Kibana reporting indices are no longer part of the `kibana` feature state since version 8.15.0

[romain-chanu]

Kibana version: 8.15.0 and later

Elasticsearch version: same as above

Server OS version: N.A

Browser version: N.A

Browser OS version: N.A

Original install method (e.g. download page, yum, from source, etc.): Any

Describe the bug:

1. Historically, Kibana reporting was using regular indices (c.f .reporting* indices). These indices were part of the kibana feature state and would be snapshot/restored through this feature state (c.f https://github.com/elastic/elasticsearch/blob/main/modules/kibana/src/main/java/org/elasticsearch/kibana/KibanaPlugin.java#L35)

2. Starting from 8.15.0, Kibana reporting is now using a data stream (c.f .kibana-reporting), c.f:

• [Reporting] Use index templates and a data stream #161608
• Use Data Stream for Reporting storage #176022

3. However, this data stream and its corresponding backing indices are no longer part of the kibana feature state.

Expected behavior: As we have a discrepancy in behaviour between versions < 8.15 and >=8.15+, we would like the Kibana team to check if this is the intended behavior.

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:

[elasticmachine]

Pinging @elastic/appex-sharedux (Team:SharedUX)

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[petrklapka]

@romain-chanu - can we get a little clarification on what you mean by

no longer part of the kibana feature state.

@elastic/es-data-management - can you please give guidance on what needs to be selected for the datastreams to backup?

Handing off to Response Ops team for further shepherding.

[szybia]

@petrklapka - re. data-management question: if the question is what (changes) do we need to do for the datastreams to backup?, we should be able to override SystemIndexPlugin::getSystemDataStreamDescriptors within KibanaPlugin and it should work (saying that after a quick code-scan and as a non-expert)

no longer part of the kibana feature state.

i can't answer for Romain, but from reading code i believe feature state is something like the plugins resources (like indices, data streams etc.)

[romain-chanu]

Hi @petrklapka @szybia

I am referring to https://www.elastic.co/docs/deploy-manage/tools/snapshot-and-restore#feature-state . The feature state will be use to snapshot / restore system indices.

The kibana feature state (as of 9.2.x) includes the following patterns:

• .kibana_*
• .reporting-*
• .apm-agent-configuration*
• .apm-custom-link*
• .chat-*
• .workflows-*

It therefore does not include the .kibana-reporting data stream introduced in 8.15.

[nielsbauman]

I suspect the problem lies somewhere here: https://github.com/elastic/elasticsearch/blob/f86f58fbf3ebfb4e54fd711acae8290e3669e835/modules/kibana/src/main/java/org/elasticsearch/kibana/KibanaPlugin.java#L25-L39
Those are all SystemIndexDescriptors, and I'm not sure if those include data streams as well - we also have a dedicated SystemDataStreamDescriptor.

Those reporting indices were converted to data streams in elastic/elasticsearch#97765.

@szybia I looked at a recent snapshot on our own Data Management ECH cluster:

GET _snapshot/found-snapshots/cloud-snapshot-2025.11.18-yhqmrnxpskejrpdennrf8q

which gave

"feature_states": [
        {
          "feature_name": "kibana",
          "indices": [
            ".kibana_usage_counters_8.16.0_001",
            ".kibana_8.6.2_001",
            ".apm-agent-configuration",
            ".kibana_analytics_8.8.0_001",
            ".kibana_ingest_8.8.0_001",
            ".kibana_security_session_1",
            ".kibana_entities-definitions-1",
            ".kibana_8.7.0_001",
            ".kibana_8.8.0_001",
            ".apm-custom-link",
            ".kibana_task_manager_8.6.2_001",
            ".kibana_security_solution_8.8.0_001",
            ".kibana_alerting_cases_8.8.0_001"
          ]
        },
]

But there are some Kibana data streams:

GET _data_stream/.kibana*?expand_wildcards=all&filter_path=data_streams.name

{
  "data_streams": [
    {
      "name": ".kibana-event-log-8.10.3"
    },
    {
      "name": ".kibana-event-log-8.10.4"
    },
    {
      "name": ".kibana-event-log-8.9.0"
    },
    {
      "name": ".kibana-event-log-ds"
    }
  ]
}

I think it's worth checking with Lee and/or the Kibana team whether these data streams are supposed to be included in snapshots as well.

[szybia]

@nielsbauman i'll bring this up with Lee during our 1:1 today, ty!

[szybia]

so talked with Lee, and dropping what i got noted down, but i'd be lying if i said i understood all that was said...

• the kibana change for this was merged, but the ES one wasn't
• my understanding is the main problem is how do we manage the lifecycle of the data stream, options that were mentioned:
  • going with ILM (stopgap): will it be locked down for users to edit? serverless: immutable retention for everyone
  • dedicated API for managing lifecycle of kibana reporting stuff: use DLM and make it a system data stream
  • adding a type of data stream that is completely external

in terms of path forward, the first part i got was to ask Kibana if they want a dedicated API -- overkill? believe they'll need to create a UI for it potentially...

[darnautov]

hi @romain-chanu,

From the issue description, the .kibana-reporting data stream and its corresponding backing indices are no longer part of the Kibana feature state. But could you please clarify what’s expected from us?

Should we reach out to the ES team to get this PR merged?