Merge branch 'main' into streams-docs

mdbirnstiehl · web-flow · commit d5ee02b797a2 · 2025-04-14T14:32:04.000-05:00
diff --git a/deploy-manage/cloud-organization/billing/update-billing-operational-contacts.md b/deploy-manage/cloud-organization/billing/update-billing-operational-contacts.md
@@ -9,9 +9,9 @@ applies_to:
 
 # Update billing and operational contacts [ec-billing-contacts]
 
-If different persons from your organization are involved in billing and operations, you can specify their relevant contact details in addition to the members set up on the account.
+If different persons from your organization are involved in billing and operations, you can specify their relevant contact details. These additional contacts only receive billing or operational emails. 
 
-These additional contacts only receive billing or operational emails. You can also set a specific email address to receive monitoring alerts. Members of the account still receive both types of emails.
+By default, these notifications are sent to all users within an {{ecloud}} organization. If you specify billing and operational email contacts, then only these contacts and the organization owner will receive operational emails.
 
 ::::{note} 
 Operational contacts can only receive operational notifications, such as out-of-memory alerts. Operational and billing contacts can’t log in to {{ecloud}}. To log in to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body),   you must log in as the [organization owner](/deploy-manage/users-roles/cloud-organization/user-roles.md), or be [a member](/deploy-manage/users-roles/cloud-organization.md) of the organization.
diff --git a/deploy-manage/cloud-organization/operational-emails.md b/deploy-manage/cloud-organization/operational-emails.md
@@ -17,6 +17,6 @@ For high disk usage, an email alert is activated when the space consumed on one
 
 We also send an email alert if one of the nodes in your cluster is restarted due to an out-of-memory condition.
 
-These alerts are sent to all users within an {{ecloud}} organization, as well as to the email addresses listed as operational email contacts. This means that an external distribution list or automated service can receive notifications without the need to be added to the organization directly.
+By default, these alerts are sent to all users within an {{ecloud}} organization.
 
-To configure recipients external to an {{ecloud}} organization for these notifications, update the list of [operational email contacts](/deploy-manage/cloud-organization/billing/update-billing-operational-contacts.md).
+Alternatively, you can configure recipients external to an {{ecloud}} organization for these notifications by updating the list of [operational email contacts](/deploy-manage/cloud-organization/billing/update-billing-operational-contacts.md). These can be any email address, meaning that an external distribution list or automated service can receive notifications without the need to be added to the organization directly. If you specify operational email contacts, then only these contacts and the organization owner will receive operational emails.
diff --git a/deploy-manage/toc.yml b/deploy-manage/toc.yml
@@ -96,7 +96,6 @@ toc:
                       - file: deploy/cloud-enterprise/migrate-ece-to-podman-hosts.md
                         children:
                           - file: deploy/cloud-enterprise/migrate-to-podman-5.md
-                  - file: deploy/cloud-enterprise/log-into-cloud-ui.md
                   - file: deploy/cloud-enterprise/post-installation-steps.md
                   - file: deploy/cloud-enterprise/install-ece-on-additional-hosts.md
                     children:
@@ -132,6 +131,7 @@ toc:
                   - file: deploy/cloud-enterprise/change-allocator-disconnect-timeout.md
                   - file: deploy/cloud-enterprise/manage-elastic-stack-versions.md
                   - file: deploy/cloud-enterprise/ece-include-additional-kibana-plugin.md
+          - file: deploy/cloud-enterprise/log-into-cloud-ui.md
           - file: deploy/cloud-enterprise/working-with-deployments.md
             children:
               - file: deploy/cloud-enterprise/deployment-templates.md
diff --git a/release-notes/elastic-observability/deprecations.md b/release-notes/elastic-observability/deprecations.md
@@ -8,7 +8,6 @@ Over time, certain Elastic functionality becomes outdated and is replaced or rem
 Review the deprecated functionality for Elastic {{observability}}. While deprecations have no immediate impact, we strongly encourage you update your implementation after you upgrade. To learn how to upgrade, check out [Upgrade](/deploy-manage/upgrade.md).
 
