Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Split the .kibana saved objects index into multiple indices #154888

Merged
merged 29 commits into from
Apr 25, 2023

Conversation

gsoldevila
Copy link
Contributor

@gsoldevila gsoldevila commented Apr 13, 2023

Description

Fix #104081

This PR move some of the SO types from the .kibana index into the following ones:

  • .kibana_alerting_cases
  • .kibana_analytics
  • .kibana_security_solution
  • .kibana_ingest

This split/reallocation will occur during the 8.8.0 Kibana upgrade (meaning: from any version older than 8.8.0 to any version greater or equal to 8.8.0)

This PR main changes are:

  • implement the changes required in the SO migration algorithm to support this reallocation
  • update the FTR tools (looking at you esArchiver) to support these new indices
  • update hardcoded references to .kibana and usage of the core.savedObjects.getKibanaIndex() to use new APIs to target the correct index/indices
  • update FTR datasets, tests and utility accordingly

To reviewers

Overall estimated risk of regressions: low

But, still, please take the time to review changes in your code. The parts of the production code that were the most impacted are the telemetry collectors, as most of them were performing direct requests against the .kibana index, so we had to adapt them. Most other contributor-owned changes are in FTR tests and datasets.

If you think a type is misplaced (either we missed some types that should be moved to a specific index, or some types were moved and shouldn't have been) please tell us, and we'll fix the reallocation either in this PR or in a follow-up.

.Kibana split

The following new indices are introduced by this PR, with the following SO types being moved to it. (any SO type not listed here will be staying in its current index)

Note: The complete type => index breakdown is available in this spreadsheet.

.kibana_alerting_cases

  • action
  • action_task_params
  • alert
  • api_key_pending_invalidation
  • cases
  • cases-comments
  • cases-configure
  • cases-connector-mappings
  • cases-telemetry
  • cases-user-actions
  • connector_token
  • rules-settings
  • maintenance-window

.kibana_security_solution

  • csp-rule-template
  • endpoint:user-artifact
  • endpoint:user-artifact-manifest
  • exception-list
  • exception-list-agnostic
  • osquery-manager-usage-metric
  • osquery-pack
  • osquery-pack-asset
  • osquery-saved-query
  • security-rule
  • security-solution-signals-migration
  • siem-detection-engine-rule-actions
  • siem-ui-timeline
  • siem-ui-timeline-note
  • siem-ui-timeline-pinned-event

.kibana_analytics

  • canvas-element
  • canvas-workpad-template
  • canvas-workpad
  • dashboard
  • graph-workspace
  • index-pattern
  • kql-telemetry
  • lens
  • lens-ui-telemetry
  • map
  • search
  • search-session
  • search-telemetry
  • visualization

.kibana_ingest

  • epm-packages
  • epm-packages-assets
  • fleet-fleet-server-host
  • fleet-message-signing-keys
  • fleet-preconfiguration-deletion-record
  • fleet-proxy
  • ingest_manager_settings
  • ingest-agent-policies
  • ingest-download-sources
  • ingest-outputs
  • ingest-package-policies

Tasks / PRs

Sub-PRs

Implementation

Individual index split

Improvements / follow-ups

Reallocation tweaks

Tweaks to the reallocation can be done after the initial merge, as long as it's done before the public release of 8.8

  • url should get back to .kibana (see comment)

Release Note

For performance purposes, Kibana is now using more system indices to store its internal data.

The following system indices will be created when upgrading to 8.8.0:

  • .kibana_alerting_cases
  • .kibana_analytics
  • .kibana_security_solution
  • .kibana_ingest

…gration (#154846)

Clone of #154151
Baseline for the `dot-kibana-split` feature branch
@gsoldevila gsoldevila added release_note:enhancement Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Feature:Saved Objects backport:skip This commit does not require backporting v8.8.0 labels Apr 13, 2023
gsoldevila and others added 3 commits April 18, 2023 09:46
…TypesMap` (#154892)

Part of #154888

Some mappings.json use a special `$KIBANA_PACKAGE_VERSION` variable.
ES archiver uses this variable to generate saved object indices with
names that match the current stack version.
Note that this a bit brittle, cause incompatible mappings changes would
break Kibana.
However, it allows skipping reindexing and saving some precious CI time
when running tests.

