Upgrade @elastic/elasticsearch to 9.3.1

[afharo]

Summary

This PR upgrades @elastic/elasticsearch to 9.3.1.

It triggered many Typescript issues due to the new utility type ExactlyOne<T> used in the Elasticsearch library.

Expand for more details of the changes

---

Root Cause

The new client version introduces an ExactlyOne<T> utility type for key Elasticsearch types: QueryDslQueryContainer, IngestProcessorContainer, BulkOperationContainer, and AggregationsAggregationContainer. This type creates a union where exactly one property is present and all others are ?: never. When the underlying interface had all-optional properties, the resulting union also includes undefined as a member. This caused three categories of breakage:

1. keyof resolves to never — Since undefined is part of the union, keyof QueryDslQueryContainer becomes never, breaking any Pick<QueryDslQueryContainer, ...> or keyof QueryDslQueryContainer usage.
2. Properties are "possibly undefined" — Any variable typed as one of these containers is now possibly undefined, so accessing .bool, .filter, etc. triggers TS18048.
3. Indexed access fails — QueryDslQueryContainer['match_phrase'] fails because the key can't be resolved on a union that includes undefined.

---

Fix Patterns Applied (124 files, +618 / -403 lines)

Pattern 1: NonNullable<T> for indexed access and keyof

Wherever code used keyof QueryDslQueryContainer or Pick<QueryDslQueryContainer, "bool" | "ids">, it was changed to operate on NonNullable<QueryDslQueryContainer> first to strip undefined from the union:

// Before
type AlertsQueryType = Pick<QueryDslQueryContainer, "bool" | "ids">;

// After
type AlertsQueryType = Partial<Pick<NonNullable<QueryDslQueryContainer>, "bool" | "ids">>;

This pattern was applied in alerting types, rule registry, alerts-table, kbn-grouping, task manager, kbn-streamlang, and kbn-streams-schema.

Pattern 2: Optional chaining for "possibly undefined" access

In source files where a variable typed as QueryDslQueryContainer (or similar) was accessed, optional chaining was added:

// Before
kueryQuery.bool
// After
kueryQuery?.bool

Applied in kbn-es-query, saved-objects migration, aiops, ML, observability, security solution, and many others.

Pattern 3: NonNullable<T> in type casts

When constructing objects and casting them as ESFilter (which maps to QueryDslQueryContainer), the cast was changed to as NonNullable<ESFilter> to prevent TypeScript from treating the freshly-constructed value as possibly undefined:

// Before
const filter = { bool: { ... } } as ESFilter;
// After
const filter = { bool: { ... } } as NonNullable<ESFilter>;

Applied in threshold bucket filters, alert conflict resolver, session index, etc.

Pattern 4: NonNullable<T>['prop'] for property type extraction

Direct indexed access on the container types was replaced with NonNullable wrapping:

// Before
estypes.QueryDslQueryContainer['match_phrase']
// After
NonNullable<estypes.QueryDslQueryContainer>['match_phrase']

Applied in phrase_filter.ts, range_filter.ts, and filter building utilities.

Pattern 5: Non-null assertions in test files

In test files where values from toElasticsearchQuery() or bulk operations were known to be defined, non-null assertions (!) were added rather than full null-checking:

// Before
expect(result.bool.should).toEqual(...)
// After
expect(result!.bool!.should).toEqual(...)

Applied across kbn-es-query tests, migration helpers tests, ML inference pipeline tests, math processor tests, etc.

Pattern 6: Structural type replacements

Where Extract<BulkOperationContainer, { delete: unknown }> resolved to never, the parameter type was replaced with a direct structural type:

// Before
Array<Extract<BulkOperationContainer, { delete: unknown }>>
// After
Array<{ delete: BulkDeleteOperation }>

Applied in security session_index.ts.

---

Summary of the changes by Area

Area	Files Changed	Key Changes
kbn-es-query (core query/filter lib)	~12	NonNullable for type access, optional chaining, test assertions
Saved Objects migration	3	Optional chaining on excludeOnUpgradeQuery.bool
Alerting / Rule Registry	~8	Partial<Pick<NonNullable<...>>> pattern for query types
ML / Aiops	~25	Default query types, optional chaining, cast adjustments
Security Solution	~10	Threshold filters, network DSL, alert bulk actions
Observability (Infra, SLO, UX, APM)	~15	Query construction, alert summaries, web vitals queries
Streams / kbn-streamlang	~6	keyof NonNullable<IngestProcessorContainer>, null checks
Enterprise Search	~8	ML inference pipeline processor types
Task Manager	1	Pick<NonNullable<...>> for pinned/bool query types
Other (Cases, Transform, Vega, etc.)	~20+	Various combinations of the above patterns

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[dhurley14]

code review only LGTM @security-detection-engine

[dhurley14]

Thanks!

[pmuellr]

LGTM, thanks for removing the hallucinations! :-)

[thomheymann]

@Kerry350 It looks like the IngestProcessorContainer type has changed in @elastic/elasticsearch. Does this change (and the others in this PR) make sense to you or would it be better to use NonNullable<IngestProcessorContainer> type instead of IngestProcessorContainer as is so that we don't need to guard against null across the codebase?

[Kerry350]

Using NonNullable<IngestProcessorContainer> makes sense to me rather than repeated guards 👌

[afharo]

I noticed that adding NonNullable<IngestProcessorContainer> to this file would cause many changes downstream: the pipe in index.ts would lead to changing the output type of conversions.ts, which would complain for many of the process*Processor methods inside the flatMap loop.

Instead, this solution simplifies the changes: b52b911

WDYT?

[Kerry350]

That looks okay, I'll approve 👌

[smith]

obs-presentation changes LGTM (re-review, code review only).

Previous comments addressed — alerts_overview.tsx and alerts_tab_badge.tsx changes correctly reverted.

Remaining obs changes are clean: change_point casts removed (now properly typed in 9.3.1), standard optional chaining and NonNullable patterns applied consistently across infra, SLO, UX, observability_agent_builder, and observability_ai_assistant_app.

[ashokaditya]

Changes to x-pack/solutions/security/plugins/security_solution/common/endpoint/utils/endpoint_metadata_filter.test.ts LGTM.

[kdelemme]

actionable-obs code change lgtm

[afharo]

@elasticmachine merge upstream

[miltonhultgren]

SigEvents change (removing // @ts-expect-error) LGTM

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: dfcc551
• Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-253660-dfcc5511840a

Failed CI Steps

• Check Types

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
aiops	521.2KB	521.3KB	+78.0B
cases	1.6MB	1.6MB	+64.0B
datasetQuality	577.4KB	577.4KB	+6.0B
dataVisualizer	600.6KB	600.6KB	+44.0B
enterpriseSearch	953.2KB	953.3KB	+15.0B
ml	5.8MB	5.8MB	+73.0B
searchIndices	215.3KB	215.4KB	+37.0B
searchPlayground	246.8KB	246.8KB	+37.0B
streamsApp	1.7MB	1.7MB	+12.0B
ux	134.8KB	135.1KB	+342.0B
total			+708.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
kbnUiSharedDeps-srcJs	4.7MB	4.7MB	+15.0B

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	718	717	-1

Total ESLint disabled count

id	before	after	diff
securitySolution	823	822	-1

History

• 💔 Build #399531 failed b52b911
• 💛 Build #399155 was flaky 960a178
• 💔 Build #398821 failed d86c5e9
• 💛 Build #398595 was flaky 352d6d3

cc @afharo