From 19aa77a19234ef7fa1307c29de7d8ad9baa6218d Mon Sep 17 00:00:00 2001 From: Maurizio Branca Date: Tue, 17 Sep 2024 02:23:14 +0200 Subject: [PATCH 1/5] Add known issues about fieldless searches --- .../release-notes/release-notes-8.13.asciidoc | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc index c3beb36eb..7fb234cf9 100644 --- a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc +++ b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc @@ -90,6 +90,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== +[[known-issue-242-8.13.0]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== + +*Details* + +Due to changes introduced to support ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. This may affect integrations that rely fieldless queries (when no field is specified for a query). + +*Impact* + + +In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} to upgrade to 8.14 when that release becomes available. + +If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. + +==== + [discrete] [[bug-fixes-8.13.2]] === Bug fixes @@ -127,6 +144,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== +[[known-issue-242-8.13.0]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== + +*Details* + +Due to changes introduced to support ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. This may affect integrations that rely fieldless queries (when no field is specified for a query). + +*Impact* + + +In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} to upgrade to 8.14 when that release becomes available. + +If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. + +==== + [discrete] [[enhancements-8.13.1]] === Enhancements @@ -233,6 +267,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== +[[known-issue-242-8.13.0]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== + +*Details* + +Due to changes introduced to support ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. This may affect integrations that rely fieldless queries (when no field is specified for a query). + +*Impact* + + +In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} to upgrade to 8.14 when that release becomes available. + +If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. + +==== + [discrete] [[new-features-8.13.0]] === New features From cffad2d50f8d298aa2556c9f4b2217de02f6a09c Mon Sep 17 00:00:00 2001 From: Maurizio Branca Date: Tue, 17 Sep 2024 02:33:00 +0200 Subject: [PATCH 2/5] Fix section IDs and cleanup --- .../release-notes/release-notes-8.13.asciidoc | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc index 7fb234cf9..4a97bbf6f 100644 --- a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc +++ b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc @@ -90,18 +90,18 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== -[[known-issue-242-8.13.0]] +[[known-issue-242-8.13.2]] .ECS fields are not included to the `index.query.default_field` in {agent} integrations [%collapsible] ==== *Details* -Due to changes introduced to support ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. This may affect integrations that rely fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). *Impact* + -In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} to upgrade to 8.14 when that release becomes available. +In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. @@ -144,18 +144,18 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== -[[known-issue-242-8.13.0]] +[[known-issue-242-8.13.1]] .ECS fields are not included to the `index.query.default_field` in {agent} integrations [%collapsible] ==== *Details* -Due to changes introduced to support ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. This may affect integrations that rely fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). *Impact* + -In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} to upgrade to 8.14 when that release becomes available. +In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. @@ -274,11 +274,11 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul *Details* -Due to changes introduced to support ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. This may affect integrations that rely fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). *Impact* + -In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} to upgrade to 8.14 when that release becomes available. +In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. From 9ebb2722a844b5ff6b97ef8fa68ea02b93ab8ea7 Mon Sep 17 00:00:00 2001 From: Maurizio Branca Date: Tue, 17 Sep 2024 09:08:16 +0200 Subject: [PATCH 3/5] Add the known issue to 8.13.3 and 8.13.4 All 8.13.x releases are affected. --- .../release-notes/release-notes-8.13.asciidoc | 72 +++++++++++++++---- 1 file changed, 57 insertions(+), 15 deletions(-) diff --git a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc index 4a97bbf6f..94f9d6117 100644 --- a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc +++ b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc @@ -32,6 +32,27 @@ Also see: There are no bug fixes for {fleet} or {agent} in this release. +[discrete] +[[known-issues-8.13.4]] +=== Known issues + +[[known-issue-174855-8.13.4]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== +*Details* + +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). + +If you run a query without specifying a field, the query will not return results for ECS fields. + +*Impact* + + +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. + +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. +==== + // end 8.13.4 relnotes // begin 8.13.3 relnotes @@ -48,6 +69,27 @@ Review important information about {fleet-server} and {agent} for the 8.13.3 rel {agent}:: * Update Go version to 1.21.9. {agent-pull}4508[#4508] +[discrete] +[[known-issues-8.13.3]] +=== Known issues + +[[known-issue-174855-8.13.3]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== +*Details* + +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). + +If you run a query without specifying a field, the query will not return results for ECS fields. + +*Impact* + + +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. + +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. +==== + [discrete] [[bug-fixes-8.13.3]] === Bug fixes @@ -90,21 +132,21 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== -[[known-issue-242-8.13.2]] +[[known-issue-174855-8.13.2]] .ECS fields are not included to the `index.query.default_field` in {agent} integrations [%collapsible] ==== - *Details* Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). -*Impact* + +If you run a query without specifying a field, the query will not return results for ECS fields. -In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. +*Impact* + -If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. ==== [discrete] @@ -144,21 +186,21 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== -[[known-issue-242-8.13.1]] +[[known-issue-174855-8.13.1]] .ECS fields are not included to the `index.query.default_field` in {agent} integrations [%collapsible] ==== - *Details* Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). -*Impact* + +If you run a query without specifying a field, the query will not return results for ECS fields. -In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. +*Impact* + -If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. ==== [discrete] @@ -267,21 +309,21 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== -[[known-issue-242-8.13.0]] +[[known-issue-174855-8.13.0]] .ECS fields are not included to the `index.query.default_field` in {agent} integrations [%collapsible] ==== - *Details* Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). -*Impact* + +If you run a query without specifying a field, the query will not return results for ECS fields. -In version 8.14.0 and later, the {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. +*Impact* + -If you are unable to upgrade to 8.14.0, you can follow the workaround described in the link:https://support.elastic.co/knowledge/bbdbeb57. +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. ==== [discrete] From 0ffac843a6f357bd109c5b118a735e25341e2154 Mon Sep 17 00:00:00 2001 From: Maurizio Branca Date: Wed, 18 Sep 2024 11:35:10 +0200 Subject: [PATCH 4/5] Update docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com> --- .../ingest-management/release-notes/release-notes-8.13.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc index 94f9d6117..cae408cb0 100644 --- a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc +++ b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc @@ -42,7 +42,7 @@ There are no bug fixes for {fleet} or {agent} in this release. ==== *Details* -Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). If you run a query without specifying a field, the query will not return results for ECS fields. From cc97bf40d96aa10f7c23f25ffdbbfdf67107d3ff Mon Sep 17 00:00:00 2001 From: Maurizio Branca Date: Wed, 18 Sep 2024 11:45:18 +0200 Subject: [PATCH 5/5] Apply suggestion from reviewers --- .../release-notes/release-notes-8.13.asciidoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc index cae408cb0..5060a98c3 100644 --- a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc +++ b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc @@ -79,7 +79,7 @@ Review important information about {fleet-server} and {agent} for the 8.13.3 rel ==== *Details* -Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). If you run a query without specifying a field, the query will not return results for ECS fields. @@ -138,7 +138,7 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== *Details* -Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). If you run a query without specifying a field, the query will not return results for ECS fields. @@ -192,7 +192,7 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== *Details* -Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). If you run a query without specifying a field, the query will not return results for ECS fields. @@ -315,7 +315,7 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== *Details* -Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer include ECS fields to the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). If you run a query without specifying a field, the query will not return results for ECS fields.