From 3b0b87008795440613115dbf140548a832858352 Mon Sep 17 00:00:00 2001
From: "konrad.szwarc" <konrad.szwarc@elastic.co>
Date: Tue, 30 Jun 2026 15:34:02 -0600
Subject: [PATCH 1/2] Split metadata_united into stateful (CCS) and serverless
 transform variants via _meta.environments

---
 .../transform/metadata_united/default.json    |  6 ++-
 .../transform/metadata_united/serverless.json | 44 +++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 package/endpoint/elasticsearch/transform/metadata_united/serverless.json

diff --git a/package/endpoint/elasticsearch/transform/metadata_united/default.json b/package/endpoint/elasticsearch/transform/metadata_united/default.json
index 38d565a0e..677ee06c7 100644
--- a/package/endpoint/elasticsearch/transform/metadata_united/default.json
+++ b/package/endpoint/elasticsearch/transform/metadata_united/default.json
@@ -2,6 +2,7 @@
     "source": {
         "index": [
             "metrics-endpoint.metadata_current_default*",
+            "*:metrics-endpoint.metadata_current_default*",
             ".fleet-agents*"
         ]
     },
@@ -36,6 +37,9 @@
     },
     "description": "Merges latest Endpoint and Agent metadata documents",
     "_meta": {
-        "managed": true
+        "managed": true,
+        "environments": [
+            "stateful"
+        ]
     }
 }
\ No newline at end of file
diff --git a/package/endpoint/elasticsearch/transform/metadata_united/serverless.json b/package/endpoint/elasticsearch/transform/metadata_united/serverless.json
new file mode 100644
index 000000000..131d3fc9d
--- /dev/null
+++ b/package/endpoint/elasticsearch/transform/metadata_united/serverless.json
@@ -0,0 +1,44 @@
+{
+    "source": {
+        "index": [
+            "metrics-endpoint.metadata_current_default*",
+            ".fleet-agents*"
+        ]
+    },
+    "dest": {
+        "index": ".metrics-endpoint.metadata_united_default"
+    },
+    "frequency": "1s",
+    "sync": {
+        "time": {
+            "delay": "4s",
+            "field": "updated_at"
+        }
+    },
+    "pivot": {
+        "aggs": {
+            "united": {
+                "scripted_metric": {
+                    "init_script": "state.docs = []",
+                    "map_script": "state.docs.add(new HashMap(params['_source']))",
+                    "combine_script": "return state.docs",
+                    "reduce_script": "def ret = new HashMap(); for (s in states) { for (d in s) { if (d.containsKey('Endpoint')) { ret.endpoint = d } else { ret.agent = d } }} return ret"
+                }
+            }
+        },
+        "group_by": {
+            "agent.id": {
+                "terms": {
+                    "field": "agent.id"
+                }
+            }
+        }
+    },
+    "description": "Merges latest Endpoint and Agent metadata documents",
+    "_meta": {
+        "managed": true,
+        "environments": [
+            "serverless"
+        ]
+    }
+}
\ No newline at end of file

From 8cbdc9f28445360220c23dca6e8ab31235b9f596 Mon Sep 17 00:00:00 2001
From: "konrad.szwarc" <konrad.szwarc@elastic.co>
Date: Tue, 30 Jun 2026 15:35:23 -0600
Subject: [PATCH 2/2] Add changelog entry for metadata_united transform
 variants

---
 package/endpoint/changelog.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/package/endpoint/changelog.yml b/package/endpoint/changelog.yml
index ecaf5c80e..3b67af41e 100644
--- a/package/endpoint/changelog.yml
+++ b/package/endpoint/changelog.yml
@@ -3,6 +3,9 @@
     - description: TBD
       type: enhancement
       link: https://github.com/elastic/endpoint-package/pull/99999
+    - description: Split the metadata_united transform into stateful (cross-cluster) and serverless (local) variants gated by _meta.environments
+      type: enhancement
+      link: https://github.com/elastic/endpoint-package/pull/750
 - version: "9.4.0"
   changes:
     - description: automatic troubleshooting endpoint context docs