connector steps that have no required parameters.

Fixes

Alerting

• Fixes empty rule type fields, such as kibana.alert.reason, on active alert documents when a delayed alert graduates to active during a flapping hold without an executor report.

Dashboards and Visualizations

• Fixes a critical validation failure that occurred when dashboard controls had null titles. Control titles are now converted to undefined during transforms, allowing validation to pass.
• Fixes a regression where the dashboard remained locked in an open-flyout state after closing the ES|QL control edit flyout when editing an existing query-based control.

Elastic Security solution

For the Elastic Security 9.4.1 release information, refer to Elastic Security Solution Release Notes.

We now recommend that your Kibana instances have at least 2 GB of memory, especially when using Platinum or Enterprise Kibana features, and for production workloads. New Elastic Cloud Hosted deployments now default to 2 GB of RAM for each Kibana instance.

Features and enhancements

Alerting

• Makes maximumCasesToOpen a runtime property.
• Adds an auto-push case option to the case connector.
• Exposes the maximumCasesToOpen parameter in the case action connection.
• Adds additional workflow steps.
• Alert deletion is now generally available.

Elastic Agent Builder

• Updates Test tool flyout to support datetime picker.
• Simplifies the ES|QL test tool parameter types.
• Exposes configuration_overrides in agent_builder/converse API.
• Adds support for array parameter types in ES|QL tools.
• Migrates the flyout to a sidebar.
• Adds server-side support for user-created skills in Agent Builder.
• Adds agent and tools RBAC sub features.
• Agent Builder's default agent is no longer read-only and can now be customized per Kibana space.
• Adds user-created skills to Agent Builder.
• Allows Agent Builder to detect outdated attachments and lets users refresh them into the next message.
• Allows ES|QL generation to search index patterns.
• Allows agents to run one or more workflows before each execution, enabling prompt modifications or conditional abort.
• Adds audit logging for agent and tool create, update, and delete actions.

Connectivity

• Adds support for the region parameter to the Bedrock Connector.
• Adds a Jina Reader data source connector.
• Adds a Jira Cloud data source connector.
• Adds a SharePoint Online data source connector.
• Adds a ServiceNow data source connector.
• Adds a Microsoft Teams data source connector.
• Adds a Tavily data source connector.
• Adds a Google Calendar data source connector.
• Adds a Slack data source connector.
• Adds an Amazon S3 data source connector.
• Adds a Salesforce data source connector.
• Adds a Zendesk data source connector.
• Adds a Firecrawl data source connector.
• Adds a 1Password data source connector.
• Adds a PagerDuty data source connector.
• Adds a Zoom data source connector.
• Adds a Figma data source connector.
• Adds a Gmail data source connector.
• Adds an AWS Lambda data source connector.
• Adds a Confluence Cloud data source connector.
• Adds a Google Cloud Storage data source connector.
• Adds a SharePoint Server data source connector.
• Adds a GitHub data source connector.
• Adds an Azure Blob Storage data source connector.
• Adds a GCP Cloud Functions data source connector.
• Adds an AbuseIPDB data source connector.
• Adds an AlienVault OTX data source connector.
• Adds a GreyNoise data source connector.
• Adds a Shodan data source connector.
• Adds a URLVoid data source connector.
• Adds a VirusTotal data source connector.

Dashboards and Visualizations

• A new Dashboard skill is now available in Agent Builder.
• New API endpoints are now available in technical preview to manage your dashboards and visualization library.
• Adds the ability to show and export Dashboard API JSON in a flyout.
• Controls are now available as a panel type, allowing them to be freely placed anywhere in your dashboards.
• Makes Contains the default search technique for options list controls.
• Allows IP fields to be searched using CIDR notation in controls.
• Extends the selectable area for dragging, collapsing and expanding sections to their entire header.
• Allows dragging of opened collapsible sections.
• Enforces panel limits on dashboards.
• Makes the filter pills section collapsible.
• Adds a grid size gauge while resizing panels.
• Adds a borderless option to panel settings.
• Adds library support for markdown panels.
• Allows panels to be dragged while they're in focus for editing.
• Redesigns the panel titles.
• Refreshes the Dashboards app menu.
• Adds a Discover session panel option to dashboards.
• Editing an unlinked Discover session panel in a dashboard now saves changes back to that panel.
• Filtering a field value in a Discover ES|QL session embedded in a dashboard now creates a DSL filter.
• Adds a tab selector to Discover session panels in Dashboards.
• Adds ES|QL support to Vega visualizations.
• Enables ES|QL multi-terms charts in Lens.
• Allows filtering from legend actions when possible for ES|QL visualizations.
• Suggests line charts for timeseries ES|QL queries in Lens.
• Retrieves variable types from the ES|QL query response.
• Enables dashboard and URL drilldown for ES|QL charts.
• Defaults the visualization type to line chart when the x-axis contains a timestamp.
• Adds a new optimized color palette for line charts.
• Adds a Badge color option for table values in Lens.
• Adds a new list legend layout for horizontal legends.
• Adds sort order options for heatmap visualization axes.
• Adds a middle position option for the primary metric styling settings of metric charts.
• Improves tick labels for time-based X axes in ES|QL heatmap visualizations.
• Improves datatable visualization performance for large datasets in Lens.
• Enables fixed-width number formatting in Lens visualizations for cleaner alignment.
• Introduces a Severity color palette in Lens color mapping.
• Improves the badge colors for metric trend indicators in Lens.
• Legend actions in Lens XY and Partition charts now only appear on hover.
• Removes the font-weight configuration option from Lens Metric chart titles.
• Updates axis title and label colors in Lens and dashboard charts to be less visually prominent.
• Displays row numbers by default in Lens data tables.

