Loading

Kibana breaking changes

Breaking changes can impact your Elastic applications, potentially disrupting normal operations. Before you upgrade, carefully review the Kibana breaking changes and take the necessary steps to mitigate any issues.

If you are migrating from a version prior to version 9.0, you must first upgrade to the last 8.x version available. To learn how to upgrade, check out Upgrade.

Improved advanced settings management APIs privilege checks

View #230067.

Change to variable syntax in ES|QL queries

View #213916.

Access to Kibana's internal APIs is blocked

Access to internal Kibana HTTP APIs is restricted from version 9.0.0. This is to ensure that HTTP API integrations with Kibana avoid unexpected breaking changes.

Impact
Any HTTP API calls to internal Kibana endpoints will fail with a 400 status code starting from version 9.0.0.

Action
Do not integrate with internal HTTP APIs. They may change or be removed without notice, and lead to unexpected behaviors. If you would like some capability to be exposed over an HTTP API, create an issue. We would love to discuss your use case.

View #193792.

Alerts and cases

Removed deprecated Alerting endpoints
  • POST /api/alerts/alert/{id?} has been replaced by POST /api/alerting/rule/{id?}
  • GET /api/alerts/alert/{{id}} has been replaced by GET /api/alerting/rule/{{id}}
  • PUT /api/alerts/alert/{{id}} has been replaced by PUT /api/alerting/rule/rule/{{id}}
  • DELETE: /api/alerts/alert/{{id}} has been replaced by DELETE /api/alerting/rule/{{id}}
  • POST /api/alerts/alert/{{id}}/_disable has been replaced by POST /api/alerting/rule/{{id}}/_disable
  • POST /api/alerts/alert/{{id}}/_enable has been replaced by POST /api/alerting/rule/{{id}}/_enable
  • GET /api/alerts/_find has been replaced by GET /api/alerting/rules/_find
  • GET /api/alerts/_health has been replaced by GET /api/alerting/rule/_health
  • GET /api/alerts/list_alert_types has been replaced by GET /api/alerting/rule_types
  • POST /api/alerts/alert/{{alert_id}}/alert_instance/{{alert_instance_id}}/_mute has been replaced by POST /api/alerting/rule/{{rule_id}}/alert/{{alert_id}}/_mute
  • POST /api/alerts/alert/{{alert_id}}/alert_instance/{{alert_instance_id}}/_unmute has been replaced by POST /api/alerting/rule/{{rule_id}}/alert/{{alert_id}}/_unmute
  • POST /api/alerts/alert/{{id}}/_mute_all has been replaced by POST /api/alerting/rule/{{id}}/_mute_all
  • POST /api/alerts/alert/{{id}}/_unmute_all has been replaced by POST /api/alerting/rule/{{id}}/_unmute_all
  • POST /api/alerts/alert/{{id}}/_update_api_key has been replaced by POST /api/alerting/rule/{{id}}/_update_api_key
  • GET /api/alerts/{{id}}/_instance_summary has been deprecated without replacement. Will be removed in v9.0.0
  • GET /api/alerts/{{id}}/state has been deprecated without replacement. Will be removed in v9.0.0

Impact
Deprecated endpoints will fail with a 404 status code starting from version 9.0.0.

Action
Remove references to GET /api/alerts/{{id}}/_instance_summary endpoint. Remove references to GET /api/alerts/{{id}}/state endpoint. Replace references to endpoints listed as deprecated by it’s replacement. See Details section. The updated APIs can be found in https://www.elastic.co/docs/api/doc/kibana/group/endpoint-alerting.

Discover and dashboards

Elasticsearch solution

Elastic Observability solution

Elastic Security solution

For the Elastic Security 9.0.0 release information, refer to Elastic Security Solution Release Notes.

Data ingestion and Fleet

Reporting

Reporting uses Kibana feature privileges only to control access to reporting features

In 8.x, the default access control model was based on a built-in role called reporting_user, which granted access to reporting features. Since 7.13, the preferred model for controlling access to reporting features has been Kibana feature privileges, enabled by setting xpack.reporting.roles.enabled: false in kibana.yml.

In 9.0.0, the xpack.reporting.roles.* settings will be ignored.

Impact
The built-in reporting_user role is no longer deprecated and provides access to reporting features using Kibana feature privileges. This means that users that do not have privileges to use reporting will not see reporting features in the Kibana UI.

Action
Use Kibana feature privileges to control access to reporting features.

  • The reporting_user role is still supported, but gives full access to all reporting features. We recommend creating custom roles with minimal privileges in Stack Management > Roles.
  • The xpack.reporting.roles.allow setting is no longer supported. If you have a xpack.reporting.roles.allow value in your kibana.yml, you should remove this setting and assign privileges to reporting features using Kibana feature privileges.

View #200834.

Kibana management

Upgrade Assistant's reindexing and batch reindexing APIs are now internal

Upgrade Assistant public APIs for reindexing and batch reindexing have been made internal. You should instead use Elasticsearch’s native reindexing APIs for programmatic reindexing.

View #214051.

Kibana security

Removed v1 Security endpoints

All v1 Kibana security HTTP endpoints have been removed.

GET /api/security/v1/logout has been replaced by GET /api/security/logout GET /api/security/v1/oidc/implicit has been replaced by GET /api/security/oidc/implicit GET /api/security/v1/oidc has been replaced by GET /api/security/oidc/callback POST /api/security/v1/oidc has been replaced by POST /api/security/oidc/initiate_login POST /api/security/v1/saml has been replaced by POST /api/security/saml/callback GET /api/security/v1/me has been removed with no replacement.

Impact
Any HTTP API calls to the v1 Kibana security endpoints will fail with a 404 status code starting from version 9.0.0. Third party OIDC and SAML identity providers configured with v1 endpoints will no longer work.

Action
Update any OIDC and SAML identity providers to reference the corresponding replacement endpoint listed above. Remove references to the /api/security/v1/me endpoint from any automations, applications, tooling, and scripts.

View #199656.