With the introduction of the .kibana split, the mappings `_meta`
information now contain a new property, called `indexTypesMap`, which
holds a list of the SO types that are part of each index.

If the list is not present, the migration logic assumes that the .kibana
index must be split (and its documents redistributed), and it forces a
reindex.

The goal of this PR is to enrich the `mappings.json` with that extra
property, so that the migrator logic will not trigger a reindex.

- Thus, these mappings must be updated whenever existing types are moved
to a separate index, or new types are added.
- Ideally, we should also update the corresponding `data.json` files, to
place each SO document to the appropriate index.
…ltiple SO indices (#154884)

Part of #154888

There are a bunch of FTR and integration tests that interact with the SO
indices directly, assuming there are only two SO indices: `.kibana` and
`.kibana_task_manager`.

The goal of this PR is to factorise that knowledge and make these tests
use a list of SO indices instead.
…154882)

Part of #154888

ES archiver logic assumes that there are only two SO indices: '.kibana'
and '.kibana_task_manager'.
This PR updates ES archiver so that it works with a list of SO indices
instead.

---------

Co-authored-by: pgayvallet <[email protected]>
gsoldevila pushed a commit that referenced this pull request Apr 18, 2023
…#155035)

## Summary

As part of #154888, we need to stop making direct requests to the index
`.kibana`, and use the SO Clients instead.

This PR changes the utility `getSavedObjectsCount` to use aggregations
in the SO client.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

I'm pointing to `main` because it's an improvement we needed anyway.

---------

Co-authored-by: kibanamachine <[email protected]>
@afharo afharo mentioned this pull request Apr 18, 2023
2 tasks
… to use the correct index (#155155)

### **this PR is targeting the `dot-kibana-split` feature branch and not
`main`**

## Summary

Part of #154888

In #154888, we're going to split
the `.kibana` savedObject index into multiple ones. For this reason,
calls to `core.savedObjects.getKibanaIndex` will not necessarily return
the correct value (e.g types that were moved out of this index)

This PR introduces the following SO APIs:
- `getDefaultIndex`
- `getIndexForType`
- `getIndicesForTypes`
- `getAllIndices`

And adapt plugins code to replace usages of
`core.savedObjects.getKibanaIndex` with the proper alternative
….kibana_alerting_cases` (#154897)

## Summary

**This is targeting a feature branch**
Part of #154888

This PR aims at moving the following saved object types to a new
`.kibana_alerting_cases ` system index:
- action
- action_task_params
- alert
- api_key_pending_invalidation
- cases
- cases-comments
- cases-configure
- cases-connector-mappings
- cases-telemetry
- cases-user-actions
- connector_token
- rules-settings

---------

Co-authored-by: Christos Nasikas <[email protected]>
Co-authored-by: pgayvallet <[email protected]>
Copy link
Contributor

@kevinlog kevinlog left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-defend-workflows changes LGTM, we have one PR to remove index: false which would conflict with this, but we can resolve conflicts there after this PR goes in since it would be minimal.

Copy link
Contributor

@TinaHeiligers TinaHeiligers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome work!

Copy link
Contributor

@michaelolo24 michaelolo24 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for doing this work @gsoldevila, looks good for the timeline SO's! Just a question on whether or not QA teams have been looped in for additional testing? I'm not sure how prepared our teams are to test for any potential regressions while also managing any existing 8.8 feature work during the upcoming FF?

@pgayvallet
Copy link
Contributor

Just a question on whether or not QA teams have been looped in for additional testing?

They have been, yes.

If you think that a particular area is more at risk because of this PR, please feel free to inform us and/or QA.

Copy link
Contributor

@darnautov darnautov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ML changes tested and LGTM

## Summary

**This is targeting a feature branch**
Part of #154888

Following some remarks and feedback from the [feature branch
PR](#154888), this PR aims at
relocating some of the SO types:
- Move `'url'` type back to `.kibana`. (related
[comment](#154888 (comment)))
Copy link
Contributor

@pjhampton pjhampton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🌔 🚀 ✨ LGTM ✨ 🚀 🌔

@gsoldevila
Copy link
Contributor Author

security-defend-workflows changes LGTM, we have one PR to remove index: false which would conflict with this, but we can resolve conflicts there after this PR goes in since it would be minimal.