Data ingestion and Fleet

• Allows remote Elasticsearch outputs and service tokens in Serverless.
• Renames Cloud Connector to Federated Identity in the UX.
• Adds support for monitoring OpenTelemetry (OTel) collectors in Fleet in technical preview.
• Introduces support for version-specific policies in Fleet when integrations specify agent version requirements.
• Shows UI warnings for integrations with upcoming deprecations.
• Resolves and merges templates listed in template_paths.
• Adds permission verifier background tasks.
• Installs package dependencies automatically.
• Requests user review when auto-upgrading packages with deprecations.
• Adds an out-of-the-box alerting rule template to freshly installed integrations for monitoring idle data streams.
• Displays warnings for deprecated integration features.
• Shows warnings in the UI when an integration is deprecated.
• Allows Fleet to install integration-managed SLO templates for creating new SLOs.
• Migrates input configurations when the migrate_from field is specified in the package manifest.
• Updates the maximum supported package specification version to 3.6.
• Adds a new Alerting tab to the integrations UI for viewing and managing alerting-related assets.
• Allows integration rollback when only some integration policies are upgraded.
• Ensures the time series index mode is not enabled for input packages with non-metrics data streams.
• Adds authentication fields to Elastic Agent binary download sources managed by Fleet for connecting to self-hosted artifact registries.
• Improves memory usage during Fleet setup by deferring package reinstalls to async tasks.

Discover

• Redesigns the ES|QL editor footer in Discover.
• Adds a fields browser to the ES|QL editor in Discover.
• Adds a layout toggle to show or hide the data table in Discover.
• Adds a grouped view in Discover for ES|QL queries that use STATS ... BY with a single grouping field.
• Converts DSL filters to ES|QL when possible when switching to ES|QL mode.
• Persists the query mode (ES|QL or classic) to local storage.
• Shows Streams field descriptions in the ES|QL editor and field sidebar.
• Filters from the top-level ES|QL WHERE clause now propagate into per-metric charts in the Discover metrics grid.
• Adds support for visualizing tdigest and exponential_histogram histogram metrics in the Discover metrics grid.
• Hides the data table by default when the metrics-specific Discover experience is triggered.
• Adds the ability to restore recently closed tab groups.
• Hovering over an entry in the recently closed tabs menu now shows a preview of what the tab contained.
• Moves the inspector menu item to the tab menu.
• The chart interval is now saved with Discover sessions and restored when reopening them.
• Adds notifications for background search completion.
• Adds a Save Discover table to dashboard option.
• Adds default table columns for indexes and views with a small number of fields.
• The doc viewer flyout now stays open when switching between Discover tabs and remembers which tab was active in each.

ES|QL editor

• Adds PromQL support in Kibana through ES|QL.
• Adds support for the USER_AGENT command.
• Adds support for the MMR command.
• Adds autocomplete and validation support for the approximate setting in the ES|QL editor.
• Adds support for KQL syntax to the quick search option.
• Adds autocomplete to the KQL function.
• Adds support for unmapped fields.
• Adds support for timezone handling.
• Makes the FORK command generally available.
• Makes the RERANK command generally available.
• Redesigns the ES|QL editor interface.
• Adds a data source browser to the ES|QL editor.
• Adds support for ES|QL views to the editor.
• Adds ES|QL query statistics to the editor.
• Improves ES|QL editor autocomplete for full-text search functions.
• Improves line commenting in the ES|QL editor to match standard IDE conventions.
• Improves query pretty printing.
• Adds an ES|QL indentation shortcut to the editor.
• Simplifies the Run and Cancel button states in the ES|QL editor.
• Highlights multiple word occurrences in search results.

Elastic Observability solution

For the Elastic Observability 9.4.0 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.4.0 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• In container deployments, automatically sets the Node.js heap size to 60% of available memory, up to a maximum of 4096 MB, when no heap size is explicitly configured.
• Adds a feedback button to Kibana's header.
• Remembers the pagination state when navigating back from an edit on the Users page.
• Distinguishes between session idle timeouts and session lifespan timeouts.
• Improves Index Management index list load performance on large clusters with many indices.
• Adds a Query Activity page under Stack Management for viewing and canceling long-running queries.

Machine Learning

• Updates Security ML jobs to use entity analytics fields for host and user fields.
• Adds a link to manage anomaly detection jobs in the Machine Learning left navigation.
• Anomaly detection now automatically closes the job when stopping a datafeed.
• Adds aria labels to anomaly detection job wizard combo boxes.
• Updates the v3_rare_process_by_host_windows bucket span to two hours.
• Changes the rare process by host Windows job bucket span from 15m to 4h.
• Adds a new single APM Correlations endpoint for latency and failed transactions.
• Adds Gemini 2.5 Flash Lite, Claude 4.5 Haiku, and Claude 4.6 Sonnet preconfigured connectors.
• Adds a dynamic default connector in GenAI settings.
• Adds a zoom in button to the date picker.
• Adds Anthropic Claude Opus 4.6 preconfigured connector.
• Uses the location field to correctly set provider config in AI/Inference Connector creation.
• Adds the proxy URL setting for product documentation artifact.
• Adds new preconfigured connectors.
• Moves the results view buttons closer to the job selection controls in Anomaly Detection.
• Adds missing ES|QL commands and functions documentation for inference tasks.
• Enhances model memory estimation for supplied configurations in anomaly detection.
• Adds the timeout parameter to InferenceChatModel.
• Adds time window buttons to the date picker.
• Adds a button to synchronize saved objects in trained models.
• Refreshes the Overview page.
• Marks 429 errors as user errors in Inference/AI Connector.
• Opens matching pattern docs in a new Discover tab.

