Skip to content

Allow kibana_system role to read and manage logs streams#143053

Merged
nikita-lavrov merged 5 commits intoelastic:mainfrom
nikita-lavrov:add-index-privileges-for-logs-streams
Feb 27, 2026
Merged

Allow kibana_system role to read and manage logs streams#143053
nikita-lavrov merged 5 commits intoelastic:mainfrom
nikita-lavrov:add-index-privileges-for-logs-streams

Conversation

@nikita-lavrov
Copy link
Copy Markdown
Contributor

@nikita-lavrov nikita-lavrov commented Feb 25, 2026

Summary

Related to https://github.com/elastic/streams-program/issues/402

The Obs Onboarding team is currently working on a feature that will allow applying stream definitions from Kibana config on startup. This PR adds necessary privileges to the kibana_system role:

  1. Enable the root logs.ecs and logs.otel streams
  2. Read and manage the root and child streams (logs.*) + logs root stream for backwards compatibility.

@nikita-lavrov nikita-lavrov requested a review from a team as a code owner February 25, 2026 12:21
@elasticsearchmachine elasticsearchmachine added needs:triage Requires assignment of a team area label v9.4.0 external-contributor Pull request authored by a developer outside the Elasticsearch team labels Feb 25, 2026
@nikita-lavrov nikita-lavrov added >non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC labels Feb 25, 2026
@elasticsearchmachine elasticsearchmachine added Team:Security Meta label for security team and removed needs:triage Requires assignment of a team area label labels Feb 25, 2026
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-security (Team:Security)

@nikita-lavrov nikita-lavrov changed the title Allow kibana_system role to read and manage logs.* streams Allow kibana_system role to read and manage logs streams Feb 25, 2026
@nikita-lavrov nikita-lavrov merged commit 330273b into elastic:main Feb 27, 2026
41 checks passed
PeteGillinElastic pushed a commit to PeteGillinElastic/elasticsearch that referenced this pull request Feb 27, 2026
)

* Allow kibana_system role to read and manage logs streams

* remove logs index

* [CI] Auto commit changes from spotless

* add logs index

---------

Co-authored-by: elasticsearchmachine <infra-root+elasticsearchmachine@elastic.co>
szybia added a commit to szybia/elasticsearch that referenced this pull request Feb 27, 2026
…cations

* upstream/main: (35 commits)
  Create ARM bulk sqrI8 implementation (elastic#142461)
  Rework get-snapshots predicates (elastic#143161)
  Refactor downsampling fetchers and producers (elastic#140357)
  ESQL: Unmute test and add extra logging to generative test validation (elastic#143168)
  Fix metadata fields being nullified/loaded by unmapped_fields setting (elastic#143155)
  Determine remote cluster version (elastic#142494)
  Populate failure message for aborted clones (elastic#143206)
  Allow kibana_system role to read and manage logs streams (elastic#143053)
  Mute org.elasticsearch.xpack.esql.CsvIT test {csv-spec:eval.DocsLength} elastic#143224
  Mute org.elasticsearch.xpack.esql.CsvIT test {csv-spec:eval.DocsByteLength} elastic#143223
  Mute org.elasticsearch.xpack.esql.CsvIT test {csv-spec:docs.DocsBitLength} elastic#143222
  Fix FloatVectorScorerSupplier bulkScore bug (elastic#143211)
  ESQL: Add data node execution for external sources (elastic#143209)
  [ESQL] Cleanup commands docs (elastic#143058)
  [ML]Fix latest transforms disregarding updates when sort and sync fields are non-monotonic (elastic#142856)
  Mute org.elasticsearch.index.mapper.IpFieldMapperTests testSyntheticSourceInObject elastic#143212
  Tests: Fix StoreDirectoryMetricsIT (elastic#143084)
  ESQL: Add distribution strategy for external sources (elastic#143194)
  CSV IT spec (elastic#142585)
  Fix VectorScorerOSQBenchmark.score to read corrections properly (elastic#143137)
  ...
tballison pushed a commit to tballison/elasticsearch that referenced this pull request Mar 3, 2026
)

* Allow kibana_system role to read and manage logs streams

* remove logs index

* [CI] Auto commit changes from spotless

* add logs index

---------

Co-authored-by: elasticsearchmachine <infra-root+elasticsearchmachine@elastic.co>
nikita-lavrov added a commit to elastic/kibana that referenced this pull request Mar 10, 2026
## Summary

Related to elastic/streams-program#402

This PR allows configuring wired streams definitions in Kibana config
and applying them on startup.

