[Fields Metadata] Update dependency @elastic/ecs to ^9.2.0 and optimize bundle by tonyghiani · Pull Request #245798 · elastic/kibana

tonyghiani · 2025-12-10T10:58:57Z

📓 Summary

Since a schema change in the new @elastic/ecs package release was conflicting with our tests, the update is being manually done here.

I also took the chance to shrink some extra KBs from the bundle, removing unnecessary deps.

elasticmachine · 2025-12-10T10:59:00Z

Pinging @elastic/obs-onboarding-team (Team:obs-onboarding)

tonyghiani · 2025-12-10T11:01:16Z

 */
 import { LRUCache } from 'lru-cache';
-import hash from 'object-hash';
+import stringify from 'json-stable-stringify';


note: We can get rid of object hashing and use a much lighter stable stringify here since the params are not a complex structure that requires deep hashing.

@rStelmach we should change this in favour of @kbn/std as this was done in #251890

…atus --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/streams --include-path /api/fleet --include-path /api/saved_objects/_import --include-path /api/saved_objects/_export --include-path /api/maintenance_window --include-path /api/agent_builder --update

kdelemme

actionable-obs code change lgtm

dhurley14

Thanks for adding the directory and updating the backport labels after we spoke. I would like to see the number of fields in the our cypress test remain the same, just with the updated names. Thanks.

dhurley14 · 2026-02-09T16:16:03Z

+      '"matched.field":["myhash.mysha256"]',
+      '"matched.index":["logs-ti_abusech.malware"]',
+      '"matched.type":["indicator_match_rule"]',
+    ];


This doesn't contain all the fields that were previously present. It looks like matched.atomic should now be x-pack/solutions/security/plugins/security_solution/common/field_maps/9.3.1/alerts.ts

Please update these field names to match the new ones introduced in this PR rather than deleting them.

dhurley14

Thanks for adding the directory and updating the backport labels after we spoke. I would like to see the number of fields in the our cypress test remain the same, just with the updated names. Thanks.

elasticmachine · 2026-02-10T12:15:06Z

💚 Build Succeeded

Buildkite Build
Commit: 44e5fdc

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`fieldsMetadata`	60	63	+3

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`automaticImport`	1.3MB	1.4MB	+156.8KB
`cases`	1.4MB	1.5MB	+156.8KB
`embeddableAlertsTable`	1017.8KB	1.1MB	+156.8KB
`fieldsMetadata`	71.9KB	42.7KB	-29.2KB
`ml`	5.6MB	5.8MB	+156.8KB
`observability`	1.8MB	2.0MB	+157.1KB
`securitySolution`	10.9MB	11.0MB	+157.1KB
`slo`	1.1MB	1.1MB	+234.0B
`synthetics`	1.0MB	1.0MB	+240.0B
`triggersActionsUi`	1.6MB	1.8MB	+156.8KB
total			⚠️ +1.0MB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`timelines`	170.8KB	171.1KB	+329.0B

Unknown metric groups

API count

id	before	after	diff
`@kbn/alerts-as-data-utils`	34	35	+1

ESLint disabled line counts

id	before	after	diff
`timelines`	24	25	+1

Total ESLint disabled count

id	before	after	diff
`timelines`	24	25	+1

History

💔 Build #391961 failed bc4d441
💔 Build #390341 failed af78a73
💛 Build #388564 was flaky 525552c
💚 Build #387998 succeeded d422cce
💔 Build #384226 failed f5b5809

dhurley14 · 2026-02-11T02:03:09Z

+      '"matched.field":["myhash.mysha256"]',
+      '"matched.index":["logs-ti_abusech.malware"]',
+      '"matched.type":["indicator_match_rule"]',
+    ];


kibanamachine · 2026-02-11T12:12:57Z

Starting backport for target branches: 9.2, 9.3

https://github.com/elastic/kibana/actions/runs/21904573072

kibanamachine · 2026-02-11T12:20:51Z

💔 All backports failed

Status	Branch	Result
❌	9.2	Backport failed because of merge conflicts
❌	9.3	Backport failed because of merge conflicts You might need to backport the following PRs to 9.3: - [One Workflow][Bug] Toggling workflow enabled state corrupts YAML conten (#252676) - [Infra][Hosts] Fix inventory Network Inbound and Outbound alert rules (#251855) - [One Workflow] fix: prevent alert rule actions from triggering disabled workflows (#252673) - Loosen `apiClient` ESLint rule on Security (#252212) - Update kubernetes templates for elastic-agent (#247970) - [CI] Move faster beta build to default (#252200)

Manual backport

To create the backport manually run:

node scripts/backport --pr 245798

Questions ?

