Skip to content

[9.4] [Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)#264033

Merged
kibanamachine merged 1 commit intoelastic:9.4from
kibanamachine:backport/9.4/pr-263717
Apr 17, 2026
Merged

[9.4] [Fleet] Fix package policy count filters: use NOT latest_revision:false instead of latest_revision:true (#263717)#264033
kibanamachine merged 1 commit intoelastic:9.4from
kibanamachine:backport/9.4/pr-263717

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 9.4:

Questions ?

Please refer to the Backport tool documentation

…se instead of latest_revision:true (elastic#263717)

## Summary

Fixes the `latest_revision` filter used when listing and counting
package policies. The previous filter (`latest_revision:true`) excluded
8.x policies that never had `latest_revision` persisted to
Elasticsearch, causing them to appear with a count of 0 in the Installed
Integrations list after upgrading from 8.x to 9.x.

The fix changes all filters from `latest_revision:true` to `NOT
latest_revision:false`. This treats a missing field as equivalent to
`true` (i.e. a current revision), which is the correct semantic — a
policy without the field is a current revision, not a previous one.

### Root cause

The `latest_revision` field was introduced in SO model version 19
(package rollback feature, PR elastic#222779). For policies created in 8.x, the
field is absent in ES because:
- The v2 migration backfill only runs on one node in a multi-node
cluster; other nodes skip document transforms
- Patch upgrades (e.g. 9.2.7 → 9.2.8) skip the backfill entirely since
no outdated documents exist
- The list aggregation uses `perPage: 0`, bypassing the read-time
in-memory backfill path entirely

### Changes

- **`package_policies_aggregation.ts`** (Bug 1 + Bug 2): Change filter
to `NOT :false`; add `size: SO_SEARCH_LIMIT` to terms aggregation to
prevent ES default truncation at 10 buckets
- **`services/epm/packages/get.ts`** (Bug 3): Add `NOT
latest_revision:false` to `getPackageUsageStats` so `:prev` rollback
docs are excluded from stats counts
- **`services/package_policy.ts`**: Apply same filter fix to `list()`,
`listIds()`, `getAllItemsIds()`, `getCompiledVersionsForAgentPolicy()`,
and `findAllForAgentPolicy()`

Closes elastic#262491
Closes elastic/ingest-dev#7478

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit 222e630)
@kibanamachine kibanamachine added the backport This PR is a backport of another PR label Apr 17, 2026
@botelastic botelastic Bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Apr 17, 2026
@kibanamachine kibanamachine enabled auto-merge (squash) April 17, 2026 11:51
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/fleet (Team:Fleet)

@macroscopeapp
Copy link
Copy Markdown
Contributor

macroscopeapp Bot commented Apr 17, 2026

Approvability

Verdict: Would Approve

Straightforward bug fix changing filter logic from latest_revision:true to NOT latest_revision:false to properly include 8.x policies that lack the field. The core change is minimal, well-tested with extensive new unit and integration tests, and the author owns all modified files.

Macroscope would have approved this PR. Enable approvability here.

@kibanamachine kibanamachine merged commit c041f0f into elastic:9.4 Apr 17, 2026
25 checks passed
@elasticmachine
Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #118 / Dataset Quality Dataset Quality Details failed docs should go to discover in ES|QL mode for failed docs when the button next to breakdown selector is clicked
  • [job] [logs] affected Scout: [ observability / apm ] plugin / local-stateful-classic - Service Dashboards - displays a linked dashboard with a control group

Metrics [docs]

✅ unchanged

cc @juliaElastic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR Team:Fleet Team label for Observability Data Collection Fleet team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants