Kibana 7.11.0edit

For detailed information about the 7.11.0 release, review the Deprecations, Enhancements, and Bug fixes. For the 7.11.0 breaking changes, refer to breaking changes in 7.11.


Lens and visualizations
  • Deprecates visualization:colorMapping advanced setting #83372
  • Deprecates kibana.index setting #83988
  • Deprecates reporting.index setting #84005
  • Deprecates xpack.task_manager.index setting #84155
  • Deprecates disabling the spaces plugin #83984
  • Deprecates disabling the security plugin #85159


  • Updates alert type selection layout to rows instead of grid #73665
  • Back Button on Add Connector Flyout #80160
  • Disables "Save" button for Alerts with broken Connectors #80579
  • Adds UI notifier to indicate secret fields and to remember / reenter values #80657
  • Adds defaultActionMessage to index threshold alert UI type definition #80936
  • Don’t wait for health check before showing Create Alert flyout #80996
  • Adds hasAuth to Webhook Configuration to avoid confusing UX #81390
  • Grouped list of alert types using producers in Types filter of Alerts tab #81876
  • Adds Alerts & Actions to the app directory #81902
  • Adds a link to documentation in the alerts and actions management UI #81909
  • Adds an Run When field in the alert flyout to assign the action to an Action Group #82472
  • Displays Action Group in Alert Details #82645
  • Removes placeholders and updates validation messages on connector forms #82734
  • Notify only on action group change #82969
  • Adds ability to assign alert actions to resolved action group in UI #83139
  • Microsoft Teams connector #83169
  • Adds action group and date to mustache template variables for actions #83195
  • Updates widths on columns in Alert Detail view #83823
  • Escaping is now off for most action parameters, except those that need per-action escaping, including the Slack, Email, and Webhook action parameters #83919
  • Adds ECS audit events for alerts and actions plugins #84113
  • Adds footer to all emails sent by Kibana email connector with a link to open Kibana or to the alert details page #84371
  • Adds default dedupKey value as an {{alertInstanceId}} to provide grouping functionality for PagerDuty incidents #84598
  • Transition to Elastic charts for all relevant APM charts #80298
  • APM Experiments settings #81554
  • APM index settings import/export in saved-object management #82784
  • Service overview: Dependencies table #83416
  • Service overview: Transactions table #83429
  • Latency chart for overview #84634
  • Add APM agent config options #84678
  • Updates header icons #84760
  • Adds log_level/sanitize_field_names config options to Python Agent #84810
  • Adds ignore_unavailable to avoid querying closed indices #84813
  • Adds sanitize_field_names and transaction_ignore_urls config options to Ruby agent #85646
  • Adds transaction_ignore_urls as central config #85734
  • Service overview: Instances table #85770
  • APM Alerts Preview charts #85868
  • Layout option for generating full-page Canvas reports #84959
  • Library Notification Popover #79581
  • Url Drilldown basic template helpers #80500
  • Edit Panel Title On Click #81076
  • Dashboards connected via drilldowns are now exported or copied to a different space together #82602
  • Panel toolbar #83342
  • Export CSV action for Lens embeddables in dashboard #83654
  • ExternalUrl service was integrated with URL Drilldown #85779
  • Adds new responsive layout #83633
Elastic Security Solution
For the Elastic Security Solution 7.11.0 release information, refer to Elastic Security Solution Release Notes.
