Merge branch 'main' into charlotte-token-usage-600

Author: charlotte-hoblik

deploy-manage/deploy/cloud-enterprise/configure-host-rhel.md

@@ -317,7 +317,7 @@ Verify that required traffic is allowed. Check the [Networking prerequisites](ec
     ```sh
     cat <<EOF | sudo tee -a /etc/sysctl.conf
     # Required by Elasticsearch
-    vm.max_map_count=262144
+    vm.max_map_count=1048576
     # enable forwarding so the Docker networking works as expected
     net.ipv4.ip_forward=1
     # Decrease the maximum number of TCP retransmissions to 5 as recommended for Elasticsearch TCP retransmission timeout.

deploy-manage/deploy/cloud-enterprise/configure-host-suse.md

@@ -156,7 +156,7 @@ You must use XFS and have quotas enabled on all allocators, otherwise disk usage
     ```sh
     cat <<EOF | sudo tee -a /etc/sysctl.conf
     # Required by Elasticsearch
-    vm.max_map_count=262144
+    vm.max_map_count=1048576
     # enable forwarding so the Docker networking works as expected
     net.ipv4.ip_forward=1
     # Decrease the maximum number of TCP retransmissions to 5 as recommended for Elasticsearch TCP retransmission timeout.

deploy-manage/deploy/cloud-enterprise/configure-host-ubuntu.md

@@ -129,7 +129,7 @@ You must use XFS and have quotas enabled on all allocators, otherwise disk usage
     ```sh
     cat <<EOF | sudo tee -a /etc/sysctl.conf
     # Required by Elasticsearch
-    vm.max_map_count=262144
+    vm.max_map_count=1048576
     # enable forwarding so the Docker networking works as expected
     net.ipv4.ip_forward=1
     # Decrease the maximum number of TCP retransmissions to 5 as recommended for Elasticsearch TCP retransmission timeout.

deploy-manage/deploy/cloud-enterprise/ece-architecture.md

@@ -86,3 +86,24 @@ Services are deployed as Docker containers, which simplifies the operational eff
 
     Docker containers communicate securely with one another through Transport Layer Security, provided by [Stunnel](https://www.stunnel.org/) (as not all of the services or components support TLS natively). Tunneling all traffic between containers makes sure that it is not possible to eavesdrop, even when someone else has access to the underlying cloud or network infrastructure.
 
+## ECE service containers by host role [ece-service-containers]
+
+Each {{ece}} service runs as a dedicated container. These containers are automatically deployed based on the roles assigned to each ECE host. The following table lists the containers on ECE hosts, along with the host roles that include each container:
+
+| Container                                         | Host roles    | Description |
+|---|---|---|
+| `frc-runners-runner`                              | All roles     | Runs on every ECE host and provides a supervisor service to deploy and manage containers based on the host's assigned roles, ensuring required containers are started at the proper version. |
+| `frc-beats-runners-beats-runner`                  | All roles     | Collects logs and metrics from local containers for monitoring and health checks. |
+| `frc-client-forwarders-client-forwarder`          | All roles     | Manages communication between services on the hosts and ZooKeeper. |
+| `frc-services-forwarders-services-forwarder`      | All roles     | Routes internal service data across the ECE platform. |
+| `frc-allocators-allocator`                        | Allocator     | Manages container lifecycle for {{stack}} application instances, such as {{es}} and {{kib}}. |
+| `frc-allocator-metricbeats-allocator-metricbeat`  | Allocator     | Collects metrics from the {{stack}} containers running in the allocator. |
+| `frc-container-task-services-container-task-service` | Allocator  | Supports autoscaling and tracks feature usage. |
+| `frc-admin-consoles-admin-console`                | Controller    | Backend service for the ECE UI that handles API requests. |
+| `frc-blueprints-blueprint`                        | Controller    | Coordinates container startup by providing configuration data to runners based on their role and token. |
+| `frc-cloud-uis-cloud-ui`                          | Controller    | Web frontend for the ECE UI, served to users in the browser. |
+| `frc-constructors-constructor`                    | Controller    | Schedules and coordinates deployment changes; assigns instances to allocators and balances zones. |
+| `frc-directors-director`                          | Director      | Coordinates the ZooKeeper cluster by ensuring there's a quorum; maintains stunnel configuration and certificates. |
+| `frc-zookeeper-servers-zookeeper`                 | Director      | Consistent distributed data store used to track ECE state and coordinate communication between services. |
+| `frc-proxies-proxyv2`                             | Proxy         | Routes user traffic to the {{stack}} deployments. |
+| `frc-proxies-route-server`                        | Proxy         | Manages the routing tables used by the proxy service. |

deploy-manage/tools/snapshot-and-restore/minio-on-premise-repository.md

@@ -10,7 +10,7 @@ products:
 
