[Cases] Reverts the introduction of the incremental_id service#228002
Merged
janmonschke merged 3 commits intoelastic:mainfrom Jul 16, 2025
Merged
[Cases] Reverts the introduction of the incremental_id service#228002janmonschke merged 3 commits intoelastic:mainfrom
janmonschke merged 3 commits intoelastic:mainfrom
Conversation
…stic#226935)" This reverts commit 2a0921f.
elastic#222874)" This reverts commit 1683180.
janmonschke
added
release_note:skip
Contributor
💚 Build Succeeded
Metrics [docs]Module Count
Async chunks
Count of Enzyme imports
Public APIs missing exports
Page load bundle
Unknown metric groupsESLint disabled line counts
Total ESLint disabled count
cc @janmonschke |
Contributor
|
Pinging @elastic/kibana-cases (Team:Cases) |
azasypkin
approved these changes
Jul 15, 2025
Contributor
azasypkin
left a comment
azasypkin
left a comment
There was a problem hiding this comment.
Change in src/platform/test/plugin_functional/test_suites/core_plugins/rendering.ts LGTM (removing a boolean config).
Bamieh
approved these changes
Jul 15, 2025
lgestc
approved these changes
Jul 16, 2025
Contributor
|
Starting backport for target branches: 8.19, 9.1 https://github.com/elastic/kibana/actions/runs/16313990386 |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 16, 2025
…ic#228002) ## Summary Reverts elastic#222874 and elastic#226935 . The mappings and the introduction of the saved object type for the increment counter object cannot be reverted. In a future PR we will bring this feature back under a different name and reuse the increment counter object that has been introduced already. (cherry picked from commit d03ab6d)
Contributor
💔 Some backports could not be created
Note: Successful backport PRs will be merged automatically after passing CI. Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
Contributor
Author
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
janmonschke
added a commit
to janmonschke/kibana
that referenced
this pull request
Jul 16, 2025
…ic#228002) ## Summary Reverts elastic#222874 and elastic#226935 . The mappings and the introduction of the saved object type for the increment counter object cannot be reverted. In a future PR we will bring this feature back under a different name and reuse the increment counter object that has been introduced already. (cherry picked from commit d03ab6d) # Conflicts: # src/platform/plugins/private/kibana_usage_collection/server/collectors/management/schema.ts # src/platform/plugins/private/kibana_usage_collection/server/collectors/management/types.ts # src/platform/plugins/shared/telemetry/schema/oss_platform.json # x-pack/platform/plugins/shared/cases/public/components/all_cases/use_cases_columns.tsx # x-pack/platform/plugins/shared/cases/server/plugin.test.ts # x-pack/platform/plugins/shared/cases/server/plugin.ts
kibanamachine
added a commit
that referenced
this pull request
Jul 16, 2025
…228002) (#228151) # Backport This will backport the following commits from `main` to `9.1`: - [[Cases] Reverts the introduction of the incremental_id service (#228002)](#228002) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Jan Monschke","email":"jan.monschke@elastic.co"},"sourceCommit":{"committedDate":"2025-07-16T08:07:17Z","message":"[Cases] Reverts the introduction of the incremental_id service (#228002)\n\n## Summary\n\nReverts #222874 and\nhttps://github.com//pull/226935 .\nThe mappings and the introduction of the saved object type for the\nincrement counter object cannot be reverted.\n\nIn a future PR we will bring this feature back under a different name\nand reuse the increment counter object that has been introduced already.","sha":"d03ab6dbb89bcfe70b513b7971bf010fce2c2b45","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:version","v9.1.0","v8.19.0","Team:Cases","v9.2.0"],"title":"[Cases] Reverts the introduction of the incremental_id service","number":228002,"url":"https://github.com/elastic/kibana/pull/228002","mergeCommit":{"message":"[Cases] Reverts the introduction of the incremental_id service (#228002)\n\n## Summary\n\nReverts #222874 and\nhttps://github.com//pull/226935 .\nThe mappings and the introduction of the saved object type for the\nincrement counter object cannot be reverted.\n\nIn a future PR we will bring this feature back under a different name\nand reuse the increment counter object that has been introduced already.","sha":"d03ab6dbb89bcfe70b513b7971bf010fce2c2b45"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/228002","number":228002,"mergeCommit":{"message":"[Cases] Reverts the introduction of the incremental_id service (#228002)\n\n## Summary\n\nReverts #222874 and\nhttps://github.com//pull/226935 .\nThe mappings and the introduction of the saved object type for the\nincrement counter object cannot be reverted.\n\nIn a future PR we will bring this feature back under a different name\nand reuse the increment counter object that has been introduced already.","sha":"d03ab6dbb89bcfe70b513b7971bf010fce2c2b45"}}]}] BACKPORT--> Co-authored-by: Jan Monschke <jan.monschke@elastic.co>
janmonschke
added a commit
that referenced
this pull request
Jul 16, 2025
…#228002) (#228156) # Backport This will backport the following commits from `main` to `8.19`: - [[Cases] Reverts the introduction of the incremental_id service (#228002)](#228002) <!--- Backport version: 10.0.1 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Jan Monschke","email":"jan.monschke@elastic.co"},"sourceCommit":{"committedDate":"2025-07-16T08:07:17Z","message":"[Cases] Reverts the introduction of the incremental_id service (#228002)\n\n## Summary\n\nReverts #222874 and\nhttps://github.com//pull/226935 .\nThe mappings and the introduction of the saved object type for the\nincrement counter object cannot be reverted.\n\nIn a future PR we will bring this feature back under a different name\nand reuse the increment counter object that has been introduced already.","sha":"d03ab6dbb89bcfe70b513b7971bf010fce2c2b45","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:version","v9.1.0","v8.19.0","Team:Cases","v9.2.0"],"title":"[Cases] Reverts the introduction of the incremental_id service","number":228002,"url":"https://github.com/elastic/kibana/pull/228002","mergeCommit":{"message":"[Cases] Reverts the introduction of the incremental_id service (#228002)\n\n## Summary\n\nReverts #222874 and\nhttps://github.com//pull/226935 .\nThe mappings and the introduction of the saved object type for the\nincrement counter object cannot be reverted.\n\nIn a future PR we will bring this feature back under a different name\nand reuse the increment counter object that has been introduced already.","sha":"d03ab6dbb89bcfe70b513b7971bf010fce2c2b45"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/228151","number":228151,"state":"OPEN"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/228002","number":228002,"mergeCommit":{"message":"[Cases] Reverts the introduction of the incremental_id service (#228002)\n\n## Summary\n\nReverts #222874 and\nhttps://github.com//pull/226935 .\nThe mappings and the introduction of the saved object type for the\nincrement counter object cannot be reverted.\n\nIn a future PR we will bring this feature back under a different name\nand reuse the increment counter object that has been introduced already.","sha":"d03ab6dbb89bcfe70b513b7971bf010fce2c2b45"}}]}] BACKPORT-->
8 tasks
Bluefinger
pushed a commit
to Bluefinger/kibana
that referenced
this pull request
Jul 22, 2025
…ic#228002) ## Summary Reverts elastic#222874 and elastic#226935 . The mappings and the introduction of the saved object type for the increment counter object cannot be reverted. In a future PR we will bring this feature back under a different name and reuse the increment counter object that has been introduced already.