Search

• Adds warnings to the Feature Settings page for models that are invalid.
• Deprecates search indices in favor of index management.
• Adds a Models page for inference management.
• Adds a Model Settings UI for inference endpoint assignments.
• Sets Jina v5 as the default inference endpoint for semantic_text fields when it's available.
• Adds an AI assistant-led onboarding option to the Elasticsearch getting started page.
• Automatically creates AI connectors for Elastic Inference Service chat completion endpoints when they are added.
• Adds sorting capabilities to the Inference Endpoints table.
• Adds a summary stats bar to the Inference Endpoints page.
• Adds a copy-to-clipboard button for inference endpoint names.
• Improves the External Inference page by hiding the Elasticsearch service provider from the Add Inference Endpoint flyout.
• Adds a model detail flyout with endpoint management.
• Reduces search latency by switching to long-polling when HTTP/2 multiplexing is available.
• Improves the Inference Endpoints management page by adding views to group by service and models.
• Consolidates Type, Preconfigured, and Tech Preview badges under the endpoint name.
• Improves AI connector setup by auto-populating the model field with recommended defaults.
• Improves the inference endpoints page by adding a Model column and enabling search by model name.
• Adds descriptions to the semantic_text field inference endpoint select.
• Fixes layout instability in the inference endpoint selector when endpoint names are long.
• Displays the API key tab if the user has permission, and hides it for users without API key management permissions.
• Updates the Search homepage design.

Workflows

• Adds import and export features for workflows.
• Adds the workflows.executionFailed trigger.
• Adds a server-side workflow validation endpoint.
• Makes the manual run API public.
• Whitelists Streams APIs as Kibana workflow steps.
• Adds the entries Liquid filter for iterating over object keys.
• Adds cases workflow steps.

Features and enhancements

Alerting

• Adds xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control the Elasticsearch index.mapping.total_fields.limit on .alerts-* indices, index templates, and component templates. Raise this above the current alert mapping field count to prevent mapping-update failures on large clusters with many rule types or custom alert fields.

Fixes

Elastic Agent Builder

• Fixes ES|QL query escaping in the Dashboard skill's visualization config generation, ensuring patterns such as GROK retain the correct escape levels when queries are embedded as JSON.

Alerting

• Fixes the Stack Alerts page triggering two search cycles on initial load when filter controls are present, which could cause a brief flash of unfiltered results.

Dashboards and Visualizations

• Fixes dashboard filters not being applied after collapsing a section that was expanded on initial load.
• Fixes dashboards with panel or filter arrays that exceed schema size limits failing to load, by removing the array-size ceiling from internal read requests.
• Improves dashboard load resilience by validating each state key independently, dropping invalid panels, filters, or queries with warnings rather than failing the entire load.
• Increases the maximum number of combined panels, sections, and controls on a dashboard from 100 to 1,000.
• Fixes Save and return not working for Maps visualizations opened from the Visualize library.
• Fixes a stale closure in the Canvas autoplay timer that could skip pages after slides are added or removed.
• Disables the experimental Defer loading panels below "the fold" dashboard setting because enabling it can cause some dashboards to fail to load.

Connectivity

• Removes the Content Connectors page from the menu for users who didn't have the appropriate role privileges.

Data ingestion and Fleet

• Improves POST /api/fleet/setup performance for deployments with many configured outputs by fetching only the required outputs instead of decrypting all saved outputs on each call.
• Optimizes the agent policies list endpoint (withAgentCount=true) to compute agent counts using a single aggregation instead of multiple queries per policy, greatly improving response time for large deployments.
• Prevents the agent version check from hanging indefinitely in air-gapped or firewall-restricted environments, and adds xpack.fleet.productVersionsApiTimeoutMs (default: 60 s) to control the request timeout.
• Fixes variable leakage and duplication across policy templates in input packages that define multiple policy templates.
• Includes input packages in the Integrations Signal type filter.
• Fixes security rule names not displaying in the integration Assets accordion.
• Fixes the agent logging level dropdown not updating after clicking Reset to policy on the agent Settings tab.
• Fixes broken asset references in the integration Assets tab when an integration is reinstalled or upgraded from a different Kibana space.
• Fixes per-integration output overrides for OpenTelemetry (OTel) integrations, and now raises a validation error when an unsupported output type is assigned instead of failing silently.

Discover

• Fixes null and undefined field values in the ES|QL document summary column incorrectly counting toward the discover:maxDocFieldsDisplayed limit, which caused fields with real values to be hidden.
• Fixes the Extend action icon in the Background searches panel being invisible in dark mode.
• Fixes Discover session panels in dashboards failing to load after Copy to Spaces or import when the target space already contains remapped sessions.

ES|QL editor

• Fixes a regression where KQL autocomplete suggestions stopped working in the ES|QL editor.
• Fixes editing of object fields in the ES|QL lookup index editor when using dot-notation column names.

Elastic Observability solution

For the Elastic Observability 9.4.3 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.4.3 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• Adds notifications.connectors.default.email as a Docker environment variable.
• Fixes user profile retrieval in reverse proxy run_as configurations, ensuring the nav bar displays the effective user's avatar and name rather than the proxy user's.
• Fixes product documentation installation timing out when the ML inference endpoint scales up from zero replicas (cold-start), and improves error messages when installation fails.

Management

• Logs Dev Tools Console requests through the elasticsearch.query debug logger (method, path, and response status; request bodies are not included since Console streams them), and adds support for URL path prefixes in elasticsearch.hosts for Console proxy requests.

Workflows

• Fixes workflow executions that become orphaned from Task Manager now being cancelled immediately rather than waiting indefinitely for an asynchronous cancel.

Fixes

Alerting

• Fixes Webhook Connector accessTokenUrl validation #258290.