 # MinIO self-managed repository [ece-configuring-minio]
 
-[MinIO](https://min.io/docs/minio/container/index.html) is a popular, open-source object storage server compatible with the Amazon AWS S3 API. As an [S3 compatible service](/deploy-manage/tools/snapshot-and-restore/s3-repository.md#repository-s3-compatible-services), MinIO is supported for use as a snapshot repository in {{ece}} (ECE).
+[MinIO](https://github.com/minio/minio) is a popular, open-source object storage server compatible with the Amazon AWS S3 API. As an [S3 compatible service](/deploy-manage/tools/snapshot-and-restore/s3-repository.md#repository-s3-compatible-services), MinIO is supported for use as a snapshot repository in {{ece}} (ECE).
 
 This guide walks you through integrating MinIO with ECE to store your {{es}} snapshots.
 
@@ -24,11 +24,11 @@ If you're evaluating MinIO in a test system, do not place MinIO containers on th
 
 This section provides guidance and recommendations for deploying MinIO. It does not include installation steps. As MinIO is a third-party product, its deployment, configuration, and maintenance are outside the scope of Elastic support.
 
-For installation instructions, refer to the official [MinIO documentation](https://min.io/docs/).
+For installation instructions, refer to the official [MinIO GitHub repository](https://github.com/minio/minio).
 
 The performance and reliability of MinIO depend on its configuration and the underlying infrastructure. Consider the following best practices:
 
-* For production use, deploy MinIO in a [Multi-Node Multi-Drive](https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html#minio-mnmd) configuration.
+* For production use, deploy MinIO in a Multi-Node Multi-Drive configuration.
 * Use a single MinIO endpoint with the ECE installation, to simplify repository configuration.
 * Secure access to the MinIO endpoint with TLS.
 
@@ -44,11 +44,11 @@ MinIO may report multiple endpoint URLs. Be sure to select the one reachable fro
 
 ### Testing and evaluation
 
-Use the [MinIO Quickstart Guide](https://charts.min.io/) or the [container deployment guide](https://min.io/docs/minio/container/index.html) to spin up a simple standalone MinIO container. Use `-v` to map persistent storage when using the `docker` or `podman` options.
+Use the [MinIO Quickstart Guide](https://charts.min.io/) or the [container deployment guide](https://docs.min.io/enterprise/aistor-object-store/installation/container/install/#deploy-minio-container) to spin up a simple standalone MinIO container. Use `-v` to map persistent storage when using the `docker` or `podman` options.
 
 ### Production environments
 
-Set up MinIO across multiple nodes and drives to ensure high availability, performance, and scalability, following the recommendations in the [MinIO documentation](https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html).
+Set up MinIO across multiple nodes and drives to ensure high availability, performance, and scalability, following the recommendations in the [MinIO documentation](https://github.com/minio/docs).
 
 You can use Docker Compose, Kubernetes, or another orchestration tool of your choice.
 

explore-analyze/elastic-inference/eis.md

@@ -45,13 +45,6 @@ You can now use `semantic_text` with the new ELSER endpoint on EIS. To learn how
 
 [Semantic Search with `semantic_text`](/solutions/search/semantic-search/semantic-search-semantic-text.md) has a detailed tutorial on using the `semantic_text` field and using the ELSER endpoint on EIS instead of the default endpoint. This is a great way to get started and try the new endpoint.
 