kertal
pushed a commit
to kertal/kibana
that referenced
this pull request
Jul 25, 2025
…ic#228002) ## Summary Reverts elastic#222874 and elastic#226935 . The mappings and the introduction of the saved object type for the increment counter object cannot be reverted. In a future PR we will bring this feature back under a different name and reuse the increment counter object that has been introduced already.
10 tasks
michaelolo24
added a commit
that referenced
this pull request
Sep 29, 2025
## Summary This is a reversion of the revert of this original #228002 of incremental id work. This original revert was done, due to the search functionality in cases being broken when searching on the new `incremental_id` field. It being of type `unsigned_long` meant that ES would not return when it was included alongside text values due to data type mismatch errors [described here](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/number#_which_type_should_i_use).. Rather than creating a new field, and making the existing `incremental_id` field dead weight, we instead [update it to a multi-field](https://www.elastic.co/docs/manage-data/data-store/mapping/update-mappings-examples#add-multi-fields-to-an-existing-field), so we can search on this value as text alongside other cases values. The update of the mapping was done here: #234054 #### Functional Changes From Reversion 1. Use of `incremental_id.text` in search functionality in place of `incremental_id` 2. There is no longer an advanced setting to hide the feature in the UI as we feel comfortable releasing it as is, and the field is currently only metadata and doesn't introduce any functional changes outside of searching. ## Testing: Feature Flag: `xpack.cases.incrementalId.enabled: true`. Currently disabled and will be enabled after additional testing during FF When running a clean branch, the feature will work correctly. We've verified locally that the mapping update works successfully via the methods described below, but feel free to test as well to confirm our results 👍🏾 ### Serverless 1. Create a security serverless environment via `qaf`. 4. Create cases in the serverless environment 5. Update images to the build image from this pr via the `--kb-docker-images` flag. 6. Wait for the task to run, and verify the numeric ids are applied to the cases 7. Search for cases by then numeric id via `#{incremental_id value}` and also search for `description + {incremental_id value}` and make sure the query successfully returns ### On-Prem 1. Run main locally 2. Create cases in the local environment 3. Switch branches from main to this branch 4. Wait for the task to run, and verify the numeric ids are applied to the cases 5. Search for cases by then numeric id via `#{id number}` and also search for `description + id number` and make sure the query successfully returns ## OUTDATED The below details were provided for manually updating the mapping via dev tools for testing/validation purposes This PR updates the mapping directly. Here are steps to update the mapping manually in a local instance: 0. Remove changes in `packages/kbn-check-mappings-update-cli/current_mappings.json` 1. Create some tests (there could be error toasts because `incremental_id.text` is not yet created 8. Create an `admin` user and assign `system_indices_superuser` and `superuser` role 9. Go to Dev tools, get the current mapping `GET /.kibana_alerting_cases_9.2.0_001/_mapping` 10. Add `text` as multi-field for `incremental_id` 11. Run `POST /.kibana_alerting_cases_9.2.0_001/_update_by_query` to update existing document 12. Go to Cases and observe the case id can be searched individually or in combination of other texts <details> <summary>mapping update query</summary> ``` PUT /.kibana_alerting_cases_9.2.0_001/_mapping { "properties": { "action": { "dynamic": "false", "properties": { "actionTypeId": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword" } } } } }, "action_task_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" } } }, "ad_hoc_run_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" }, "end": { "type": "date" }, "rule": { "properties": { "alertTypeId": { "type": "keyword" }, "consumer": { "type": "keyword" } } }, "start": { "type": "date" } } }, "alert": { "dynamic": "false", "properties": { "actions": { "type": "nested", "dynamic": "false", "properties": { "actionRef": { "type": "keyword" }, "actionTypeId": { "type": "keyword" }, "group": { "type": "keyword" } } }, "alertTypeId": { "type": "keyword" }, "artifacts": { "properties": { "investigation_guide": { "properties": { "blob": { "type": "text" } } } } }, "consumer": { "type": "keyword" }, "createdAt": { "type": "date" }, "createdBy": { "type": "keyword" }, "enabled": { "type": "boolean" }, "executionStatus": { "properties": { "error": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } }, "lastDuration": { "type": "long" }, "lastExecutionDate": { "type": "date" }, "numberOfTriggeredActions": { "type": "long" }, "status": { "type": "keyword" }, "warning": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } } } }, "lastRun": { "properties": { "alertsCount": { "properties": { "active": { "type": "float" }, "ignored": { "type": "float" }, "new": { "type": "float" }, "recovered": { "type": "float" } } }, "outcome": { "type": "keyword" }, "outcomeOrder": { "type": "float" } } }, "legacyId": { "type": "keyword" }, "mapped_params": { "properties": { "risk_score": { "type": "float" }, "severity": { "type": "keyword" } } }, "monitoring": { "properties": { "run": { "properties": { "calculated_metrics": { "properties": { "p50": { "type": "long" }, "p95": { "type": "long" }, "p99": { "type": "long" }, "success_ratio": { "type": "float" } } }, "last_run": { "properties": { "metrics": { "properties": { "duration": { "type": "long" }, "gap_duration_s": { "type": "float" }, "total_alerts_created": { "type": "float" }, "total_alerts_detected": { "type": "float" }, "total_indexing_duration_ms": { "type": "long" }, "total_search_duration_ms": { "type": "long" } } }, "timestamp": { "type": "date" } } } } } } }, "muteAll": { "type": "boolean" }, "mutedInstanceIds": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "normalizer": "lowercase" } } }, "notifyWhen": { "type": "keyword" }, "params": { "type": "flattened", "ignore_above": 4096 }, "revision": { "type": "long" }, "running": { "type": "boolean" }, "schedule": { "properties": { "interval": { "type": "keyword" } } }, "scheduledTaskId": { "type": "keyword" }, "snoozeSchedule": { "type": "nested", "properties": { "duration": { "type": "long" }, "id": { "type": "keyword" }, "skipRecurrences": { "type": "date", "format": "strict_date_time" } } }, "tags": { "type": "keyword" }, "throttle": { "type": "keyword" }, "updatedAt": { "type": "date" }, "updatedBy": { "type": "keyword" } } }, "api_key_pending_invalidation": { "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" } } }, "cases": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "category": { "type": "keyword" }, "closed_at": { "type": "date" }, "closed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "connector": { "properties": { "fields": { "properties": { "key": { "type": "text" }, "value": { "type": "text" } } }, "name": { "type": "text" }, "type": { "type": "keyword" } } }, "created_at": { "type": "date" }, "created_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "customFields": { "type": "nested", "properties": { "key": { "type": "keyword" }, "type": { "type": "keyword" }, "value": { "type": "keyword", "fields": { "boolean": { "type": "boolean", "ignore_malformed": true }, "date": { "type": "date", "ignore_malformed": true }, "ip": { "type": "ip", "ignore_malformed": true }, "number": { "type": "long", "ignore_malformed": true }, "string": { "type": "text" } } } } }, "description": { "type": "text" }, "duration": { "type": "unsigned_long" }, "external_service": { "properties": { "connector_name": { "type": "keyword" }, "external_id": { "type": "keyword" }, "external_title": { "type": "text" }, "external_url": { "type": "text" }, "pushed_at": { "type": "date" }, "pushed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "incremental_id": { "type": "unsigned_long", "fields": { "raw": { "type": "keyword" } } }, "observables": { "type": "nested", "properties": { "typeKey": { "type": "keyword" }, "value": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "settings": { "properties": { "syncAlerts": { "type": "boolean" } } }, "severity": { "type": "short" }, "status": { "type": "short" }, "tags": { "type": "keyword" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "total_alerts": { "type": "integer" }, "total_comments": { "type": "integer" }, "updated_at": { "type": "date" }, "updated_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "cases-comments": { "dynamic": "false", "properties": { "actions": { "properties": { "type": { "type": "keyword" } } }, "alertId": { "type": "keyword" }, "comment": { "type": "text" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "externalReferenceAttachmentTypeId": { "type": "keyword" }, "owner": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "pushed_at": { "type": "date" }, "type": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-configure": { "dynamic": "false", "properties": { "closure_type": { "type": "keyword" }, "created_at": { "type": "date" }, "owner": { "type": "keyword" } } }, "cases-connector-mappings": { "dynamic": "false", "properties": { "owner": { "type": "keyword" } } }, "cases-incrementing-id": { "dynamic": "false", "properties": { "@timestamp": { "type": "date" }, "last_id": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-rules": { "dynamic": "false", "properties": { "counter": { "type": "unsigned_long" }, "createdAt": { "type": "date" }, "rules": { "properties": { "id": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "cases-telemetry": { "type": "object", "dynamic": "false" }, "cases-user-actions": { "dynamic": "false", "properties": { "action": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "payload": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "comment": { "properties": { "externalReferenceAttachmentTypeId": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "type": { "type": "keyword" } } }, "connector": { "properties": { "type": { "type": "keyword" } } } } }, "type": { "type": "keyword" } } }, "connector_token": { "dynamic": "false", "properties": { "connectorId": { "type": "keyword" }, "tokenType": { "type": "keyword" } } }, "coreMigrationVersion": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "type": "keyword" }, "maintenance-window": { "dynamic": "false", "properties": { "enabled": { "type": "boolean" }, "events": { "type": "date_range", "format": "epoch_millis||strict_date_optional_time" }, "expirationDate": { "type": "date" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "managed": { "type": "boolean" }, "namespace": { "type": "keyword" }, "namespaces": { "type": "keyword" }, "originId": { "type": "keyword" }, "references": { "type": "nested", "properties": { "id": { "type": "keyword" }, "name": { "type": "keyword" }, "type": { "type": "keyword" } } }, "rules-settings": { "dynamic": "false", "properties": { "flapping": { "type": "object" } } }, "scheduled_report": { "dynamic": "false", "properties": { "createdBy": { "type": "keyword" } } }, "type": { "type": "keyword" }, "typeMigrationVersion": { "type": "version" }, "updated_at": { "type": "date" }, "updated_by": { "type": "keyword" } } } ``` </details> ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: Jan Monschke <jan.monschke@elastic.co> Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
niros1
pushed a commit
that referenced
this pull request
Sep 30, 2025
## Summary This is a reversion of the revert of this original #228002 of incremental id work. This original revert was done, due to the search functionality in cases being broken when searching on the new `incremental_id` field. It being of type `unsigned_long` meant that ES would not return when it was included alongside text values due to data type mismatch errors [described here](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/number#_which_type_should_i_use).. Rather than creating a new field, and making the existing `incremental_id` field dead weight, we instead [update it to a multi-field](https://www.elastic.co/docs/manage-data/data-store/mapping/update-mappings-examples#add-multi-fields-to-an-existing-field), so we can search on this value as text alongside other cases values. The update of the mapping was done here: #234054 #### Functional Changes From Reversion 1. Use of `incremental_id.text` in search functionality in place of `incremental_id` 2. There is no longer an advanced setting to hide the feature in the UI as we feel comfortable releasing it as is, and the field is currently only metadata and doesn't introduce any functional changes outside of searching. ## Testing: Feature Flag: `xpack.cases.incrementalId.enabled: true`. Currently disabled and will be enabled after additional testing during FF When running a clean branch, the feature will work correctly. We've verified locally that the mapping update works successfully via the methods described below, but feel free to test as well to confirm our results 👍🏾 ### Serverless 1. Create a security serverless environment via `qaf`. 