Kibana breaking changesedit

This list summarizes the most important breaking changes in Kibana 7.15.1. For the complete list, go to Kibana breaking changes.

New scheduled query action ID format for Osquery Manager

Action IDs for scheduled queries have been changed, which may break dashboards, alerts, or other features that depend on Osquery action IDs.

Previously, scheduled query action IDs used the query ID. For example, if you scheduled a query with the name rpm_packages, the action ID would be rpm_packages. Now, scheduled query action IDs use the pack_<scheduled query group name>_<query ID> format. For example, if you have a scheduled query with the name rpm_packages in a group named system_monitoring, the action ID would be pack_system_monitoring_rpm_packages.

Removes support for legacy charts library

The legacy area, line, and charts library are deprecated in 7.15.0. In 7.16.0, support for the legacy charts library will be removed. For more information, refer to #105055.

When you upgrade, Kibana uses the new charts library by default, which includes improved performance, color palettes, fill capacity, and more.

If you have changed the default Advanced Settings, you must disable the legacy charts library to use the new charts library:

  1. Open the main menu, then click Stack Management > Advanced Settings.
  2. Deselect Legacy charts library.

The default setting for courier:batchSearches is now falseedit

Details: Changing the default setting for courier:batchSearches to false means that search requests will use the _search Elasticsearch endpoint rather than _msearch.

Impact: Dashboard panels will load individually, and search requests will terminate when users navigate away or update the query.

The experimental Code app has been removededit

Details: The experimental Code app that was previously disabled by default has been removed. Due to the existing implementation of code being untenable, we’ve decided not to pursue further development of the code app at this time.

Impact: Any installs that previously enabled the Code app will now log a warning when Kibana starts up. It’s safe to remove all configurations starting with xpack.code.. Starting in 8.0, these warnings will become errors that prevent Kibana from starting up.

Use search instead of msearch when batching is disablededit

Details: When the advanced setting courier:batchSearches is disabled, we previously sent the search requests as _msearch requests. We now use _search when batching is disabled.

Impact: When the advanced setting courier:batchSearches is disabled, requests from Discover, Visualize, and Dashboard will now query Elasticsearch using the _search endpoint rather than the _msearch endpoint.

Visibility of features after configuring a term join in Mapsedit

Details: When performing a terms join in a vector layer in the Maps app, features that do not have a matching term in the join will no longer be visible on the map. Before, these features would remain visible, although they would not show any results for the join in their corresponding tooltip. This aligns the behavior of this functionality with the behavior in the Region Maps visualization. The old behavior, in which features without a corresponding record in the term-query result would still be visible on the map, is no longer supported.

Impact: This affects all maps that have a term join configured on a vector layer. The effect is primarily a change in the visual representation of the layer. In practice, fewer features will be visible if the results of the term-query have no corresponding record for all features on the map. This also means that all fields in a tooltip will have a corresponding value. Previously, the aggregation metrics for some rows in the tooltip would just be empty if there was no corresponing result in the term-query.

Removed support for date histogram format specifications in transformsedit

Details: If your transform groups your data by using a date histogram, the format property is no longer supported.

Impact: Transforms that were created in 7.2 and use date histograms might no longer work in 7.3. If you run into issues starting a transform, recreate it by copying the pivot part of the configuration into the advanced editor of the transforms wizard. The advanced editor will remove the unsupported attribute once the configuration gets applied.