-### Limitations
-
-#### Batch size
-
-Batches are limited to a maximum of 16 documents.
-This is particularly relevant when using the [_bulk API]({{es-apis}}operation/operation-bulk) for data ingestion.
-
 ## `jina-embeddings-v3` on EIS [jina-embeddings-on-eis]
 
 ```{applies_to}

release-notes/elastic-cloud-serverless/index.md

@@ -11,7 +11,109 @@ Review the changes, fixes, and more to {{serverless-full}}.
 
 
 ## December 16, 2025 [serverless-changelog-12162025]
-* {{serverless-full}} is now available in four new Google Cloud Platform [regions](/deploy-manage/deploy/elastic-cloud/regions.md): GCP Singapore (`asia-southeast1`), GCP London (`europe-west2`), GCP Frankfurt (`europe-west3`), and GCP Netherlands (`europe-west4`)
+
+### Features and enhancements [serverless-changelog-12162025-features-enhancements]
+
+* Adds four new Google Cloud Platform [regions](/deploy-manage/deploy/elastic-cloud/regions.md) for {{serverless-full}}: GCP Singapore (`asia-southeast1`), GCP London (`europe-west2`), GCP Frankfurt (`europe-west3`), and GCP Netherlands (`europe-west4`)
+* Adds an integration knowledge opt-out UI setting and feature flag [#245080]({{kib-pull}}245080)
+* Redesigns the single and bulk agent actions menus in {{fleet}}, organizing commonly used actions at the top level and grouping other actions into nested menus by use case [#245174]({{kib-pull}}245174)
+* Adds agent internal YAML settings [#245819]({{kib-pull}}245819)
+* Adds support for chain controls [#242909]({{kib-pull}}242909)
+* Improves validation and autocomplete for CASE [#244280]({{kib-pull}}244280)
+* Avoids redundant requests when breakdown or chart interval changes [#245523]({{kib-pull}}245523)
+* Adds support for filtering on multivalue fields [#245554]({{kib-pull}}245554)
+* Adds an example plugin for UX testing of the {{esql}} editor [#245792]({{kib-pull}}245792)
+* Adds a **Copy as Markdown** option for selected results [#245545]({{kib-pull}}245545)
+* Adds an internal API for global params sync [#239284]({{kib-pull}}239284)
+* Adds the ability to bulk mute and unmute alerts [#245690]({{kib-pull}}245690)
+* Adds Rules feature privileges, allowing access to {{elastic-sec}} rules to be explicitly set for user roles [#239634]({{kib-pull}}239634)
+* Updates the threat hunting UI [#243311]({{kib-pull}}243311)
+* Adds support for QRadar reference sets as lookups [#244924]({{kib-pull}}244924)
+* Shows analyzer in full height [#245857]({{kib-pull}}245857)
+* Shows session view in full height [#245888]({{kib-pull}}245888)
+* Adds an integration knowledge platform tool to Agent Builder [#245259]({{kib-pull}}245259)
+* Adds Agent Builder UI settings, RBAC, navigation, and tour [#246089]({{kib-pull}}246089)
+* Redesigns Lookup join file upload [#244550]({{kib-pull}}244550)
+* Adds an action to create an anomaly detection alerting rule [#241274]({{kib-pull}}241274)
+* Adds an empty state for the Partitioning tab [#244893]({{kib-pull}}244893)
+* Improves attachment filters with multi-type selection, server-side filtering, and a suggestions limit [#245248]({{kib-pull}}245248)
+* Adds a new **Similar errors** section with an occurrences chart [#244665]({{kib-pull}}244665)
+* Adds dashboard ownership and write-restricted mode, allowing you to control who can edit your dashboards regardless of broader space permissions [#224552]({{kib-pull}}224552)
+* Adds a new gap fill status column to the Rules page [#242595]({{kib-pull}}242595)
+* Validates space ownership when unlinking attachments [#245250]({{kib-pull}}245250)
+* Adds `deactivate_all_instrumentations`, `deactivate_instrumentations`, `send_logs`, `send_metrics`, and `send_traces` agent configuration settings for EDOT PHP [#246021]({{kib-pull}}246021)
+* Adds dashboard suggestions for ECS Kubernetes and OTel dashboards when selecting pods in the Infrastructure inventory UI [#245784]({{kib-pull}}245784)
