Kibana 8.8.1edit

Review the following information about the Kibana 8.8.1 release.

Known issuesedit

Kibana can run out of memory during an upgrade when there are many Fleet agent policies.

Details
Due to a schema version update, during Fleet setup in 8.8.x, all agent policies are being queried and deployed. This action triggers a lot of queries to the Elastic Package Registry (EPR) to fetch integration packages. As a result, there is an increase in Kibana’s resident memory usage (RSS).

Impact
Because the default batch size of 100 for schema version upgrade of Fleet agent policies is too high, this can cause Kibana to run out of memory during an upgrade. For example, we have observed 1GB Kibana instances run out of memory during an upgrade when there were 20 agent policies with 5 integrations in each.

Workaround
Two workaround options are available:

  • Increase the Kibana instance size to 2GB. So far, we are not able to reproduce the issue with 2GB instances.
  • Set xpack.fleet.setup.agentPolicySchemaUpgradeBatchSize to 2 in the kibana.yml and restart the Kibana instance(s).

In 8.9.0, we are addressing this by changing the default batch size to 2.

Memory leak in Fleet audit logging.

Details
Fleet introduced audit logging for various CRUD (create, read, update, and delete) operations in version 8.8.0.

While audit logging is not enabled by default, we have identified an off-heap memory leak in the implementation of Fleet audit logging that can result in poor Kibana performance, and in some cases Kibana instances being terminated by the OS kernel’s oom-killer. This memory leak can occur even when Kibana audit logging is not explicitly enabled (regardless of whether xpack.security.audit.enabled is set in the kibana.yml settings file).

Impact
The version 8.8.2 release includes in a fix for this problem. If you are using Fleet integrations and Kibana audit logging in version 8.8.0 or 8.8.1, you should upgrade to 8.8.2 or above to obtain the fix.

Breaking changesedit

Breaking changes can prevent your application from optimal operation and performance. Before you upgrade to 8.8.1, review the breaking changes, then mitigate the impact to your application.

There are no breaking changes in the Kibana 8.8.1 release.

To review the breaking changes in the previous release, check 8.8.0.

Enhancementsedit

Elastic Security
For the Elastic Security 8.8.1 release information, refer to Elastic Security Solution Release Notes.
Fleet
  • Add Elastic Agent UI instructions for Universal Profile #158936

Bug Fixesedit

Alerting
  • Fixes a bug where ML embeddables, OsQuery, and IoCs attachments in a case render the wrong view #158441
  • Makes alert links shorter #158582
  • Throws a Mustache error when validating action message for warnings #158668
  • Adds null checks when iterating through an index template list #158742
APM
  • Displays the size of hidden indices in storage explorer #158746
  • Changes the APM latency value and latency threshold to microseconds #158703
  • Fixes service transaction metrics by using transaction.duration.histogram for percentile aggregations #158909
Discover
  • Update single doc view locator to URL encode rowId #158635
  • Fixes the display of grid row selection when in dark mode #158231
Elastic Security
For the Elastic Security 8.8.1 release information, refer to Elastic Security Solution Release Notes.
Fleet
  • Include hidden data streams in package upgrade #158654
Logs
  • Fixes Log Categorization UI failure due to an infinite loop #159090
Machine Learning
  • Increases calendar events request limit #158726
  • Disables the delete option for deployed models #158533
  • Applies theme based on the User Profile settings #158258
Maps
  • Fixes toolbar action button not filled when selected #158284
  • Fixes Maps to display dark theme when enabled #158219
Operations
  • Fixes configuration stacking order #158827
Platform
  • Fixes Kibana crashing on Safari versions prior to 16.4 #158825
  • Updates all aliases with a single updateAliases() when relocating saved objects #158940
  • Fixes a race condition that could cause intermittent upgrade migration failures when Kibana connects to a single node Elasticsearch cluster #158182
  • Dynamically reduces the migrations.batchSize value when Kibana encounters a migration batch that’s too big to process #157494