Add support for saved search assets in content packages#1210
Open
tommyers-elastic wants to merge 3 commits into
Open
Add support for saved search assets in content packages#1210tommyers-elastic wants to merge 3 commits into
tommyers-elastic wants to merge 3 commits into
Conversation
Saved search assets (kibana/search) are already supported in integration packages. Allow them in content packages too, guarded to spec versions >= 3.7.0. Fleet installs Kibana assets for content packages through the same streaming install path as integration packages, with no per-package-type asset filtering, so these assets are installed as-is once present. Co-Authored-By: Claude Fable 5 <[email protected]>
Co-Authored-By: Claude Fable 5 <[email protected]>
Follow the security_rule (elastic#885) and ml_module (elastic#1149) precedent: allow the asset at all content spec versions, since Fleet already installs it. good_content stays at format_version 3.6.0, which also exercises the folder at an older spec version. Co-Authored-By: Claude Fable 5 <[email protected]>
💚 Build Succeeded
History
|
mrodm
reviewed
Jul 22, 2026
| link: https://github.com/elastic/package-spec/pull/1196 | ||
| - description: Add support for saved search assets in content packages. | ||
| type: enhancement | ||
| link: https://github.com/elastic/package-spec/pull/1210 |
Contributor
There was a problem hiding this comment.
Please, create a new version entry 3.6.6-next for this change.
As there is no need to add support in Kibana for this change (is that right @tommyers-elastic ?) it could be kept in 3.6.x.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds support for Kibana saved search assets (
kibana/search) in content packages, mirroring the existing definition for integration packages (same filename pattern and forbidden-ecs/-ECSsuffix rule).The asset is allowed at all content spec versions (no
versions:guard), following the precedent ofsecurity_rule(#885) andml_module(#1149), and the deliberate relaxation of theslo_template/alerting_rule_templateguards in #1064: since the stack already supports installing these assets, existing content packages can adopt them without aformat_versionbump.Also adds a saved search asset to the
good_contenttest package (which stays atformat_version: 3.6.0, exercising the folder at an older spec version).Why is it important?
Content packages currently cannot ship saved searches, even though integration packages can and Kibana/Fleet is already capable of installing them for content packages.
We are planning to use Integration-managed saved searches to power "inventory views" in Kibana.
Checklist
spec/changelog.yml.🤖 Generated with Claude Code