Upgrade notes

Details
The get case metrics APIs are now internal. For more information, refer to (#162506).

Details
The project monitor API for Synthetics in Elastic Observability has been removed. For more information, refer to #155470.

Impact
In 8.8.0 and later, an error appears when you use the project monitor API.

Details
The /api/fleet/current_upgrades endpoint has been removed. For more information, refer to #147616.

Impact
When you upgrade to 8.7.0, use the api/fleet/agents/action_status endpoint.

Details
The /api/fleet/setup/preconfiguration API, which was released as generally available by error, has been removed. For more information, refer to #147199.

Impact
Do not use /api/fleet/setup/preconfiguration. To manage preconfigured agent policies, use kibana.yml. For more information, check Preconfigured settings.

Details
To make bulk action responses consistent, returns actionId instead of agent ids with success: True or success: False results. For more information, refer to #141757.

Impact
When you use FleetBulkResponse, you now receive only actionId responses.

Details
On the Logs and Metrics UIs, references to the following API and saved object deprecated fields have been removed:

For more information, refer to #116821 and #115874.

Impact
When you upgrade to 8.0.0, you are unable to use references to the deprecated fields.

Details
The /api/settings REST API has been removed. For more information, refer to #114730.

Impact
Use /api/stats.

Details
GET /api/status reports a new and more verbose payload. For more information, refer to #110830.

Impact
To retrieve the Kibana status in the previous format, use GET /api/status?v7format=true.

Details
Roles with at least a sub-feature privilege configured will not have access to the cases setting like they had previously. All roles without a sub-feature privilege configured will not be affected. For more information, refer to (#170635).

Details
Limits are now imposed on the number of objects cases can process or the amount of data those objects can store.

For the full list, refer to #146945.

Details
The privileges for attaching alerts to cases has changed. For more information, refer to #147985.

Impact
To attach alerts to cases, you must have Read access to an Observability or Security feature that has alerts and All access to the Cases feature. For detailed information, check Kibana privileges and Configure access to cases.

Details
The monitoring.cluster_alerts.allowedSpaces setting, which Kibana uses to create Stack Monitoring alerts, has been removed. For more information, refer to #123229.

Impact
Before you upgrade to 8.0.0, remove monitoring.cluster_alerts.allowedSpaces from kibana.yml.

Details
The xpack.task_manager.index setting has been removed. For more information, refer to #114558.

Impact
Before you upgrade to 8.0.0, remove xpack.task_manager.index from kibana.yml.

Details
The xpack.actions.enabled setting has been removed. For more information, refer to #113461.

Impact
Before you upgrade to 8.0.0, remove xpack.actions.enabled from kibana.yml.

Details
Filters associated with unknown data views, such as deleted data views, are no longer automatically disabled. For more information, refer to #139431.

Impact
Filters associated with unknown data views now display a warning message instead of being automatically disabled.

Details
The function addProcessorDefinition is removed from the Console plugin start contract (server side). For more information, refer to (#159041).

Details
The console.ssl setting has been removed. For more information, refer to #123754.

Impact
Before you upgrade to 8.0.0, remove console.ssl from kibana.yml.

Details
This change updates all instances of vulnerability.package to the ECS standard package fieldset. For more information, refer to (#164651).

Details
The advanced setting which hides ES|QL from the UI has been renamed from discover:enableESQL to enableESQL. It is enabled by default and must be switched off to disable ES|QL features from your Kibana applications. For more information, refer to (#182074).

Details
These functions have been removed from ES|QL queries as they are not supported. Errors would be thrown when trying to use them. For more information, refer to (#174674).

Details
Rate limiting was added to the upload api/fleet/epm/packages endpoint. For more information, refer to #184036.

Impact
If you do two or more requests in less than 10 seconds, the subsequent requests fail with 429 Too Many Requests. Wait 10 seconds before uploading again. This change could potentially break automations for users that rely on frequent package uploads.

Details
The Kafka output no longer supports conditional topics. For more information, refer to (#176879).

Details

Integration content installed by Fleet is no longer editable. This content is tagged with Managed in the Kibana UI, and is Elastic managed. This content cannot be edited or deleted. However, managed visualizations, dashboards, and saved searches can be cloned. The clones can be customized.

