Skip to content

Commit bb5900f

Browse files
authored
Merge branch 'main' into 34-Elastic-Connectors-in-Security
2 parents a9df361 + e9c3c0c commit bb5900f

File tree

10 files changed

+323
-132
lines changed

10 files changed

+323
-132
lines changed

deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ This table compares Observability capabilities between {{ech}} deployments and S
110110
| **APM integration** ||| Use **Managed Intake Service** (supports Elastic APM and OTLP protocols) |
111111
| [**APM Agent Central Configuration**](/solutions/observability/apm/apm-agent-central-configuration.md) ||| Not available in Serverless |
112112
| [**APM Tail-based sampling**](/solutions/observability/apm/transaction-sampling.md#apm-tail-based-sampling) ||| - Not available in Serverless <br>- Consider **OpenTelemetry** tail sampling processor as an alternative |
113-
| [**Android agent/SDK instrumentation**](opentelemetry://reference/edot-sdks/android/index.md) || | Not available in Serverless |
113+
| [**Android agent/SDK instrumentation**](opentelemetry://reference/edot-sdks/android/index.md) || | |
114114
| [**AWS Firehose integration**](/solutions/observability/cloud/monitor-amazon-web-services-aws-with-amazon-data-firehose.md) ||| |
115115
| **Custom roles for Kibana Spaces** || **Planned** | Anticipated in a future release |
116116
| [**Data stream lifecycle**](/manage-data/lifecycle/data-stream.md) ||| Primary lifecycle management method in Serverless |
@@ -119,7 +119,7 @@ This table compares Observability capabilities between {{ech}} deployments and S
119119
| **[Fleet Agent policies](/reference/fleet/agent-policy.md)** ||| |
120120
| **[Fleet server](/reference/fleet/fleet-server.md)** | - Self-hosted <br>- Hosted || Fully managed by Elastic |
121121
| [**Index lifecycle management**](/manage-data/lifecycle/index-lifecycle-management.md) ||| Use [**Data stream lifecycle**](/manage-data/lifecycle/data-stream.md) instead |
122-
| **[iOS agent/SDK instrumentation](opentelemetry://reference/edot-sdks/ios/index.md)** || | Not available in Serverless |
122+
| **[iOS agent/SDK instrumentation](opentelemetry://reference/edot-sdks/ios/index.md)** || | |
123123
| **[Kibana Alerts](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md)** ||| |
124124
| **[LogsDB index mode](/manage-data/data-store/data-streams/logs-data-stream.md)** ||| - Reduces storage footprint <br> - Enabled by default <br>- Cannot be disabled |
125125
| **[Logs management](/solutions/observability/logs.md)** ||| |

docset.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,7 @@ subs:
278278
agent-pull: "https://github.com/elastic/elastic-agent/pull/"
279279
fleet-server-issue: "https://github.com/elastic/fleet-server/issues/"
280280
fleet-server-pull: "https://github.com/elastic/fleet-server/pull/"
281+
es-pull: "https://github.com/elastic/elasticsearch/pull/"
281282
kib-pull: "https://github.com/elastic/kibana/pull/"
282283
eck_helm_minimum_version: "3.2.0"
283284
eck_resources_list: "Elasticsearch, Kibana, APM Server, Beats, Elastic Agent, Elastic Maps Server, and Logstash"

reference/security/defend-advanced-settings.md

Lines changed: 132 additions & 122 deletions
Large diffs are not rendered by default.
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
navigation_title: Breaking changes
3+
products:
4+
- id: cloud-serverless
5+
---
6+
7+
# {{serverless-full}} breaking changes [elastic-cloud-serverless-breaking-changes]
8+
9+
## June 23, 2025 [serverless-changelog-06232025]
10+
11+
* {{esql}}: Disallows mixed quoted/unquoted patterns in `FROM` commands [#127636]({{es-pull}}127636)
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
toc:
22
- file: index.md
3+
- file: breaking-changes.md
34
- file: known-issues.md
45
- file: deprecations.md
Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
applies_to:
3+
stack: ga
4+
serverless: ga
5+
products:
6+
- id: observability
7+
---
8+
9+
# Configure log data sources
10+
11+
The `observability:logSources` {{kib}} advanced setting defines which index patterns your deployment or project uses to store and query log data.
12+
13+
Configure this setting at **Stack Management****Advanced Settings** or by searching for `Advanced Settings` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
14+
15+
16+
::::{note}
17+
Adding indices to the `observability:logSources` setting that don't contain log data may cause degraded functionality. Changes to this setting can also impact the sources queried by log threshold rules.
18+
::::
19+
20+
## Configure log data sources using the `saved_objects` API
21+
22+
::::{important}
23+
Using the `saved_objects` API to import log data sources has the following limitations:
24+
25+
* To import the log data source, you need to import the entire **Advanced Settings** saved object. This overwrites any other changes that you've made to your **Advanced Settings** in the target cluster, not just `observability:logSources`.
26+
* This approach is backward compatible, but not forward compatible. You cannot import the settings from an older version to a newer version.
27+
::::
28+
29+
To configure log data sources using the `saved_objects` API and the **Advanced Settings** saved object:
30+
31+
1. Go to **Stack Management****Advanced Settings** from the navigation menu or use the [global search field](../../../explore-analyze/find-and-organize/find-apps-and-objects.md).
32+
1. Configure your custom log sources in `observability:logSources`.
33+
1. Go to **Stack Management****Saved Objects** from the navigation or use the [global search field](../../../explore-analyze/find-and-organize/find-apps-and-objects.md).
34+
1. [Export](/explore-analyze/find-and-organize/saved-objects.md#saved-objects-import-and-export) the **Advanced Settings** saved object.
35+
1. Import the saved object to your target cluster using the [import saved objects API]({{kib-apis}}/operation/operation-importsavedobjectsdefault).

