Kibana 7.9.0edit

See also breaking changes in 7.9.

  • Moves kibana-keystore from data/ to config/ #57856


  • Shows, and/or in metadata table #66376
  • Adds error rate chart to Transaction overview and detail views #67327
  • Adds ThemeProvider to support dark mode #68242
  • Triggers Lazy-load alert #68806
  • Changes to duration formatting #69039
  • Adds callout to inform users of high cardinality in unique transaction names #69112
  • Creates API to return data to be used on the Overview page #69137
  • Fixes confusing request/minute viz #69143
  • Adds decimals only for numbers below 10 #69334
  • Adds support for dark mode #69362
  • Chart breakdowns #69420
  • Quotes trace id to ensure a word is searched (#69500) #69504
  • Adds error rates to Service Map popovers #69520
  • Resubmits initial version #69531
  • Adds Anomaly detection settings page to create ML jobs per environment #70560
  • Service maps anomaly detection integration by environment #70932
  • Anomaly detection setup link with alert if job doesn’t exist #71229
  • Respects default time range defined in Kibana Advanced Settings #71464
  • Uses HDR for percentiles #64758
  • Adds simple variables to workpads #66139
  • Enables drilldowns for Lens visualizations #65675
  • Improves positioning of cloned panels #67461
  • Lens editor auto refresh #65868
Enterprise Search
  • Workplace Search in Kibana MVP #70979
Ingest Management
  • Adds support for datastream to each template #66367
  • Improves server-side error handling #67278
  • Adds ability to copy an agent config #68737
  • Adds enroll agent action to config action menu #68840
  • Adds ability to sort to agent configs and package configs #70676
Lens and visualizations
  • Warns if leaving with unsaved visualization #67689
  • Uses accordion menus in field list for available and empty fields #68871
  • Adds "no data" popover #69147
  • Last used Index pattern is saved to and retrieved from local storage #69511
  • Fitting functions #69820
  • Multiple y axes #69911
  • Adds ability to set colors for y-axis series #70311
  • Allows histogram fields in average and sum aggregations #66891
  • Changes the error message on TSVB in order to be more user friendly #67090
  • Allows the user to change the tooltip mode #67775
  • Updates vega version #68639
  • Adds support for histogram type #68837
  • Enables "Explore underlying data" actions for Lens visualizations #70047
  • Validates ML job setup time ranges #66426
  • [Alerting] "Group by" functionality #68250
  • ML log integration splash screen #69288
  • Actions menu in log entry categorization page #69567
  • Adds index names for the new indexing strategy #70245
  • Adds category anomalies to anomalies page #70982
  • Anomalies page dataset filtering #71110
  • Shows log analysis ML jobs in a list #71132
Machine Learning
  • Search should have a categorical option for job type #65770
  • Adds linking to dataframe from job management tab #65778
  • Adds optional ability to delete target index and index pattern when deleting data frame analytics job #66934
  • Data frame analytics: Creation wizard part 1 #67564
  • Extends population preview chart to show actual and typical value #67569
  • Adds minor refresh button to data frame analytics and anomaly detection Job Messages tabs #67750
  • Keeps the edit rule flyout open if there are multiple rules #68174
  • Model snapshot management #68182
  • Data frame analytics: Creation wizard part 2 #68462
  • Removes sub navigation menu from the Anomaly Detection pages #68663
  • Adds anomaly swim lane embeddable to the dashboard from the Anomaly Explorer page #68784
  • Allows editing of model_snapshot_retention_days #69003
  • Anomaly Explorer swim lane pagination #70063
  • Anomaly Detection: Annotations enhancements #70198
  • Updates APM Module to Work with Service Maps #70361
  • Changes all calls to ML endpoints to use internal user #70487
  • Data frame analytics: add ability to edit job for fields supported by API #70489
  • Data frame analytics: adds prompt for destination index pattern creation #70651
  • Adds switch to enable model plot annotations independently #70678
  • Adds peak_model_bytes to model size stats type #70825
  • Anomaly swim lane embeddable navigation and filter actions #71082