Lens and visualizations
  • Adds categorical color palettes in Lens #75309
  • Adds color for dimension trigger in Lens #76871
  • Adds median operation in Lens #79453
  • Improves the range formatter #80132
  • Adds drag support within dimension group to reorder in Lens #80547
  • Renames X/Y axis to horizontal/vertical in Lens #80991
  • Adds value labels in Lens bar charts #81776
  • Enables "Other" bucket for top values operation in Lens #82704
  • Adds CSV Export for Lens #83430
  • Adds "Last value" operation to Lens #83437
  • Adds sorting to Lens data tables #84435
  • Adds in-product help to Lens fields list #85544
  • Adds toggle to height data table export button #70801
  • Adds support for HDR percentiles in TSVB visualizations #78306
  • Displays epoch on a more human readable format for TSVB #79110
  • Adds Ignore global filters to series options in TSVB #79337
  • Updates New visualization window #79627
  • Adds textTruncate option for tooltips #80524
  • Renames positive rate to counter rate #80939
  • Use "histogram:maxBars" and "histogram:barTarget" advanced settings in TSVB #83628
  • Fixes Graph saved object references #85295
  • Allow sorting by median #79839
  • Syncs logs timerange with wider Kibana #79444
  • Displays progress for asynchronous loading of the log entry fly-out content and cancels pending requests when closing the fly-out #83906
Machine Learning
  • Data frame analytics: Scatterplot matrix for outlier detection #73419
  • Adds space aware jobs #77916
  • Adds probability values in decision path visualization for classification data frame analytics #80229
  • DFAnalytics Creation: update form to handle num_top_classes setting for all classes #80751
  • DF Analytics wizard: ensure user can set mml manually or select to use given estimate #81078
  • Adds annotation markers to time series brush area to indicate annotations exist outside of selected range #81490
  • Configure sorting for partition values on Single Metric Viewer #81510
  • Adds option for anomaly charts for metric detector should plot min, mean or max as appropriate #81662
  • Data frame analytics: Adds map view #81666
  • Improves support for script and aggregation fields in anomaly detection jobs #81923
  • Adds space aware jobs (#77916) #82446
  • Job saved objects initialization #82639
  • Adds non-space aware checks for existing jobs #82814
  • Additional job spaces initialization #83127
  • Persisted URL state for the "Anomaly detection jobs" page #83149
  • Performance improvements to annotations editing in Single Metric Viewer & buttons placement #83216
  • Space management UI #83320
  • Persisted URL state for the Data frame analytics jobs and models pages #83439
  • Improves browser history navigation #83792
  • Persisted URL state for Anomalies table #84314
  • Persisted URL state for Data Frame Analytics Exploration page #84499
  • Improves messaging and support for datafeed using aggregated and scripted fields #84594
  • Adds security_linux and security_windows Modules #85065
  • Data Frame Analytics: check space permissions before deleting jobs #85495
  • Redesign index-based Data Visualizer #85726
  • Adds runtime_mappings to job wizards #85817
  • Allows custom name for fields via index pattern field management #70039
  • In index pattern management - Refresh button removed as index pattern field lists are refreshed when index patterns are loaded, such as on page load or when moving between kibana apps #82223
  • Painless Lab in DevTools now supports autocompletion for keywords, and class and class members for the Painless language based on a given context #80577
  • Transforms: Remove index field limitation for custom query #81467
  • In the Index Management app, you can now click a data stream index lifecycle policy and view it in the Index Lifecycle Policies app #82165
  • Use monacco editor in the inspector request panel #82272
  • In the Index Management app, you can now click a data stream index template and view it on the Index Templates tab #82592
  • In the Index Management app, data streams managed by Fleet can now be identified by a Managed label #83049
  • In the Index Management app, buttons to delete a data stream are now controlled by user privileges #83573
  • Index Patterns service now has public HTTP API, which third parties can use to manage index patterns, index pattern field metadata, and scripted fields #83576
  • The ILM policy UI now supports configuring searchable snapshot in the cold and hot phases #83783
