[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true#263717
Merged
juliaElastic merged 7 commits intoelastic:mainfrom Apr 17, 2026
Conversation
Contributor
Catch flakiness early (recommended)Recommended before merge: run the flaky test runner against this PR to catch flakiness early. Trigger a run with the Flaky Test Runner UI or post this comment on the PR: This check is experimental. Share your feedback in the #appex-qa channel. Posted via Macroscope — Flaky Test Runner nudge |
juliaElastic
added
release_note:fix
backport:version
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
botelastic
Bot
added
the
Team:Fleet
Contributor
|
Pinging @elastic/fleet (Team:Fleet) |
Contributor
ApprovabilityVerdict: Needs human review This PR modifies query filter logic across multiple Fleet package policy services to change which policies are included in counts and lists. While the intent is a bug fix (including 8.x policies without the latest_revision field), it changes runtime query behavior across several code paths. The author does not own any of the modified files, which are all owned by @elastic/fleet. You can customize Macroscope's approvability policy. Learn more. |
criamico
reviewed
Apr 16, 2026
| kuery | ||
| ? `${savedObjectType}.attributes.latest_revision:true AND (${kuery})` | ||
| : `${savedObjectType}.attributes.latest_revision:true` | ||
| ? `NOT ${savedObjectType}.attributes.latest_revision:false AND (${kuery})` |
Member
There was a problem hiding this comment.
since this part is repeated a lot maybe it could be extracted to a common function or something like this
…d add test cleanup - Extract repeated NOT latest_revision:false filter expression into a buildCurrentRevisionFilter() helper used across all 6 call sites - Add try/finally cleanup to integration test that strips latest_revision from a SO doc, restoring it after assertions so it does not affect subsequent tests Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When list() is called with fields:['policy_ids'] (e.g. from checkFleetServerVersionsForSecretsStorage), the SO client returns partial attributes and attributes.name is undefined — crashing with TypeError on the audit log call. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
criamico
approved these changes
Apr 17, 2026
Member
criamico
left a comment
criamico
left a comment
There was a problem hiding this comment.
Thanks for the changes! LGTM
Contributor
⏳ Build in-progress, with failures
Failed CI StepsTest Failures
History
|
Contributor
|
Starting backport for target branches: 9.2, 9.3, 9.4 https://github.com/elastic/kibana/actions/runs/24563264380 |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Apr 17, 2026
…se instead of latest_revision:true (elastic#263717) ## Summary Fixes the `latest_revision` filter used when listing and counting package policies. The previous filter (`latest_revision:true`) excluded 8.x policies that never had `latest_revision` persisted to Elasticsearch, causing them to appear with a count of 0 in the Installed Integrations list after upgrading from 8.x to 9.x. The fix changes all filters from `latest_revision:true` to `NOT latest_revision:false`. This treats a missing field as equivalent to `true` (i.e. a current revision), which is the correct semantic — a policy without the field is a current revision, not a previous one. ### Root cause The `latest_revision` field was introduced in SO model version 19 (package rollback feature, PR elastic#222779). For policies created in 8.x, the field is absent in ES because: - The v2 migration backfill only runs on one node in a multi-node cluster; other nodes skip document transforms - Patch upgrades (e.g. 9.2.7 → 9.2.8) skip the backfill entirely since no outdated documents exist - The list aggregation uses `perPage: 0`, bypassing the read-time in-memory backfill path entirely ### Changes - **`package_policies_aggregation.ts`** (Bug 1 + Bug 2): Change filter to `NOT :false`; add `size: SO_SEARCH_LIMIT` to terms aggregation to prevent ES default truncation at 10 buckets - **`services/epm/packages/get.ts`** (Bug 3): Add `NOT latest_revision:false` to `getPackageUsageStats` so `:prev` rollback docs are excluded from stats counts - **`services/package_policy.ts`**: Apply same filter fix to `list()`, `listIds()`, `getAllItemsIds()`, `getCompiledVersionsForAgentPolicy()`, and `findAllForAgentPolicy()` Closes elastic#262491 Closes elastic/ingest-dev#7478 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> (cherry picked from commit 222e630)
Contributor
💔 Some backports could not be created
Note: Successful backport PRs will be merged automatically after passing CI. Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
kibanamachine
added a commit
that referenced
