In Kibana all visualizations underneath render using Kibana expressions (that you can see user facing inside Canvas expression editor). Right now old custom visualization plugins are all using the same visualizations expression function underneath. We’re going to remove this function in one of the upcoming minors, meaning your custom visualization plugin will require to register its own renderer and expression function and provide a toExpressionAst function.

You can check any of the PRs for core visualizations as a reference how those migration need to look like.

via #85234

The esaggs expression function, which is the default method of requesting aggregations for visualizations, has had some changes to the arguments it accepts.

// old
esaggs index="logstash-*" aggConfigs="[{ id: 1, enabled: true, type: "count", schema: "metric" }]"

// new
esaggs
  // use indexPatternLoad and pass your ID instead of passing it as a string
  index={indexPatternLoad id="logstash-*"}
  // use aggType functions for each aggregation you need. the aggs argument
  // can be passed multiple times. if you are using AggConfigs you can automatically
  // generate the expression AST for these arguments with `aggConfig.toExpressionAst()`
  aggs={aggCount id=1 enabled=true schema="metric"}

via #84973

server.xsrf.whitelist was deprecated in favor of server.xsrf.allowlist.

via #84791

The SavedObjectsRepository.incrementCounter method no longer accepts a string field name. An array of field names to increment must be provided.

via #84326

This change adds incrementBy to the config SavedObjectsIncrementCounterOptions for SavedObjectsRepository.incrementCounter().

The config incrementBy allows incrementing the counter by a custom number instead of a hardcoded 1. If no value is specified, the counter is incremented by 1.

Example:

await internalRepository.incrementCounter(type, id, counterFieldName, {
  incrementBy: 5,
});

via #84224

See the createNewCopies parameter in the Copy saved objects to space API documentation for more information.

via #83575

Task Manager now uses predefined IDs with encrypted saved objects. Kibana previously generated the ID within the EncryptedSavedObjectsClientWrapper in order to use a UUID v4. This restriction was put in place because typically a saved object has a reference to an "encrypted saved object" and we wanted to reduce the likelihood of someone potentially guessing the reference ID. Instead of relaxing this constraint for all saved object types used with the encrypted saved objects plugin, this PR allows certain saved object types to opt-out of this protection.

via #83482

UiSettings registration without a validation schema will throw an exception.

uiSettings.register({ mySetting: { value: 42 } });

via #83037

To create or update a comment, you must provide the type of comment and the attributes of each type. Specifically:

via #82715

SearchSource now uses the search fields param by default

The data plugin’s high-level search API, SearchSource, has migrated to use the Elasticsearch search fields param as the default when constructing a search request body with specific fields. To make it as easy as possible for plugins to migrate to the new behavior, we’ve preserved a way for plugins to use the legacy behavior of requesting fields from _source:

class MyPlugin {
  start(core, { data }) {
    const searchSource = data.search.searchSource.create();

    // Deprecated. Legacy behavior from 'fields' has been moved to 'fieldsFromSource'.
    // This is now the only way to search for fields directly from `_source`:
    searchSource.setField('fieldsFromSource', ['fieldA', 'fieldB']);

    // The old 'fields' syntax now uses the search fields API under the hood, and accepts
    // an array of fields that are passed straight through to the fields API.
    searchSource.setField('fields', ['fieldC', { field: 'fieldD', format: 'date_time' });

    ...etc
  }
}

If your plugin calls setField('fields', [...]), update it to use fieldsFromSource until you are able to adapt your plugin to the new fields behavior.

SearchSource has stopped using docvalue_fields by default

Previously SearchSource would automatically request docvalue_fields for any date fields in an index pattern to avoid a situation where Kibana might receive a date field from Elasticsearch that it doesn’t know how to format. With the introduction of the Elasticsearch search fields param, which supports requesting fields in a particular format, we no longer need to rely on docvalue_fields for this behavior.

SearchSource now automatically requests any date fields via the fields API, unless you provide specific ones via setField('fields', [...]), in which case only the relevant ones will be requested. If you do not provide a format for the fields you are requesting, one will automatically be added for you.

via #82383

This requires the following changes:

via #81739

The SavedObjects export API now supports the export of SavedObjects with circular references.

via #81582

The icon and navLinkId options were removed from Feature registration:

The validLicenses property was renamed minimumLicense. The existing property was unnecessarily configurable. This rename aligns the property with the licensing plugin’s functionality, which has built-in support for checking a minimum license against the current license.

via #80909

Features support defining a set of valid licenses for which they are available. Although this works for conditionally supporting top-level features, it doesn’t scale to sub-feature privileges.

Currently, there is no way to define a sub-feature privilege that is only available at a certain license level. This change introduces a minimumLicense property on each sub-feature privilege, so that consumers can choose the set of valid licenses for their sub-feature privileges.

A concrete example is Reporting. There are different report types offered at different license levels. PDF reports are a Platinum feature, so an administrator configuring roles in a Gold cluster shouldn’t be able to toggle the PDF report privilege.

Licensed sub-feature privileges will only be registered with Elasticsearch when the minimumLicense is satisfied. Further, the sub-feature privilege will only be included into the primary feature privileges when the minimumLicense is satisfied. The privilege registration system is already configured to listen to license changes at runtime, so the set of available/registered sub-feature privileges will always be kept in sync.

via #80905

A new field was introduced to cases' comments. It must be provided when adding a comment to a case. Specifically:

via #80870

The original URL rewritten in the onPreRouting interceptor is now provided in the KibanaRequest.rewrittenUrl property.

via #80810

These methods were added for setting field formatters: indexPattern.setFieldFormat and indexPattern.deleteFieldFormat. indexPattern.getFormatterForFieldNoDefault was also added, which is used by the management interface.

via #78352

This PR introduces the frontend session management service and integrates it into Discover by initializing a session before fetching fresh data from the server.

This PR also uses the session service to show the timeout error once per session instead of using a debounce.

via #76889

The following audit events are logged when enabled:

via #74640