When cloning a dashboard the cloned panels become entirely independent copies that are unlinked from the original configurations and dependencies.

For managed content relating to specific visualization editors such as Lens, TSVB, and Maps, the clones retain the original reference configurations. The same applies to editing any saved searches in a managed visualization.

For more information, refer to (#172393).

Details
Improve config output validation to not allow to defining multiple default outputs in Kibana configuration. For more information, refer to (#167085).

Details
The bidirectional foreign key between agent policy and package policy has been removed. For more information, refer to #138677.

Impact
The agent policy saved object no longer includes the package_policies field.

Details
When you configure xpack.fleet.agents.fleet_server.hosts and xpack.fleet.agents.elasticsearch.hosts in kibana.yml, you are unable to update the fields on the Fleet UI.

For more information, refer to #135669.

Impact
To configure xpack.fleet.agents.fleet_server.hosts and xpack.fleet.agents.elasticsearch.hosts on the Fleet UI, avoid configuring the settings in kibana.yml.

Details
For package policy upgrades, the packagePolicy upgrade endpoint format supports a mutative upgrade operation (when dryRun: false) and a read-only dry run operation (when dryRun: true):

 POST /package_policies/upgrade
 {
   packagePolicyIds: [...],
   dryRun: false
 }

For more information, refer to #118854.

Impact
The endpoint is now split into two separate endpoints:

 POST /package_policies/upgrade
 {
   packagePolicyIds: [...]
 }

 POST /package_policies/upgrade/dry_run
 {
   packagePolicyIds: [...]
 }

Details
The CONFIG_PATH and DATA_PATH environment variables have been removed. For more information, refer to #111535.

Impact
Replace the CONFIG_PATH environment variable with KBN_PATH_CONF, and replace DATA_PATH with the path.data setting.

Details
Support for the csp.rules configuration property has been removed. For more information, refer to #114379.

Impact
Configuring the default csp.script_src, csp.workers_src, and csp.style_src values is not required.

Details
The deprecation notice for server.cors has changed from level:critical to level:warning.

The following settings have changed:

Support for the following configuration settings has been removed:

For more information, refer to #113653.

Impact
* The header value provided to the xpack.banners.placement configuration has been renamed to top * The newsfeed.defaultLanguage newsfeed items are retrieved based on the browser locale and default to English * Replace cpu.cgroup.path.override with ops.cGroupOverrides.cpuPath * Replace cpuacct.cgroup.path.override with ops.cGroupOverrides.cpuAcctPath * Replace server.xsrf.whitelist with server.xsrf.allowlist * Replace xpack.xpack_main.xpack_api_polling_frequency_millis with xpack.licensing.api_polling_frequency * Replace KIBANA_PATH_CONF path to the Kibana configuration file using the KBN_PATH_CONF environment variable

Details
Using {plugin_name}.enabled to disable plugins has been removed. Some plugins, such as telemetry, newsfeed, reporting, and the various vis_type plugins will continue to support this setting. All other Kibana plugins will not support this setting. Any new plugin will support this setting only when specified in the configSchema. For more information, refer to #113495.

The xpack.security.enabled setting has been removed. For more information, refer to #111681.

Impact
Before you upgrade to 8.0.0:

Details
The plugins.scanDirs setting and --plugin-dir cli option have been removed. For more information, refer to #113367.

Impact
Before you upgrade to 8.0.0, remove plugins.scanDirs from kibana.yml.

Details
The legacy optimize.* settings have been removed. If your configuration uses the following legacy optimize.* settings, Kibana fails to start:

For more information, refer to #113296.

Impact
To run the @kbn/optimizer separately in development, pass --no-optimizer to yarn start. For more details, refer to #73154.

Details
Some of the savedObjects, server, and elasticsearch settings have been removed. If your configuration uses the following settings, Kibana fails to start:

For more information, refer to #113173.

Impact
Before you upgrade to 8.0.0., remove these settings from kibana.yml.

Details
To start Kibana, you must enable inline scripting in Elasticsearch. For more information, refer to #113068.

Impact
Enable inline scripting.

Details
The kibana.index, xpack.reporting.index, and xpack.task_manager.index settings have been removed. For more information, refer to #112773.

Impact
Use spaces, cross-cluster replication, or cross-cluster search. To migrate to spaces, export your saved objects from a tenant into the default space. For more details, refer to #82020.

