From c5f0dbb06c45dc13247df80d8e53e5878d4c96cc Mon Sep 17 00:00:00 2001 From: Maurizio Branca Date: Tue, 5 Nov 2024 17:51:53 +0100 Subject: [PATCH] Add ECS known issue for ecs@mappings and fieldless searches (#1330) * Add known issues about fieldless searches * Fix section IDs and cleanup * Add the known issue to 8.13.3 and 8.13.4 All 8.13.x releases are affected. * Update docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com> * Apply suggestion from reviewers --------- Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com> (cherry picked from commit f3e0dd11ac0530232fd14e884352bc9379cffbc9) --- .../release-notes/release-notes-8.13.asciidoc | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) diff --git a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc index c3beb36eb..5060a98c3 100644 --- a/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc +++ b/docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc @@ -32,6 +32,27 @@ Also see: There are no bug fixes for {fleet} or {agent} in this release. +[discrete] +[[known-issues-8.13.4]] +=== Known issues + +[[known-issue-174855-8.13.4]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== +*Details* + +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). + +If you run a query without specifying a field, the query will not return results for ECS fields. + +*Impact* + + +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. + +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. +==== + // end 8.13.4 relnotes // begin 8.13.3 relnotes @@ -48,6 +69,27 @@ Review important information about {fleet-server} and {agent} for the 8.13.3 rel {agent}:: * Update Go version to 1.21.9. {agent-pull}4508[#4508] +[discrete] +[[known-issues-8.13.3]] +=== Known issues + +[[known-issue-174855-8.13.3]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== +*Details* + +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). + +If you run a query without specifying a field, the query will not return results for ECS fields. + +*Impact* + + +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. + +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. +==== + [discrete] [[bug-fixes-8.13.3]] === Bug fixes @@ -90,6 +132,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== +[[known-issue-174855-8.13.2]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== +*Details* + +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). + +If you run a query without specifying a field, the query will not return results for ECS fields. + +*Impact* + + +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. + +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. +==== + [discrete] [[bug-fixes-8.13.2]] === Bug fixes @@ -127,6 +186,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== +[[known-issue-174855-8.13.1]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== +*Details* + +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). + +If you run a query without specifying a field, the query will not return results for ECS fields. + +*Impact* + + +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. + +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. +==== + [discrete] [[enhancements-8.13.1]] === Enhancements @@ -233,6 +309,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul ==== +[[known-issue-174855-8.13.0]] +.ECS fields are not included to the `index.query.default_field` in {agent} integrations +[%collapsible] +==== +*Details* + +Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query). + +If you run a query without specifying a field, the query will not return results for ECS fields. + +*Impact* + + +In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available. + +If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57. +==== + [discrete] [[new-features-8.13.0]] === New features