From c56c17f224a3e94d136da96d4876451e9213f888 Mon Sep 17 00:00:00 2001 From: "konrad.szwarc" Date: Mon, 6 Jul 2026 12:37:37 -0600 Subject: [PATCH 1/2] Add cross-cluster search source to the metadata_united transform for remote Elasticsearch output support --- package/endpoint/changelog.yml | 2 +- .../elasticsearch/transform/metadata_united/default.json | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/package/endpoint/changelog.yml b/package/endpoint/changelog.yml index ecaf5c80e..e83396253 100644 --- a/package/endpoint/changelog.yml +++ b/package/endpoint/changelog.yml @@ -1,6 +1,6 @@ - version: "9.5.0-next" changes: - - description: TBD + - description: Add cross-cluster search source to the metadata_united transform for Elastic Defend remote Elasticsearch output support type: enhancement link: https://github.com/elastic/endpoint-package/pull/99999 - version: "9.4.0" diff --git a/package/endpoint/elasticsearch/transform/metadata_united/default.json b/package/endpoint/elasticsearch/transform/metadata_united/default.json index 38d565a0e..c4f3b47cd 100644 --- a/package/endpoint/elasticsearch/transform/metadata_united/default.json +++ b/package/endpoint/elasticsearch/transform/metadata_united/default.json @@ -2,6 +2,7 @@ "source": { "index": [ "metrics-endpoint.metadata_current_default*", + "*:metrics-endpoint.metadata_current_default*", ".fleet-agents*" ] }, From 3f6741b025fbb8ef90b9c3c4097cf67621b2b571 Mon Sep 17 00:00:00 2001 From: "konrad.szwarc" Date: Mon, 6 Jul 2026 12:38:38 -0600 Subject: [PATCH 2/2] Point changelog entry at PR 756 --- package/endpoint/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/endpoint/changelog.yml b/package/endpoint/changelog.yml index e83396253..f36757c5c 100644 --- a/package/endpoint/changelog.yml +++ b/package/endpoint/changelog.yml @@ -2,7 +2,7 @@ changes: - description: Add cross-cluster search source to the metadata_united transform for Elastic Defend remote Elasticsearch output support type: enhancement - link: https://github.com/elastic/endpoint-package/pull/99999 + link: https://github.com/elastic/endpoint-package/pull/756 - version: "9.4.0" changes: - description: automatic troubleshooting endpoint context docs