Thanks for letting us know! Whoever merges last should update the "dynamic" mappings.json (there's 8 of them), to get rid of the removed type endpoint:user-artifact.

Copy link
Contributor

@yctercero yctercero left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-solution-platform changes LGTM.

I did wonder if there are any traces of the .siem-notification SO. That one is part of the legacy security solution actions and didn't see it listed.
EDIT: It's an alert SO

@kibana-ci
Copy link
Collaborator

kibana-ci commented Apr 25, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
fleet 804 805 +1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/core-saved-objects-migration-server-internal 85 87 +2
@kbn/core-saved-objects-server 100 106 +6
total +8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
fleet 957.4KB 957.4KB +1.0B

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id before after diff
@kbn/core-saved-objects-base-server-internal 8 9 +1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
fleet 127.4KB 127.4KB +51.0B

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id before after diff
action 4 - -4
alert 68 - -68
api_key_pending_invalidation 3 - -3
canvas-element 8 - -8
canvas-workpad 5 - -5
canvas-workpad-template 8 - -8
cases 50 - -50
cases-comments 14 - -14
cases-configure 4 - -4
cases-connector-mappings 2 - -2
cases-user-actions 16 - -16
connector_token 3 - -3
csp-rule-template 6 - -6
dashboard 22 - -22
endpoint:user-artifact 10 - -10
endpoint:user-artifact-manifest 7 - -7
epm-packages 23 - -23
epm-packages-assets 8 - -8
exception-list 42 - -42
exception-list-agnostic 42 - -42
fleet-fleet-server-host 6 - -6
fleet-preconfiguration-deletion-record 2 - -2
fleet-proxy 8 - -8
graph-workspace 10 - -10
index-pattern 5 - -5
ingest_manager_settings 4 - -4
ingest-agent-policies 23 - -23
ingest-download-sources 5 - -5
ingest-outputs 14 - -14
ingest-package-policies 17 - -17
lens 4 - -4
lens-ui-telemetry 5 - -5
maintenance-window 3 - -3
map 7 - -7
osquery-manager-usage-metric 3 - -3
osquery-pack 15 - -15
osquery-pack-asset 10 - -10
osquery-saved-query 11 - -11
query 3 - -3
search 3 - -3
search-session 6 - -6
security-rule 3 - -3
security-solution-signals-migration 4 - -4
siem-detection-engine-rule-actions 9 - -9
siem-ui-timeline 96 - -96
siem-ui-timeline-note 7 - -7
siem-ui-timeline-pinned-event 6 - -6
visualization 4 - -4
total -638
Unknown metric groups

API count

id before after diff
@kbn/core-saved-objects-migration-server-internal 120 122 +2
@kbn/core-saved-objects-server 496 510 +14
total +16

ESLint disabled line counts

id before after diff
enterpriseSearch 17 19 +2
securitySolution 397 399 +2
total +4

References to deprecated APIs

id before after diff
@kbn/core-plugins-server-internal 10 12 +2
@kbn/core-saved-objects-server-internal 6 7 +1
@kbn/core-saved-objects-server-mocks 0 2 +2
savedObjectsTagging 75 76 +1
total +6

Total ESLint disabled count

id before after diff
enterpriseSearch 18 20 +2
securitySolution 477 479 +2
total +4

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@gsoldevila gsoldevila merged commit 21351df into main Apr 25, 2023
@gsoldevila gsoldevila deleted the dot-kibana-split branch April 25, 2023 07:43
gsoldevila added a commit that referenced this pull request May 23, 2023
Documentation must reflect changes brought by the [dot kibana
split](#154888).

Our public facing documentation just mentions two indices e.g.

https://www.elastic.co/guide/en/kibana/8.8/saved-object-migrations.html

https://www.elastic.co/guide/en/kibana/8.8/resolve-migrations-failures.html#upgrade-migrations-old-indices
this one in particular mentions that "all other indices are safe to
delete".
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request May 23, 2023
Documentation must reflect changes brought by the [dot kibana
split](elastic#154888).

