#270231)

# Backport

This will backport the following commits from `main` to `9.4`:
- [[Entity Store] Change default log cap behavior to drop
(#270180)](#270180)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Rômulo
Farias","email":"romulo.farias@elastic.co"},"sourceCommit":{"committedDate":"2026-05-20T15:02:45Z","message":"[Entity
Store] Change default log cap behavior to drop (#270180)\n\n##
Summary\n\nChange default log cap behavior from `defer` to
`drop`\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"c01d094e513b7e5c4da1b727bd73aaf3b774a087","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:version","v9.5.0","v9.4.2"],"title":"[Entity
Store] Change default log cap behavior to
drop","number":270180,"url":"https://github.com/elastic/kibana/pull/270180","mergeCommit":{"message":"[Entity
Store] Change default log cap behavior to drop (#270180)\n\n##
Summary\n\nChange default log cap behavior from `defer` to
`drop`\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"c01d094e513b7e5c4da1b727bd73aaf3b774a087"}},"sourceBranch":"main","suggestedTargetBranches":["9.4"],"targetPullRequestStates":[{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/270180","number":270180,"mergeCommit":{"message":"[Entity
Store] Change default log cap behavior to drop (#270180)\n\n##
Summary\n\nChange default log cap behavior from `defer` to
`drop`\n\n---------\n\nCo-authored-by: kibanamachine
<42973632+kibanamachine@users.noreply.github.com>","sha":"c01d094e513b7e5c4da1b727bd73aaf3b774a087"}},{"branch":"9.4","label":"v9.4.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Rômulo Farias <romulo.farias@elastic.co>

## Summary

Change default log cap behavior from `defer` to `drop`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary

Change default log cap behavior from `defer` to `drop`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Summary

Updates the Entity Store troubleshooting section in
`solutions/security/advanced-entity-analytics/entity-store.md` to cover
the log extraction tunables added in **9.4.2**
([elastic/kibana#269482](elastic/kibana#269482),
[elastic/kibana#270180](elastic/kibana#270180))
and refreshes the `maxLogsPerPage` default to reflect the 9.4.2 value
bump
([elastic/kibana#270617](elastic/kibana#270617)).

### What's new in the section

- **`maxLogsPerWindow`** — per-task-run total-volume cap (new in 9.4.2).
Documented as the most effective lever for protecting a cluster from
sudden ingest spikes, because it bounds the work a single extraction
task can do regardless of how many slices the window is split into.
- **`maxLogsPerWindowCapBehavior`** — new in 9.4.2. Documents both
`drop` (default, cluster-health-first) and `defer` (coverage-first)
modes and the coverage-vs-freshness trade-off between them.
- **`maxLogsPerPage` default** — version-gated to show `40000` for
9.4.0–9.4.1 and `50000` for 9.4.2

### Why now

We've seen multiple SDHs (#1675, #9945, EOG, plus internal Infosec)
where Entity Store v2 extraction overwhelmed hot data nodes after 9.4.0.
The 9.4.2 knobs are the supported mitigation path; this page is where
Support and customers look first.

### applies_to notes

- New fields are gated `serverless: planned` to match the rest of the
troubleshoot section. Once the Serverless rollout date is known, update
accordingly.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: natasha-moore-elastic <natasha.moore@elastic.co>
Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>