Kibana 8.5.1edit

Review the following information about the Kibana 8.5.1 release.

Known issuesedit

Unable to load Stack Management > Rules and Connectors due to corrupted rule definitions

Details
Releases 8.5 and 8.6 have a bug that corrupts rules when you update API keys or manage snooze schedules. In particular, it affects tracking containment rules and Elasticsearch query rules with KQL or Lucene query types. Releases 8.7 and beyond do not include this bug (fixed in #153370).

Impact
This known issue causes "unable to load rules" messages to occur in Stack Management > Rules and Connectors. To temporarily work around the problem, copy the rule content (params, name, tags, actions) for the problematic rules, delete the rules, then recreate them. For more details, refer to Elasticsearch query rules and Tracking containment rules.

Unable to add Fleet Server integration on Windows

Details

We discovered a high severity issue in version 8.5.1 that only affects Windows users in self-managed environments. When you attempt to add a Fleet Server, Kibana is unable to add the Fleet Server integration, and the Fleet Server polices are created without the necessary integration. For more information, see issue #144880.

Impact

This issue will be resolved in version 8.5.2. We advise Windows users not to upgrade to version 8.5.1.

Offline Elastic Agents fail to unenroll after timeout has expired

Details

A known issue in Fleet Server 8.5.1 prevents offline agents from being automatically unenrolled after the unenrollment timeout expires.

Impact

Offline agents will be displayed in the Fleet Agents list until you explicitly force unenroll them. You can do this through the Fleet UI or by using the API.

To use the API:

  1. Find agent’s ID. Go to Fleet > Agents and click the agent to see its details. Copy the Agent ID.
  2. In a terminal window, run:

    curl -u <username>:<password> --request POST \
      --url <kibana_url>/api/fleet/agents/<agentID>/unenroll \
      --header 'content-type: application/json' \
      --header 'kbn-xsrf: xx' \
      --data-raw '{"force":true,"revoke":true}' \
      --compressed

    Where <agentID> is the ID you copied in the previous step.

Breaking changesedit

Breaking changes can prevent your application from optimal operation and performance. Before you upgrade, review the breaking change, then mitigate the impact to your application.

There are no breaking changes in Kibana 8.5.1.

8.4.0 | 8.3.0 | 8.2.0 | 8.1.0 | 8.0.0 | 8.0.0-rc2 | 8.0.0-rc1 | 8.0.0-beta1 | 8.0.0-alpha2 | 8.0.0-alpha1

Enhancementsedit

Elastic Security
For the Elastic Security 8.5.1 release information, refer to Elastic Security Solution Release Notes.

Bug fixesedit

APM
  • Fixes a bug where Metadata API does not filter by environment #144472
  • Fixes a bug where AWS lambda checks for an undefined value #143987
Dashboard
  • Removes support for scripted fields in options list #144643
  • Fixes help documentation link for dashboard #143894
Elastic Security
For the Elastic Security 8.5.1 release information, refer to Elastic Security Solution Release Notes.
Fleet
Make asset tags space aware #144066
Machine Learning
  • Correcting the size of the free ML node on cloud #144512
  • Fixes model testing flyout reload #144318
  • Explain Log Rate Spikes: Wrap analysis in try/catch block #143651
  • Explain Log Rate Spikes: Fix uncompressed streams and backpressure handling #142970
Osquery
  • Fixes a bug that prevented users from viewing Osquery results if they were in a non-default Kibana space #144210
Platform
Fixes the execution pipeline not to stop on a flaky subexpression #143852
Uptime
  • Adjust forumla for synthetics monitor availability #144868
  • TLS alert - do not alert when status cannot be determined #144767