solutions/security/investigate/visual-event-analyzer.md

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,19 @@ If you’re experiencing performance degradation, you can [exclude cold and froz
2323

2424
## Find events to analyze [find-events-analyze]
2525

26-
You can only visualize events triggered by hosts configured with the {{elastic-defend}} integration or any `sysmon` data from `winlogbeat`.
26+
You can visualize events from the following sources:
2727

28-
In KQL, this translates to any event with the `agent.type` set to either:
28+
* {{elastic-defend}} integration
29+
* Sysmon data collected through {{winlogbeat}}
30+
* [CrowdStrike integration](integration-docs://reference/crowdstrike.md) (Falcon logs collected through Event Stream or FDR)
31+
* [SentinelOne Cloud Funnel integration](integration-docs://reference/sentinel_one_cloud_funnel.md)
32+
33+
In KQL, this translates to any event with the `agent.type` set to:
2934

3035
* `endpoint`
3136
* `winlogbeat` with `event.module` set to `sysmon`
37+
* `filebeat` with `event.module` set to `crowdstrike`
38+
* `filebeat` with `event.module` set to `sentinel_one_cloud_funnel`
3239

3340
To find events that can be visually analyzed:
3441

@@ -37,13 +44,12 @@ To find events that can be visually analyzed:
3744
* Find **Hosts** in the main menu, or search for `Security/Explore/Hosts` by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then select the **Events** tab. A list of all your hosts' events appears at the bottom of the page.
3845
* Find **Alerts** in the main menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then scroll down to the Alerts table.
3946

40-
2. Filter events that can be visually analyzed by entering either of the following queries in the KQL search bar, then selecting **Enter**:
47+
2. Filter events that can be visually analyzed by entering one of the following queries in the KQL search bar, then selecting **Enter**:
4148

4249
* `agent.type:"endpoint" and process.entity_id :*`
43-
44-
Or
45-
4650
* `agent.type:"winlogbeat" and event.module: "sysmon" and process.entity_id : *`
51+
* `agent.type:"filebeat" and event.module: "crowdstrike" and process.entity_id : *`
52+
* `agent.type:"filebeat" and event.module: "sentinel_one_cloud_funnel" and process.entity_id : *`
4753

4854
3. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. The event analyzer is accessible from the **Hosts**, **Alerts**, and **Timelines** pages, as well as the alert details flyout.
4955

@@ -75,7 +81,7 @@ Within the visual analyzer, each cube represents a process, such as an executabl
7581

7682
To understand what fields were used to create the process, select the **Process Tree** to show the schema that created the graphical view. The fields included are:
7783

78-
* `SOURCE`: Can be either `endpoint` or `winlogbeat`
84+
* `SOURCE`: Indicates the data source—for example, `endpoint` or `winlogbeat`
7985
* `ID`: Event field that uniquely identifies a node
8086
* `EDGE`: Event field which indicates the relationship between two nodes
8187