4. Create cases in the serverless environment 5. Update images to the build image from this pr via the `--kb-docker-images` flag. 6. Wait for the task to run, and verify the numeric ids are applied to the cases 7. Search for cases by then numeric id via `#{incremental_id value}` and also search for `description + {incremental_id value}` and make sure the query successfully returns ### On-Prem 1. Run main locally 2. Create cases in the local environment 3. Switch branches from main to this branch 4. Wait for the task to run, and verify the numeric ids are applied to the cases 5. Search for cases by then numeric id via `#{id number}` and also search for `description + id number` and make sure the query successfully returns ## OUTDATED The below details were provided for manually updating the mapping via dev tools for testing/validation purposes This PR updates the mapping directly. Here are steps to update the mapping manually in a local instance: 0. Remove changes in `packages/kbn-check-mappings-update-cli/current_mappings.json` 1. Create some tests (there could be error toasts because `incremental_id.text` is not yet created 8. Create an `admin` user and assign `system_indices_superuser` and `superuser` role 9. Go to Dev tools, get the current mapping `GET /.kibana_alerting_cases_9.2.0_001/_mapping` 10. Add `text` as multi-field for `incremental_id` 11. Run `POST /.kibana_alerting_cases_9.2.0_001/_update_by_query` to update existing document 12. Go to Cases and observe the case id can be searched individually or in combination of other texts <details> <summary>mapping update query</summary> ``` PUT /.kibana_alerting_cases_9.2.0_001/_mapping { "properties": { "action": { "dynamic": "false", "properties": { "actionTypeId": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword" } } } } }, "action_task_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" } } }, "ad_hoc_run_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" }, "end": { "type": "date" }, "rule": { "properties": { "alertTypeId": { "type": "keyword" }, "consumer": { "type": "keyword" } } }, "start": { "type": "date" } } }, "alert": { "dynamic": "false", "properties": { "actions": { "type": "nested", "dynamic": "false", "properties": { "actionRef": { "type": "keyword" }, "actionTypeId": { "type": "keyword" }, "group": { "type": "keyword" } } }, "alertTypeId": { "type": "keyword" }, "artifacts": { "properties": { "investigation_guide": { "properties": { "blob": { "type": "text" } } } } }, "consumer": { "type": "keyword" }, "createdAt": { "type": "date" }, "createdBy": { "type": "keyword" }, "enabled": { "type": "boolean" }, "executionStatus": { "properties": { "error": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } }, "lastDuration": { "type": "long" }, "lastExecutionDate": { "type": "date" }, "numberOfTriggeredActions": { "type": "long" }, "status": { "type": "keyword" }, "warning": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } } } }, "lastRun": { "properties": { "alertsCount": { "properties": { "active": { "type": "float" }, "ignored": { "type": "float" }, "new": { "type": "float" }, "recovered": { "type": "float" } } }, "outcome": { "type": "keyword" }, "outcomeOrder": { "type": "float" } } }, "legacyId": { "type": "keyword" }, "mapped_params": { "properties": { "risk_score": { "type": "float" }, "severity": { "type": "keyword" } } }, "monitoring": { "properties": { "run": { "properties": { "calculated_metrics": { "properties": { "p50": { "type": "long" }, "p95": { "type": "long" }, "p99": { "type": "long" }, "success_ratio": { "type": "float" } } }, "last_run": { "properties": { "metrics": { "properties": { "duration": { "type": "long" }, "gap_duration_s": { "type": "float" }, "total_alerts_created": { "type": "float" }, "total_alerts_detected": { "type": "float" }, "total_indexing_duration_ms": { "type": "long" }, "total_search_duration_ms": { "type": "long" } } }, "timestamp": { "type": "date" } } } } } } }, "muteAll": { "type": "boolean" }, "mutedInstanceIds": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "normalizer": "lowercase" } } }, "notifyWhen": { "type": "keyword" }, "params": { "type": "flattened", "ignore_above": 4096 }, "revision": { "type": "long" }, "running": { "type": "boolean" }, "schedule": { "properties": { "interval": { "type": "keyword" } } }, "scheduledTaskId": { "type": "keyword" }, "snoozeSchedule": { "type": "nested", "properties": { "duration": { "type": "long" }, "id": { "type": "keyword" }, "skipRecurrences": { "type": "date", "format": "strict_date_time" } } }, "tags": { "type": "keyword" }, "throttle": { "type": "keyword" }, "updatedAt": { "type": "date" }, "updatedBy": { "type": "keyword" } } }, "api_key_pending_invalidation": { "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" } } }, "cases": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "category": { "type": "keyword" }, "closed_at": { "type": "date" }, "closed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "connector": { "properties": { "fields": { "properties": { "key": { "type": "text" }, "value": { "type": "text" } } }, "name": { "type": "text" }, "type": { "type": "keyword" } } }, "created_at": { "type": "date" }, "created_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "customFields": { "type": "nested", "properties": { "key": { "type": "keyword" }, "type": { "type": "keyword" }, "value": { "type": "keyword", "fields": { "boolean": { "type": "boolean", "ignore_malformed": true }, "date": { "type": "date", "ignore_malformed": true }, "ip": { "type": "ip", "ignore_malformed": true }, "number": { "type": "long", "ignore_malformed": true }, "string": { "type": "text" } } } } }, "description": { "type": "text" }, "duration": { "type": "unsigned_long" }, "external_service": { "properties": { "connector_name": { "type": "keyword" }, "external_id": { "type": "keyword" }, "external_title": { "type": "text" }, "external_url": { "type": "text" }, "pushed_at": { "type": "date" }, "pushed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "incremental_id": { "type": "unsigned_long", "fields": { "raw": { "type": "keyword" } } }, "observables": { "type": "nested", "properties": { "typeKey": { "type": "keyword" }, "value": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "settings": { "properties": { "syncAlerts": { "type": "boolean" } } }, "severity": { "type": "short" }, "status": { "type": "short" }, "tags": { "type": "keyword" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "total_alerts": { "type": "integer" }, "total_comments": { "type": "integer" }, "updated_at": { "type": "date" }, "updated_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "cases-comments": { "dynamic": "false", "properties": { "actions": { "properties": { "type": { "type": "keyword" } } }, "alertId": { "type": "keyword" }, "comment": { "type": "text" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "externalReferenceAttachmentTypeId": { "type": "keyword" }, "owner": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "pushed_at": { "type": "date" }, "type": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-configure": { "dynamic": "false", "properties": { "closure_type": { "type": "keyword" }, "created_at": { "type": "date" }, "owner": { "type": "keyword" } } }, "cases-connector-mappings": { "dynamic": "false", "properties": { "owner": { "type": "keyword" } } }, "cases-incrementing-id": { "dynamic": "false", "properties": { "@timestamp": { "type": "date" }, "last_id": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-rules": { "dynamic": "false", "properties": { "counter": { "type": "unsigned_long" }, "createdAt": { "type": "date" }, "rules": { "properties": { "id": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "cases-telemetry": { "type": "object", "dynamic": "false" }, "cases-user-actions": { "dynamic": "false", "properties": { "action": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "payload": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "comment": { "properties": { "externalReferenceAttachmentTypeId": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "type": { "type": "keyword" } } }, "connector": { "properties": { "type": { "type": "keyword" } } } } }, "type": { "type": "keyword" } } }, "connector_token": { "dynamic": "false", "properties": { "connectorId": { "type": "keyword" }, "tokenType": { "type": "keyword" } } }, "coreMigrationVersion": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "type": "keyword" }, "maintenance-window": { "dynamic": "false", "properties": { "enabled": { "type": "boolean" }, "events": { "type": "date_range", "format": "epoch_millis||strict_date_optional_time" }, "expirationDate": { "type": "date" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "managed": { "type": "boolean" }, "namespace": { "type": "keyword" }, "namespaces": { "type": "keyword" }, "originId": { "type": "keyword" }, "references": { "type": "nested", "properties": { "id": { "type": "keyword" }, "name": { "type": "keyword" }, "type": { "type": "keyword" } } }, "rules-settings": { "dynamic": "false", "properties": { "flapping": { "type": "object" } } }, "scheduled_report": { "dynamic": "false", "properties": { "createdBy": { "type": "keyword" } } }, "type": { "type": "keyword" }, "typeMigrationVersion": { "type": "version" }, "updated_at": { "type": "date" }, "updated_by": { "type": "keyword" } } } ``` </details> ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: Jan Monschke <jan.monschke@elastic.co> Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
VladimirFilonov
pushed a commit
to VladimirFilonov/kibana
that referenced
this pull request
Sep 30, 2025
## Summary This is a reversion of the revert of this original elastic#228002 of incremental id work. This original revert was done, due to the search functionality in cases being broken when searching on the new `incremental_id` field. It being of type `unsigned_long` meant that ES would not return when it was included alongside text values due to data type mismatch errors [described here](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/number#_which_type_should_i_use).. Rather than creating a new field, and making the existing `incremental_id` field dead weight, we instead [update it to a multi-field](https://www.elastic.co/docs/manage-data/data-store/mapping/update-mappings-examples#add-multi-fields-to-an-existing-field), so we can search on this value as text alongside other cases values. The update of the mapping was done here: elastic#234054 #### Functional Changes From Reversion 1. Use of `incremental_id.text` in search functionality in place of `incremental_id` 2. There is no longer an advanced setting to hide the feature in the UI as we feel comfortable releasing it as is, and the field is currently only metadata and doesn't introduce any functional changes outside of searching. ## Testing: Feature Flag: `xpack.cases.incrementalId.enabled: true`. Currently disabled and will be enabled after additional testing during FF When running a clean branch, the feature will work correctly. We've verified locally that the mapping update works successfully via the methods described below, but feel free to test as well to confirm our results 👍🏾 ### Serverless 1. Create a security serverless environment via `qaf`. 4. Create cases in the serverless environment 5. Update images to the build image from this pr via the `--kb-docker-images` flag. 6. Wait for the task to run, and verify the numeric ids are applied to the cases 7. Search for cases by then numeric id via `#{incremental_id value}` and also search for `description + {incremental_id value}` and make sure the query successfully returns ### On-Prem 1. Run main locally 2. Create cases in the local environment 3. Switch branches from main to this branch 4. Wait for the task to run, and verify the numeric ids are applied to the cases 5. Search for cases by then numeric id via `#{id number}` and also search for `description + id number` and make sure the query successfully returns ## OUTDATED The below details were provided for manually updating the mapping via dev tools for testing/validation purposes This PR updates the mapping directly. Here are steps to update the mapping manually in a local instance: 0. Remove changes in `packages/kbn-check-mappings-update-cli/current_mappings.json` 1. Create some tests (there could be error toasts because `incremental_id.text` is not yet created 8. Create an `admin` user and assign `system_indices_superuser` and `superuser` role 9. Go to Dev tools, get the current mapping `GET /.kibana_alerting_cases_9.2.0_001/_mapping` 10. Add `text` as multi-field for `incremental_id` 11. Run `POST /.kibana_alerting_cases_9.2.0_001/_update_by_query` to update existing document 12. Go to Cases and observe the case id can be searched individually or in combination of other texts <details> <summary>mapping update query</summary> ``` PUT /.kibana_alerting_cases_9.2.0_001/_mapping { "properties": { "action": { "dynamic": "false", "properties": { "actionTypeId": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword" } } } } }, "action_task_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" } } }, "ad_hoc_run_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" }, "end": { "type": "date" }, "rule": { "properties": { "alertTypeId": { "type": "keyword" }, "consumer": { "type": "keyword" } } }, "start": { "type": "date" } } }, "alert": { "dynamic": "false", "properties": { "actions": { "type": "nested", "dynamic": "false", "properties": { "actionRef": { "type": "keyword" }, "actionTypeId": { "type": "keyword" }, "group": { "type": "keyword" } } }, "alertTypeId": { "type": "keyword" }, "artifacts": { "properties": { "investigation_guide": { "properties": { "blob": { "type": "text" } } } } }, "consumer": { "type": "keyword" }, "createdAt": { "type": "date" }, "createdBy": { "type": "keyword" }, "enabled": { "type": "boolean" }, "executionStatus": { "properties": { "error": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } }, "lastDuration": { "type": "long" }, "lastExecutionDate": { "type": "date" }, "numberOfTriggeredActions": { "type": "long" }, "status": { "type": "keyword" }, "warning": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } } } }, "lastRun": { "properties": { "alertsCount": { "properties": { "active": { "type": "float" }, "ignored": { "type": "float" }, "new": { "type": "float" }, "recovered": { "type": "float" } } }, "outcome": { "type": "keyword" }, "outcomeOrder": { "type": "float" } } }, "legacyId": { "type": "keyword" }, "mapped_params": { "properties": { "risk_score": { "type": "float" }, "severity": { "type": "keyword" } } }, "monitoring": { "properties": { "run": { "properties": { "calculated_metrics": { "properties": { "p50": { "type": "long" }, "p95": { "type": "long" }, "p99": { "type": "long" }, "success_ratio": { "type": "float" } } }, "last_run": { "properties": { "metrics": { "properties": { "duration": { "type": "long" }, "gap_duration_s": { "type": "float" }, "total_alerts_created": { "type": "float" }, "total_alerts_detected": { "type": "float" }, "total_indexing_duration_ms": { "type": "long" }, "total_search_duration_ms": { "type": "long" } } }, "timestamp": { "type": "date" } } } } } } }, "muteAll": { "type": "boolean" }, "mutedInstanceIds": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "normalizer": "lowercase" } } }, "notifyWhen": { "type": "keyword" }, "params": { "type": "flattened", "ignore_above": 4096 }, "revision": { "type": "long" }, "running": { "type": "boolean" }, "schedule": { "properties": { "interval": { "type": "keyword" } } }, "scheduledTaskId": { "type": "keyword" }, "snoozeSchedule": { "type": "nested", "properties": { "duration": { "type": "long" }, "id": { "type": "keyword" }, "skipRecurrences": { "type": "date", "format": "strict_date_time" } } }, "tags": { "type": "keyword" }, "throttle": { "type": "keyword" }, "updatedAt": { "type": "date" }, "updatedBy": { "type": "keyword" } } }, "api_key_pending_invalidation": { "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" } } }, "cases": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "category": { "type": "keyword" }, "closed_at": { "type": "date" }, "closed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "connector": { "properties": { "fields": { "properties": { "key": { "type": "text" }, "value": { "type": "text" } } }, "name": { "type": "text" }, "type": { "type": "keyword" } } }, "created_at": { "type": "date" }, "created_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "customFields": { "type": "nested", "properties": { "key": { "type": "keyword" }, "type": { "type": "keyword" }, "value": { "type": "keyword", "fields": { "boolean": { "type": "boolean", "ignore_malformed": true }, "date": { "type": "date", "ignore_malformed": true }, "ip": { "type": "ip", "ignore_malformed": true }, "number": { "type": "long", "ignore_malformed": true }, "string": { "type": "text" } } } } }, "description": { "type": "text" }, "duration": { "type": "unsigned_long" }, "external_service": { "properties": { "connector_name": { "type": "keyword" }, "external_id": { "type": "keyword" }, "external_title": { "type": "text" }, "external_url": { "type": "text" }, "pushed_at": { "type": "date" }, "pushed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "incremental_id": { "type": "unsigned_long", "fields": { "raw": { "type": "keyword" } } }, "observables": { "type": "nested", "properties": { "typeKey": { "type": "keyword" }, "value": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "settings": { "properties": { "syncAlerts": { "type": "boolean" } } }, "severity": { "type": "short" }, "status": { "type": "short" }, "tags": { "type": "keyword" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "total_alerts": { "type": "integer" }, "total_comments": { "type": "integer" }, "updated_at": { "type": "date" }, "updated_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "cases-comments": { "dynamic": "false", "properties": { "actions": { "properties": { "type": { "type": "keyword" } } }, "alertId": { "type": "keyword" }, "comment": { "type": "text" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "externalReferenceAttachmentTypeId": { "type": "keyword" }, "owner": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "pushed_at": { "type": "date" }, "type": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-configure": { "dynamic": "false", "properties": { "closure_type": { "type": "keyword" }, "created_at": { "type": "date" }, "owner": { "type": "keyword" } } }, "cases-connector-mappings": { "dynamic": "false", "properties": { "owner": { "type": "keyword" } } }, "cases-incrementing-id": { "dynamic": "false", "properties": { "@timestamp": { "type": "date" }, "last_id": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-rules": { "dynamic": "false", "properties": { "counter": { "type": "unsigned_long" }, "createdAt": { "type": "date" }, "rules": { "properties": { "id": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "cases-telemetry": { "type": "object", "dynamic": "false" }, "cases-user-actions": { "dynamic": "false", "properties": { "action": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "payload": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "comment": { "properties": { "externalReferenceAttachmentTypeId": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "type": { "type": "keyword" } } }, "connector": { "properties": { "type": { "type": "keyword" } } } } }, "type": { "type": "keyword" } } }, "connector_token": { "dynamic": "false", "properties": { "connectorId": { "type": "keyword" }, "tokenType": { "type": "keyword" } } }, "coreMigrationVersion": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "type": "keyword" }, "maintenance-window": { "dynamic": "false", "properties": { "enabled": { "type": "boolean" }, "events": { "type": "date_range", "format": "epoch_millis||strict_date_optional_time" }, "expirationDate": { "type": "date" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "managed": { "type": "boolean" }, "namespace": { "type": "keyword" }, "namespaces": { "type": "keyword" }, "originId": { "type": "keyword" }, "references": { "type": "nested", "properties": { "id": { "type": "keyword" }, "name": { "type": "keyword" }, "type": { "type": "keyword" } } }, "rules-settings": { "dynamic": "false", "properties": { "flapping": { "type": "object" } } }, "scheduled_report": { "dynamic": "false", "properties": { "createdBy": { "type": "keyword" } } }, "type": { "type": "keyword" }, "typeMigrationVersion": { "type": "version" }, "updated_at": { "type": "date" }, "updated_by": { "type": "keyword" } } } ``` </details> ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: Jan Monschke <jan.monschke@elastic.co> Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
rylnd