Dashboards and Visualizations

• Adjusts scrolling when you drag and drop a dashboard panel to avoid jumping #258445.
• Fixes Canvas library embeddables failing to load when savedObjectId is present without saved object references #257779.
• Fixes a race condition in the dashboard backup service and removes unnecessary error toasts #257762.
• Fixes Add from library in Canvas creating incorrect embeddable state #257261.
• Fixes Lens panels appearing to revert after inline edits until you refresh the page, even though changes are saved #256984.

Data ingestion and Fleet

• Improves screen reader announcements and focus when moving processors in the ingest pipeline editor #259096.
• Fixes Fleet bulk agent actions (unenroll, upgrade, reassign to policy) not respecting the current space when selection uses a kuery filter #258582.
• Fixes automatic agent upgrades stopping early with “target percentage already reached” because agents upgrading in other policies are also counted #258387.

Data management

• Restores keyboard focus to the Create a transform button on the Transforms page #258095.
• Enhances screen reader notifications for bulk actions in Index Management tables, providing live announcements when the bulk actions menu becomes visible or hidden #257089.

Elastic Observability solution

For the Elastic Observability 9.3.3 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.3.3 release information, refer to Elastic Security Solution Release Notes.

Elasticsearch solution

• Fixes the query rules UI rejecting case variants as duplicate values #259506.
• Fixes only passing filtered rules to the API and deleting rules not matching the filter in the Query Rule Set editor #259503.
• Prevents creating incompatible inference endpoints when adding a semantic_text field in the Index Management mappings editor #256586.

Machine Learning

• Fixes the anomaly swim lane dashboard panel not refreshing #259962.
• Fixes a console error when opening the data frame analytics jobs list #258591.
• Adds aria labels to job wizard combo boxes #258509.

The 9.3.2 release contains fixes for potential security vulnerabilities. Check our security advisory for more details.

Features and enhancements

Elastic Security solution:
For the Elastic Security 9.3.2 release information, refer to Elastic Security Solution Release Notes.

Connectivity:

• Adds Gemini 2.5 Flash Lite, Claude 4.5 Haiku, and Claude 4.6 Sonnet models to preconfigured connectors #253109.

Fixes

Elastic Agent Builder:

• Fixes a bug in the platform.core.search tool and index_search tool type where nested fields were ignored when searching for matching documents #255914.
• Fixes MCP connectors ignoring the proxy and SSL configuration from the actions plugin (xpack.actions configuration property) #255813.

Alerting:

• Fixes a problem generating a report with multi-page Canvas workpads #255022.
• Fixes a blank page appearing at the end of PDF exports when using the Print format option with an even number of dashboard visualizations #254957.
• Improves handling of 204 responses #251090.

Dashboards and Visualizations:

• Fixes an issue where embedded panels in Canvas workpads could lose their saved object references, causing panels to fail to load #252191.
• Fixes the Add from library action adding incorrect embeddable state #257261.
• Fixes Lens transforms #257224.
• Fixes an issue where dashboard panels could get stuck in an infinite loading state after an error instead of showing error messages #257188.
• Fixes Maps failing to load when the stored time filter contained a quick mode value #255178.

Data ingestion and Fleet:

• Fixes the unenroll task and adds an FTR test #255726.
• Fixes incorrect installation of assets #254923.

Discover:

• Fixes glitchy rendering in the Attributes tab #255173.

Elastic Observability solution:
For the Elastic Observability 9.3.2 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution:
For the Elastic Security 9.3.2 release information, refer to Elastic Security Solution Release Notes.

Kibana platform:

• Fixes the spaces list displaying No spaces match text on load #255654.
• Fixes the embeddable console auto-closing on chrome or overlay clicks #253382.
• Fixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

Kibana security:

• Adds waitFor for the privilege button #255094.
• Fixes an issue where saving a dashboard included access control features when a user profile was not available #255065.

Machine Learning:

• Fixes screen reader announcements for flyouts #256409.

Management:

• Improves name announcement in the index mode modal #256392.
• Fixes an issue in Dev Tools Console where syntax highlighting broke when queries contained accented or non-ASCII characters #255649.
• Fixes an issue in Dev Tools Console where closing nested braces broke syntax highlighting for subsequent elements #255426.

Search:

• Changes the Run in Console button type #256455.
• Fixes Search Playground routes to limit the maximum size of arrays #255881.
• Fixes focus behavior when there are errors in the connector flyout form #255770.
• Adds server-side API key generation #256083.

The 9.3.1 release contains fixes for potential security vulnerabilities. Check our security advisory for more details.

Features and enhancements

Data ingestion and Fleet

• Allows integration rollback even if all package policies are not on an upgraded version #253646.

Elastic Security solution

For the Elastic Security 9.3.1 release information, refer to Elastic Security Solution Release Notes.

Machine Learning

• Adds a dynamic default connector to GenAI settings #252861.
• Adds missing ES|QL commands and functions documentation for inference tasks #249089.

Fixes

Alerting and cases

• Fixes a bug with PagerDuty where setting the Custom details field causes rules to fail #253683.
• Adds external reference IDs to the attached documents check when a case is selected #253107.
• Fixes rule execution failing due to null execution UUIDs #252618.
• Improves handling of 204 responses #251090.

Connectivity

• Fixes AI Connector form fields incorrectly resetting to default values when cleared with backspace #251095.
• Updates connector description terminology to reference "pre-configured AI connectors" #250649.

Dashboards and Visualizations

• Fixes layer editor scrolling in the full Lens editor #253247.
• Fixes runtime_mappings being ignored or overridden in Vega specs when defined in data[].url.body #253560.

Data ingestion and Fleet

• Fixes an issue where an agent rolled back after an upgrade could not be upgraded again in Fleet UI #253850.

Discover

• Fixes handling of missing values #251892.

