Merge branch 'main' into 20250417-transform-link

Author: leemthompo

.github/workflows/add-new-team-label.yml

@@ -0,0 +1,18 @@
+name: "Label new issues with needs-team"
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  add-needs-triage-label:
+    name: Add `needs-team` label
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add the needs-team label
+        uses: actions-ecosystem/action-add-labels@v1
+        with:
+          labels: |
+            needs-team
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/add-to-board.yml

@@ -0,0 +1,43 @@
+name: Triage & route issues
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  route:
+    runs-on: ubuntu-latest
+    if: |
+      github.event.label.name == 'team:DocsEng' ||
+      github.event.label.name == 'team:Obs' ||
+      github.event.label.name == 'team:Platform' ||
+      github.event.label.name == 'team:Projects' ||
+      github.event.label.name == 'team:Search' ||
+      github.event.label.name == 'team:Security'
+    env:
+      PROJECT_ID_MAP: |
+        {
+          "team:DocsEng":   "1625",
+          "team:Obs":       "649",
+          "team:Platform":  "1232",
+          "team:Projects":  "1415",
+          "team:Search":    "726",
+          "team:Security":  "1034"
+        }
+    steps:
+      - name: Remove needs-team label
+        uses: actions-ecosystem/action-remove-labels@v1
+        with:
+          labels: needs-team
+
+      - name: Add issue to the right project
+        uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e
+        with:
+          project-url: https://github.com/orgs/elastic/projects/${{ fromJson(env.PROJECT_ID_MAP)[github.event.label.name] }}
+          github-token: ${{ secrets.ADD_TO_BOARD_TOKEN }}
+          labeled: ${{ github.event.label.name }}
+          label-operator: OR

deploy-manage/autoscaling/autoscaling-in-eck.md

@@ -20,6 +20,14 @@ Configure autoscaling for {{es}} deployments in {{eck}}. Learn how to enable aut
 
 ECK can leverage the [autoscaling API](https://www.elastic.co/docs/api/doc/elasticsearch/group/endpoint-autoscaling) introduced in {{es}} 7.11 to adjust automatically the number of Pods and the allocated resources in a tier. Currently, autoscaling is supported for {{es}} [data tiers](/manage-data/lifecycle/data-tiers.md) and machine learning nodes.
 
+### Supported Resources for Autoscaling per Elasticsearch Tier
+
+| Tiers | Storage | Memory | CPU |
+| --- | ---| --- | --- |
+| Data Nodes (except Frozen) | Yes | Calculated proportionally to the required amount of storage | Calculated proportionally to the required amount of memory
+| Frozen Nodes | Yes | Yes | Calculated proportionally to the required amount of memory
+| Machine Learning | No | Yes | Calculated proportionally to the required amount of memory
+
 
 ### Enable autoscaling [k8s-enable]
 
@@ -345,4 +353,4 @@ spec:
         target:
           type: Utilization
           averageUtilization: 50
-```
+```

deploy-manage/deploy/cloud-enterprise/default-system-deployment-versions.md

@@ -14,6 +14,10 @@ Note that since version 2.7.0, system deployments are automatically upgraded whe
 
 | {{ece}} version | Admin cluster | Logging & Metrics cluster | Security cluster |
 | --- | --- | --- | --- |
+| 4.0.0 | 8.18.0 | 8.18.0 | 8.18.0 |
+| 3.8.0 | 8.17.4 | 8.17.4 | 8.17.4 |
+| 3.7.3 | 7.17.24 | 7.17.24 | 8.15.2 |
+| 3.7.2 | 7.17.22 | 7.17.22 | 8.13.4 |
 | 3.7.1 | 7.17.20 | 7.17.20 | 8.13.2 |
 | 3.6.2 | 7.17.15 | 7.17.15 | 8.11.1 |
 | 3.6.1 | 7.17.13 | 7.17.13 | 8.9.2 |

manage-data/data-store/data-streams/logs-data-stream.md

@@ -143,7 +143,7 @@ By default, `logsdb` index mode sets `ignore_malformed` to `true`. With this set
 
 ### `ignore_above` [logs-db-ignore-above]
 
-In `logsdb` index mode, the `index.mapping.ignore_above` setting is applied by default at the index level to ensure efficient storage and indexing of large keyword fields.The index-level default for `ignore_above` is 8191 *characters.* Using UTF-8 encoding, this results in a limit of 32764 bytes, depending on character encoding.
+In `logsdb` index mode, the `index.mapping.ignore_above` setting is applied by default at the index level to ensure efficient storage and indexing of large keyword fields. This applies to all members of the keyword type family (keyword, constant_keyword, and wildcard). The index-level default for `ignore_above` is 8191 *characters.* Using UTF-8 encoding, this results in a limit of 32764 bytes, depending on character encoding.
 