 % ## Next version
-% **Release date:** Month day, year
 
 % ::::{dropdown} Deprecation title
 % Description of the deprecation.
@@ -17,15 +16,7 @@ Review the deprecated functionality for Elastic {{observability}}. While depreca
 % **Action**<br> Steps for mitigating deprecation impact.
 % ::::
 
-% ## 9.0.0 [elastic-observability-900-deprecations]
-% **Release date:** April 2, 2025
-
-% ::::{dropdown} Deprecation title
-% Description of the deprecation.
-% For more information, check [PR #](PR link).
-% **Impact**<br> Impact of deprecation. 
-% **Action**<br> Steps for mitigating deprecation impact.
-% ::::
+## 9.0.0 [elastic-observability-900-deprecations]
 
 ::::{dropdown} Removed Logs Explorer
 Logs Explorer has been removed. 
diff --git a/release-notes/elastic-security/breaking-changes.md b/release-notes/elastic-security/breaking-changes.md
@@ -5,7 +5,6 @@ navigation_title: "Breaking changes"
 Breaking changes can impact your Elastic applications, potentially disrupting normal operations. Before you upgrade, carefully review the {{elastic-sec}} breaking changes and take the necessary steps to mitigate any issues. To learn how to upgrade, check [Upgrade](/deploy-manage/upgrade.md).
 
 % ## Next version [elastic-security-nextversion-breaking-changes]
-% **Release date:** Month day, year
 
 % ::::{dropdown} Title of breaking change 
 % Description of the breaking change.
@@ -17,7 +16,6 @@ Breaking changes can impact your Elastic applications, potentially disrupting no
 % ::::
 
 ## 9.0.0 [elastic-security-900-breaking-changes]
-**Release date:** April 8, 2025
 
 ::::{dropdown} Removes legacy security rules bulk endpoints
 * `POST /api/detection_engine/rules/_bulk_create` has been replaced by `POST /api/detection_engine/rules/_import`
diff --git a/release-notes/elastic-security/deprecations.md b/release-notes/elastic-security/deprecations.md
@@ -8,7 +8,6 @@ Over time, certain Elastic functionality becomes outdated and is replaced or rem
 Review the deprecated functionality for {{elastic-sec}}. While deprecations have no immediate impact, we strongly encourage you update your implementation after you upgrade. To learn how to upgrade, check out [Upgrade](/deploy-manage/upgrade.md).
 
 % ## Next version
-% **Release date:** Month day, year
 
 % ::::{dropdown} Deprecation title
 % Description of the deprecation.
@@ -18,7 +17,6 @@ Review the deprecated functionality for {{elastic-sec}}. While deprecations have
 % ::::
 
 ## 9.0.0 [elastic-security-900-deprecations]
-**Release date:** April 8, 2025
 
 ::::{dropdown} Renames the `integration-assistant` plugin
 Renames the `integration-assistant` plugin to `automatic-import` to match the associated feature.
diff --git a/release-notes/elastic-security/index.md b/release-notes/elastic-security/index.md
@@ -13,7 +13,6 @@ To check for security updates, go to [Security announcements for the Elastic sta
 % Release notes include only features, enhancements, and fixes. Add breaking changes, deprecations, and known issues to the applicable release notes sections.
 
 % ## version.next [elastic-security-next-release-notes]
-% **Release date:** Month day, year
 
 % ### Features and enhancements [elastic-security-next-features-enhancements]
 % *
@@ -22,7 +21,6 @@ To check for security updates, go to [Security announcements for the Elastic sta
 % *
 
 ## 9.0.0 [elastic-security-900-release-notes]
-**Release date:** April 8, 2025
 
 ::::{NOTE}
 All features introduced in 8.18.0 are also available in 9.0.0.
diff --git a/release-notes/fleet-elastic-agent/breaking-changes.md b/release-notes/fleet-elastic-agent/breaking-changes.md
@@ -6,7 +6,6 @@ navigation_title: "Breaking changes"
 Breaking changes can impact your Elastic applications, potentially disrupting normal operations. Before you upgrade, carefully review the {{fleet}} and {{agent}} breaking changes and take the necessary steps to mitigate any issues. To learn how to upgrade, check [Upgrade](/deploy-manage/upgrade.md).
 