Details
The logging configuration and log output format has changed. For more information, refer to #112305.

Impact
Use the new logging system configuration.

Details
The deprecated kibana.defaultAppId setting in kibana.yml, which is also available as kibana_legacy.defaultAppId, has been removed. For more information, refer to #109798.

Impact
When you upgrade, remove kibana.defaultAppId from your kibana.yml file. To configure the default route for users when they enter a space, use the defaultRoute in Advanced Settings.

Details
The deprecated courier:batchSearches setting in Advanced Settings has been removed. For more information, refer to #109350.

Impact
When you upgrade, the courier:batchSearches setting will no longer be available.

Details
The default values for the session timeout xpack.security.session.{lifespan|idleTimeout} settings have changed. For more information, refer to #106061

Impact
The new default values are as follows:

Details
Support for configuring Kibana with 0 as the server.host has been removed. Please use 0.0.0.0 instead. For more information, refer to #87114

Impact
You are now unable to use 0 as the server.host.

Details
The xpack.security.public and xpack.security.authProviders settings have been removed. For more information, refer to #38657

Impact
Use the xpack.security.authc.saml.realm and xpack.security.authc.providers settings.

Details
The logging.useUTC setting has been removed. For more information, refer to #22696

Impact
The default timezone is UTC. To change the timezone, set logging.timezone: false in kibana.yml. Change the timezone when the system, such as a docker container, is configured for a nonlocal timezone.

Details
Time-based interval index patterns were deprecated in 5.x. In 6.x, you could no longer create time-based interval index patterns, but they continued to function as expected. Support for these index patterns has been removed in 8.0. For more information, refer to #35173

Impact
You must migrate your time_based index patterns to a wildcard pattern. For example, logstash-*.

Details
The deprecated xpack.infra.sources.default.logAlias and xpack.infra.sources.default.logAlias settings have been removed. For more information, refer to #115974.

Impact
Before you upgrade, remove the settings from kibana.yml, then configure the settings in Logs.

Details
The Logs and Metrics configurable fields settings have been removed. For more information, refer to #61302.

Impact
Configure the settings in ECS.

Details
APM Node.js and RUM JavaScript anomaly detection job modules have been removed. For more information, refer to #119945.

Impact
When you upgrade to 8.0.0, you are unable to create and view the APM Node.js and RUM JavaScript jobs in Machine Learning.

Details
Machine learning features are included as base privileges. For more information, refer to #115444.

Impact
If you do not want to grant users privileges to machine learning features, update Users and Roles.

Details
The Osquery Kibana privilege has been updated, so that when the Privileges for all features level is set to All, this now applies All to Osquery privileges as well. Previously, users had to choose the Customize option to grant any access to Osquery. For more information, refer to #130523.

Impact
This impacts user roles that have Privileges for all features set to All. After this update, users with this role will have access to the Osquery page in Kibana. However, to use the Osquery feature fully, these requirements remain the same: users also need Read access to the logs-osquery_manager.result* index and the Osquery Manager integration must be deployed to Elastic Agents.

Details
Unknown saved object types now cause Kibana migrations to fail. For more information, refer to #107678.

Impact
To complete the migration, re-enable plugins or delete documents from the index in the previous version.

Details
In Kibana 8.0.0 and later, the legacy format from Kibana 6.x is unsupported. For more information, refer to #110738

Impact
Using the user interface to import saved objects is restricted to .ndjson format imports.

Details
The legacy audit logger has been removed. For more information, refer to #116191.

Impact
Audit logs will be written to the default location in the new ECS format. To change the output file, filter events, and more, use the audit logging settings.

Details
The /api/security/v1/saml route has been removed and is reflected in the kibana.yml server.xsrf.whitelist setting, Elasticsearch, and the Identity Provider SAML settings. For more information, refer to #47929

Impact
Use the /api/security/saml/callback route, or wait to upgrade to 8.0.0-alpha2 when the /api/security/saml/callback route breaking change is reverted.

Details
To provide the maximum level of protection for most installations, the csp.strict config is now enabled by default. Legacy browsers not supported by Kibana, such as Internet Explorer 11, are unable to access Kibana unless explicitly enabled. All browsers officially supported by Kibana do not have this issue. For more information, refer to #41700

Impact
To enable support for legacy browsers, set csp.strict: false in kibana.yml. To effectively enforce the security protocol, we strongly discourage disabling csp.strict unless it is critical that you support Internet Explorer 11.