Elastic Observability solution

For the Elastic Observability 9.3.1 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.3.1 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• Strips system-managed date fields from ingest pipelines before PUT requests #252579.
• Fixes Stack Monitoring breadcrumb when in solution view #249751.

Machine Learning

• Fixes "today" and "this week" filters for Log Rate and Pattern Analysis embeddables #252925.
• Fixes word break in Anomaly Detection page titles #250058.

Management

• Fixes autocomplete not working in embedded console #253306.
• Fixes an issue loading the doc count in index management when viewing larger page sizes with long index names #252422.
• Fixes a validation error for AI pipeline suggestions with empty grok patterns #251113.

Search

• Fixes homepage throwing errors when license level is below Enterprise #251484.
• Reduces background polling on the Index Details page to avoid unnecessary API requests #251446.
• Fixes links being visible on Search homepage when the user doesn't have access #251437.

Workflows

• Adds datemath support to the KQL evaluator #252840.

Features and enhancements

Elastic Agent Builder

• Elastic Agent Builder is now generally available. It is enabled by default in Elasticsearch solution environments, and you can opt in to Agent Builder and its AI Agent chat experience in Observability and Security solution environments. Learn how to get started.

Alerting

• Supports searching for report schedules by title and creator #243841.
• Provides fields for specifying cc and bcc recipients, the subject line, and the message for scheduled report email notifications #242922.
• Enables incremental human-readable case IDs #238555.
• Adds option to delete report schedules #238197.
• Alert cleanup is now generally available #247465.
• Adds search to the new Attachments tab in cases #246265.
• Adds support for searching rules by their actions' params using the API #246123.
• Scheduled reports are now generally available #245882.
• The Slack connector can now be configured to send messages to any channel using channel names #245423.
• Improves search on the case management page #245321.
• Adds option to enable disabled report schedules #244202.
• Disable flapping per rule - schema only changes #243855.
• Centralizes tabs for different attachement types under the new Attachments tab in cases #243708.
• Adds a date time picker to the cases management page to help you find cases that were created during a specific time range #243409.
• Adds option to edit report schedules #241928.
• Improves UI for specifying additional fields for IBM Resilient action #238869.
• Makes Agent ID the default observables type #238533.
• Adds kibana.alert.index_pattern to all Stack alerts. This change doesn't affect detection alerts #239450.

Connectivity

• Elastic will regularly be adding new AI models from 9.3 onwards which will appear as pre-configured AI connectors in Kibana. Refer to the Elastic Inference Service page for more details.
• Adds Groq to the list of available providers for the Inference/AI Connector and for Inference endpoint creation #244962.
• Introduces a Brave Search connector #245329.
• The webhook connector now supports the following HTTP request methods: POST(default), PUT, PATCH, GET, and DELETE #238072.
• Adds new preconfigured connectors and updates existing ones #242791.
• Adds a new temperature parameter to AI Connector and to OpenAI, Bedrock, and Gemini connectors #239806.
• Adds support for headers in the OpenAI integration #238710.

Dashboards and Visualizations

• Dashboards now support ownership and "write_restricted" mode. You can now keep dashboards publicly editable or in a write-restricted state until they are ready to be published, giving you more control over who can edit your dashboards, regardless of broader space permissions #224552.
• Adds support for chaining variable controls. You can now set up variable controls to depend on the values selected for another variable control #242909.
• Adds basic filtering support for interactions with ES|QL charts #243439.
• Removes the Supporting visualization section heading from the Primary Metric editor. All configuration options remain fully accessible in the same location under Appearance #245979.
• Reorganizes and renames color settings in the Primary Metric dimension editor. For numeric metrics, the "Color by value" and "Color mapping"/"Color" settings are now located under the "Background chart" field. The settings have been renamed as follows: "Color by value" is now "Color mode", and "Color mapping" is now "Dynamic color mapping" #243608.
• In dashboard visualization in-line editing and Lens workspace, the 'Appearance', 'Titles and text', 'Axis', and 'Legend' settings have been moved from a popover into a dedicated flyout panel #240804.
• Moves the Lens visualization toolbar from the workspace section to the configuration panel #239879
• Moves the Save as and Reset options under the top nav Save button when the dashboard is in edit mode #237211.
• The Lens configuration panel has been redesigned to display layers as tabs instead of vertically stacked panels. Layer actions (clone, remove, save) are now accessible through a menu in each tab, improving the editing experience when working with multiple data layers, annotations, and reference lines #235372.

Data ingestion and Fleet

• Enables integration knowledge generation by default and adds a UI setting that allows you to opt out of the integration knowledge indexing #245080.
• Enables rolling back integrations to the previously installed version #240761.
• Adds capability for rolling back a recent upgrade of a Fleet-managed Elastic Agent using Fleet UI or API #247398, #249416.
• Adds functionality for removing root privilege from Fleet-managed agents if applicable #237790.
• Adds Advanced Internal YAML Settings field to the agent policy settings UI #245819.
• Redesigns the Actions menu in Fleet, placing commonly used actions at the top level and organizing other actions into nested menus by use case #245174.
• Auto-migrates component templates to use type@lifecycle ILM policies during Fleet setup #243333.
• Adds a cleanup task that removes excess policy revisions from the .fleet-policies index #242612.
• Uses type@lifecycle ILM policies for new package installations #241992.
• Adds the xpack.fleet.experimentalFeatures config setting #238840.
• Adds a Show agentless resources toggle on the Fleet > Settings page for debugging and diagnostics #237528.
• Adds Fleet Server host authentication settings for Elastic Agent > Fleet Server SSL support #236959.
• Persists the state of filters in the agent list table while navigating within a session #228875.