+* Enhances search for the main Cases page [#245321]({{kib-pull}}245321)
+* Adds concurrency to KMeansLocal [#139239]({{es-pull}}139239)
+* Enables CCS tests for {{esql}} subqueries [#137776]({{es-pull}}137776)
+* Adds CCS support for the {{esql}} Inference command [#139244]({{es-pull}}139244)
+* Introduces usage limits for COMPLETION and RERANK [#139074]({{es-pull}}139074)
+* Adds privileges to the {{kib}} System role to manage internal indexes in support of {{elastic-defend}} features [#138993]({{es-pull}}138993)
+* Optimizes native bulk dot product scoring for Int7 [#139069]({{es-pull}}139069)
+* Adds Azure OpenAI chat completion support [#138726]({{es-pull}}138726)
+* Adds NVIDIA support to the inference plugin [#132388]({{es-pull}}132388)
+* Adds TDigest histogram as a metric [#139247]({{es-pull}}139247)
+* Adds a `TOP_SNIPPETS` function to return the best snippets for a field [#138940]({{es-pull}}138940)
+* Takes `TOP_SNIPPETS` out of snapshot [#139272]({{es-pull}}139272)
+* Prevents `AggregateMetricDouble` fields from building BKD indexes [#138724]({{es-pull}}138724)
+* Bumps jruby/joni to 2.2.6 [#139075]({{es-pull}}139075)
+* Enables bfloat16 and on-disk rescoring for dense vectors [#138492]({{es-pull}}138492)
+* Enables the new `exponential_histogram` field type [#138968]({{es-pull}}138968)
+* Adds planning detailed timing to profile information in {{esql}} [#138564]({{es-pull}}138564)
+* Optimizes `GROUP BY ALL` in {{esql}} [#139130]({{es-pull}}139130)
+* Pulls `OrderBy` above `InlineJoin` in {{esql}} [#137648]({{es-pull}}137648)
+* Re-enables bfloat16 in semantic text [#139347]({{es-pull}}139347)
+* Adds filter support for pushing down `COUNT(*) BY DATE_TRUNC` [#138765]({{es-pull}}138765)
+* Restricts GPU indexing to FLOAT element types [#139084]({{es-pull}}139084)
+* Introduces an adaptive HNSW Patience collector [#138685]({{es-pull}}138685)
+* Rewrites terms queries to a filter on `constant_keyword` fields [#139106]({{es-pull}}139106)
+* Minimizes doc values fetches in `TSDBSyntheticIdFieldsProducer` [#139053]({{es-pull}}139053)
+* Monitors `/proc/net/tcp{,6}` for retransmissions
+* Removes the `DOC_VALUES_SKIPPER` feature flag [#138723]({{es-pull}}138723)
+* Removes the `gpu_vectors_indexing` feature flag [#139318]({{es-pull}}139318)
+* Adds semantic search CCS support when `ccs_minimize_roundtrips=false` [#138982]({{es-pull}}138982)
+* Stores the `@timestamp` field value range in the compound commit header
+* Uses the existing `DocumentMapper` when creating a new `MapperService` [#138489]({{es-pull}}138489)
+* Uses the new bulk scoring dot product for max inner product [#139409]({{es-pull}}139409)
+
+
+### Fixes [serverless-changelog-12162025-fixes]
+
+* Enables storing secrets in {{fleet-server}} host config if {{fleet-server}} is running at a minimum supported version [#237464]({{kib-pull}}237464)
+* Fixes Discover tab initialization [#245752]({{kib-pull}}245752)
+* Improves error handling for tool responses [#241425]({{kib-pull}}241425)
+* Updates Gemini connector configuration [#245647]({{kib-pull}}245647)
+* Limits the API for retrieving gap summaries to 100 `rule_id`s per request [#245924]({{kib-pull}}245924)
+* Fixes "now" and mixed-format date handling in the share modal [#245539]({{kib-pull}}245539)
+* Ensures chart tooltips are always shown correctly in anomaly detection result views [#246077]({{kib-pull}}246077)
+* Turns off geopoint mapping in the processing preview [#245506]({{kib-pull}}245506)
+* Validates child stream input [#242581]({{kib-pull}}242581)
+* Fixes an issue where the upgrade assistant would incorrectly warn about nodes breaching the low watermark despite the `max_headroom` setting [#243906]({{kib-pull}}243906)
+* Fixes an ECS-incompatible value in the logs [#245706]({{kib-pull}}245706)
+* Fixes grammatical issues in the Solution Nav tour and simplifies the content by consolidating multiple links into one [#245718]({{kib-pull}}245718)