this pull request
Apr 17, 2026
…on:false instead of latest_revision:true (#263717) (#264033) # Backport This will backport the following commits from `main` to `9.4`: - [[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)](#263717) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Julia Bardi","email":"90178898+juliaElastic@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-04-17T11:41:48Z","message":"[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)\n\n## Summary\n\nFixes the `latest_revision` filter used when listing and counting\npackage policies. The previous filter (`latest_revision:true`) excluded\n8.x policies that never had `latest_revision` persisted to\nElasticsearch, causing them to appear with a count of 0 in the Installed\nIntegrations list after upgrading from 8.x to 9.x.\n\nThe fix changes all filters from `latest_revision:true` to `NOT\nlatest_revision:false`. This treats a missing field as equivalent to\n`true` (i.e. a current revision), which is the correct semantic — a\npolicy without the field is a current revision, not a previous one.\n\n### Root cause\n\nThe `latest_revision` field was introduced in SO model version 19\n(package rollback feature, PR #222779). For policies created in 8.x, the\nfield is absent in ES because:\n- The v2 migration backfill only runs on one node in a multi-node\ncluster; other nodes skip document transforms\n- Patch upgrades (e.g. 9.2.7 → 9.2.8) skip the backfill entirely since\nno outdated documents exist\n- The list aggregation uses `perPage: 0`, bypassing the read-time\nin-memory backfill path entirely\n\n### Changes\n\n- **`package_policies_aggregation.ts`** (Bug 1 + Bug 2): Change filter\nto `NOT :false`; add `size: SO_SEARCH_LIMIT` to terms aggregation to\nprevent ES default truncation at 10 buckets\n- **`services/epm/packages/get.ts`** (Bug 3): Add `NOT\nlatest_revision:false` to `getPackageUsageStats` so `:prev` rollback\ndocs are excluded from stats counts\n- **`services/package_policy.ts`**: Apply same filter fix to `list()`,\n`listIds()`, `getAllItemsIds()`, `getCompiledVersionsForAgentPolicy()`,\nand `findAllForAgentPolicy()`\n\nCloses #262491\nCloses https://github.com/elastic/ingest-dev/issues/7478\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>","sha":"222e63005e6b113dd2ffffd7e75893a7be70e4be","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","v9.4.0","v9.5.0","v9.3.4","v9.2.9"],"title":"[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true","number":263717,"url":"https://github.com/elastic/kibana/pull/263717","mergeCommit":{"message":"[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)\n\n## Summary\n\nFixes the `latest_revision` filter used when listing and counting\npackage policies. The previous filter (`latest_revision:true`) excluded\n8.x policies that never had `latest_revision` persisted to\nElasticsearch, causing them to appear with a count of 0 in the Installed\nIntegrations list after upgrading from 8.x to 9.x.\n\nThe fix changes all filters from `latest_revision:true` to `NOT\nlatest_revision:false`. This treats a missing field as equivalent to\n`true` (i.e. a current revision), which is the correct semantic — a\npolicy without the field is a current revision, not a previous one.\n\n### Root cause\n\nThe `latest_revision` field was introduced in SO model version 19\n(package rollback feature, PR #222779). For policies created in 8.x, the\nfield is absent in ES because:\n- The v2 migration backfill only runs on one node in a multi-node\ncluster; other nodes skip document transforms\n- Patch upgrades (e.g. 9.2.7 → 9.2.8) skip the backfill entirely since\nno outdated documents exist\n- The list aggregation uses `perPage: 0`, bypassing the read-time\nin-memory backfill path entirely\n\n### Changes\n\n- **`package_policies_aggregation.ts`** (Bug 1 + Bug 2): Change filter\nto `NOT :false`; add `size: SO_SEARCH_LIMIT` to terms aggregation to\nprevent ES default truncation at 10 buckets\n- **`services/epm/packages/get.ts`** (Bug 3): Add `NOT\nlatest_revision:false` to `getPackageUsageStats` so `:prev` rollback\ndocs are excluded from stats counts\n- **`services/package_policy.ts`**: Apply same filter fix to `list()`,\n`listIds()`, `getAllItemsIds()`, `getCompiledVersionsForAgentPolicy()`,\nand `findAllForAgentPolicy()`\n\nCloses #262491\nCloses https://github.com/elastic/ingest-dev/issues/7478\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>","sha":"222e63005e6b113dd2ffffd7e75893a7be70e4be"}},"sourceBranch":"main","suggestedTargetBranches":["9.4","9.3","9.2"],"targetPullRequestStates":[{"branch":"9.4","label":"v9.4.