 The mapping-level `ignore_above` setting takes precedence. If a specific field has an `ignore_above` value defined in its mapping, that value overrides the index-level `index.mapping.ignore_above` value. This default behavior helps to optimize indexing performance by preventing excessively large string values from being indexed.
 

reference/fleet/fleet-api-docs.md

@@ -405,3 +405,51 @@ Example response (formatted for readability):
    "total" : 4
 }
 ```
+
+## List all {{agents}} [list-agents-api]
+
+Use the [Get agents API](https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-fleet-agents) to retrieve a list of currently enrolled {{agents}}:
+
+```shell
+curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents
+```
+
+By default, a maximum of 10,000 agents are returned, with 20 agents listed per page.
+
+### List all {{agents}} with `perPage` setting [list-agents-api-perpage]
+
+The following query returns the same list, showing 10,000 {{agents}} per page:
+
+```shell
+curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents?perPage=10000'
+```
+
+### List the next set of 10,000 {{agents}} [list-agents-api-next-set]
+```{applies_to}
+stack: ga 9.1
+```
+
+Beginning with {{stack}} version 9.1, the previous query response includes a `nextSearchAfter` parameter that you can pass in a subsequent call, to retrieve the next page of 10,000 enrolled agents:
+
+```shell
+curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents?perPage=10000&searchAfter=<nextSearchAfter>'
+```
+
+### List all {{agents}} for a point in time [list-agents-api-point-in-time]
+```{applies_to}
+stack: ga 9.1
+```
+
+Beginning with {{stack}} version 9.1, you can also capture a point-in-time ID (`pitId`) parameter from the `Get agents API` response, and use that together with the `nextSearchAfter` parameter to capture the next page of 10,000 enrolled agents for a specific point in time.
+
+Include the `openPit` and `pitKeepAlive` parameters in your initial request:
+
+```shell
+curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents?perPage=10000&openPit=true&pitKeepAlive=5m'
+```
+
+You can then use the returned values in a new request to retrieve the next set of 10,000 agents:
+
+```shell
+curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents?perPage=10000&searchAfter=<nextSearchAfter>&pitId=<pit id>&pitKeepAlive=5m'
+```

reference/fleet/ls-output-settings.md

@@ -24,7 +24,7 @@ input {
   elastic_agent {
     port => 5044
     enrich => none <1>
-    ssl => true
+    ssl_enabled => true
     ssl_certificate_authorities => ["<ca_path>"]
     ssl_certificate => "<server_cert_path>"
     ssl_key => "<server_cert_key_in_pkcs8>"
@@ -38,7 +38,7 @@ output {
     data_stream => "true"
     api_key => "<api_key>" <3>
     data_stream => true
-    ssl => true
+    ssl_enabled => true
     # cacert => "<elasticsearch_ca_path>"
   }
 }

solutions/observability/apm/get-started-apm-server-binary.md

@@ -761,11 +761,83 @@ to sign all our packages. It is available from [https://pgp.mit.edu](https://pgp
 
 ### APT [_apt]
 
-Version 9.0.0-beta1 of apm-server has not yet been released.
+To add the apm-server repository for APT:
+
+1. Download and install the Public Signing Key:
+
+    ```shell
+    wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
+    ```
+
+1. You may need to install the `apt-transport-https` package on Debian before proceeding:
+
+    ```shell
+    sudo apt-get install apt-transport-https
+    ```
+
+1. Save the repository definition to `/etc/apt/sources.list.d/elastic-9.0.0.list`:
+
+    ```shell
+    echo "deb https://artifacts.elastic.co/packages/9.0.0-prerelease/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-9.0.0-prerelease.list
+    ```
+
+    :::{warning}
+    To add the Elastic repository, make sure that you use the `echo` method shown in the example. Do not use `add-apt-repository` because it will add a `deb-src` entry, but we do not provide a source package.
+
+    If you have added the `deb-src` entry by mistake, you will see an error like the following:
+
+    ```text
+    Unable to find expected entry 'main/source/Sources' in Release file (Wrong sources.list entry or malformed file)
+    ```
+    :::
+
+1. Run `apt-get update`, and the repository is ready for use. For example, you can install APM Server by running:
+
+    ```shell
+    sudo apt-get update && sudo apt-get install apm-server
+    ```
+
+1. To configure APM Server to start automatically during boot, run:
+
+    ```shell
+    sudo systemctl enable apm-server
+    ```
 
 ### YUM [_yum]
 
-Version 9.0.0-beta1 of apm-server has not yet been released.
+To add the apm-server repository for YUM:
+
+1. Download and install the public signing key:
+
+    ```shell
+    sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
+    ```
+
+1. Create a file with a .repo extension (for example, elastic.repo) in your /etc/yum.repos.d/ directory and add the following lines:
+
+    ```shell
+    [elastic-9.0.0]
+    name=Elastic repository for 9.0.0 packages
+    baseurl=https://artifacts.elastic.co/packages/9.0.0/yum
+    gpgcheck=1
+    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
+    enabled=1
+    autorefresh=1
+    type=rpm-md
+    ```
+
+    Your repository is ready to use. For example, you can install APM Server by running:
+
+    ```shell
+    sudo yum install apm-server
+    ```
+
+1. To configure APM Server to start automatically during boot, run:
+
+    ```shell
+    sudo systemctl enable apm-server
+    ```
+
 
 ## Run APM Server on Docker [apm-running-on-docker]
 
@@ -779,7 +851,34 @@ These images are free to use under the Elastic license. They contain open source
 
 Obtaining APM Server for Docker is as simple as issuing a `docker pull` command against the Elastic Docker registry and then, optionally, verifying the image.
 
-However, version 9.0.0-beta1 of APM Server has not yet been released, so no Docker image is currently available for this version.
+1. Pull the Docker image:
+
+    ```shell
+    docker pull docker.elastic.co/apm/apm-server:9.0.0
+    ```
+
+    Alternately, you can use the hardened [Wolfi](https://wolfi.dev/) image:
+
+    ```shell
+    docker pull docker.elastic.co/apm/apm-server-wolfi:9.0.0
+    ```
+
+1. Verify the Docker image:
+
+    ```shell
+    wget https://artifacts.elastic.co/cosign.pub
+    cosign verify --key cosign.pub docker.elastic.co/apm/apm-server:9.0.0
+    ```
+
+    The `cosign` command prints the check results and the signature payload in JSON format:
+
+    ```shell
+    Verification for docker.elastic.co/apm/apm-server:9.0.0 --
+    The following checks were performed on each of these signatures:
+      - The cosign claims were validated
+      - Existence of the claims in the transparency log was verified offline
+      - The signatures were verified against the specified public key
+    ```
 
 ### Configure APM Server on Docker [_configure_apm_server_on_docker]
 
@@ -803,7 +902,7 @@ docker run -d \
   --name=apm-server \
   --user=apm-server \
   --volume="$(pwd)/apm-server.docker.yml:/usr/share/apm-server/apm-server.yml:ro" \
-  docker.elastic.co/apm/apm-server:9.0.0-beta1 \
+  docker.elastic.co/apm/apm-server:9.0.0 \
   --strict.perms=false -e \
   -E output.elasticsearch.hosts=["elasticsearch:9200"] <1> <2>
 ```
@@ -820,6 +919,6 @@ The `apm-server.docker.yml` downloaded earlier should be customized for your env
 It’s possible to embed your APM Server configuration in a custom image. Here is an example Dockerfile to achieve this:
 
 ```dockerfile
-FROM docker.elastic.co/apm/apm-server:9.0.0-beta1
+FROM docker.elastic.co/apm/apm-server:9.0.0
 COPY --chmod=0644 --chown=1000:1000 apm-server.yml /usr/share/apm-server/apm-server.yml
 ```