+* Fixes Discover trace waterfall behavior with duplicate spans [#244984]({{kib-pull}}244984)
+* Avoids JVM metric conflicts with explicit cast [#244151]({{kib-pull}}244151)
+* Fixes an issue where metadata filtering was confusing or broken when typing "OR" in Host view [#233836]({{kib-pull}}233836)
+* Compares {{esql}} query builders using identity [#139080]({{es-pull}}139080)
+* Adds support for chunking settings for sparse embeddings in a custom service to the Inference API [#138776]({{es-pull}}138776)
+* Uses the `dimensions` field in JinaAI `text_embedding` requests to the Inference API [#139395]({{es-pull}}139395)
+* Adds a configurable `max_batch_size` for GoogleVertexAI embedding service settings [#138047]({{es-pull}}138047)
+* Improves `CompoundRetrieverBuilder` failure handling [#136732]({{es-pull}}136732)
+* Treats dash-prefixed expressions as index exclusions [#138467]({{es-pull}}138467)
+* Enables auto prefiltering for queries on dense `semantic_text` fields [#138989]({{es-pull}}138989)
+* Disallows index type updates to `bbq_disk`, reverting (#131760) [#139061]({{es-pull}}139061)
+* Enforces DiskBBQ licensing [#139087]({{es-pull}}139087)
+* Ensures integer sorts are rewritten to long sorts for backward compatible indexes [#139293]({{es-pull}}139293)
+* Fixes `project_routing` in EQL [#139366]({{es-pull}}139366)
+* Changes `FUSE KEY BY` to accept a list of `qualifiedName` [#139071]({{es-pull}}139071)
+* Fixes metrics that took between 1 and 10 hours in {{esql}} [#139257]({{es-pull}}139257)
+* Prunes `InlineJoin` right aggregations by delegating to the child plan in {{esql}} [#139357]({{es-pull}}139357)
+* Fixes downsampling with disabled subobjects [#138715]({{es-pull}}138715)
+* Fixes an offset maths bug in `InetAddress` parsing [#139420]({{es-pull}}139420)
+* Avoids `EsqlIllegalArgumentException` for invalid window values [#139470]({{es-pull}}139470)
+
+
+
 
 ## December 8, 2025 [serverless-changelog-12082025]
 

release-notes/elastic-observability/index.md

@@ -21,6 +21,19 @@ To check for security updates, go to [Security announcements for the Elastic sta
 % ### Fixes [elastic-observability-next-fixes]
 % *
 
+## 9.2.3 [elastic-observability-9.2.3-release-notes]
+
+### Features and enhancements [elastic-observability-9.2.3-features-enhancements]
+* Adds a message to tell users when a stream is missing [#244366]({{kib-pull}}244366).
+* Adds a warning when deleting API keys that are currently in use by alerting rules [#243353]({{kib-pull}}243353).
+* Shows supported schemas in the Infrastructure inventory [#244481]({{kib-pull}}244481).
+
+
+### Fixes [elastic-observability-9.2.3-fixes]
+* Fixes alias resolution when checking lock index mappings [#244559]({{kib-pull}}244559).
+* Adds managed field to `dataViewSpecSchema` [#244134]({{kib-pull}}244134).
+* Removes mentions of template snippets from descriptions [#243656]({{kib-pull}}243656).
+
 ## 9.2.2 [elastic-observability-9.2.2-release-notes]
 
 ### Features and enhancements [elastic-observability-9.2.2-features-enhancements]
@@ -119,6 +132,14 @@ To check for security updates, go to [Security announcements for the Elastic sta
 * Improves accessibility for Streams badges [#235625]({{kib-pull}}235625).
 * Fixes code area responsiveness in Stream management [#232630]({{kib-pull}}232630).
 
+## 9.1.9 [elastic-observability-9.1.9-release-notes]
+
+### Features and enhancements [elastic-observability-9.1.9-features-enhancements]
+*  Adds a warning when deleting API keys that are currently in use by alerting rules [#243353]({{kib-pull}}243353).
+
+### Fixes [elastic-observability-9.1.9-fixes]
+* Fixes alias resolution when checking lock index mappings [#244559]({{kib-pull}}244559).
+
 ## 9.1.8 [elastic-observability-9.1.8-release-notes]
 
 ### Features and enhancements [elastic-observability-9.1.8-features-enhancements]