diff --git a/docs/CHANGELOG.asciidoc b/docs/CHANGELOG.asciidoc index a50dbf1ddaf21..af6607bf3b096 100644 --- a/docs/CHANGELOG.asciidoc +++ b/docs/CHANGELOG.asciidoc @@ -74,6 +74,63 @@ coming::[7.15.0] For information about the 7.14.1 release, review the following information. +[float] +[[security-updates-v7.14.1]] +=== Security updates + +Review the security updates that were found in previous versions of {kib}. + +[discrete] +[[code-execution-issue]] +.Code execution issue +[%collapsible] +==== +*Details* + +In {kib} 7.10.2 to 7.14.0, users with Fleet admin privileges could insecurely upload malicious packages. Due to an older version of the js-yaml library, attackers were able to execute commands on the {kib} server. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22150[CVE-2021-22150] +*Solution* + +Upgrade to {kib} 7.14.1. +==== + +[discrete] +[[path-traversal-issue]] +.Path traversal issue +[%collapsible] +==== +*Details* + +In {kib} 7.13.4 and earlier, {kib} was not validating the user supplied paths that upload .pbf files, allowing malicious users to arbitrarily traverse the {kib} host to load internal files that end in the .pbf extension. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22151[CVE-2021-22151] +Thanks to Luat Nguyen of CyberJutsu for reporting this issue. +*Solution* + +Upgrade to {kib} 7.14.1. +==== + +[discrete] +[[html-injection-issue]] +.HTML injection issue +[%collapsible] +==== +*Details* + +In {kib} 7.14.0, {kib} was not sanitizing document fields that contain HTML snippets, allowing attackers with the ability to write documents to an {es} index to inject HTML. When *Discover* highlighted a search term that contained the HTML, the term was rendered. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37936[CVE-2021-37936] +*Solution* + +In <>, set `doc_table:highlight` to `false`. If you do not want to change the *Advanced Settings*, upgrade to {kib} 7.14.1. +==== + +[discrete] +[[nodejs-security-vulnerabilities]] +.Node.js security vulnerabilities +[%collapsible] +==== +*Details* + +In {kib} 7.14.0 and earlier, Node.js 14.17.3 is affected by the following security vulnerabilities: +* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930[CVE-2021-22930] +* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672[CVE-2021-3672] +* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22931[CVE-2021-22931] +* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930[CVE-2021-22930] +* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22939[CVE-2021-22939] +We do not believe an attacker can exploit the security vulnerabilities against {kib}, but are upgrading Node.js out of an abudance of caution. To resolve the security vulnerabilities, {kib} 7.14.1 upgrades Node.js to 14.17.5. +*Solution* + +Upgrade to {kib} 7.14.1. +==== + [float] [[breaking-changes-v7.14.1]] === Breaking changes diff --git a/docs/developer/index.asciidoc b/docs/developer/index.asciidoc index cfa25e5cb315a..fd899b2e10fd6 100644 --- a/docs/developer/index.asciidoc +++ b/docs/developer/index.asciidoc @@ -31,7 +31,6 @@ include::advanced/index.asciidoc[] include::plugin-list.asciidoc[] -include::plugin-api-changes/plugin-api-changes-7_12.asciidoc[] +include::plugin-api-changes/plugin-api-changes.asciidoc[] include::telemetry.asciidoc[] - diff --git a/docs/developer/plugin-api-changes/plugin-api-changes-7_12.asciidoc b/docs/developer/plugin-api-changes/plugin-api-changes-7_12.asciidoc deleted file mode 100644 index 887ae0829acaf..0000000000000 --- a/docs/developer/plugin-api-changes/plugin-api-changes-7_12.asciidoc +++ /dev/null @@ -1,14 +0,0 @@ -[[plugin-api-changes]] -== Plugin API changes in 7.13 -++++ -Plugin API changes -++++ - -This page discusses the plugin API changes that you need to be aware of when migrating -your application to {kib} 7.13. - -Other versions: {kibana-ref-all}/7.12/plugin-api-changes.html[7.12] | -{kibana-ref-all}/7.11/plugin-api-changes-7-11.html[7.11] | -{kibana-ref-all}/7.10/breaking-changes-7.10.html#general-plugin-API-changes-7-10[7.10] | -{kibana-ref-all}/7.9/breaking-changes-7.9.html#general-plugin-API-changes-79[7.9] | -{kibana-ref-all}/7.8/breaking-changes-7.8.html#general-plugin-API-changes-78[7.8] diff --git a/docs/developer/plugin-api-changes/plugin-api-changes.asciidoc b/docs/developer/plugin-api-changes/plugin-api-changes.asciidoc new file mode 100644 index 0000000000000..32cd24950566c --- /dev/null +++ b/docs/developer/plugin-api-changes/plugin-api-changes.asciidoc @@ -0,0 +1,151 @@ +[[plugin-api-changes]] +== Plugin API changes in {minor-version} +++++ +Plugin API changes +++++ + +This page discusses the plugin API changes that you need to be aware of when migrating +your application to {kib} {minor-version}. + +Other versions: {kibana-ref-all}/7.14/plugin-api-changes.html[7.14] | +{kibana-ref-all}/7.13/plugin-api-changes.html[7.13] | +{kibana-ref-all}/7.12/plugin-api-changes.html[7.12] | +{kibana-ref-all}/7.11/plugin-api-changes-7-11.html[7.11] | +{kibana-ref-all}/7.10/breaking-changes-7.10.html#general-plugin-API-changes-7-10[7.10] | +{kibana-ref-all}/7.9/breaking-changes-7.9.html#general-plugin-API-changes-79[7.9] | +{kibana-ref-all}/7.8/breaking-changes-7.8.html#general-plugin-API-changes-78[7.8] + +[[breaking_plugin_v7.15.0_107173]] +.`fieldFormats` extracted from `data` plugin +[%collapsible] +==== + +`fieldFormats` were extracted from the `data` plugin into a separate plugin. +For an example on how to use them, check `examples/field_formats_example`. + +Refer to https://github.com/elastic/kibana/pull/107173[#107173]. + +==== + +[[breaking_plugin_v7.15.0_106973]] +.@kbn/field-types extracted to a package +[%collapsible] +==== + +`kbn_field_types` were extracted from the `data` plugin into a separate `@kbn/field-types` package. + +*via https://github.com/elastic/kibana/pull/106973[#106973]* + +==== + +[[breaking_plugin_v7.15.0_106828]] +.Start contract for field formatters fixed +[%collapsible] +==== + +Previously, the field formatter start contract exposed the `register` method. +Now, it is available only on the setup contract. + +Refer to https://github.com/elastic/kibana/pull/106828[#106828]. + +==== + +[[breaking_plugin_v7.15.0_103744]] +.Warnings handled inside of headers +[%collapsible] +==== + +The `data.search` service now returns a `warning` property that +includes any warnings returned from {es} in the headers. + +Refer to https://github.com/elastic/kibana/pull/103744[#103744]. + +==== + +[[breaking_plugin_v7.15.0_103727]] +.Scoring support added to KQL +[%collapsible] +==== + +`buildEsQuery` (and in turn, `fromKuery`) now support an additional option, +`filtersInMustClause`, which will generate KQL queries in the +`must` clause rather than the `filter` clause. +This change supports use cases such as sorting by `_score`. + +`SearchSource` now automatically sets `filtersInMustClause` to `true` when +`_score` is included in the `sort` clause. + +Refer to https://github.com/elastic/kibana/pull/103727[#103727]. + +==== + +[[breaking_plugin_v7.15.0_103530]] +.Key types and functions related to query generation moved to a package +[%collapsible] +==== + +Import the following types and functions from `@kbn/es-query`. +Importing them from the `data` plugin is deprecated and support will be removed in `v8.0`. + + * *Index Pattern base types* (New types, not re-exported from the `data` plugin) + ** `IndexPatternBase` + ** `IndexPatternFieldBase` + ** `IFieldSubType` + * *Filter Types* + ** `RangeFilter` + ** `RangeFilterMeta` + ** `RangeFilterParams` + ** `ExistsFilter` + ** `PhrasesFilter` + ** `PhraseFilter` + ** `CustomFilter` + ** `MatchAllFilter` + * *Filter type guards* + ** `isExistsFilter` + ** `isFilterPinned` + ** `isMatchAllFilter` + ** `isMissingFilter` + ** `isPhraseFilter` + ** `isPhrasesFilter` + ** `isQueryStringFilter` + ** `isRangeFilter` + * *Filter generators* + ** `buildEmptyFilter` + ** `buildExistsFilter` + ** `buildPhraseFilter` + ** `buildPhrasesFilter` + ** `buildQueryFilter` + ** `buildRangeFilter` + * *Filter utilities* + ** `getPhraseFilterField` + ** `getPhraseFilterValue` + ** `toggleFilterNegated` + ** `disableFilter` + * *KQL helpers* + ** `KueryNode` + ** `fromKueryExpression` + ** `toElasticsearchQuery` + ** `nodeTypes` + ** `buildEsQuery` + ** `buildQueryFromFilters` + ** `luceneStringToDsl` + ** `decorateQuery` + ** `EsQueryConfig` + +Refer to https://github.com/elastic/kibana/pull/103530[#103530]. + +==== + +[[breaking_plugin_v7.15.0_103494]] +.Expression functions that generate an aggregation configuration were updated +[%collapsible] +==== + +These expression no longer take +JSON blobs as arguments. Corresponding expression functions +were added to generate any complex argument types. Update +your expressions if you use aggregation functions. + +Refer to https://github.com/elastic/kibana/pull/103494[#103494]. + +==== diff --git a/docs/discover/images/add-field-to-pattern.png b/docs/discover/images/add-field-to-pattern.png index 9a206f5f1bd1d..54d6610ca7bb4 100644 Binary files a/docs/discover/images/add-field-to-pattern.png and b/docs/discover/images/add-field-to-pattern.png differ diff --git a/docs/discover/images/customer.png b/docs/discover/images/customer.png index 4c1ff2f2fddbd..904741631eb34 100644 Binary files a/docs/discover/images/customer.png and b/docs/discover/images/customer.png differ diff --git a/docs/discover/images/discover-from-visualize.png b/docs/discover/images/discover-from-visualize.png index 42d46e6cbd5b5..6c976f01bc9f4 100644 Binary files a/docs/discover/images/discover-from-visualize.png and b/docs/discover/images/discover-from-visualize.png differ diff --git a/docs/discover/images/discover-search-for-relevance.png b/docs/discover/images/discover-search-for-relevance.png index 64cfd87b7aac2..15945b3515530 100644 Binary files a/docs/discover/images/discover-search-for-relevance.png and b/docs/discover/images/discover-search-for-relevance.png differ diff --git a/docs/discover/images/document-table-expanded.png b/docs/discover/images/document-table-expanded.png index ebbd2e607eb5a..3abc9ee7c1cbf 100644 Binary files a/docs/discover/images/document-table-expanded.png and b/docs/discover/images/document-table-expanded.png differ diff --git a/docs/discover/images/document-table.png b/docs/discover/images/document-table.png index 5b5dbc08d6e64..98764f34350bf 100644 Binary files a/docs/discover/images/document-table.png and b/docs/discover/images/document-table.png differ diff --git a/docs/discover/images/double-arrow.png b/docs/discover/images/double-arrow.png index ba4ee11ebf738..80b87b4a35326 100644 Binary files a/docs/discover/images/double-arrow.png and b/docs/discover/images/double-arrow.png differ diff --git a/docs/discover/images/downward-arrow.png b/docs/discover/images/downward-arrow.png index 47b03cfe82b34..a0b153bfe3b39 100644 Binary files a/docs/discover/images/downward-arrow.png and b/docs/discover/images/downward-arrow.png differ diff --git a/docs/discover/images/hello-field.png b/docs/discover/images/hello-field.png index 5c6348d4e90fe..fc2c79c13a5d2 100644 Binary files a/docs/discover/images/hello-field.png and b/docs/discover/images/hello-field.png differ diff --git a/docs/discover/search-for-relevance.asciidoc b/docs/discover/search-for-relevance.asciidoc index f3cf1c3a7f52c..eab310c1b5b01 100644 --- a/docs/discover/search-for-relevance.asciidoc +++ b/docs/discover/search-for-relevance.asciidoc @@ -1,6 +1,5 @@ [[discover-search-for-relevance]] == Search for relevance -Sometimes you might be unsure which documents best match your search. {es} assigns a relevancy, or score to each document, so you can can narrow your search to the documents with the most relevant results. The higher the score, the better it matches your query. @@ -12,9 +11,7 @@ the <>, or you can use your ow . In *Discover*, open the index pattern dropdown, and select that data you want to work with. + For the sample flights data, set the index pattern to *kibana_sample_data_flights*. -. In the query bar, click *KQL*, and then turn it off. -+ -You're now using the <>. + . Run your search. For the sample data, try: + ```ts @@ -22,15 +19,15 @@ Warsaw OR Venice OR Clear ``` . If you don't see any results, expand the <>, for example to *Last 7 days*. . From the list of *Available fields*, add `_score` and any other fields you want to the document table. -. To sort the `_score` column in descending order, hover over its header, and then click twice on -the arrow icon -image:images/double-arrow.png[Double arrow icon to indicate sorting] so it changes to +. To sort the `_score` column in descending order, hover over its header, and set +the sort icon to image:images/downward-arrow.png[Downward pointing arrow to indicate descending sorting]. + At this point, you're doing a multi-column sort: first by `Time`, and then by `_score`. -. To turn off sorting for the `Time` field, hover over its header, and then click the down arrow. +. To turn off sorting for the `Time` field, hover over its header, and set the sort icon to +image:images/double-arrow.png[Arrow on both ends of the icon indicates sorting is off]. + Your table now sorts documents from most to least relevant. + [role="screenshot"] -image::images/discover-search-for-relevance.png["Example of a search for relevance"] +image::images/discover-search-for-relevance.png["Documents are sorted from most relevant to least relevant."] diff --git a/docs/management/connectors/action-types/email.asciidoc b/docs/management/connectors/action-types/email.asciidoc index bab04b8052674..869fb86796b53 100644 --- a/docs/management/connectors/action-types/email.asciidoc +++ b/docs/management/connectors/action-types/email.asciidoc @@ -107,7 +107,7 @@ For other email servers, you can check the list of well-known services that Node [[elasticcloud]] ==== Sending email from Elastic Cloud -IMPORTANT: These instructions require you to link:{cloud}/ec-watcher.html#ec-watcher-whitelist[whitelist] the email addresses that notifications get sent first. +IMPORTANT: These instructions require you to link:{cloud}/ec-watcher.html#ec-watcher-whitelist[allowlist] the email addresses that notifications get sent. Use the following connector settings to send email from Elastic Cloud: diff --git a/docs/spaces/images/edit-space-feature-visibility.png b/docs/spaces/images/edit-space-feature-visibility.png index f1852d3cc03b5..b6ee4740e1d20 100644 Binary files a/docs/spaces/images/edit-space-feature-visibility.png and b/docs/spaces/images/edit-space-feature-visibility.png differ diff --git a/docs/spaces/images/edit-space.png b/docs/spaces/images/edit-space.png index 9785dd9e77aba..97d7ec009ade4 100644 Binary files a/docs/spaces/images/edit-space.png and b/docs/spaces/images/edit-space.png differ diff --git a/docs/spaces/images/spaces-roles.png b/docs/spaces/images/spaces-roles.png index 031b319cfad3e..b9003a91092bf 100644 Binary files a/docs/spaces/images/spaces-roles.png and b/docs/spaces/images/spaces-roles.png differ diff --git a/docs/spaces/index.asciidoc b/docs/spaces/index.asciidoc index aeeb7b45ccd8a..6722503eb0323 100644 --- a/docs/spaces/index.asciidoc +++ b/docs/spaces/index.asciidoc @@ -8,29 +8,18 @@ the dashboards and saved objects that belong to that space. {kib} creates a default space for you. After you create your own -spaces, you're asked to choose a space when you log in to Kibana. You can change your +spaces, you're asked to choose a space when you log in to {kib}. You can change your current space at any time by using the menu. [role="screenshot"] image::images/change-space.png["Change current space menu"] -Kibana supports spaces in several ways. You can: - -[[spaces-getting-started]] - -* <> -* <> -* <> -* <> -* <> -* <> - [float] -==== Required permissions +==== Required privileges The `kibana_admin` role or equivalent is required to manage **Spaces**. -TIP: Looking to support multiple tenants? See <> for more information. +TIP: Looking to support multiple tenants? Refer to <> for more information. [float] [[spaces-managing]] @@ -71,14 +60,14 @@ You can't delete the default space, but you can customize it to your liking. === Control feature access based on user needs You have control over which features are visible in each space. -For example, you might hide Dev Tools -in your "Executive" space or show Stack Monitoring only in your "Admin" space. +For example, you might hide *Dev Tools* +in your "Executive" space or show *Stack Monitoring* only in your "Admin" space. You can define which features to show or hide when you add or edit a space. Controlling feature visibility is not a security feature. To secure access to specific features on a per-user basis, you must configure -<>. +<>. [role="screenshot"] image::images/edit-space-feature-visibility.png["Controlling features visiblity"] @@ -87,12 +76,12 @@ image::images/edit-space-feature-visibility.png["Controlling features visiblity" [[spaces-control-user-access]] === Control feature access based on user privileges -When using Kibana with security, you can configure applications and features +When using {kib} with security, you can configure applications and features based on your users’ privileges. This means different roles can have access to different features in the same space. Power users might have privileges to create and edit visualizations and dashboards, -while analysts or executives might have Dashboard and Canvas with read-only privileges. -See <> for details. +while analysts or executives might have read-only privileges for *Dashboard* and *Canvas*. +Refer to <> for details. [role="screenshot"] image::images/spaces-roles.png["Controlling features visiblity"] @@ -105,7 +94,7 @@ To move saved objects between spaces, you can <>. + +When you upgrade {kib}, the default space contains all of your existing saved objects. + -If you are upgrading your -version of {kib}, the default space will contain all of your existing saved objects. diff --git a/docs/user/alerting/rule-types/es-query.asciidoc b/docs/user/alerting/rule-types/es-query.asciidoc index 5615c79a6c9c7..65d39ba170c3c 100644 --- a/docs/user/alerting/rule-types/es-query.asciidoc +++ b/docs/user/alerting/rule-types/es-query.asciidoc @@ -60,4 +60,32 @@ image::user/alerting/images/rule-types-es-query-valid.png[Test {es} query return * An error message is shown if the query is invalid. + [role="screenshot"] -image::user/alerting/images/rule-types-es-query-invalid.png[Test {es} query shows error when invalid] \ No newline at end of file +image::user/alerting/images/rule-types-es-query-invalid.png[Test {es} query shows error when invalid] + +[float] +==== Match de-duplication + +The {es} query rule type performs de-duplication of document matches across rule executions. If you configure the rule with a schedule interval smaller than the time window, and a document matches a query in multiple rule executions, it will be alerted on only once. + +Suppose you have a rule configured to run every minute. The rule uses a time window of 1 hour and checks if there are more than 99 matches for the query. The {es} query rule type will do the following: + +[cols="3*<"] +|=== + +| `Execution 1 (0:00)` +| Rule finds 113 matches in the last hour: `113 > 99` +| Rule is active and user will be alerted. + +| `Execution 2 (0:01)` +| Rule finds 127 matches in the last hour. 105 of the matches are duplicates that were alerted on in Execution 1, so you actually have 22 matches: `22 !> 99` +| No alert. + +| `Execution 3 (0:02)` +| Rule finds 159 matches in the last hour. 88 of the matches are duplicates that were alerted on in Execution 1, so you actually have 71 matches: `71 !> 99` +| No alert. + +| `Execution 4 (0:03)` +| Rule finds 190 matches in the last hour. 71 of them are duplicates that were alerted on in Exeuction 1, so you actually have 119 matches: `119 > 99` +| Rule is active and user will be alerted. + +|=== \ No newline at end of file diff --git a/docs/user/alerting/troubleshooting/alerting-common-issues.asciidoc b/docs/user/alerting/troubleshooting/alerting-common-issues.asciidoc index c57e9876a4118..408b18143f27f 100644 --- a/docs/user/alerting/troubleshooting/alerting-common-issues.asciidoc +++ b/docs/user/alerting/troubleshooting/alerting-common-issues.asciidoc @@ -68,7 +68,7 @@ Rules are taking a long time to execute and are impacting the overall health of [IMPORTANT] ============================================== -By default, only users with a `superuser` role can query the {kib} event log because it is a system index. To enable additional users to execute this query, assign `read` privileges to the `.kibana-event-log*` index. +By default, only users with a `superuser` role can query the experimental[] {kib} event log because it is a system index. To enable additional users to execute this query, assign `read` privileges to the `.kibana-event-log*` index. ============================================== *Solution* diff --git a/docs/user/alerting/troubleshooting/event-log-index.asciidoc b/docs/user/alerting/troubleshooting/event-log-index.asciidoc index fa5b5831c04ee..393b982b279f5 100644 --- a/docs/user/alerting/troubleshooting/event-log-index.asciidoc +++ b/docs/user/alerting/troubleshooting/event-log-index.asciidoc @@ -2,6 +2,8 @@ [[event-log-index]] === Event log index +experimental[] + Use the event log index to determine: * Whether a rule successfully ran but its associated actions did not diff --git a/docs/user/dashboard/dashboard.asciidoc b/docs/user/dashboard/dashboard.asciidoc index 6430c5d246dc6..1284c057af2da 100644 --- a/docs/user/dashboard/dashboard.asciidoc +++ b/docs/user/dashboard/dashboard.asciidoc @@ -283,37 +283,15 @@ To enable series interactions, refer to < Download as CSV*. - -[float] -[[download-other-panel-data]] -=== Download all other panel data - -Download the data for non-*Lens* panels. +Download panel data in a CSV file. When you download visualization panels with multiple layers, each layer produces a CSV file, and the file names contain the visualization and layer index names. . Open the panel menu, then select *Inspect*. -. Click *Download CSV*, then select the CSV type from the dropdown: +. Click *Download CSV*, then select the format type from the dropdown: * *Formatted CSV* — Contains human-readable dates and numbers. * *Unformatted* — Best used for computer use. -+ -[role="screenshot"] -image:images/Dashboard_inspect.png[Inspect in dashboard] [float] [[defer-loading-panels-below-the-fold]] diff --git a/docs/user/dashboard/lens.asciidoc b/docs/user/dashboard/lens.asciidoc index 774b50caeba6a..6b61c9fe6a9a3 100644 --- a/docs/user/dashboard/lens.asciidoc +++ b/docs/user/dashboard/lens.asciidoc @@ -1,14 +1,18 @@ [[lens]] -=== Lens +=== Create visualizations with Lens +++++ +Lens +++++ -To create visualization panels with *Lens*, you drag the data fields you want to visualize to the workspace, then *Lens* uses heuristics to apply each field and create a visualization for you. +To create a visualization, drag the data fields you want to visualize to the workspace, then *Lens* uses visualization best practices to apply the fields and create a visualization that best displays the data. With *Lens*, you can: -* Create area, line, and bar charts with multiple layers, indices, and visualization types. -* Change the aggregation function and labels to customize the data. +* Create area, line, and bar charts with layers to display multiple indices and chart types. +* Change the aggregation function to change the data in the visualization. * Perform math on aggregations using *Formula*. -* Use time shifts to compare data for two time intervals, such as month over month. +* Use time shifts to compare the data in two time intervals, such as month over month. +* Create custom tables. ++++