solutions/search/cross-cluster-search.md

@@ -3,7 +3,7 @@ mapped_pages:
   - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-cross-cluster-search.html
 applies_to:
   stack:
-  serverless:
+  serverless: unavailable
 ---
 
 # Cross-cluster search [modules-cross-cluster-search]

solutions/search/ranking/semantic-reranking.md

@@ -88,7 +88,7 @@ To use semantic re-ranking in {{es}}, you need to:
 
 1. **Select and configure a re-ranking model**. You have the following options:
 
-    1. Use the Elastic Rerank cross-encoder model via the [inference API's {{es}} service](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-inference-put-elasticsearch).
+    1. Use the Elastic Rerank cross-encoder model through a preconfigured `.rerank-v1-elasticsearch` endpoint or create a custom one using the [inference API's {{es}} service](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-inference-put-elasticsearch).
     2. Use the [Cohere Rerank inference endpoint](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-inference-put-cohere) to create a `rerank` endpoint.
     3. Use the [Google Vertex AI inference endpoint](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-inference-put-googlevertexai) to create a `rerank` endpoint.
     4. Upload a model to {{es}} from Hugging Face with [Eland](eland://reference/machine-learning.md#ml-nlp-pytorch). You’ll need to use the `text_similarity` NLP task type when loading the model using Eland. Then set up an [{{es}} service inference endpoint](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-inference-put-elasticsearch) with the `rerank` endpoint type.