Please refer to the Backport tool documentation

closes: #252704 ## Summary Bumps `@elastic/ecs` from `9.2.0` to `9.3.0` and fixes all resulting CI test failures. ## Changes ### Dependency bump - **`package.json` / `yarn.lock`** - updated `@elastic/ecs` from `9.2.0` to `9.3.0` ### Snapshot updates (ECS field expansion + version string change) - **`x-pack/platform/plugins/shared/stack_alerts/server/rule_types/es_query/util.test.ts`** - updated inline snapshot for `getSourceFields()` to include ~324 new ECS fields added in 9.3.0 (e.g. `entity.*`, `entity.target.*`, `host.target.*`) - **`src/core/packages/logging/server-internal/src/__snapshots__/logging_system.test.ts.snap`** - updated `ecs.version` from `"9.3.0-dev"` to `"9.3.0"` across all snapshot entries ### Generated schema regeneration - **`src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/ecs_schema.ts`** - regenerated io-ts schemas to reflect the new ECS 9.3.0 field definitions in `ecsFieldMap` ### Test fixture updates - **`x-pack/platform/test/api_integration/apis/maps/maps_telemetry.ts`** - updated `geo_point` field count assertion from `63` to `71` to account for new ECS geo_point fields in cluster stats - **`x-pack/solutions/security/test/fixtures/es_archives/security_solution/alerts/8.1.0/mappings.json.gz`** - raised `total_fields.limit` from `2500` to `3500` in test archive mappings to prevent `illegal_argument_exception` when loading the SIEM alert fixture with expanded ECS fields (same approach used in #245798 for `8.8.0` archives, test-only, production limit in `alerts_service.ts` remains at `2500`)

closes: elastic#252704 ## Summary Bumps `@elastic/ecs` from `9.2.0` to `9.3.0` and fixes all resulting CI test failures. ## Changes ### Dependency bump - **`package.json` / `yarn.lock`** - updated `@elastic/ecs` from `9.2.0` to `9.3.0` ### Snapshot updates (ECS field expansion + version string change) - **`x-pack/platform/plugins/shared/stack_alerts/server/rule_types/es_query/util.test.ts`** - updated inline snapshot for `getSourceFields()` to include ~324 new ECS fields added in 9.3.0 (e.g. `entity.*`, `entity.target.*`, `host.target.*`) - **`src/core/packages/logging/server-internal/src/__snapshots__/logging_system.test.ts.snap`** - updated `ecs.version` from `"9.3.0-dev"` to `"9.3.0"` across all snapshot entries ### Generated schema regeneration - **`src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/ecs_schema.ts`** - regenerated io-ts schemas to reflect the new ECS 9.3.0 field definitions in `ecsFieldMap` ### Test fixture updates - **`x-pack/platform/test/api_integration/apis/maps/maps_telemetry.ts`** - updated `geo_point` field count assertion from `63` to `71` to account for new ECS geo_point fields in cluster stats - **`x-pack/solutions/security/test/fixtures/es_archives/security_solution/alerts/8.1.0/mappings.json.gz`** - raised `total_fields.limit` from `2500` to `3500` in test archive mappings to prevent `illegal_argument_exception` when loading the SIEM alert fixture with expanded ECS fields (same approach used in elastic#245798 for `8.8.0` archives, test-only, production limit in `alerts_service.ts` remains at `2500`)

tonyghiani added 5 commits December 9, 2025 16:24

feat(fields-metadata): update types to match values from update

760f6b3

refactor(fields-metadata): optimize bundle for cache key generation

9245f61

chore(fields-metadata): update elastic/ecs version

80e6069

feat(fields-metadata): update types to match values from update

703f28b

chore(fields-metadata): remove unnecessary dependency

1d164e0

tonyghiani added release_note:skip Skip the PR/issue when compiling release notes backport:all-open Backport to all branches that could still receive a release labels Dec 10, 2025