Discover

• Discover now shows partial results after a search gets canceled #242346.
• Background search is now enabled by default in all environments #242105.
• Adds a “Copy as Markdown” option for selected results #245545.
• Optimizes performance by avoiding redundant requests when breakdown or chart interval changes #245523.
• Shows multi-fields in the document viewer by default in ES|QL mode #245890.
• Adds support for filtering multivalue fields by interacting with the results table in ES|QL mode #245554.
• Improves the lookup index editor interface available in ES|QL mode #244480.
• Improves the file upload section of the lookup index editor interface #244550.
• Saving an ES|QL query's visualization to a dashboard now brings any related controls along with it #237070.
• Updates the icon in the document viewer to add or remove a field in the main documents table #246024.

ES|QL editor

• Adds a Quick search functionality that helps you turn free-text inputs into ES|QL WHERE clauses #242123.
• Adds support for multi-value variables using MV_CONTAINS functions #239266.
• Adds inline suggestions to ES|QL queries #235162.
• Allows selecting field data type in the lookup index editor interface of the ES|QL editor #241637.
• Adds support for expressions in functions #236343.
• Improves computed suggestions for expressions #246421.
• Renders string-only suggestions for Like and RLike operators #244903.
• Improves validation and autocomplete suggestions for the CASE function #244280.
• Adds context-aware suggestion ordering with categorization #243312.
• Suggests adding curly braces after the WITH keyword for RERANK and COMPLETION commands #243047.
• Adds support for new exponential_histogram Elasticsearch field type #242748.
• Wraps the fork subcommands inside aparens node #242369.
• Improves the quality of context-based suggestions #241081.
• Adds autocomplete suggestions for expressions in LOOKUP JOIN commands #240735.
• Applies the breakdown field before applying time bucketing in STATS BY commands to preserve consistent sorting across buckets in ES|QL queries #239685.

Elastic Observability solution

For the Elastic Observability 9.3.0 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.3.0 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• Adds buttons to the time picker component to quickly shift the selected time range backward and forward, and adds timezone information to the time picker popover #243020.
• Adds cross-tab syncing for recently used time ranges #242467.
• The defaultRoute advanced setting now controls the target of the Elastic logo link for spaces using a solution view #241571.
• The name of the deployment now appears in the navigation breadcrumb on Elastic Cloud Hosted #238078.
• Enforces the object_src 'none' directive in Kibana's Content Security Policy and introduces a new csp.object_src configuration option to control its behavior
• Containers now set the default Node.js heap to 75% of available memory up to a maximum of 4096 Mb. Previously, this was set to 50% #246073.
• Linux now supports the populate_file_data advanced option which enables entropy and header_bytes fields in file events #246197.
• Adds the ability to cancel file uploads #241297.

Kibana security

• The API keys management page now defaults to showing personal API keys only #245261.
• Adds a warning when deleting API keys currently used by alerting rules #243353.
• Adds the ability to specify the origin(s) of authentication providers that appear to users logging in to Kibana #239993.
• Enhances the error message to include detailed information about why a role is considered as malformed #239098.
• Removes the AI Assistants Settings privilege #239144.

Machine Learning

• Adds an optional timeout parameter to the Inference chat model #248326.
• Adds Security machine learning modules for GCP Audit and Azure Activity Logs #236849.
• Removes median line length anomaly detection categorization check #243827.
• Adds custom header support to inference endpoints creation UI #242187.
• Improves the layout for custom inference endpoint UI #241779.
• Adds an action to create an anomaly detection alerting rule #241274.
• Makes the machine learning update space APIs public #241109.
• Improves display of long fields values in top values list #241006.
• Adds the ability to narrow down the list of anomalies that the Anomaly detection rule looks for #240100.
• Adds feedback button to the Anomaly Explorer and Single Metric Viewer #239883.

Search

• When creating a new Elasticsearch solution project, you will now land on the Elasticsearch home page by default instead of the Create index page to get immediate access to relevant tutorials and educational content #237612.
• Adds a new getting started page within the Elasticsearch solution which offers hands-on feature tutorials. This page defaults as the initial destination for users creating a new Elasticsearch solution project #245311.
• Adds a clear confirmation when an element has been successfully copied using one of the available Copy buttons on the Elasticsearch solution home page #246090.
• Adds callouts and guided tours to Kibana's Elasticsearch solution UI on Elastic Cloud Hosted and Serverless to provide better introductions to Elastic Inference Service endpoints. You can dismiss callouts and tours, which will not reappear after dismissal #244626.
• Improves the Console UI to make key actions more intuitive. The Play button is now more prominent, a new Copy to language button provides quick access to export the selected command in your preferred coding language, and the context menu has been updated to allow you to set a default language preference #242487.

Workflows

• Elastic Workflows is now available in technical preview. Build YAML-based workflows to automate actions across Elasticsearch,Kibana, external systems, and AI. Workflows support manual, scheduled, and alert-based triggers, conditional logic, and integrations with existing connectors and Agent Builder. You must turn on the feature to get started. Refer to Set up workflows for more details.