Details
After you extract an archive, the output directory no longer includes the target platform. For example, kibana-8.0.0-linux-aarch64.tar.gz produces a kibana-8.0.0 folder. For more information, refer to #93835.

Impact
To use the new folder, update the configuration management tools and automation.

Details
The default support for TLS v1.0 and v1.1 has been removed. For more information, refer to #90511.

Impact
To enable support, set --tls-min-1.0 in the node.options configuration file. To locate the configuration file, go to the kibana/config folder or any other configuration with the KBN_PATH_CONF environment variable. For example, if you are using a Debian-based system, the configuration file is located in /etc/kibana.

Details
All supported operating systems use systemd service files. Any system that doesn’t have service aliased to use kibana.service should use systemctl start kibana.service instead of service start kibana. For more information, refer to #74424.

Impact
If your installation uses .deb or .rpm packages with SysV, migrate to systemd.

Details
In previous versions, all events are logged in json when logging.json:true. With the new logging configuration, you can choose the json and pattern output formats with layouts. For more information, refer to #42353.

Impact
To restore the previous behavior, configure the logging format for each custom appender with the appender.layout property in kibana.yml. There is no default for custom appenders, and each appender must be configured explicitly.

Details
The API endpoint for downloading a CSV file from a saved search in the Dashboard application has changed to reflect the fact that this is an internal API. The previous API path of /api/reporting/v1/generate/immediate/csv_searchsource has been changed to /internal/reporting/generate/immediate/csv_searchsource. For more information, refer to #162288.

Details
CSV reports now use PIT instead of Scroll. Previously generated CSV reports that used an index alias with alias-only privileges, but without privileges on the alias referenced-indices will no longer generate. For more information, refer to #158338.

Impact
To generate CSV reports, grant read privileges to the underlying indices.

Details
The /api/reporting/generate/csv endpoint has been removed. For more information, refer to #121435.

Impact
If you are using 7.13.0 and earlier, regenerate the POST URLs that you use to automatically generate CSV reports.

Details
The POST URLs that you generated in Kibana 6.2.0 no longer work. For more information, refer to #121369.

Impact
Regenerate the POST URLs that you use to automatatically generate PDF reports.

Details
The following settings have been removed:

For more information, refer to #114216.

Impact
Before you upgrade to 8.0.0, remove the settings from kibana.yml.

Details
Reporting is no longer compatible with POST URL snippets generated with Kibana 6.2.0 and earlier. For more information, refer to #52539

Impact
If you use POST URL snippets to automatically generate PDF reports, regenerate the POST URL strings.

Details
In production, you are no longer able to use the elastic superuser to authenticate to Elasticsearch. For more information, refer to #122722.

Impact
When you configure elasticsearch.username: elastic, Kibana fails.

Details
lens:useFieldExistenceSampling has been removed from Advanced Settings. The setting allowed you to enable document sampling to determine the fields that are displayed in Lens. For more information, refer to #149482.

Impact
In 8.1.0 and later, Kibana uses the field caps API, by default, to determine the fields that are displayed in Lens.

Details
visualization:visualize:legacyPieChartsLibrary has been removed from Advanced Settings. The setting allowed you to create aggregation-based pie chart visualizations using the legacy charts library. For more information, refer to #146990.

Impact
In 7.14.0 and later, the new aggregation-based pie chart visualization is available by default. For more information, check Aggregation-based.

Details
To configure higher resolution data histogram aggregations without changing the Advanced Settings, the default histogram:maxBars setting is now 1000 instead of 100. For more information, refer to #143081.

Impact
For each space, complete the following to change histogram:maxBars to the previous default setting:

Details
The legacy implementation of the Timelion visualization charts library has been removed. All Timelion visualizations now use the elastic-charts library, which was introduced in 7.15.0.

For more information, refer to #134336.

Impact
In 8.4.0 and later, you are unable to configure the Timelion legacy charts library advanced setting. For information about visualization Advanced Settings, check Visualization.

Details
The experimental .quandl and .graphite functions and advanced settings are removed from Timelion. For more information, check #129581.

Impact
When you use the vis_type_timelion.graphiteUrls kibana.yml setting, Kibana successfully starts, but logs a [WARN ][config.deprecation] You no longer need to configure "vis_type_timelion.graphiteUrls". warning.

To leave your feedback about the removal of .quandl and .graphite, go to the discuss forum.

Details
The Display warnings option has been removed from the aggregation-based gauge visualization. For more information, refer to #113516.

Impact
When you create aggregation-based gauge visualizations, the Display warnings option is no longer available in Options > Labels.

Details
The following deprecated visEditors plugin settings have been removed:

For more information, refer to #112643.

Impact
Before you upgrade, make the following changes in kibana.yml:

Details
The Dimming opacity setting in Advanced Settings has been removed. For more information, refer to #111704.

Impact
When you upgrade to 8.0.0, you are no longer able to configure the dimming opactiy for visualizations.

Details
In TSVB, custom Less stylesheets have been removed. For more information, refer to #110985.

Impact
Existing less stylesheets are automatically converted to CSS stylesheets.

Details
In TSVB, the Index pattern selection mode option has been removed. For more information, refer to #110571.

Impact
To use index patterns and Elasticsearch indices in TSVB visualizations:

Details
The map.proxyElasticMapsServiceInMaps setting has been removed. For more information, refer to #116184.

Impact
Install the on-prem version of the Elastic Maps Service, which is a Docker service that resides in the Elastic Docker registry, in an accessible location on your internal network. When you complete the installation, update kibana.yml to point to the service.

Details
The deprecated map.regionmap.* setting in kibana.yml has been removed. For more information, refer to #109896.

Impact
If you have maps that use map.regionmap layers:

Details
The legacy dashboard-only mode has been removed. For more information, refer to #108103.

Impact
To grant users access to only dashboards, create a new role, then assign only the Dashboard feature privilege. For more information, refer to Kibana privileges.

Details
The deprecated xpack.maps.showMapVisualizationTypes setting in kibana.yml has been removed. For more information, refer to #105979

Impact
When you upgrade, remove xpack.maps.showMapVisualizationTypes from your kibana.yml file.

Details
Removes the apm_user role. For more information, check #132790.

Impact
The apm_user role is replaced with the viewer and editor built-in roles.

Details
We introduced a breaking change in the SLO features that will break any SLOs created before 8.12. These SLOs have to be manually reset through an API until we provide a UI for it. The data aggregated over time (rollup) is still available in the SLI v2 index, but won’t be used for summary calculation when reset.

The previous summary transforms summarizing every SLOs won’t be used anymore and can be stopped and deleted:

Be aware that when installing a new SLO (or after resetting an SLO), we install two transforms (one for the rollup data and one that summarize the rollup data). Do not delete the new slo-summary-{slo_id}-{slo_revision} transforms. For more information, refer to (#172224).

Details

If some SLOs have been installed in a prior version at 8.10, they won’t work after migrating to 8.10. There are two approaches to handle this breaking change. The recommended route is to delete all SLOs before migrating to 8.10. The alternative is to migrate to 8.10 and manually remove the SLOs.

Removing SLOs before migrating to 8.10

Use the SLO UI or the SLO delete API to delete all existing SLOs. This takes care of the saved object, transform and rollup data. When all SLOs have been deleted, then delete the residual rollup indices: .slo-observability.sli-v1*. Note that this is v1.

Removing SLOs after migrating to 8.10

After migrating to 8.10, the previously created SLOs won’t appear in the UI because the API is using a new index. The previously created SLOs still exist, and associated transforms are still rolling up data into the previous index .slo-observability.sli-v1*. The SLO delete API can’t be used now, so remove the resources resources manually:

Details
The Uptime app now gets hidden from the interface when it doesn’t have any data for more than a week. If you have a standalone Heartbeat pushing data to Elasticsearch, the Uptime app is considered active. You can disable this automatic behavior from the advanced settings in Kibana using the Always show legacy Uptime app option. For synthetic monitoring, we now recommend to use the new Synthetics app. For more information, refer to #159118

Details
Data from browser monitors and monitors of all types created within the Synthetics App or via the Elastic Synthetics Fleet Integration will no longer appear in Uptime. For more information, refer to #159012

Details
Enterprise Search now requires that you enable X-Pack Security. For more information, refer to #106307

Impact
Enable X-Pack Security.