  • Adds shrink field to hot phase #84087
  • Index and component templates can now be configured with runtime fields in their mappings #84184
  • The Ingest Node Pipelines UI now supports autocompletion for the Painless language when defining a condition for a processor, ane when defining a source for a script processor #84554
  • In the Index Management app, hidden data streams are now displayed and indicated by a label #85028
  • Aligns form fields in ILM with ESUI standards #85143
  • Moves error and loading notices for data allocation #85154
  • Index Lifecycle Management app now includes readonly action #85419
  • Adds support for latest function #85784
  • Updates logstash pipeline management to use system index APIs #80405
  • Reintroduce "Add support for runtime field types to mappings editor" #79940
  • Form UI #81766
  • Geo line source #76572
  • Supports envelope #80614
  • Adds query bar inputs to geo threshold alerts tracked points & boundaries #80871
  • Support by value saved objects #82486
  • Show icon when layer is filtered by time and allow layers to ignore global time range #83006
  • Saved object tagging #83197
  • Updates style when metrics change #83586
  • Support URL drilldowns #83732
  • Background color map setting #83822
  • Adds geo containment tracking alert type #84151
  • Style by percentiles #84291
  • Use index-pattern field display name in UX #84945
  • Adds percentile #85367
  • Adds on-prem EMS config #82525
  • Adds endpoint for Metrics API #81693
  • Adds full custom metric UI to inventory alerts #81929
  • Adds basic interaction and shell for node details overlay #82013
  • Adds metrics to node details #83357
  • Don’t show loading screen during auto-reload #83376
  • Adds logs to node details #83433
  • Adds Process tab to Enhanced Node Details #83477
  • Implements Resolved action group in Metrics alerts #83687
  • Adds metadata tab to node details flyout #84454
  • Fixes double loading of inventory page when there’s a default view #84843
  • Synch time for metrics ui Kibana time #85502
  • Thread pool rejections alert #79433
  • Improves Collector fetch API #79595
  • Usage collection add saved objects client to collector fetch context #80554
  • Some progress on making alerts better in the UI #81569
  • CCR read exceptions alert #85908
  • Starting in 8.0, deb and rpm packages will restart on upgrade by default #82049
  • Adds a new CLI for generating encryption keys used by Kibana #82838
  • Adds deb and rpm packages for ARM64 #84364
  • Upgrades the major Node.js version used by and shipped with Kibana from v12 to v14 #83425
  • Adds experimental support for configuring CORS policy #84316
  • Apply back pressure in Task Manager whenever Elasticsearch responds with a 429 #75666
  • Adds basic observability into Task Manager’s runtime operations #77868
  • Custom labels for ranges #79628
  • Adds cumulative sum expression function #80129
  • Adds a row click trigger to Lens embeddable for datatable expression renderer #83167
  • Adds search request batching using bfetch #83418 and #84043
  • Normalize values by time unit #83904
  • Navigation search now includes deep links into various applications, allowing you to quickly navigate directly to the screens you need most #83380
  • Adds tags UI to search results #85084
Querying & Filtering
  • Use new Search API for rollup search #83275
  • Adds audit logging events and event filtering[#74640]
  • Allow the default space to be accessed via /s/default #77109
  • Omit runtime fields from FLS suggestions #78330
  • Adds the ability to log in to Kibana anonymously without using any 3rd-party reverse proxy workarounds #79985
  • Adds the ability to specify session timeout settings for every provider separately #82583
  • Adds cloud links to user menu #82803
  • Users are now redirected back to the original URL after they log in again #84229
  • Upgrades the major Node.js version used by and shipped with Kibana from v10 to v12 #61587
  • Persist date range between uptime and other apps #79418
  • Prompt for confirmation when saving alert with no action #79892
  • Applies the active timefilter onto the autocomplete requests to fix performance issues #81515
  • Adds description and documentation link in alert flyout #81526
  • Put APM links into header action menu #82292
  • Displays response headers for a ping #82332
  • APM header changes #82870
  • Uptime overview overhaul #83406
  • Waterfall view #84821