Fixes

Alerting

• Fixes cases.total_event not showing the number of events attached to a case #247996.
• Encodes terms searched on cases management page #247992.
• Adds max character validation to the email connector params and config #246453.
• Fixes an issue that caused the Security alerts table to not update columns correctly when switching view mode #245253.
• Adds alert.consecutiveMatches to action context #244997.
• Fixes case submissions becoming stale #244543.
• Allows spaces in file paths for case observables #244350.
• Catches connector errors without interrupting the case creation flow #244188.
• Improves error messages for IBM connector #244012.
• Verifies the alert exists before muting #242847.
• Fixes auto-extraction in event bulk actions #242325.
• Fixes Alerts table pagination being stuck on rule details page #242275.
• Use real dimensions when taking a screenshot of {kib} layout #242127.
• Only takes tag changes into account when connector supports them #241944.
• Improves cases management table loading to prevent flashing #240155.
• Fixes missing announcements in case forms to improve accessiblity #240132.
• Adds manual focus to buttons for case actions to improve accessiblity #239504.
• Removes autoFocus to preserve proper focus when modal closed #239366.
• Fixes observables not being added to cases when auto-extract is turned on #239000.
• Updates nodemailer to to 7.0.9 #238816.
• Adds Jira's otherFields JSON editor to case creation flow #238435.
• Isolates the configuration parameters for the Tines connector to the server side #236863.
• Enables auto-extraction by default and adds user actions for case observable actions #236524.
• Separates sync alert and auto-extract updates in case activity #236519.
• Fixes the alert history chart background color in dark mode #246017.
• Fixes infinite loop issue in investigation guide editor #240472.
• Fixes missing fields when using combined filters with the ignoreFilterIfFieldNotInIndex advanced setting enabled #238945.

Connectivity

• Ensures that the "maximum tokens" parameter is passed as expected by the service for the Anthropic connector #241188.
• Removes the default fallback region for the Bedrock connector #241157.
• Ensures all authentication fields show up correctly for the AI Connector #240913.

Dashboards and Visualizations

• Cleans filters as they’re updated from Unified Search, adds extra cleanup for compound filters by removing undefined properties, and fixes unsaved badges appearing when dashboards with compound filters are loaded #247309.
• Uses Number.MAX_VALUE instead of Infinity for the default maximum height of a panel #243572.
• Fixes an issue where saving a dashboard after switching a Dashboard Link to an External Link caused the save function to throw an error #243134.
• Fixes the silence warnings by silencing error notifications in Discover and Dashboards and changing the built-in URL restore error to a console.warn #242788.
• Fixes a regression with print mode in Dashboard #242780.
• Fixes an issue with sync colors and sync tooltips being turned on by default for new dashboards. Now, those options are turned off by default for new dashboards #242442.
• Fixes an error with deselecting a "(blank)" option from an options list #242036.
• Fixes layout issues for Markdown embeddables in small dashboard panels using CSS container queries. When a markdown panel is shorter than 120px, the UI now adapts to a compact layout that maximizes usable space #240806.
• Labels in the Create index flow now render with the default Use vector tiles scaling as soon as label styling is applied (or after save), without requiring a scaling toggle #240728.
• Fixes an issue where users could not reset unsaved changes after enabling time restore and changing dashboard time range #239992.
• Fixes search session restoration issue #239822.
• Fixes an error in the Options list control when selecting a "(blank)" value #239791.
• Fixes an issue in the LensConfigBuilder that treated all dataview references the same, causing the UI to throw an error attempting to find an ad-hoc dataview that does not exist as a SavedObject #239431.
• Fixes an issue in the Lens Table that broke click to filter on table rows when any column is used as a formula #239222.
• Fixes metric color assignment when the breakdown and maximum options are defined in Lens #238901.
• Fixes an issue where ad-hoc data views were not providing suggestions in the global search bar #238731.
• Fixes an error in the Visualize Listing page in which an error in the visualization could cause the entire page to error. This improves the error handling to make it easier to identify which visualization is causing the problem in order to address it #238355.
• Fixes an issue where dashboards cannot be saved when a filter pill has a combined filter using OR or AND operations #237477.
• Fixes an issue where panels in sections are not displayed when opening the dashboard from a shared link #237382.
• Prevents a double fetch when panels would fetch data while controls were building filters and then fetch data again once controls filters are available #237169.
• Fixes color contrast for links in Lens #247721.

Data ingestion and Fleet

• Uses long expiration for agent auto-upgrade actions and scheduled upgrades #243443.
• Fixes auto-upgrade logic to retry upgrade action if agents are stuck in Updating state #243326.
• Adds retry behavior for /api/fleet/agents when transient issues with Elasticsearch are encountered #243105.
• Fixes Docker image in the Kubernetes manifest in the Add agent instructions #242691.
• Fixes an issue where some package icons were not loaded correctly #242406.
• Shows warnings on sync integrations UI when referencing other entities #241623.
• Adds the proxy SSL options to download sources if a proxy is selected #241115.
• Omits system properties when synchronizing ingest pipelines #241096.
• Fixes template_path asset selection for some integration packages #240750.
• Allows Fleet setup retries on start in all environments #240342.
• Fixes an issue where the uniqueness of agent policy names was not consistently enforced across spaces when name or space changes occurred #239631.
• Fixes ignore_above mapping for flattened fields #238890.
• Fixes a "package not found" error when skipping cloud onboarding for a prerelease package #238629.
• Fixes an issue where new package global variables were not included and stale variable references were not removed on integration policy upgrade #238542.
• Fixes an error that occurred when deleting orphaned integration policies #237875.
• Enables storing secrets in Fleet Server host config if Fleet Server is running at a minimum supported version #237464.
• Fixes MSI commands for installing Elastic Agent and Fleet Server #236994.

Discover

• Fixes an issue with the "Search entire time range" option that could exclude some results if the time field was set to date nanos #248495.
• Fixes an issue where document viewer tabs were unnecessarily re-mounting on every refresh, leading to degraded performance #248203.
• Fixes an issue causing query drafts to be lost when switching between tabs without running the query first in ES|QL mode #247968.
• Fixes an issue with ES|QL tabs not loading properly #246941.
• Fixes an issue in Discover where default app state could trigger unsaved changes in saved Discover sessions, such as default columns applied through the defaultColumns advanced setting #246664.
• Fixes an issue with Discover tabs that occurs when navigating to a different tab while the previous tab is still initializing #245752.
• Fixes truncation for longer text in the Discover table #241440.