Our public facing documentation just mentions two indices e.g.

https://www.elastic.co/guide/en/kibana/8.8/saved-object-migrations.html

https://www.elastic.co/guide/en/kibana/8.8/resolve-migrations-failures.html#upgrade-migrations-old-indices
this one in particular mentions that "all other indices are safe to
delete".

(cherry picked from commit 70eb9d3)
kibanamachine referenced this pull request May 23, 2023
… (#158270)

# Backport

This will backport the following commits from `main` to `8.8`:
- [Update saved objects migrations documentation for 8.8.0
(#158241)](#158241)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Gerard
Soldevila","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-05-23T13:53:52Z","message":"Update
saved objects migrations documentation for 8.8.0
(#158241)\n\nDocumentation must reflect changes brought by the [dot
kibana\r\nsplit](https://github.com/elastic/kibana/pull/154888).\r\n\r\nOur
public facing documentation just mentions two indices
e.g.\r\n\r\nhttps://www.elastic.co/guide/en/kibana/8.8/saved-object-migrations.html\r\n\r\nhttps://www.elastic.co/guide/en/kibana/8.8/resolve-migrations-failures.html#upgrade-migrations-old-indices\r\nthis
one in particular mentions that \"all other indices are safe
to\r\ndelete\".","sha":"70eb9d3ecbb11768d091fca385bad4f20960deef","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:Core","release_note:skip","documentation","Feature:Migrations","backport:prev-minor","v8.8.0","v8.9.0","v8.8.1"],"number":158241,"url":"https://github.com/elastic/kibana/pull/158241","mergeCommit":{"message":"Update
saved objects migrations documentation for 8.8.0
(#158241)\n\nDocumentation must reflect changes brought by the [dot
kibana\r\nsplit](https://github.com/elastic/kibana/pull/154888).\r\n\r\nOur
public facing documentation just mentions two indices
e.g.\r\n\r\nhttps://www.elastic.co/guide/en/kibana/8.8/saved-object-migrations.html\r\n\r\nhttps://www.elastic.co/guide/en/kibana/8.8/resolve-migrations-failures.html#upgrade-migrations-old-indices\r\nthis
one in particular mentions that \"all other indices are safe
to\r\ndelete\".","sha":"70eb9d3ecbb11768d091fca385bad4f20960deef"}},"sourceBranch":"main","suggestedTargetBranches":["8.8"],"targetPullRequestStates":[{"branch":"8.8","label":"v8.8.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/158241","number":158241,"mergeCommit":{"message":"Update
saved objects migrations documentation for 8.8.0
(#158241)\n\nDocumentation must reflect changes brought by the [dot
kibana\r\nsplit](https://github.com/elastic/kibana/pull/154888).\r\n\r\nOur
public facing documentation just mentions two indices
e.g.\r\n\r\nhttps://www.elastic.co/guide/en/kibana/8.8/saved-object-migrations.html\r\n\r\nhttps://www.elastic.co/guide/en/kibana/8.8/resolve-migrations-failures.html#upgrade-migrations-old-indices\r\nthis
one in particular mentions that \"all other indices are safe
to\r\ndelete\".","sha":"70eb9d3ecbb11768d091fca385bad4f20960deef"}}]}]
BACKPORT-->

Co-authored-by: Gerard Soldevila <[email protected]>
delanni pushed a commit to delanni/kibana that referenced this pull request May 25, 2023
Documentation must reflect changes brought by the [dot kibana
split](elastic#154888).

Our public facing documentation just mentions two indices e.g.

https://www.elastic.co/guide/en/kibana/8.8/saved-object-migrations.html

https://www.elastic.co/guide/en/kibana/8.8/resolve-migrations-failures.html#upgrade-migrations-old-indices
this one in particular mentions that "all other indices are safe to
delete".
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:skip This commit does not require backporting Epic:ScaleMigrations Scale upgrade migrations to millions of saved objects Feature:Saved Objects release_note:enhancement Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Team:Fleet Team label for Observability Data Collection Fleet team v8.8.0
Projects
No open projects
Development

Successfully merging this pull request may close these issues.

Improve migrations performance by using distinct indices per SO type