  • Display tags in monitor list and details page #85168

Bug fixesedit

  • Don’t change previousStartedAt when alert execution fails #81388
  • Enables the EventLog Client to query across ILM versions of the .event-log index #81920
  • Used SO for saving the API key IDs that should be deleted #82211
  • Fixes pagination in connectors list #83638
  • Prevents errors in Action and Alert Type UIs from cascading through Alerts Management #83925
  • Fixes buggy default message behaviour #84202
  • Revert the Revert of "[Alerting] renames Resolved action group to Recovered (#84123)" #84662
  • Fixes bug where severity is auto selected but not applied to the action in PagerDuty #84891
  • Fixes bug when switching between threshold comparators #85844
  • Set refresh: false when partially updating the alert’s execution status #86316
  • Sort action type filters in alerts list and hide case action type #86360
  • Fixes webhook errror messages to be more specific #87044
  • Shift polling interval by random amount when Task Manager experiences consistent claim version conflicts #88020
  • Fixes link to upgrade assistant #82138
  • Filtering by "Type" on error overview sometimes causes an error #82750
  • Fixes broken link to ML when time range is not set #85976
  • Set default for agent icons #86023
  • Adds range query to service map trace walk #86631
  • Filter out service nodes if there are no metrics #86639
  • Truncate long service names in Trace overview #86759
  • "View job" link from latency charts leads to a malfunctioning page #86788
  • transactionType should be required on service-specific endpoints #86893
  • Custom links can still be created with a read only user. #87089
  • Toggle action and service icon menus #87220
  • Blank page when selecting a future time range #87298
  • Fixes alert creation items being available for readonly users #87343
  • Fixes missing datepicker when service maps has no data #87393
  • Explicitly set environment for cross-service links #87481
  • Optimize anomaly data loading strategy #87522
  • Fixes a bug that would sometimes cause the Kibana process to crash with Error: Failed to run task "apm-telemetry-task" as it is currently running #87645
  • Fixes stale custom links list after creating new link #87932
  • Fixes alerting expression popovers positions on scroll #88085
  • Hide “Create configuration” for users without write access #88149
  • Hide recording setting from from RUM agents #88152
  • Reset time range if either value changes #88186
  • Fixes cloning panels reactive issue #74253
  • Fixes dashboard "snapshot share" is not sharing panel state in view mode #79837
  • Deangularize Dashboard #82909
  • Fixes Unlink Action via Rollback of ReplacePanel #83873
  • Transition Embeddable State Transfer to Session Storage #85688
  • Fixes Add From Library Flyout Staying Open #86698
  • Fixes double fetching of saved search embeddable #84060
  • Fixes navigating back when changing index pattern #84061
Elastic Security Solution
For the Elastic Security Solution 7.11.0 release information, refer to Elastic Security Solution Release Notes.
  • Fixes duplicate ingest pipeline refs #82078
Lens and visualizations
  • Do not reset formatting when switching between custom ranges and auto histogram #82694
  • Makes incomplete switches possible #83519
  • Fixes bug causing bar charts to render bars at the wrong width #83545
  • Fixes label input debouncing #84121
  • Fixes Treemap outer labels with transparent background #84245
  • Line Visualization improper scaling can result in gaps #80135
  • Handle correctly {{key}} placeholder on series name #81748
  • Fixes "other bucket" for fields containing dashes #81981
  • Disable using top_hits in pipeline aggregations #82278
  • Fixes Moving Avg help link in Vis Editor #82423
  • TSVB doesn’t communicate it’s index-patterns to dashboard #82964
  • Offset option doesn’t work properly for some values #83051
  • Remove extra column in split mode #83193
  • Table tab not working with rollup indexes #83635
  • Filter bar in Vega is not usable with non default index pattern. #84090
  • TSVB field list performance issue on using annotations #84407
  • Gauge visualization can no longer be clicked to filter on values since Kibana 7.10.0 #84768
  • Wrong x-axis formatting if "dateFormat" configuration property is not specified #84899
  • Date histogram timestamps on daily are getting displayed as epoch times #85565
  • Fixes request with disabled aggregation #85696