 % ## Next version [fleet-elastic-agent-nextversion-breaking-changes]
-% **Release date:** Month day, year
 
 % ::::{dropdown} Title of breaking change 
 % Description of the breaking change.
@@ -18,7 +17,6 @@ Breaking changes can impact your Elastic applications, potentially disrupting no
 % ::::
 
 ## 9.0.0 [fleet-elastic-agent-900-breaking-changes]
-**Release date:** April 2, 2025
 
 ::::{dropdown} Removed deprecated `epm` Fleet APIs
 Removed `GET/POST/DELETE /epm/packages/:pkgkey` APIs in favor of the `GET/POST/DELETE /epm/packages/:pkgName/:pkgVersion`.
diff --git a/release-notes/fleet-elastic-agent/deprecations.md b/release-notes/fleet-elastic-agent/deprecations.md
@@ -8,7 +8,6 @@ Over time, certain Elastic functionality becomes outdated and is replaced or rem
 Review the deprecated functionality for {{fleet}} and {{agent}}. While deprecations have no immediate impact, we strongly encourage you update your implementation after you upgrade. To learn how to upgrade, check out [Upgrade](/deploy-manage/upgrade.md).
 
 % ## Next version
-% **Release date:** Month day, year
 
 % ::::{dropdown} Deprecation title
 % Description of the deprecation.
@@ -18,11 +17,5 @@ Review the deprecated functionality for {{fleet}} and {{agent}}. While deprecati
 % ::::
 
 % ## 9.0.0 [fleet-elastic-agent-900-deprecations]
-% **Release date:** April 2, 2025
 
-% ::::{dropdown} Deprecation title
-% Description of the deprecation.
-% For more information, check [PR #](PR link).
-% **Impact**<br> Impact of deprecation. 
-% **Action**<br> Steps for mitigating deprecation impact.
-% ::::
+_No deprecations_
diff --git a/release-notes/fleet-elastic-agent/index.md b/release-notes/fleet-elastic-agent/index.md
@@ -16,7 +16,6 @@ To check for security updates, go to [Security announcements for the Elastic sta
 % For each new version section, include the Fleet and Elastic Agent and Kibana changes.
 
 % ## version.next [fleet-elastic-agent-next-release-notes]
-% **Release date:** Month day, year
 
 % ### Features and enhancements [fleet-elastic-agent-next-features-enhancements]
 % *
@@ -26,7 +25,6 @@ To check for security updates, go to [Security announcements for the Elastic sta
 
 
 ## 9.0.0 [fleet-elastic-agent-900-release-notes]
-**Release date:** April 2, 2025
 
 ### Features and enhancements [fleet-elastic-agent-900-features-enhancements]
 * New setting allowing automatic deletion of unenrolled agents in Fleet settings [#195544]({{kib-pull}}195544)
diff --git a/release-notes/fleet-elastic-agent/known-issues.md b/release-notes/fleet-elastic-agent/known-issues.md
@@ -15,4 +15,6 @@ Known issues are significant defects or limitations that may impact your impleme
 % **Workaround** 
 % Workaround description.
 
-:::
+:::
+
+_No known issues_
diff --git a/solutions/observability/apm/create-assign-feature-roles-to-apm-server-users.md b/solutions/observability/apm/create-assign-feature-roles-to-apm-server-users.md
@@ -10,7 +10,6 @@ applies_to:
 
 ::::{note}
 Kibana custom roles are *not* compatible with [{{serverless-full}}](https://docs.elastic.co/serverless).
-
 ::::
 
 Manage access on a feature-by-feature basis by creating several custom feature-related *roles* and assigning one or more of these roles to each *user or group* based on which features they need to access.
@@ -23,7 +22,6 @@ In general, there are three types of privileges you’ll work with when creating
 * **{{es}} cluster privileges**: Manage the actions a user can perform against your cluster.
 * **{{es}} index privileges**: Control access to the data in specific indices of your cluster.
 * **{{kib}} space privileges**: Grant users write or read access to features and apps within {{kib}}.
-
 ::::
 