pushed a commit
to rylnd/kibana
that referenced
this pull request
Oct 17, 2025
## Summary This is a reversion of the revert of this original elastic#228002 of incremental id work. This original revert was done, due to the search functionality in cases being broken when searching on the new `incremental_id` field. It being of type `unsigned_long` meant that ES would not return when it was included alongside text values due to data type mismatch errors [described here](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/number#_which_type_should_i_use).. Rather than creating a new field, and making the existing `incremental_id` field dead weight, we instead [update it to a multi-field](https://www.elastic.co/docs/manage-data/data-store/mapping/update-mappings-examples#add-multi-fields-to-an-existing-field), so we can search on this value as text alongside other cases values. The update of the mapping was done here: elastic#234054 #### Functional Changes From Reversion 1. Use of `incremental_id.text` in search functionality in place of `incremental_id` 2. There is no longer an advanced setting to hide the feature in the UI as we feel comfortable releasing it as is, and the field is currently only metadata and doesn't introduce any functional changes outside of searching. ## Testing: Feature Flag: `xpack.cases.incrementalId.enabled: true`. Currently disabled and will be enabled after additional testing during FF When running a clean branch, the feature will work correctly. We've verified locally that the mapping update works successfully via the methods described below, but feel free to test as well to confirm our results 👍🏾 ### Serverless 1. Create a security serverless environment via `qaf`. 4. Create cases in the serverless environment 5. Update images to the build image from this pr via the `--kb-docker-images` flag. 6. Wait for the task to run, and verify the numeric ids are applied to the cases 7. Search for cases by then numeric id via `#{incremental_id value}` and also search for `description + {incremental_id value}` and make sure the query successfully returns ### On-Prem 1. Run main locally 2. Create cases in the local environment 3. Switch branches from main to this branch 4. Wait for the task to run, and verify the numeric ids are applied to the cases 5. Search for cases by then numeric id via `#{id number}` and also search for `description + id number` and make sure the query successfully returns ## OUTDATED The below details were provided for manually updating the mapping via dev tools for testing/validation purposes This PR updates the mapping directly. Here are steps to update the mapping manually in a local instance: 0. Remove changes in `packages/kbn-check-mappings-update-cli/current_mappings.json` 1. Create some tests (there could be error toasts because `incremental_id.text` is not yet created 8. Create an `admin` user and assign `system_indices_superuser` and `superuser` role 9. Go to Dev tools, get the current mapping `GET /.kibana_alerting_cases_9.2.0_001/_mapping` 10. Add `text` as multi-field for `incremental_id` 11. Run `POST /.kibana_alerting_cases_9.2.0_001/_update_by_query` to update existing document 12. Go to Cases and observe the case id can be searched individually or in combination of other texts <details> <summary>mapping update query</summary> ``` PUT /.kibana_alerting_cases_9.2.0_001/_mapping { "properties": { "action": { "dynamic": "false", "properties": { "actionTypeId": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword" } } } } }, "action_task_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" } } }, "ad_hoc_run_params": { "dynamic": "false", "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" }, "end": { "type": "date" }, "rule": { "properties": { "alertTypeId": { "type": "keyword" }, "consumer": { "type": "keyword" } } }, "start": { "type": "date" } } }, "alert": { "dynamic": "false", "properties": { "actions": { "type": "nested", "dynamic": "false", "properties": { "actionRef": { "type": "keyword" }, "actionTypeId": { "type": "keyword" }, "group": { "type": "keyword" } } }, "alertTypeId": { "type": "keyword" }, "artifacts": { "properties": { "investigation_guide": { "properties": { "blob": { "type": "text" } } } } }, "consumer": { "type": "keyword" }, "createdAt": { "type": "date" }, "createdBy": { "type": "keyword" }, "enabled": { "type": "boolean" }, "executionStatus": { "properties": { "error": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } }, "lastDuration": { "type": "long" }, "lastExecutionDate": { "type": "date" }, "numberOfTriggeredActions": { "type": "long" }, "status": { "type": "keyword" }, "warning": { "properties": { "message": { "type": "keyword" }, "reason": { "type": "keyword" } } } } }, "lastRun": { "properties": { "alertsCount": { "properties": { "active": { "type": "float" }, "ignored": { "type": "float" }, "new": { "type": "float" }, "recovered": { "type": "float" } } }, "outcome": { "type": "keyword" }, "outcomeOrder": { "type": "float" } } }, "legacyId": { "type": "keyword" }, "mapped_params": { "properties": { "risk_score": { "type": "float" }, "severity": { "type": "keyword" } } }, "monitoring": { "properties": { "run": { "properties": { "calculated_metrics": { "properties": { "p50": { "type": "long" }, "p95": { "type": "long" }, "p99": { "type": "long" }, "success_ratio": { "type": "float" } } }, "last_run": { "properties": { "metrics": { "properties": { "duration": { "type": "long" }, "gap_duration_s": { "type": "float" }, "total_alerts_created": { "type": "float" }, "total_alerts_detected": { "type": "float" }, "total_indexing_duration_ms": { "type": "long" }, "total_search_duration_ms": { "type": "long" } } }, "timestamp": { "type": "date" } } } } } } }, "muteAll": { "type": "boolean" }, "mutedInstanceIds": { "type": "keyword" }, "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "normalizer": "lowercase" } } }, "notifyWhen": { "type": "keyword" }, "params": { "type": "flattened", "ignore_above": 