[Logging] Add `service.*` global fields by afharo · Pull Request #256878 · elastic/kibana

afharo · 2026-03-10T11:19:08Z

Summary

Resolves #256855

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

elasticmachine · 2026-03-10T11:19:12Z

Pinging @elastic/kibana-core (Team:Core)

github-actions · 2026-03-10T11:25:41Z

🔍 Preview links for changed docs

docs/reference/user-activity.md

github-actions · 2026-03-10T11:26:23Z

✅ Vale Linting Results

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

afharo · 2026-03-10T20:07:13Z

@elasticmachine merge upstream

afharo · 2026-03-10T22:06:55Z

@elasticmachine merge upstream

elasticmachine · 2026-03-10T23:02:35Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: 077d4df

Failed CI Steps

Test Failures

[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for generic and write to updates then latest index
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for generic and write to updates then latest index
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for host and write to updates then latest index
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for host and write to updates then latest index
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for service and write to updates then latest index
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for service and write to updates then latest index
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for user and write to updates then latest index
[job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction for user and write to updates then latest index

History

cc @afharo

afharo · 2026-03-10T23:21:19Z

@elasticmachine merge upstream

…e_fix * commit '565f7545c422192218b803874fbdf93e8d8f08ee': (27 commits) [Lens API] ESQL schema for XY separately for Agent and some small token optimizations (elastic#256885) Fix "Accessing resource attributes before async attributes settled" telemetry error (elastic#256880) [Security Solution][Attacks/Alerts][Attacks page][Table section] Preserver "Sort by" state on Attacks page (elastic#256717) (elastic#256795) [APM] Improve redirect with default date range guard (elastic#256887) [Security Solution][Attacks/Alerts][Attacks page][Table section] Add assignees avatars to the group component (elastic#250126) (elastic#256901) [Docs] add xpack.alerting.rules.maxScheduledPerMinute setting description (elastic#257041) [SO] Fix non-deterministic ordering in nested find API integration tests (elastic#256447) [Write-restricted dashboards] Update user profile retrieval for getShouldAddAccessControl (elastic#255065) [One Workflow] Add Scout API test scaffold and execution tests (elastic#256300) [Fleet] add use_apm if dynamic_signal_types are enabled (elastic#256429) [Fleet] ignore data streams starting with `.` in Fleet API (elastic#256625) [ES|QL] METRICS_INFO support: columns_after & summary (elastic#256758) [Agent Builder] Agent plugins: initial installation support (elastic#256478) [Streams] Add field descriptions and documentation-only field overrides (elastic#255136) [api-docs] 2026-03-11 Daily api_docs build (elastic#257023) [Security Solution] fix alerts page infinite loading state due to data view error (elastic#256983) [Logging] Add `service.*` global fields (elastic#256878) [Canvas] Apply embeddable transforms to embeddable elements (elastic#252191) [table_list_view_table] stabilize jest test (elastic#254991) [Obs AI] get_index_info: add unit tests (elastic#256802) ...

## Summary Resolves #256855 ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [x] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

[Logging] Add service.* global fields

1ed3876

afharo self-assigned this Mar 10, 2026

afharo requested a review from a team as a code owner March 10, 2026 11:19

afharo added Team:Core Platform Core services: plugins, logging, config, saved objects, http, ES client, i18n, etc t// release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Mar 10, 2026

Extend docs

5a80d19

afharo requested a review from a team as a code owner March 10, 2026 11:23

afharo requested a review from consulthys March 10, 2026 11:23

afharo added 3 commits March 10, 2026 12:34

Use {kib} instead of Kibana in the docs

f517b2c

Use Kibana instead of {kib}

617d00c

Use final dots consistently

b561a5f

jesuswr approved these changes Mar 10, 2026

View reviewed changes

florent-leborgne approved these changes Mar 10, 2026

View reviewed changes

kibanamachine added 2 commits March 10, 2026 11:47

Changes from node scripts/lint_ts_projects --fix

59b19fa

Changes from node scripts/regenerate_moon_projects.js --update

b406c67

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner March 10, 2026 12:00

Merge branch 'main' into logging/add-service-fields

c110a12

afharo enabled auto-merge (squash) March 10, 2026 16:16

Merge branch 'main' into logging/add-service-fields

33266e3

Merge branch 'main' into logging/add-service-fields

077d4df

Merge branch 'main' into logging/add-service-fields

8bdd973

afharo merged commit 3d4df43 into elastic:main Mar 11, 2026
19 checks passed

afharo deleted the logging/add-service-fields branch March 11, 2026 00:37

kibanamachine added the v9.4.0 label Mar 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Logging] Add `service.*` global fields#256878

[Logging] Add `service.*` global fields#256878
afharo merged 11 commits intoelastic:mainfrom
afharo:logging/add-service-fields

afharo commented Mar 10, 2026

Uh oh!

elasticmachine commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

afharo commented Mar 10, 2026

Uh oh!

afharo commented Mar 10, 2026

Uh oh!

elasticmachine commented Mar 10, 2026

Uh oh!

afharo commented Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

afharo commented Mar 10, 2026

Summary

Checklist

Uh oh!

elasticmachine commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Vale Linting Results

Uh oh!

afharo commented Mar 10, 2026

Uh oh!

afharo commented Mar 10, 2026

Uh oh!

elasticmachine commented Mar 10, 2026

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

Uh oh!

afharo commented Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Mar 10, 2026 •

edited

Loading

github-actions bot commented Mar 10, 2026 •

edited

Loading