 The following are common roles that APM Server users might need:
@@ -32,14 +30,14 @@ The following are common roles that APM Server users might need:
 * [**Central configuration management role**](#apm-privileges-agent-central-config): Allows a user to view APM Agent central configurations, which is **required** when [central configuration management](/solutions/observability/apm/apm-agent-central-configuration.md) is enabled (it is enabled by default).
 * [**Monitoring role**](#apm-privileges-to-publish-monitoring): Allows a user to publish monitoring data, view monitoring data, or both.
 * [**RUM source mapping role**](#apm-privileges-rum-source-mapping): Allows a user to read RUM source maps.
+* [**Tail-based sampling role**](#apm-privileges-tail-based-sampling): Allows a user to use [tail-based sampling](/solutions/observability/apm/transaction-sampling.md#apm-tail-based-sampling).
 
 ::::{admonition} Example: Assigning multiple roles to an APM Server user
 If you want to create an APM Server user who can use the Elastic APM Real User Monitoring (RUM) JavaScript Agent to ingest data from a frontend application and you use central configuration to manage APM agents, you would need to assign these three roles to the user:
 
 * [Writer role](#apm-privileges-to-publish-events)
 * [Central configuration management role](#apm-privileges-agent-central-config)
 * [RUM source mapping role](#apm-privileges-rum-source-mapping)
-
 ::::
 
 ## Create a *writer* role [apm-privileges-to-publish-events]
@@ -48,7 +46,6 @@ APM users that publish events to {{es}} *must* have privileges to write to APM d
 
 ::::{note}
 This is not needed when APM Server doesn’t write to {{es}} directly. For example, in some cases you may configure APM Server to write to another output like Logstash, Kafka, or any other output supported by libbeat. In these cases, different authentication credentials will need to be passed to [`apm-server.agent.config.elasticsearch`](/solutions/observability/apm/configure-apm-agent-central-configuration.md#apm-agent-config-elasticsearch).
-
 ::::
 
 To grant an APM Server user the required privileges for writing events to {{es}}:
@@ -69,7 +66,6 @@ If you have explicitly disabled Elastic security *and* you are *not* using tail-
 
 ::::{note}
 Assign additional APM feature roles to users as needed including the *Central configuration management role*, which is [required in most cases](#apm-central-config-role-note).
-
 ::::
 
 ## Create a *central configuration management* role [apm-privileges-agent-central-config]
@@ -78,7 +74,6 @@ Assign additional APM feature roles to users as needed including the *Central co
 :name: apm-central-config-role-note
 
 The privileges included in this role are **required** for all users when [central configuration management](/solutions/observability/apm/apm-agent-central-configuration.md) is enabled (it is enabled by default). You need this role unless central configuration management has been explicitly disabled in the Applications UI.
-
 ::::
 
 $$$apm-privileges-agent-central-config-server$$$
@@ -108,7 +103,6 @@ The previous privileges should be sufficient for APM agent central configuration
 
 ::::{note}
 Assign additional APM feature roles to users as needed including the *Writer role*, which is [required in most cases](#apm-privileges-to-publish-events).
-
 ::::
 
 ::::{tip}
@@ -130,7 +124,6 @@ Looking for privileges and roles needed to use central configuration from the Ap
 
 ::::{important}
 **{{ecloud}} users:** This section does not apply to [{{ech}}](https://www.elastic.co/cloud/elasticsearch-service). Monitoring on {{ecloud}} is enabled by clicking the **Enable** button in the **Monitoring** panel.
-
 ::::
 
 #### Internal collection [apm-privileges-to-publish-monitoring-internal]
@@ -161,7 +154,6 @@ If you don’t use the `apm_system` user, you can create a custom role:
 
 ::::{note}
 Assign additional APM feature roles to users as needed including the [*Writer role*](#apm-privileges-to-publish-events) and [*Central configuration management role*](#apm-central-config-role-note), both of which are required in most cases.
-
 ::::
 
 #### {{metricbeat}} collection [apm-privileges-to-publish-monitoring-metricbeat]
@@ -194,7 +186,6 @@ If you don’t use the `remote_monitoring_user` user, you can create a custom us
 