  • Adds siem_cloudtrail Module #71323
  • Management apps are now organized into buckets that support common workflow-oriented use-cases: data ingestion, data management, insights and alerting, security, Kibana management, and Stack management #65796
  • The ES UI built a new component to assist with building ingest pipelines. Before, when building ingest pipelines, users would have to type and carefully curate JSON describing an ingest pipeline. With this new component a lot of that burden is removed and improved access to ES processors is provided. This component is the foundation of an improved pipeline building experience #66021
  • Transforms: Filter aggregation support #67591
  • Adds a "Data Streams" tab to Index Management to help users manage their data streams #67806
  • Transforms: Support sub-aggregations #68306
  • Data Grid Histograms #68359
  • Adds a snapshot policy name field to Delete phase of index lifecycle policy. This option ensures that the snapshot policy is executed before the managed index is deleted #68505
  • Transform: Adds ability to create index pattern time field when creating transform #68842
  • Transforms - Updated: Add ability to delete dest index & index pattern when deleting transform job #68896
  • Transform: Table enhancements #69307
  • Transform: Enable force delete if one of the transforms failed #69472
  • A new tab called Component Templates is available in Index Management. It provides a way to manage Elasticsearch’s component templates. Users can create, edit, clone, and delete a component template #69732
  • The index templates tab allows users to manage both their legacy index templates and composable index templates. Users can create, edit, clone, and delete a composable index template #70220
  • We updated the snapshot policy name field in Delete phase of index lifecycle policy. This component now display a list of existing snapshot policies and warns the user if their input doesn’t match any existing policies #70627
  • Displays ranged-data with bands #60570
  • Adds styling and tooltip support to mapbox mvt vector tile sources #64488
  • Allows adding multiple layers #67544
  • Enables gridding/clustering/heatmaps for geo_shape fields #67886
  • Security layer wizards #68290
  • Surface geo_shape clustering gold feature #68666
  • Layer wizard select re-design #69313
  • Shows vector tile labels on top #69444
  • Choropleth layer wizard #69699
  • Increases DEFAULT_MAX_BUCKETS_LIMIT to 65535 #70313
  • Shows joins disabled message #70826
  • Exposes registerLayerWizard and registerSource in maps plugin start #71553
  • Adds support for multiple groupings to Metrics Explorer (and Alerts) #66503
  • Adds sorting for name and value to Inventory View #66644
  • Changes Metric Threshold Alert charts to use bar charts #66672
  • Allows users to configure Inventory View palettes #66948
  • Adds timestamp context variable #67482
  • Adds back context variables with descriptions #67487
  • Adds overrides to Snapshot API to support alert previews #68125
  • Enhances Inventory View Tooltips #69757
  • UX improvements for saved views #69910
  • Register function for Observability homepage #70529
  • Adds framework for recovery messaging to metric threshold alerts (non-functional) #65339
  • Adds preview feature for metric threshold alerts #67684
  • Adds inventory alert preview #68909
  • Prefills alerts from the global dropdown #68967
  • Adds context.reason and alertOnNoData to Inventory alerts #70260
  • Collects number of visualization saved in the past 7, 30 and 90 days #67865
  • Out of the box alerting #68805
  • Node options from cfg file for production #62468
  • Creates Linux aarch64 package #69165
  • Switches to core application service #63443
  • Adds docLinks to CoreSetup #66631
  • New Enterprise Search Kibana plugin #66922
Querying & Filtering
  • Resolves range date filter bugs and improve usability #71298
  • Allow saved objects to be searched across multiple spaces #67644
  • Uses ML Capabilities API to determine license type #66921
  • Landing page for Observability #67467
  • Monitor availability reporting #67790
  • Creates "Add data" links in all Observability app headers #69016
  • Observability overview page #69141
  • Availability alert #70284
  • Duration Anomaly Alert #71208