`StreamsClient` has been refactored to be able to work without Kibana
requests, making it possible to pass both scoped and unscoped dependency
clients.

This change depends on
elastic/elasticsearch#143053

**Sample stream definition:**
```
xpack.streams:
  preconfigured:
    enabled: true
    stream_definitions:
    - name: logs.ecs
      dashboards: []
      queries: []
      rules: []
      stream:
        description: ""
        query_streams: []
        ingest:
          lifecycle:
            dsl: {}
          processing:
            steps: []
          settings: {}
          failure_store:
            lifecycle:
              enabled:
                data_retention: '20d'
          wired:
            routing:
            - destination: logs.ecs.child1
              where:
                field: 'resource.attributes.host.name'
                startsWith: 'filebeat'
              status: 'enabled'
``` 
> [!NOTE]
> Just setting `xpack.streams.preconfigured.enabled: true` will only
create the root `logs.ecs` and `logs.otel` streams.

> [!IMPORTANT]
> Since the RulesClient cannot be made unscoped, `queries` and `rules`
should always be empty. This is a limitation of the config-based streams
for now.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for preconfigured streams, allowing streams to be
defined and automatically enabled at startup with customizable field
sets (ECS or base fields).

* **Configuration**
* Extended configuration schema to include preconfiguration options for
managing stream definitions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joe Reuter <johannes.reuter@elastic.co>
qn895 pushed a commit to qn895/kibana that referenced this pull request Mar 11, 2026
## Summary

Related to elastic/streams-program#402

This PR allows configuring wired streams definitions in Kibana config
and applying them on startup.

`StreamsClient` has been refactored to be able to work without Kibana
requests, making it possible to pass both scoped and unscoped dependency
clients.

This change depends on
elastic/elasticsearch#143053

**Sample stream definition:**
```
xpack.streams:
  preconfigured:
    enabled: true
    stream_definitions:
    - name: logs.ecs
      dashboards: []
      queries: []
      rules: []
      stream:
        description: ""
        query_streams: []
        ingest:
          lifecycle:
            dsl: {}
          processing:
            steps: []
          settings: {}
          failure_store:
            lifecycle:
              enabled:
                data_retention: '20d'
          wired:
            routing:
            - destination: logs.ecs.child1
              where:
                field: 'resource.attributes.host.name'
                startsWith: 'filebeat'
              status: 'enabled'
``` 
> [!NOTE]
> Just setting `xpack.streams.preconfigured.enabled: true` will only
create the root `logs.ecs` and `logs.otel` streams.

> [!IMPORTANT]
> Since the RulesClient cannot be made unscoped, `queries` and `rules`
should always be empty. This is a limitation of the config-based streams
for now.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for preconfigured streams, allowing streams to be
defined and automatically enabled at startup with customizable field
sets (ECS or base fields).

* **Configuration**
* Extended configuration schema to include preconfiguration options for
managing stream definitions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joe Reuter <johannes.reuter@elastic.co>
sorenlouv pushed a commit to elastic/kibana that referenced this pull request Mar 17, 2026
## Summary

Related to https://github.com/elastic/streams-program/issues/402

This PR allows configuring wired streams definitions in Kibana config
and applying them on startup.

`StreamsClient` has been refactored to be able to work without Kibana
requests, making it possible to pass both scoped and unscoped dependency
clients.

This change depends on
elastic/elasticsearch#143053

**Sample stream definition:**
```
xpack.streams:
  preconfigured:
    enabled: true
    stream_definitions:
    - name: logs.ecs
      dashboards: []
      queries: []
      rules: []
      stream:
        description: ""
        query_streams: []
        ingest:
          lifecycle:
            dsl: {}
          processing:
            steps: []
          settings: {}
          failure_store:
            lifecycle:
              enabled:
                data_retention: '20d'
          wired:
            routing:
            - destination: logs.ecs.child1
              where:
                field: 'resource.attributes.host.name'
                startsWith: 'filebeat'
              status: 'enabled'
``` 
> [!NOTE]
> Just setting `xpack.streams.preconfigured.enabled: true` will only
create the root `logs.ecs` and `logs.otel` streams.

> [!IMPORTANT]
> Since the RulesClient cannot be made unscoped, `queries` and `rules`
should always be empty. This is a limitation of the config-based streams
for now.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for preconfigured streams, allowing streams to be
defined and automatically enabled at startup with customizable field
sets (ECS or base fields).

* **Configuration**
* Extended configuration schema to include preconfiguration options for
managing stream definitions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joe Reuter <johannes.reuter@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

external-contributor Pull request authored by a developer outside the Elasticsearch team >non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team v9.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants