You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: manage-data/data-store/data-streams.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ products:
13
13
14
14
# Data streams [data-streams]
15
15
16
-
A data stream lets you store append-only time series dataacross multiple indices while giving you a single named resource for requests. Data streams are well-suited for logs, events, metrics, and other continuously generated data.
16
+
A data stream acts as a layer of abstraction over a set of indices that are optimized for storing append-only time series data. It stores data across multiple backing indices while giving you a single named resource to use for requests. Data streams are well-suited for logs, events, metrics, and other continuously generated data.
17
17
18
18
You can submit indexing and search requests directly to a data stream. The stream automatically routes the request to backing indices that store the stream’s data. You can use [{{ilm}} ({{ilm-init}})](../lifecycle/index-lifecycle-management.md) to automate the management of these backing indices. For example, you can use {{ilm-init}} to automatically move older backing indices to less expensive hardware and delete unneeded indices. {{ilm-init}} can help you reduce costs and overhead as your data grows.
19
19
@@ -39,7 +39,7 @@ A data stream consists of one or more [hidden](elasticsearch://reference/elastic
39
39
:alt: data streams diagram
40
40
:::
41
41
42
-
A data stream requires a matching [index template](templates.md). The template contains the mappings and settings used to configure the stream’s backing indices.
42
+
A data stream requires a matching [index template](templates.md). The template contains the mappings and settings used to configure the stream’s backing indices and defines the {{ilm-init}} policy that the data stream uses.
43
43
44
44
Every document indexed to a data stream must contain a `@timestamp` field, mapped as a [`date`](elasticsearch://reference/elasticsearch/mapping-reference/date.md) or [`date_nanos`](elasticsearch://reference/elasticsearch/mapping-reference/date_nanos.md) field type. If the index template doesn’t specify a mapping for the `@timestamp` field, {{es}} maps `@timestamp` as a `date` field with default options.
Copy file name to clipboardExpand all lines: manage-data/lifecycle/data-stream.md
+8-1Lines changed: 8 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ products:
10
10
11
11
# Data stream lifecycle [data-stream-lifecycle]
12
12
13
-
A data stream lifecycle is the built-in mechanism data streams use to manage their lifecycle. It enables you to easily automate the management of your data streams according to your retention requirements. For example, you could configure the lifecycle to:
13
+
A data stream lifecycle is the built-in mechanism [data streams](/manage-data/data-store/data-streams.md) use to manage their lifecycle. It enables you to easily automate the management of your data streams according to your retention requirements. For example, you could configure the lifecycle to:
14
14
15
15
* Ensure that data indexed in the data stream will be kept at least for the retention time you defined.
16
16
* Ensure that data older than the retention period will be deleted automatically by {{es}} at a later time.
@@ -22,6 +22,13 @@ To achieve that, it supports:
22
22
23
23
A data stream lifecycle also supports downsampling the data stream backing indices. See [the downsampling example](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-data-lifecycle) for more details.
24
24
25
+
## Data stream lifecycle availability
26
+
27
+
Note the availability of data stream lifecycle to ensure that it's applicable for your use case:
28
+
29
+
* Data stream lifecycle is supported only for data streams and cannot be used with individual indices.
30
+
31
+
* Data stream lifecycle is supported for all deployment types on the versioned {{stack}} as well as for {{es-serverless}}.
25
32
26
33
## How does it work? [data-streams-lifecycle-how-it-works]
{{ilm-cap}} ({{ilm-init}}) provides an integrated and streamlined way to manage time-based data such as logs and metrics, making it easier to follow best practices for managing your indices.
17
-
18
-
You can configure {{ilm-init}} policies to automatically manage indices according to your performance, resiliency, and retention requirements. For example, you could use {{ilm-init}} to:
17
+
{{ilm-cap}} ({{ilm-init}}) provides an integrated and streamlined way to manage your time series data. You can configure {{ilm-init}} policies to automatically manage indices according to your performance, resiliency, and retention requirements. For example, you could use {{ilm-init}} to:
19
18
20
19
* Spin up a new index when an index reaches a certain size or number of documents
21
20
* Create a new index each day, week, or month and archive previous ones
22
21
* Delete stale indices to enforce data retention standards
23
22
24
-
::::{tip}
25
-
{{ilm-init}} is not available on {{es-serverless}}.
26
-
27
-
:::{dropdown} Why?
28
-
In an {{ecloud}} or self-managed environment, ILM lets you automatically transition indices through data tiers according to your performance needs and retention requirements. This allows you to balance hardware costs with performance. {{es-serverless}} eliminates this complexity by optimizing your cluster performance for you.
29
-
30
-
Data stream lifecycle is an optimized lifecycle tool that lets you focus on the most common lifecycle management needs, without unnecessary hardware-centric concepts like data tiers.
31
-
:::
32
-
::::
33
-
34
23
::::{important}
35
24
To use {{ilm-init}}, all nodes in a cluster must run the same version. Although it might be possible to create and apply policies in a mixed-version cluster, there is no guarantee they will work as intended. Attempting to use a policy that contains actions that aren’t supported on all nodes in a cluster will cause errors.
36
25
::::
37
26
38
-
## Actions
27
+
## {{ilm-init}} availability
28
+
29
+
Note the availability of {{ilm-init}} to ensure that it's applicable for your use case.
30
+
31
+
* You can use {{ilm-init}} to manage indices and data streams:
32
+
33
+
***Indices:** You use {{ilm-init}} to manage a specific index or set of indices by defining a lifecycle policy and applying it to the indices or an index alias. Each index is then evaluated against its policy and transitions through phases (`hot`, `warm`, `cold`, `frozen`, `delete`) based on pre-defined conditions. This approach allows for more granular control over each index but requires considerably more effort compared to using a data stream, which is our recommended option.
34
+
35
+
***Data streams:** A [data stream](/manage-data/data-store/data-streams.md) acts as a layer of abstraction over a set of indices that contain append-only, time series data. You can configure {{ilm-init}} using a data stream as a single named resource, so that rollover and any other configured actions are performed on the data stream's backing indices automatically.
36
+
37
+
* {{ilm-init}} is available for all deployment types on the versioned {{stack}} but is not available for {{es-serverless}}. In a {{serverless-short}} environment, [data stream lifecycle](/manage-data/lifecycle/data-stream.md) is available as a data lifecycle option.
38
+
39
+
:::{admonition} Simpler lifecycle management in Serverless environments
40
+
{{ilm-init}} lets you automatically transition indices through data tiers according to your performance needs and retention requirements. This allows you to balance hardware costs with performance. {{ilm-init}} is not available in {{serverless-short}} because in that environment your cluster performance is optimized for you. Instead, data stream lifecycle is available as a data management option.
41
+
42
+
Data stream lifecycle is a simpler lifecycle management tool optimized for the most common lifecycle management needs. It enables you to configure the retention duration for your data and to optimize how the data is stored, without hardware-centric concepts like data tiers. For a detailed comparison of {{ilm-init}} and data stream lifecycle refer to [Data lifecycle](/manage-data/lifecycle.md).
Copy file name to clipboardExpand all lines: solutions/security/ai/ai-assistant.md
+243-5Lines changed: 243 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -112,28 +112,266 @@ Be sure to specify which language you’d like AI Assistant to use when writing
112
112
AI Assistant can remember particular information you tell it to remember. For example, you could tell it: "When anwering any question about srv-win-s1-rsa or an alert that references it, mention that this host is in the New York data center". This will cause it to remember the detail you highlighted.
113
113
::::
114
114
115
+
## Share conversations
116
+
117
+
```{applies_to}
118
+
stack: ga 9.2
119
+
serverless: ga
120
+
```
121
+
122
+
Conversations that you start with AI Assistant are private by default and not visible to other members of your team. You have two ways to share conversations - either with selected members or more broadly to everyone with access to the space.
123
+
124
+
To share a conversation, do one of the following:
125
+
126
+
- Click the **Private** / **Shared** / **Restricted** badge next to the conversation's title. Use the dropdown menu to define the chat's visibility. If you select **Restricted**, a modal appears where you can select which users have access.
:alt: AI Assistant chat with the sharing status dropdown open
129
+
:screenshot:
130
+
::::
131
+
- Go to **AI Assistant settings -> Conversations** to view all conversations you've started. Update their visibility as desired.
132
+
133
+
134
+
Once a conversation is shared, you can copy its URL to easily link it to your team:
135
+
136
+
- Open an AI Assistant chat, open the **Conversation settings** menu and select **Copy URL**.
137
+
- Open the **Conversations** tab of the AI Assistant settings page, then select the one you want to share and click **Copy URL**.
138
+
139
+
When someone shares a chat with you, you can review it but can't continue the conversation, since it is owned by another user. However, you can duplicate a shared conversation and continue where your colleague left off. To duplicate a shared conversation:
140
+
141
+
- Open an AI Assistant chat, open the **Conversation settings** menu and select **Duplicate**.