solutions/toc.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,7 @@ toc:
407407
- file: observability/logs/categorize-log-entries.md
408408
- file: observability/logs/inspect-log-anomalies.md
409409
- file: observability/logs/run-pattern-analysis-on-log-data.md
410+
- file: observability/logs/log-data-sources.md
410411
- file: observability/logs/add-service-name-to-logs.md
411412
- file: observability/logs/logs-index-template-reference.md
412413
- file: observability/logs/streams/streams.md
Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
navigation_title: Contact support
3+
description: Learn how to contact Elastic Support and what information to include to help resolve issues faster.
4+
applies_to:
5+
stack:
6+
serverless:
7+
observability:
8+
product:
9+
edot_collector: ga
10+
products:
11+
- id: cloud-serverless
12+
- id: observability
13+
- id: edot-collector
14+
---
15+
16+
# Contact support
17+
18+
In some cases, you may unable to resolve an issue with the Elastic Distributions of OpenTelemetry (EDOT) using the troubleshooting guides.
19+
20+
If you have an [Elastic subscription](https://www.elastic.co/pricing), you can contact Elastic support for assistance. You can reach us in the following ways:
21+
22+
* **Through the [Elastic Support Portal](https://support.elastic.co/):** The Elastic Support Portal is the central place where you can access all of your cases, subscriptions, and licenses.
23+
24+
* **By email:** [[email protected]](mailto:[email protected])
25+
26+
:::{tip}
27+
If you contact us by email, use the email address you registered with so we can help you more quickly. If your registered email is a distribution list, you can register a second email address with us. Just open a case to let us know the name and email address you want to add.
28+
:::
29+
30+
:::{warning}
31+
All cases opened by email default to a normal severity level. For incidents, open a case through the [Elastic Support Portal](https://support.elastic.co/) and select the [appropriate severity](https://www.elastic.co/support/welcome#what-to-say-in-a-case).
32+
:::
33+
34+
Providing a clear description of your issue and relevant technical context helps our support engineers respond more quickly and effectively.
35+
36+
## What to include in your support request
37+
38+
To help Elastic Support investigate the problem efficiently, please include the following details whenever possible:
39+
40+
### Basic information
41+
42+
* A brief description of the issue
43+
* When the issue started and whether it is intermittent or consistent
44+
* Affected environments (dev, staging, production)
45+
* Whether you’re using Elastic Cloud or self-managed deployments
46+
* The version of the Elastic Stack you're using
47+
* Any additional context to help support understand the full data flow (from the instrumented applications at the edge to {{es}})
48+
49+
### Deployment context
50+
51+
* Are you using a [standalone EDOT Collector](opentelemetry://reference/edot-collector/config/default-config-standalone.md) or [Kubernetes](opentelemetry://reference/edot-collector/config/default-config-k8s.md)?
52+
* If applicable, include:
53+
* Helm chart version and values (for Kubernetes)
54+
* Container image version
55+
56+
### Configuration
57+
58+
* Your full or partial EDOT Collector configuration file or files, redacted as needed
59+
* Environment variables that may affect telemetry
60+
* Any overrides or runtime flags, such as `--log-level=debug` or `--config` path
61+
* To enable debug logging in Kubernetes environments using the Helm chart, set the log level explicitly with:
62+
63+
```yaml
64+
collector:
65+
args:
66+
- "--config=/etc/otel/config.yaml"
67+
- "--log-level=debug"
68+
```
69+
70+
In Kubernetes environments with multiple EDOT Collector pods, be sure to collect logs and configuration from all instances. You can use `kubectl` to list and inspect each:
71+
72+
```sh
73+
kubectl get pods -l app=edot-collector
74+
kubectl logs <pod-name> --container edot-collector
75+
```
76+
Repeat for each Collector pod to provide complete context for support.
77+
78+
### Logs and diagnostics
79+
80+
* Recent Collector logs with relevant errors or warning messages
81+
* Output from:
82+
83+
```bash
84+
edot-collector --config=/path/to/config.yaml --dry-run
85+
```
86+
* Output from:
87+
88+
```bash
89+
lsof -i :4317
90+
kubectl logs <collector-pod>
91+
```
92+
93+
### Data and UI symptoms
94+
95+
* Are traces, metrics, or logs missing from the UI?
96+
* Are you using the [Elastic Managed OTLP endpoint](https://www.elastic.co/docs/observability/apm/otel/managed-otel-ingest/)?
97+
* If data is missing or incomplete, consider enabling the [debug exporter](https://github.com/open-telemetry/opentelemetry-collector/blob/main/exporter/debugexporter/README.md) to inspect the raw signal data emitted by the Collector.
98+
99+
You can use it for specific signals (logs, metrics, or traces) by adding a pipeline like:
100+
101+
```yaml
102+
exporters:
103+
debug:
104+
verbosity: detailed # options: normal, detailed
105+
106+
service:
107+
pipelines:
108+
traces:
109+
receivers: [otlp]
110+
processors: [batch]
111+
exporters: [debug]
112+
```
113+
114+
This helps verify whether the Collector is receiving and processing telemetry as expected before it's sent to Elasticsearch.
115+
116+
## Next steps
117+
118+
When you’ve gathered the information above relevant to your case:
119+
120+
1. Log in to the [Elastic Support portal](https://support.elastic.co/)
121+
2. Open a new case and fill in the form.
122+
3. Attach your logs, configs, or example files. Redact sensitive data.
123+
124+
Our support team will review your request and get back to you as soon as possible.
125+

troubleshoot/ingest/opentelemetry/toc.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,5 @@ toc:
1515
- file: edot-sdks/java/proxy-issues.md
1616
- file: edot-sdks/nodejs/index.md
1717
- file: edot-sdks/php/index.md
18-
- file: edot-sdks/python/index.md
18+
- file: edot-sdks/python/index.md
19+
- file: contact-support.md

0 commit comments

Comments
 (0)