Plugin API changes in 7.11edit

This page discusses the plugin API changes that you need to be aware of when migrating your application to Kibana 7.11.

Custom visualizations plugin need to build their own expression AST

In Kibana all visualizations underneath render using Kibana expressions (that you can see user facing inside Canvas expression editor). Right now old custom visualization plugins are all using the same visualizations expression function underneath. We’re going to remove this function in one of the upcoming minors, meaning your custom visualization plugin will require to register its own renderer and expression function and provide a toExpressionAst function.

You can check any of the PRs for core visualizations as a reference how those migration need to look like.

via #85234

esaggs expression function changed

The esaggs expression function, which is the default method of requesting aggregations for visualizations, has had some changes to the arguments it accepts.

// old
esaggs index="logstash-*" aggConfigs="[{ id: 1, enabled: true, type: "count", schema: "metric" }]"

// new
  // use indexPatternLoad and pass your ID instead of passing it as a string
  index={indexPatternLoad id="logstash-*"}
  // use aggType functions for each aggregation you need. the aggs argument
  // can be passed multiple times. if you are using AggConfigs you can automatically
  // generate the expression AST for these arguments with `aggConfig.toExpressionAst()`
  aggs={aggCount id=1 enabled=true schema="metric"}

via #84973

server.xsrf.whitelist rename server.xsrf.allowlist

server.xsrf.whitelist was deprecated in favor of server.xsrf.allowlist.

via #84791

SavedObjectsRepository.incrementCounter supports array of fields

The SavedObjectsRepository.incrementCounter method no longer accepts a string field name. An array of field names to increment must be provided.

via #84326

UI counters introduced

This change adds incrementBy to the config SavedObjectsIncrementCounterOptions for SavedObjectsRepository.incrementCounter().

The config incrementBy allows incrementing the counter by a custom number instead of a hardcoded 1. If no value is specified, the counter is incremented by 1.


await internalRepository.incrementCounter(type, id, counterFieldName, {
  incrementBy: 5,

via #84224

Conflict checking is now disabled by default when copying saved objects

See the createNewCopies parameter in the Copy saved objects to space API documentation for more information.

via #83575

Predefined IDs allowed for encrypted saved objects

Task Manager now uses predefined IDs with encrypted saved objects. Kibana previously generated the ID within the EncryptedSavedObjectsClientWrapper in order to use a UUID v4. This restriction was put in place because typically a saved object has a reference to an "encrypted saved object" and we wanted to reduce the likelihood of someone potentially guessing the reference ID. Instead of relaxing this constraint for all saved object types used with the encrypted saved objects plugin, this PR allows certain saved object types to opt-out of this protection.

via #83482

Schema for UiSettings is now required

UiSettings registration without a validation schema will throw an exception.

uiSettings.register({ mySetting: { value: 42 } });

via #83037

User and alert comment types added

To create or update a comment, you must provide the type of comment and the attributes of each type. Specifically:





The type of the comment

user or alert


The comment. Valid only when type is user.



The alert ID. Valid only when the type is alert.



The index where the alert is saved. Valid only when the type is alert.


via #82715

SearchSource updated to use fields API

SearchSource now uses the search fields param by default

The data plugin’s high-level search API, SearchSource, has migrated to use the Elasticsearch search fields param as the default when constructing a search request body with specific fields. To make it as easy as possible for plugins to migrate to the new behavior, we’ve preserved a way for plugins to use the legacy behavior of requesting fields from _source:

class MyPlugin {
  start(core, { data }) {
    const searchSource =;

    // Deprecated. Legacy behavior from 'fields' has been moved to 'fieldsFromSource'.
    // This is now the only way to search for fields directly from `_source`:
    searchSource.setField('fieldsFromSource', ['fieldA', 'fieldB']);

    // The old 'fields' syntax now uses the search fields API under the hood, and accepts
    // an array of fields that are passed straight through to the fields API.
    searchSource.setField('fields', ['fieldC', { field: 'fieldD', format: 'date_time' });


If your plugin calls setField('fields', [...]), update it to use fieldsFromSource until you are able to adapt your plugin to the new fields behavior.

SearchSource has stopped using docvalue_fields by default

Previously SearchSource would automatically request docvalue_fields for any date fields in an index pattern to avoid a situation where Kibana might receive a date field from Elasticsearch that it doesn’t know how to format. With the introduction of the Elasticsearch search fields param, which supports requesting fields in a particular format, we no longer need to rely on docvalue_fields for this behavior.

SearchSource now automatically requests any date fields via the fields API, unless you provide specific ones via setField('fields', [...]), in which case only the relevant ones will be requested. If you do not provide a format for the fields you are requesting, one will automatically be added for you.

via #82383

Global types removed

This requires the following changes:

  • PublicMethodsOf, MethodKeysOf, and Writable should be imported from @kbn/utility-types.
  • DeeplyMockedKeys bands MockedKeys should be imported from @kbn/utility-types/jest.

via #81739

Support for SavedObjects export API enhanced

The SavedObjects export API now supports the export of SavedObjects with circular references.

via #81582

Feature registration improved

The icon and navLinkId options were removed from Feature registration:

  • icon was used on the Spaces and Role Management interfaces, but a recent redesign of these screens rendered the icon unnecessary.
  • navLinkId was only required by the legacy platform, and is therefore no longer supported in versions >= 7.11.0.

The validLicenses property was renamed minimumLicense. The existing property was unnecessarily configurable. This rename aligns the property with the licensing plugin’s functionality, which has built-in support for checking a minimum license against the current license.

via #80909

independent sub-feature privileges can now be licensed

Features support defining a set of valid licenses for which they are available. Although this works for conditionally supporting top-level features, it doesn’t scale to sub-feature privileges.

Currently, there is no way to define a sub-feature privilege that is only available at a certain license level. This change introduces a minimumLicense property on each sub-feature privilege, so that consumers can choose the set of valid licenses for their sub-feature privileges.

A concrete example is Reporting. There are different report types offered at different license levels. PDF reports are a Platinum feature, so an administrator configuring roles in a Gold cluster shouldn’t be able to toggle the PDF report privilege.

Licensed sub-feature privileges will only be registered with Elasticsearch when the minimumLicense is satisfied. Further, the sub-feature privilege will only be included into the primary feature privileges when the minimumLicense is satisfied. The privilege registration system is already configured to listen to license changes at runtime, so the set of available/registered sub-feature privileges will always be kept in sync.

via #80905

A field for cases' comments was added

A new field was introduced to cases' comments. It must be provided when adding a comment to a case. Specifically:






user or alert

The case’s new comment type


via #80870

URL rewritten in onPreRouting interceptor now provided in setting

The original URL rewritten in the onPreRouting interceptor is now provided in the KibanaRequest.rewrittenUrl property.

via #80810

API added for index pattern edit field formatter

These methods were added for setting field formatters: indexPattern.setFieldFormat and indexPattern.deleteFieldFormat. indexPattern.getFormatterForFieldNoDefault was also added, which is used by the management interface.

via #78352

Client side session service introduced

This PR introduces the frontend session management service and integrates it into Discover by initializing a session before fetching fresh data from the server.

This PR also uses the session service to show the timeout error once per session instead of using a debounce.

via #76889

New audit logging events and event filtering added

The following audit events are logged when enabled:

  • user_login
  • http_request
  • saved_object_create
  • saved_object_get
  • saved_object_update
  • saved_object_delete
  • saved_object_find
  • saved_object_add_to_spaces
  • saved_object_delete_from_spaces

via #74640