142
+
- Open the **Conversations** tab of the AI Assistant settings page, then select the one you want to duplicate and click **Duplicate**.
143
+
144
+
There are several [audit events](kibana://reference/kibana-audit-events.md) related to conversation sharing. Click each title to show an example:
"message": "User has shared conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"] to all users in the space",
"message": "User has restricted conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"] to user ([id=u_LdnmWaOWbWS1ObwqRW2MLWMkWtxCSyiElishzEpew0g_0, name=test_dina_bahringer])",
326
+
"log": {
327
+
"level": "INFO",
328
+
"logger": "plugins.security.audit.ecs"
329
+
},
330
+
"process": {
331
+
"pid": 77921,
332
+
"uptime": 29.727069625
333
+
},
334
+
"span": {
335
+
"id": "80e57252aceea924"
336
+
}
337
+
}
338
+
```
339
+
:::
340
+
115
341
## Configure AI Assistant [configure-ai-assistant]
116
342
117
-
To adjust AI Assistant's settings from the chat window, click the **More**(three dots) button in the upper-right.
343
+
To adjust general AI Assistant settings from the chat window, click the **Assistant settings menu** button in the upper-right.
The first three options (**AI Assistant settings**, **Knowledge Base**, and **Anonymization**) open the corresponding tabs of the **Security AI settings** page. The **Chat options**affect display-only user settings: whether to show or hide anonymized values, and whether to include citations. When citations are enabled, AI Assistant will refer you to information sources including data you've shared with it, information you've added to the [knowledge base](/solutions/security/ai/ai-assistant-knowledge-base.md), and content from Elastic's Security Labs and [product documentation](/solutions/security/ai/ai-assistant-knowledge-base.md#elastic-docs).
350
+
The first three options (**AI Assistant settings**, **Knowledge Base**, and **Anonymization**) open the corresponding tabs of the **Security AI settings** page. The **Alerts to analyze**button allows you to adjust how many alerts to include as context for your conversation.
125
351
126
352
The **Security AI settings** page provides a range of configuration options for AI Assistant. To access it directly, use the global search field to search for "AI Assistant for Security".
127
353
128
354
It has the following tabs:
129
355
130
-
***Conversations:**When you open AI Assistant from certain pages, such as **Alerts**, it defaults to the relevant conversation type. For each conversation type, choose the default System Prompt, the default connector, and the default model (if applicable). The **Streaming** setting controls whether AI Assistant’s responses appear word-by-word (streamed), or as a complete block of text. Streaming is currently only available for OpenAI models.
356
+
***Conversations:** The **Streaming** setting controls whether AI Assistant’s responses appear word-by-word (streamed), or as a complete block of text. After the streaming setting is a list of all saved conversations. From here you can change their visibility, system prompt, and connector.
131
357
***Connectors:** Manage all LLM connectors.
132
358
***System Prompts:** Edit existing System Prompts or create new ones. To create a new System Prompt, type a unique name in the **Name** field, then press **enter**. Under **Prompt**, enter or update the System Prompt’s text. Under **Contexts**, select where the System Prompt should appear.
133
359
***Quick Prompts:** Modify existing Quick Prompts or create new ones. To create a new Quick Prompt, type a unique name in the **Name** field, then press **enter**. Under **Prompt**, enter or update the Quick Prompt’s text.
134
360
***Anonymization:** Select fields to include as plaintext, to obfuscate, and to not send when you provide events to AI Assistant as context. [Learn more](/solutions/security/ai/ai-assistant.md#ai-assistant-anonymization).
135
361
***Knowledge base:** Provide additional context to AI Assistant. [Learn more](/solutions/security/ai/ai-assistant-knowledge-base.md).
136
362
363
+
364
+
To adjust the settings for a specific chat, click the **Conversation settings** button in the upper-right of its chat window.
The **Copy URL** and **Duplicate** options allow you to share conversations (by sending their URL) and to continue conversations that were shared with you (by duplicating them). The **Delete** option appears for the conversation owner only and allows you to remove a saved conversation.
372
+
373
+
Settings in the **Chat options** section affect display-only user settings: whether to show or hide anonymized values, and whether to include citations. When citations are enabled, AI Assistant will refer you to information sources including data you've shared with it, information you've added to the [knowledge base](/solutions/security/ai/ai-assistant-knowledge-base.md), and content from Elastic's Security Labs and [product documentation](/solutions/security/ai/ai-assistant-knowledge-base.md#elastic-docs).
0 commit comments