 ::::{note}
 Assign additional APM feature roles to users as needed including the [*Writer role*](#apm-privileges-to-publish-events) and [*Central configuration management role*](#apm-central-config-role-note), both of which are required in most cases.
-
 ::::
 
 ### View monitoring data [apm-privileges-to-publish-monitoring-view]
@@ -216,7 +207,6 @@ To grant users the required privileges for viewing monitoring data:
 
 ::::{note}
 Assign additional APM feature roles to users as needed including the [*Writer role*](#apm-privileges-to-publish-events) and [*Central configuration management role*](#apm-central-config-role-note), both of which are required in most cases.
-
 ::::
 
 ## Create a *source map* role [apm-privileges-rum-source-map]
@@ -232,7 +222,20 @@ To grant an APM Server user with the required privileges for reading RUM source
 
 ::::{note}
 Assign additional APM feature roles to users as needed including the [*Writer role*](#apm-privileges-to-publish-events) and [*Central configuration management role*](#apm-central-config-role-note), both of which are required in most cases.
-
 ::::
 
-The previous privileges should be sufficient for RUM source mapping to work properly as long as APM Server communicates with {{es}} successfully. If it fails, it may fallback to read source maps through {{kib}} if configured, which requires additional {{kib}} privileges. For more details, refer to the [{{stack}}](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-apm-sourcemaps) or [{{serverless-short}}](https://www.elastic.co/docs/api/doc/serverless/group/endpoint-apm-sourcemaps) API documentation.
+The previous privileges should be sufficient for RUM source mapping to work properly as long as APM Server communicates with {{es}} successfully. If it fails, it may fallback to read source maps through {{kib}} if configured, which requires additional {{kib}} privileges. For more details, refer to the [{{stack}}](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-apm-sourcemaps) or [{{serverless-short}}](https://www.elastic.co/docs/api/doc/serverless/group/endpoint-apm-sourcemaps) API documentation.
+
+## Create a *tail-based sampling* role [apm-privileges-tail-based-sampling]
+
+If [tail-based sampling](/solutions/observability/apm/tail-based-sampling.md) is enabled, the user will need additional privileges.
+
+APM Server users need the following privileges to read tail-based sampling indices from {{es}}:
+
+| Type | Privilege | Purpose |
+| --- | --- | --- |
+| Index | `read` on `traces-apm.sampled` index | Allow APM Server to read tail-based sampling indices from {{es}} |
+
+::::{note}
+Assign additional APM feature roles to users as needed including the [*Writer role*](#apm-privileges-to-publish-events) and [*Central configuration management role*](#apm-central-config-role-note), both of which are required in most cases.
+::::
diff --git a/solutions/observability/apm/grant-access-using-api-keys.md b/solutions/observability/apm/grant-access-using-api-keys.md
@@ -56,6 +56,14 @@ To create an API key:
                     "allow_restricted_indices": true
                 }
             ]
+        },
+        "apm_tail_based_sampling": {
+            "index": [
+                {
+                    "names": ["traces-apm.sampled"],
+                    "privileges": ["read"]
+                }
+            ]
         }
     }
     ```
@@ -156,6 +164,14 @@ POST /_security/api_key
           "allow_restricted_indices": true
         }
       ]
+    },
+    "apm_tail_based_sampling": {
+        "index": [
+            {
+                "names": ["traces-apm.sampled"],
+                "privileges": ["read"]
+            }
+        ]
     }
   }
 }
diff --git a/solutions/observability/apm/tail-based-sampling.md b/solutions/observability/apm/tail-based-sampling.md
@@ -11,7 +11,10 @@ applies_to:
 ![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "")
 
 Most options on this page are supported by all APM Server deployment methods when writing to {{es}}. If you are using a different [output](/solutions/observability/apm/configure-output.md), tail-based sampling is *not* supported.
+::::
 
+::::{note}
+Enhanced privileges are required to use tail-based sampling. For more information, refer to [Create a tail-based sampling role](/solutions/observability/apm/create-assign-feature-roles-to-apm-server-users.md#apm-privileges-tail-based-sampling).
 ::::
 
 Tail-based sampling configuration options.
diff --git a/solutions/observability/apm/transaction-sampling.md b/solutions/observability/apm/transaction-sampling.md