4096 }, "revision": { "type": "long" }, "running": { "type": "boolean" }, "schedule": { "properties": { "interval": { "type": "keyword" } } }, "scheduledTaskId": { "type": "keyword" }, "snoozeSchedule": { "type": "nested", "properties": { "duration": { "type": "long" }, "id": { "type": "keyword" }, "skipRecurrences": { "type": "date", "format": "strict_date_time" } } }, "tags": { "type": "keyword" }, "throttle": { "type": "keyword" }, "updatedAt": { "type": "date" }, "updatedBy": { "type": "keyword" } } }, "api_key_pending_invalidation": { "properties": { "apiKeyId": { "type": "keyword" }, "createdAt": { "type": "date" } } }, "cases": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "category": { "type": "keyword" }, "closed_at": { "type": "date" }, "closed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "connector": { "properties": { "fields": { "properties": { "key": { "type": "text" }, "value": { "type": "text" } } }, "name": { "type": "text" }, "type": { "type": "keyword" } } }, "created_at": { "type": "date" }, "created_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } }, "customFields": { "type": "nested", "properties": { "key": { "type": "keyword" }, "type": { "type": "keyword" }, "value": { "type": "keyword", "fields": { "boolean": { "type": "boolean", "ignore_malformed": true }, "date": { "type": "date", "ignore_malformed": true }, "ip": { "type": "ip", "ignore_malformed": true }, "number": { "type": "long", "ignore_malformed": true }, "string": { "type": "text" } } } } }, "description": { "type": "text" }, "duration": { "type": "unsigned_long" }, "external_service": { "properties": { "connector_name": { "type": "keyword" }, "external_id": { "type": "keyword" }, "external_title": { "type": "text" }, "external_url": { "type": "text" }, "pushed_at": { "type": "date" }, "pushed_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "incremental_id": { "type": "unsigned_long", "fields": { "raw": { "type": "keyword" } } }, "observables": { "type": "nested", "properties": { "typeKey": { "type": "keyword" }, "value": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "settings": { "properties": { "syncAlerts": { "type": "boolean" } } }, "severity": { "type": "short" }, "status": { "type": "short" }, "tags": { "type": "keyword" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "total_alerts": { "type": "integer" }, "total_comments": { "type": "integer" }, "updated_at": { "type": "date" }, "updated_by": { "properties": { "email": { "type": "keyword" }, "full_name": { "type": "keyword" }, "profile_uid": { "type": "keyword" }, "username": { "type": "keyword" } } } } }, "cases-comments": { "dynamic": "false", "properties": { "actions": { "properties": { "type": { "type": "keyword" } } }, "alertId": { "type": "keyword" }, "comment": { "type": "text" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "externalReferenceAttachmentTypeId": { "type": "keyword" }, "owner": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "pushed_at": { "type": "date" }, "type": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-configure": { "dynamic": "false", "properties": { "closure_type": { "type": "keyword" }, "created_at": { "type": "date" }, "owner": { "type": "keyword" } } }, "cases-connector-mappings": { "dynamic": "false", "properties": { "owner": { "type": "keyword" } } }, "cases-incrementing-id": { "dynamic": "false", "properties": { "@timestamp": { "type": "date" }, "last_id": { "type": "keyword" }, "updated_at": { "type": "date" } } }, "cases-rules": { "dynamic": "false", "properties": { "counter": { "type": "unsigned_long" }, "createdAt": { "type": "date" }, "rules": { "properties": { "id": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "cases-telemetry": { "type": "object", "dynamic": "false" }, "cases-user-actions": { "dynamic": "false", "properties": { "action": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "properties": { "username": { "type": "keyword" } } }, "owner": { "type": "keyword" }, "payload": { "dynamic": "false", "properties": { "assignees": { "properties": { "uid": { "type": "keyword" } } }, "comment": { "properties": { "externalReferenceAttachmentTypeId": { "type": "keyword" }, "persistableStateAttachmentTypeId": { "type": "keyword" }, "type": { "type": "keyword" } } }, "connector": { "properties": { "type": { "type": "keyword" } } } } }, "type": { "type": "keyword" } } }, "connector_token": { "dynamic": "false", "properties": { "connectorId": { "type": "keyword" }, "tokenType": { "type": "keyword" } } }, "coreMigrationVersion": { "type": "keyword" }, "created_at": { "type": "date" }, "created_by": { "type": "keyword" }, "maintenance-window": { "dynamic": "false", "properties": { "enabled": { "type": "boolean" }, "events": { "type": "date_range", "format": "epoch_millis||strict_date_optional_time" }, "expirationDate": { "type": "date" }, "title": { "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "updatedAt": { "type": "date" } } }, "managed": { "type": "boolean" }, "namespace": { "type": "keyword" }, "namespaces": { "type": "keyword" }, "originId": { "type": "keyword" }, "references": { "type": "nested", "properties": { "id": { "type": "keyword" }, "name": { "type": "keyword" }, "type": { "type": "keyword" } } }, "rules-settings": { "dynamic": "false", "properties": { "flapping": { "type": "object" } } }, "scheduled_report": { "dynamic": "false", "properties": { "createdBy": { "type": "keyword" } } }, "type": { "type": "keyword" }, "typeMigrationVersion": { "type": "version" }, "updated_at": { "type": "date" }, "updated_by": { "type": "keyword" } } } ``` </details> ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [ ] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. ### Identify risks Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss. Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging. - [ ] [See some risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) - [ ] ... --------- Co-authored-by: Jan Monschke <jan.monschke@elastic.co> Co-authored-by: Michael Olorunnisola <michael.olorunnisola@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reverts #222874 and #226935 .
The mappings and the introduction of the saved object type for the increment counter object cannot be reverted.
In a future PR we will bring this feature back under a different name and reuse the increment counter object that has been introduced already.