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/263717","number":263717,"mergeCommit":{"message":"[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)\n\n## Summary\n\nFixes the `latest_revision` filter used when listing and counting\npackage policies. The previous filter (`latest_revision:true`) excluded\n8.x policies that never had `latest_revision` persisted to\nElasticsearch, causing them to appear with a count of 0 in the Installed\nIntegrations list after upgrading from 8.x to 9.x.\n\nThe fix changes all filters from `latest_revision:true` to `NOT\nlatest_revision:false`. This treats a missing field as equivalent to\n`true` (i.e. a current revision), which is the correct semantic — a\npolicy without the field is a current revision, not a previous one.\n\n### Root cause\n\nThe `latest_revision` field was introduced in SO model version 19\n(package rollback feature, PR #222779). For policies created in 8.x, the\nfield is absent in ES because:\n- The v2 migration backfill only runs on one node in a multi-node\ncluster; other nodes skip document transforms\n- Patch upgrades (e.g. 9.2.7 → 9.2.8) skip the backfill entirely since\nno outdated documents exist\n- The list aggregation uses `perPage: 0`, bypassing the read-time\nin-memory backfill path entirely\n\n### Changes\n\n- **`package_policies_aggregation.ts`** (Bug 1 + Bug 2): Change filter\nto `NOT :false`; add `size: SO_SEARCH_LIMIT` to terms aggregation to\nprevent ES default truncation at 10 buckets\n- **`services/epm/packages/get.ts`** (Bug 3): Add `NOT\nlatest_revision:false` to `getPackageUsageStats` so `:prev` rollback\ndocs are excluded from stats counts\n- **`services/package_policy.ts`**: Apply same filter fix to `list()`,\n`listIds()`, `getAllItemsIds()`, `getCompiledVersionsForAgentPolicy()`,\nand `findAllForAgentPolicy()`\n\nCloses #262491\nCloses https://github.com/elastic/ingest-dev/issues/7478\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>","sha":"222e63005e6b113dd2ffffd7e75893a7be70e4be"}},{"branch":"9.3","label":"v9.3.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.9","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Julia Bardi <90178898+juliaElastic@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
juliaElastic
added a commit
that referenced
this pull request
Apr 17, 2026
…on:false instead of latest_revision:true (#264041) # Backport This will backport the following commits from `main` to `9.3`: - [Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717) <!--- Backport version: 9.6.1 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Julia Bardi","email":"90178898+juliaElastic@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-04-17T11:41:48Z","message":"[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)","sha":"222e63005e6b113dd2ffffd7e75893a7be70e4be","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","v9.4.0","v9.5.0","v9.3.4"],"title":"[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true","number":263717,"url":"https://github.com/elastic/kibana/pull/263717","mergeCommit":{"message":"[Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)","sha":"222e63005e6b113dd2ffffd7e75893a7be70e4be"}},"sourceBranch":"main","suggestedTargetBranches":["9.3"],"targetPullRequestStates":[{"branch":"9.4","label":"v9.4.0","url":"https://github.com/elastic/kibana/pull/264033","number":264033,"state":"OPEN"},{"branch":"9.3","label":"v9.3.4","state":"NOT_CREATED"}]}] BACKPORT--> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the
latest_revisionfilter used when listing and counting package policies. The previous filter (latest_revision:true) excluded 8.x policies that never hadlatest_revisionpersisted to Elasticsearch, causing them to appear with a count of 0 in the Installed Integrations list after upgrading from 8.x to 9.x.The fix changes all filters from
latest_revision:truetoNOT latest_revision:false. This treats a missing field as equivalent totrue(i.e. a current revision), which is the correct semantic — a policy without the field is a current revision, not a previous one.Root cause
The
latest_revisionfield was introduced in SO model version 19 (package rollback feature, PR #222779). For policies created in 8.x, the field is absent in ES because:perPage: 0, bypassing the read-time in-memory backfill path entirelyChanges
package_policies_aggregation.ts(Bug 1 + Bug 2): Change filter toNOT :false; addsize: SO_SEARCH_LIMITto terms aggregation to prevent ES default truncation at 10 bucketsservices/epm/packages/get.ts(Bug 3): AddNOT latest_revision:falsetogetPackageUsageStatsso:prevrollback docs are excluded from stats countsservices/package_policy.ts: Apply same filter fix tolist(),listIds(),getAllItemsIds(),getCompiledVersionsForAgentPolicy(), andfindAllForAgentPolicy()Closes #262491
Closes https://github.com/elastic/ingest-dev/issues/7478
🤖 Generated with Claude Code