  • Visualize charts flicker on each change #86888
  • Fixes selection of suggested field names in the logs stream query bar #85973
  • Fixes initial selection of log threshold alert condition field if missing from mapping #86488
Machine Learning
  • Fixes exclude frequent in advanced wizard (#81121) #81154
  • Updating analysis config schema (#82703) #82714
  • Data Frame Analytics Classification results view: fix Actual label #86060
  • Anomaly Detection: Fix validation error when no data in index. #86114
  • DFA results view: ensure results not stuck in loading state when no docs returned from text search #86178
  • Fix sort order of data recognizer module cards #86250
  • Fixes displaying of setup errors in recognizer wizard #86430
  • Fixes alignment of values in data frame analytics results view badges #86621
  • Fixes cloning of partition field in per-partition categorization jobs #86635
  • Fix Single Metric Viewer y domain extending beyond the visible focus area #86655
  • Ensure job group badge fonts are same color #86674
  • Anomaly Detection jobs list: fix edit groups popup #86836
  • Fixes issues in Index Management and ILM when resources have special characters in names #80835
  • Fixes ilm navigation #81664
  • Fixes a bug in the Watcher UI where the search input cleared after 1 minute of inactivity, causing a user to lose the filtered results #82651
  • Fixes a bug in the Index Templates UI where editing an index template with a deprecated type defined and no mapped fields could remove the type on save #82987
  • Grokdebugger correctly passes Elasticsearch errors to the Kibana UI #83036
  • Fixes an issue in the Snapshot and Restore UI, where editing a Snapshot Lifecycle Management policy may fail if it contains a previous snapshot failure with a large payload content #83928
  • Reset to default for empty strings #85137
  • Fixes esaggs missing default time field scenario in Lens #85754
  • Transforms: Support for missing_bucket in transform advanced pivot editor #85758
  • Documentation links in the Index Lifecycle Management UI have been updated #87216
  • Fixes a bug causing the index pattern override selection to be cleared when switching page while performing a legacy format saved object import #81621
  • Fixes a UI error when attempting to copy a saved object when a user only has Read access to the Default space #81828
  • Fixes index pattern recreation when removing experimental packages #81940
  • Fixes logstash central pipeline management test #83281
  • Fixes feature tooltip remains open when zoom level change hides layer #81373
  • Fixes geojson upload diacritic handling #83122
  • Always initialize routes on server-startup #84806
  • Fixes multi-select query from Controls visualization not always getting applied to map in dashboard #87310
  • Fixes zooming while drawing shape filter logs errors in console #88413
  • Refactor Observability Overview for Performance #84955
  • Hide drawer on inventory #85503
  • Iterate over saved object & index patterns pages to collect telemetry results #73077
  • Fixes bug in logs UI link #80943
  • Uses asCurrentUser in getClusterUuid #82908
  • Uses fetchClustersRange #87882
  • Change cloud messaging on no data page #88375
  • Fixes the logging destination for systemd installations and and updates the sysv filename to be consistent with other stack products #74896
  • Create keystore after installation #76465
  • Wrap blocked paths in quotes #83560
  • Adds loading indicator during debounce time #80158
  • Mark task as failed if maxAttempts has been met. #80681
  • Reactively disable Task Manager lifecycle when core services become unavailable #81779
  • Schedule retry based on schedule on recurring tasks #83682
Querying & Filtering
  • KQL autocomplete suggestions for field values will now have backslashes properly escaped #85457
  • Prevent Kerberos and PKI providers from initiating a new session for unauthenticated XHR/API requests #82817
  • Fixes incomplete client cert chain when using PKI authentication with the login selector #88229
  • Monitor status alert use url as instance #81736
  • Removes Connector flyouts after usage #82126
  • User experience display low values #86026
  • Simple monitor status alert fix for page duty and other connectors #87460
  • Fixes kuery bar dark theme #87827
  • Clear ping state when PingList component in unmounted #88321
  • UX use replace history instead of push on first load #88586
  • Fixes impacted page load errors #88597