tonyghiani requested a review from a team as a code owner December 10, 2025 10:58

tonyghiani added the Team:obs-onboarding Observability Onboarding Team label Dec 10, 2025

tonyghiani commented Dec 10, 2025

View reviewed changes

kibanamachine and others added 2 commits December 10, 2025 11:16

Merge branch 'main' into feat/upgrade-elastic-ecs

5e15b7f

rStelmach requested review from a team as code owners December 22, 2025 11:35

rStelmach force-pushed the feat/upgrade-elastic-ecs branch from b4834c6 to 3ae1957 Compare December 23, 2025 13:34

PhilippeOberti approved these changes Dec 23, 2025

View reviewed changes

rStelmach requested review from a team as code owners December 24, 2025 14:31

rStelmach force-pushed the feat/upgrade-elastic-ecs branch from b2e30aa to ba3a46f Compare December 25, 2025 12:38

rStelmach marked this pull request as draft December 29, 2025 16:29

rStelmach force-pushed the feat/upgrade-elastic-ecs branch from e881bb5 to 5e15b7f Compare December 30, 2025 13:47

rStelmach and others added 8 commits December 30, 2025 14:47

Merge branch 'main' into feat/upgrade-elastic-ecs

8b1d86e

update snapshots and chema

430e3f5

fix quick_checks

6460c06

update more tests

c6372b4

update schemas

cd4a9e8

Merge branch 'main' into feat/upgrade-elastic-ecs

38e63c5

add new elemtns to excluded types array

ff3cbdb

update ecs schema and add helper function

1c8ebf6

kfirpeled mentioned this pull request Feb 5, 2026

Upgrade Kibana's ECS version to latest #246727

Closed

2 tasks

kdelemme approved these changes Feb 5, 2026

View reviewed changes

baileycash-elastic approved these changes Feb 5, 2026

View reviewed changes

rStelmach and others added 2 commits February 9, 2026 14:07

Merge branch 'main' into feat/upgrade-elastic-ecs

213532c

add 9.3.1 folder

bc4d441

rStelmach added backport:version Backport to applied version labels v9.3.0 v9.2.0 and removed backport:all-open Backport to all branches that could still receive a release labels Feb 9, 2026

dhurley14 requested changes Feb 9, 2026

View reviewed changes

add missing fields in cypress test

44e5fdc

rStelmach requested a review from dhurley14 February 10, 2026 12:18

dhurley14 approved these changes Feb 11, 2026

View reviewed changes

rStelmach and others added 2 commits February 11, 2026 10:25

Merge branch 'main' into feat/upgrade-elastic-ecs

6d9d97e

replace stringify package

98ec314

rStelmach approved these changes Feb 11, 2026

View reviewed changes

rStelmach merged commit 7569676 into elastic:main Feb 11, 2026
17 checks passed

kibanamachine added the v9.4.0 label Feb 11, 2026

rStelmach added backport:skip This PR does not require backporting and removed backport:version Backport to applied version labels v9.2.0 v9.3.0 labels Feb 12, 2026

tonyghiani deleted the feat/upgrade-elastic-ecs branch February 20, 2026 12:05

rStelmach mentioned this pull request Feb 24, 2026

Update dependency @elastic/ecs to v9.3.0 #254661

Merged

Conversation

tonyghiani commented Dec 10, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📓 Summary

Uh oh!

elasticmachine commented Dec 10, 2025

Uh oh!

tonyghiani Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

tonyghiani Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

kdelemme left a comment

Choose a reason for hiding this comment

Uh oh!

dhurley14 left a comment

Choose a reason for hiding this comment

Uh oh!

dhurley14 Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

rStelmach Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

dhurley14 Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

dhurley14 left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Feb 10, 2026

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

API count

ESLint disabled line counts

Total ESLint disabled count

History

Uh oh!

dhurley14 Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Feb 11, 2026

Uh oh!

kibanamachine commented Feb 11, 2026

💔 All backports failed

Manual backport

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

tonyghiani commented Dec 10, 2025 •

edited by kibanamachine

Loading