Details
Converts filterQuery to a KQL query string. For more information, refer to (#161806).

Details
The PUT endpoint for the agent reassign API is deprecated. For more information, refer to #152236.

Impact
Use the POST endpoint for the agent reassign API.

Details
The total field in /agent_status Fleet API responses is deprecated. For more information, refer to #151564.

Impact
The /agent_status Fleet API now returns the following statuses:

Details
The Fleet API has been updated to improve consistency:

For more information, refer to #119494.

Impact
When you upgrade to 8.0.0, use the following API changes:

For more information, refer to Fleet APIs.

Details
The following rule action variables have been deprecated. Use the recommended variables (in parentheses) instead:

For more information, refer to (#161136).

Details
Search sessions are now deprecated and will be removed in a future version. By default, queries that take longer than 10 minutes (the default for the advanced setting search:timeout) will be canceled. To allow queries to run longer, consider increasing search:timeout or setting it to 0 which will allow queries to continue running as long as a user is waiting on-screen for results.

Details
The following Task Manager settings are deprecated:

For more information, refer to #154275.

Impact
To improve task execution resiliency, remove the deprecated settings from the kibana.yml file. For detailed information, check Task Manager settings in Kibana.

Details
In kibana.yml, the xpack.data_enhanced.* setting is deprecated. For more information, check #122075.

Impact
Use the data.* configuration parameters instead.

Details
The xpack:default_admin_email setting for monitoring use has been removed. For more information, refer to #33603

Impact
Use the xpack.monitoring.clusterAlertsEmail in kibana.yml.

Details
The ability to authenticate interactive users with ApiKey via a web browser has been deprecated, and will be removed in a future version.

For more information, refer to #136422.

Impact
To authenticate interactive users via a web browser, use another authentication method. Use API keys only for programmatic access to Kibana and Elasticsearch.

Details
The apiKey, including key and ID/key pair, and elasticsearch_anonymous_user credential types for anonymous authentication providers are deprecated. For more information, check #131636.

Impact
If you have anonymous authentication provider configured with apiKey or elasticsearch_anonymous_user credential types, a deprecation warning appears, even when the provider is not enabled.

Details
The v1 and v2 job configurations for security_linux and security_windows are deprecated. For more information, check #131166.

Impact
The following security_linux and security_windows job configurations are updated to v3:

Details
The mechanism of exporting CSV data from a saved search panel in a dashboard has been changed to generate a CSV report, rather than allowing the CSV data to be downloaded without creating a report. To preserve the original behavior, it is necessary to update kibana.yml with the setting of xpack.reporting.csv.enablePanelActionDownload: true. The scope of this breaking change is limited to downloading CSV files from saved search panels only; downloading CSV files from other types of dashboard panels is unchanged. For more information, refer to #178159.

Details
The option to create legacy input controls when creating a new visualization is hidden. For more information, refer to #156455

Details
Legacy felid stats that were previously shown within a popover have been removed. For more information, refer to #155503

Details
The input control panels, which allow you to add interactive filters to dashboards, are deprecated. For more information, check #132562.

Impact
To add interactive filters to your dashboards, use the new controls.

Details
In the Lens visualization editor, the Auto default for Legend width has been deprecated. For more information, check #130336.

Impact
When you create Lens visualization, the default for the Legend width is now Medium.

Details
The xpack.apm.autocreateApmIndexPattern APM setting has been removed. For more information, refer to #120689.

Impact
To automatically create data views in APM, use xpack.apm.autoCreateApmDataView.

Details
The Uptime app is already hidden from Kibana when there is no recent Heartbeat data. Migrate to Synthetics as an alternative. For more details, refer to the Uptime documentation.

Details
Synthetics and Uptime monitor schedules and zip URL fields are deprecated. For more information, refer to #154010 and #154952.

Impact
When you create monitors in Uptime Monitor Management and the Synthetics app, unsupported schedules are automatically transferred to the nearest supported schedule. To use zip URLs, use project monitors.

Details
The Elastic Synthetics integration is deprecated. For more information, refer to #149506.

Impact
To monitor endpoints, pages, and user journeys, go to Observability → Synthetics (beta).