Skip to content

[Docs] Kibana 9.4.0 release notes#264554

Merged
jmikell821 merged 36 commits intoelastic:mainfrom
jmikell821:kib-rn-9.4
May 5, 2026
Merged

[Docs] Kibana 9.4.0 release notes#264554
jmikell821 merged 36 commits intoelastic:mainfrom
jmikell821:kib-rn-9.4

Conversation

@jmikell821
Copy link
Copy Markdown
Member

@jmikell821 jmikell821 commented Apr 20, 2026

[To merge on release day]

This PR adds release notes for version 9.4.0.

  1. Generate content
  • Generate unedited list of entries
  1. Edit entries for clarity and consistency

  2. Check for entries belonging to Security or Obs release notes instead, especially from the uncategorized PRs

  3. Ready for review

  • Get reviews from product teams
    Reviewers, please check for any unclear, incorrect, or missing entry. Thank you!

Resolves elastic/docs-content#5890.

@jmikell821 jmikell821 self-assigned this Apr 20, 2026
@jmikell821 jmikell821 added Team:Docs release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting docs v9.4.0 labels Apr 20, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/experience-docs (Team:Docs)

Comment thread docs/release-notes/breaking-changes.md
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 20, 2026

@github-actions
Copy link
Copy Markdown
Contributor

Vale Linting Results

Summary: 3 warnings, 7 suggestions found

⚠️ Warnings (3)
File Line Rule Message
docs/release-notes/index.md 54 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
docs/release-notes/index.md 237 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
docs/release-notes/index.md 460 Elastic.BritishSpellings Use American English spelling 'gray' instead of British English 'grey'.
💡 Suggestions (7)
File Line Rule Message
docs/release-notes/deprecations.md 122 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
docs/release-notes/index.md 294 Elastic.Clone Use cloned only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
docs/release-notes/index.md 352 Elastic.WordChoice Consider using 'deactivates, deselects, hides, turns off, makes unavailable' instead of 'Disables', unless the term is in the UI.
docs/release-notes/index.md 416 Elastic.Wordiness Consider using 'many' instead of 'a large number of'.
docs/release-notes/index.md 433 Elastic.WordChoice Consider using 'deactivates, deselects, hides, turns off, makes unavailable' instead of 'Disables', unless the term is in the UI.
docs/release-notes/index.md 443 Elastic.WordChoice Consider using 'stop, cancel, end' instead of 'abort', unless the term is in the UI.
docs/release-notes/index.md 553 Elastic.Clone Use cloned only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

Comment thread docs/release-notes/deprecations.md Outdated
## 9.4.0 [kibana-9.4.0-deprecations]

$$$kibana-263996$$$
::::{dropdown} Threat Hunting Agent removed from Agent Builder
Copy link
Copy Markdown
Contributor

@benironside benironside Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Threat Hunting Agent deprecation notice looks good 👍

Copy link
Copy Markdown
Contributor

@natasha-moore-elastic natasha-moore-elastic Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The RN tool also picked this one up for Security RNs since the PR has Team:Threat Hunting. Should I exclude it from Security RNs since we're doc'ing it here? @benironside @jmikell821

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was a tech preview feature. Do we need to provide deprecation notices for TP features? 🤔

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's better placed in Security solution, and that even if that was a tech preview feature we can keep it in the RNs in case anyone has been using it and is wondering why it's gone

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll remove this from the Kibana deprecation RNs and @natasha-moore-elastic you'll include it in the Security deprecation RNs? 👀

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, I have it in Security, feel free to remove from here @jmikell821 :)

Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/breaking-changes.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Copy link
Copy Markdown
Member

@alaudazzi alaudazzi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested a few edits.

Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/breaking-changes.md Outdated
Comment thread docs/release-notes/deprecations.md Outdated
Comment thread docs/release-notes/deprecations.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Co-authored-by: Visha Angelova <91186315+vishaangelova@users.noreply.github.com>
@leemthompo
Copy link
Copy Markdown
Member

leemthompo commented Apr 22, 2026

👋 PRs with feature:agent-builder labels should go in a new Agent Builder section

done in 2426f73

Move agent-builder labeled PRs from Workflows and uncategorized sections
into a dedicated Elastic Agent Builder section in both Features and Fixes.
Also fix bare /explore-analyze/ links to use docs-content:// prefix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Copy link
Copy Markdown
Contributor

@davismcphee davismcphee left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some minor feedback and suggestions, but Data Discovery notes LGTM overall 👍

Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Comment thread docs/release-notes/index.md Outdated
Copy link
Copy Markdown
Contributor

@consulthys consulthys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Co-authored-by: Davis McPhee <davismcphee@hotmail.com>
Comment thread docs/release-notes/index.md
Comment thread docs/release-notes/index.md
Co-authored-by: Florent LB <florent.leborgne@elastic.co>
Comment thread docs/release-notes/index.md Outdated
florent-leborgne added a commit that referenced this pull request Apr 30, 2026
>[!NOTE]
To merge on release day (currently April 30, 2025). This will likely
have a merge conflict with 9.4.0 release notes:
#264554.

## Summary

Resolves elastic/docs-content#5981.

Co-authored-by: Florent LB <florent.leborgne@elastic.co>
Comment thread docs/release-notes/index.md Outdated
For the Elastic Security 9.4.0 release information, refer to [Elastic Security Solution Release Notes](docs-content://release-notes/elastic-security/index.md).

**Kibana platform**:
* Sets the default {{kib}} instance size to 2 GB of RAM for new {{ech}} deployments. For Platinum and Enterprise users, we recommend provisioning at least 2 GB of RAM for {{kib}} instances in all deployment types. Below this size, features such as Security Detection Rules, Reporting, Workflows, and Agent Builder might be unavailable or cause service interruptions.
Copy link
Copy Markdown
Contributor

@wajihaparvez wajihaparvez May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yuvielastic @lukeelmers Can you please have a look at this note and tell me if we need to change anything?

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would remove "might be unavailable" as features will be available always, but if customers use it then they will run into out of memory errors.

So I will just say re-phrase this to:

Below this size, use of features such as Security Detection Rules, Reporting, Workflows, and Agent Builder may lead to service interruptions.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Yuvi! Updated

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This RN makes it sound like there will only be disruption if running those features at below 2GB. If running heavy workloads, its also possible to have disruptions at larger sizes. And its the use of the plat/ent features, not the license type itself. Also Reporting is disabled in ECH if <2GB (so technically its unavailable)...

Suggest

Sets the default {{kib}} instance size to 2 GB of RAM for new {{ech}} deployments. This is the recommended minimum in all deployment types for Platinum and Enterprise {{kib}} features, and for production workloads. 

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

slightly reworded + made it a callout at the top of the release notes so it's more visible

Comment thread docs/release-notes/index.md Outdated
For the Elastic Security 9.4.0 release information, refer to [Elastic Security Solution Release Notes](docs-content://release-notes/elastic-security/index.md).

**Kibana platform**:
* Sets the default {{kib}} instance size to 2 GB of RAM for new {{ech}} deployments. For Platinum and Enterprise users, we recommend provisioning at least 2 GB of RAM for {{kib}} instances in all deployment types. Below this size, features such as Security Detection Rules, Reporting, Workflows, and Agent Builder might cause service interruptions.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we move this up somewhere more prominent? If we don't label it as breaking, we should at least try to put it toward the top of the release notes. I worry it's too buried if we just stick it in the platform features section. there are users who will need to take action before upgrading to ensure they continue to have the best experience possible.

also optional: could be more explicit in all deployment types beginning in 9.4.0

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it higher, just under the 9.4 section title, and made it a callout

Comment thread docs/release-notes/index.md Outdated
Co-authored-by: macroscopeapp[bot] <170038800+macroscopeapp[bot]@users.noreply.github.com>
@jmikell821 jmikell821 merged commit 90cd357 into elastic:main May 5, 2026
37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting docs release_note:skip Skip the PR/issue when compiling release notes Team:Docs v9.4.0 v9.5.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Release notes for Kibana 9.4.0