Add cross-cluster source to metadata_united transform for remote Elasticsearch output support#756
Merged
szwarckonrad merged 2 commits intoJul 6, 2026
Conversation
…remote Elasticsearch output support
pzl
reviewed
Jul 6, 2026
| - version: "9.5.0-next" | ||
| changes: | ||
| - description: TBD | ||
| - description: Add cross-cluster search source to the metadata_united transform for Elastic Defend remote Elasticsearch output support |
Member
There was a problem hiding this comment.
you can leave off the changelog, the entries are grabbed at release time via automation
pzl
approved these changes
Jul 6, 2026
tomsonpl
pushed a commit
to elastic/kibana
that referenced
this pull request
Jul 9, 2026
…output (#276749) Flips the `defendRemoteOutputCcs` experimental flag on by default, enabling the CCS read paths for Elastic Defend when an agent ships to a remote Elasticsearch output. The read-path awareness shipped behind this flag in #271559; this turns it on for 9.5. CCS is stateful-only, so on serverless / no-remote clusters it is a no-op (the flag gates a `_remote/info` check that finds no remotes). <details> <summary>LLM description</summary> One-line change: `defendRemoteOutputCcs: false -> true` in `common/experimental_features.ts`. This lets `EndpointAppContextService.isCcsEnabled()` actually consult connected remotes (it short-circuits to `false` when the flag is off). Downstream, endpoint read paths (metadata list/by-id, response-action reads, policy responses, suggestions + endpoint fields, workflow insights) apply `prefixIndexPatternsWithCcs` only when a remote cluster is connected. Depends on `elastic/endpoint-package#756` (the `*:` metadata_united transform, merged) for the endpoint list, and `elastic/elasticsearch#152211` (fleet-server-remote grants, merged) for response-action completion. No other refs to the flag; no test asserts its default; snapshots clean; the `isCcsEnabled` unit tests set the flag explicitly. </details>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks elastic/kibana#271559
Re-applies #747 (reverted in #749 after it broke Fleet's serverless package install). The Fleet-side fix that strips the
*:source on serverless (elastic/kibana#275649) is now merged, so this transform change is safe to ship again. The change is identical to #747.Change Summary
Adds a cross-cluster (
*:) source to themetadata_unitedtransform so it also readsmetrics-endpoint.metadata_currentfrom connected remote clusters:When Elastic Defend agents ship to a remote Elasticsearch output, endpoint metadata lands on the remote (data) cluster while
.fleet-agentsstays on the managing cluster. With only the local current index in scope, the join produced agent-only documents and the Endpoint list came up empty. Reading the remotemetadata_currentover CCS lets the join run on the managing cluster and populates the united index.