Bug fixesedit

  • Adds lazy loading of alerting UI components #65060
  • Fixes Connectors edit flyout retains state after being closed #71911
  • Fixes Webhook connector doesn’t retain added HTTP header settings #71924
  • Removes Missing permission page #72030
  • Fixes linking errors to ML and Discover #73758
  • Observability i18n fixes #72984
  • Fixes falsey/null value bug for dropdown choices #69290
  • Shows drilldown context menu over chart tooltip #67311
  • Loses OriginatingApp Connection on Save As #72725
  • Sometimes when creating filters on a dashboard suggestions from default index patterns were shown by mistake #72899
  • Handles listing errors gracefully #66986
  • Kibana now sets the keep_alive parameter to 1m in _async_search requests to Elasticsearch to ensure that search requests are cancelled if a user closes the browser or navigates outside of Kibana before a request completes #73712
  • Multiple chart actions context menu positioning fixes #70705
  • Fixes accessibility issue in Uptime app nav links #72926
  • Prevents whitespace wrapping of doc table header #52861
  • Removes column from sorting array when removed from table #65990
  • Validates timerange before submitting query to ES #69363
  • Adds error and warning statuses to FilterBar filters #66979
  • Forbids timezones not working in Elasticsearch #70780
Ingest Management
  • Fixes clear filters on agents table not working #71978
Kibana UI
  • New Kibana app link order #66320
  • Fixes special clicks and 3rd party icon sizes in nav #69767
Lens and visualizations
  • Keeps global filters, time range and refresh interval on refresh #68075
  • Adds description property and check duplicate title on save #68219
  • Keeps custom labels #68498
  • Fixes delete button position in dimension panel for long labels #69495
  • Fixes cross cluster bug and optimize existence query #70132
  • Do not crash data panel on invalid KQL query #70712
  • Handles failing existence check #70718
  • Fixes overflow in printable report #70723
  • Fixes switching with layers #71982
  • Pins filters not applied when coming from different app #73825
  • Fixes missing percentage column and wrong headers on export formatted csv #66883
  • TSVB: handle division by zero in math agg #67111
  • Fixes vega specification parsing #67963
  • VEGA is missing scroll bars #68766
  • Replaces the Custom Color Picker on TSVB with the EuiColorPicker #68888
  • Fixes spec color highlighting not working on vega vis #68995
  • Fixes Advanced Settings Panel number editing in Graph #69672
  • Hide only duplicated consecutive ticks #70981
  • Fixes TSVB table trend slope value #71087
  • Fixes export table for table export links #71249
  • Removes opacity from vislib bars #71421
  • Fixes float percentiles line chart #71902
  • Fixes display of dataset values in anomaly and category example rows #71693
  • Handles modifier keys #74237
  • Removes UUID from Alert Instances #71340
Machine Learning
  • DF Analytics Results: do not hide query bar and table on query syntax error #69196
  • Fixes anomaly chart and validation for one week bucket span #69671
  • Anomaly Detection: ensure Category examples tab in the expanded table row can be seen #70241
  • Fixes error toasts shown when starting or editing jobs #71618
  • Fixes new job with must_not saved search #71831
  • Fixes management section access denied #71841
  • DF Analytics creation: ensure monitor cluster privilege not required to create job #71934
  • Fixes job list crashing due to undefined processed records #71966
  • Fixes datafeed start time is incorrect when the job has trailing empty buckets #71976
  • Fixes HTML named characters encoding #72060
  • Fixes annotations pagination & change labels from letters to numbers #72204
  • Stops annotation flyout re-rendering on each keystoke #72299
  • Fixes display of regression stop stats if one is NaN #72412
  • Handling data recognizer saved object errors #72447
  • DF Analytics results: add index-pattern management link to click here error prompt #72470
  • Fixes layout of anomaly chart tooltip for long field values #72689
  • Fixes link to index management from file data visualizer #72863
  • Fixes deleting DFA not showing index pattern check #72904
  • Fixes recognizer wizard create job button #73025
  • Fixes unnecessary deleting job polling #73087
  • Disables ML if license feature is disabled #73187
  • DF Analytics results: ensure View link is only enabled when job has successfully completed #73539
  • Inspect action shows on dashboard for every chart #65998
  • Fixes an issue in Watcher, where a watch status or action status was incorrectly marked as "Error" #67952
  • Error handling #68809
  • Fixes an issue in Dev Tools Console where the example shown in the "Help" panel was formatted incorrectly #71188
  • Fixes the alignment of the Timing field for Warm, Cold and Delete phases on the Index Lifecycle Policy edit page #71273
  • Adopts data stream API changes #71682
  • Fixes #66185 #66186
  • Do not check count for blended layers when layer is not visible #66460
  • Fixes mapbox glyphs error when EMS access is turned off #67427
  • Fixes fit to bounds requests not getting canceled #67629
  • Fixes cannot select Solid fill-color when removing fields #70621
  • Fixes zoom in/zoom out buttons are not visible in dark mode #72699
  • Fixes removing global filter from layer can cause app to start thrashing #72763
  • Fixes cloned clustered documents layer returns error #72975
  • Fixes data driven style properties not working when cloned layer contains joins #73124
  • Fixes tile layer attibution text and attribution link validation errors #73160
  • Fixes fit to data for Point to Point layer #73563
  • Fixes #fit to bounds for ES document layers with joins #73985
  • Removes no longer required div wrapper around ValidatedDualRange #70188
  • Fixes asynchronicity and error handling in Snapshot API #70503
  • Fixes evaluating rate-aggregated alerts when there’s no normalized value #73545
  • Removes UUID from Alert Instance IDs #71335
  • Fixes a bug in Metric Threshold query filter construction #70672
  • Displays Too Many Buckets error when previewing Inventory Alerts #70508
  • Round metric threshold time buckets to nearest unit #71172
  • Adds a case for Alerting if security/ssl is disabled #71846
  • Checks for security feature first when entering setup mode #73821
  • Sets wrap to the errorLink so it doesn’t go outside of box #67797
  • Fixes plugin lifecycle log to only include server plugins #68686
Querying & Filtering
  • When using KQL or the filter bar, if a request is issued to Elasticsearch for suggestions for a value for a specific field, the request will be cancelled when navigating away as well as when the input is updated (and a new request is issued #69769
  • Fixes a bug where the Kibana server could crash if the Reporting server-side headless browser crashes #71989
  • Adds panel flyout opens 2 flyouts #65861
  • Adds lazy loading to AlertType and Flyout components #65678
  • Fixes metric query broken because of missing mapping #68999
  • Fixes charts dark theme #69748
  • Uses manual intervals for ping histogram #72928


  • Removes watcher integration #71655
  • Deprecates kibana.defaultAppId setting #67635