ES|QL editor

• Displays the available options when editing an existing variable control #239315.
• Fixes unrecognized GROK patterns #246871.
• Fixes KEEP behavior in ES|QL when a query initially returns no results #239063.
• Adds FORK with KEEP/STATS in the transformational commands #240011.
• Fixes the autocomplete of timeseries sources after a comma #241402.

Elastic Observability solution

For the Elastic Observability 9.3.0 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.3.0 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• Fixes the serialization of meta.error in JSON layouts. If it is an Error instance, only message, name, and stack are included. Other fields are no longer returned in the logs #244364.
• Fixes an issue in the component template creation flow where a new component template with @custom suffix in its name would lead to updating mappings of all unrelated data streams and cause a popup to appear asking to roll over conflicting ones #237952.
• Fixes privilege requirements when reindexing indices through the upgrade assistant. Previously, the "superuser" role was required. Now, "cluster: manage" and "all" privileges for the relevant indices are sufficient #237055.
• Fixes a case where the upgrade assistant would incorrectly warn about a node breaching the low watermark despite the max headroom setting #243906.
• Fixes createAuditEvents always returning failure as outcome #247152.
• Fixes "now" and mixed format date handling in the Share menu #245539.
• Fixes favicon CSS specifity #243351.
• Reduces re-renders on resize and items changes #239888.
• Fixes an issue with the files management flyout crashing #237588.
• Fixes infinite loading of roles on the Edit space page #242954.
• Reflects the value selected for the AI Assistants Visibility GenAI setting when opening AI Assistant from the header #239555.
• Fixes ECS-incompatible logs values #245706.
• Fixes an issue where clients authorized to a partial list of saved object types would circumvent the Saved Objects Repository's allowed types and could list hidden saved object types #244967.

Kibana security

• Fixes an issue where fields were not case-sensitive in Kibana's user interface for creating and updating roles, though fields are case-sensitive in Elasticsearch #246069.
• Fixes an issue preventing IDP-initiated login with multiple OIDC providers #243869.
• Introduces a separate error for empty login attempts with SAML and OIDC providers #237611.

Machine Learning

• Disables field statistics when using the ES|QL TS command in Data Visualizer #247641.
• Fixes display of Data Visualizer's map view for small screen sizes #247615.
• Fixes anomaly chart empty query issue #246841.
• Fixes creating new anomaly detection jobs from Discover sessions with no data view #246410.
• Ensures Anomaly detection result chart tooltips are always shown correctly #246077.
• Prevents clearing cell selections after hiding the alert's table popover in Anomaly explorer #244183.
• Optimizes and enables text field analysis in contextual insights for log rate analysis #244109.
• Ensures deleted text in the inference connector, AI connector, and inference endpoint creation forms is not sent as an empty string #244059.
• Fixes wizard for data view with runtime fields for data frame analytics #242557.
• Fixes import and improves validation for Anomaly detection and Data frame analytics jobs #242263.
• Ensures max tokens parameter is passed as expected during Anthropic endpoint creation #241212.
• Fixes index names causing incompatible cluster errors when product docs are installed for multiple inference IDs #240506.
• Ensures inference endpoints UI list loads when provider is custom #240189.
• Fixes layout of fields in machine learning overview and notifications pages #239113.
• Adds unique accessible labels for Show top field values buttons #237972.
• Fixes tool calling unavailable tools #237174.
• Improves trained models list performance #237072.
• Fixes partition field settings errors in the single metric viewer dashboard panel #237046.
• Prevents URL-like strings from being displayed as links in alerts #226849.
• Improves anonymization error messages when NER model is unavailable #247696.
• Adds table caption for empty top categories in logs category table #246041.
• Fixes broken Data Visualizer and AI Operations navigation breadcrumbs and sidebar in solutions #248167.
• Fixes counter metric fields missing in anomaly detection dropdown #153021.

Search

• Fixes an issue when running Elasticsearch with a Basic license, where you could encounter errors when updating index mappings, even when adding non-ML field types. Mapping updates now work as expected, while advanced semantic text features continue to require the appropriate license #248462.
• Disables 'API keys' button on the Elasticsearch home page when logged in with insufficient permissions #248072.
• Fixes the token count display showing "NaN" in Search Playground by preserving message annotations across the AI SDK v5 stream #246589.
• Fixes an issue with the API creation flyout size #244072.
• Fixes a case of keyboard focus getting trapped in pages using document preview #243791.
• Makes elser-2-elastic (ELSER in EIS) the default inference endpoint for adding semantic text fields. Refactors the SelectInferenceId component for clarity and stability, resolving a console warning and improving popover and flyout state handling #242436.
• Fixes Agents & Playground icons in the solution side navigation to render correctly when using dark mode #240475.
• Fixes visual issues in the data preview metadata popup when ID is too long. Adds a tooltip and copy button to improve user experience #239768.
• Fixes an issue in RAG Playground where invalid fields displayed red styling but no error messages. Error text now appears to help you identify and correct form issues #238284.
• Fixes an accessibility issue where resetting changes or removing all terms in the Synonyms panel was not announced by screen readers. VoiceOver users on Safari will now hear updates when terms are reset #237877.
• The Index management mappings editor now syncs model deployment status correctly. This fixes a case where users couldn't save semantic_text fields during deployment without forcing #237812.
• Fixes an issue where the retriever query copied from the "Search your data" JavaScript tutorial fails with a parsing_exception when passed through the query parameter in the Node.js Elasticsearch client. Retriever queries must be passed through the body parameter to ensure they are serialized correctly #237654.
• Adds refusal field to AI Assistant conversations #243423.
• Turns off custom suggestions on the embedded console #241516.
• Fixes an issue where form fields were resetting automatically when editing ingest pipeline settings #237509.