From b74ee04a020e61b7acff0d40bd5d005d0fa13f8e Mon Sep 17 00:00:00 2001 From: Janeen Roberts Date: Thu, 18 Sep 2025 18:13:30 -0400 Subject: [PATCH 1/2] Update known-issues.md --- release-notes/elastic-security/known-issues.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/release-notes/elastic-security/known-issues.md b/release-notes/elastic-security/known-issues.md index c0a0ba546e..f8a04746db 100644 --- a/release-notes/elastic-security/known-issues.md +++ b/release-notes/elastic-security/known-issues.md @@ -23,6 +23,18 @@ Applies to: 9.1.0, 9.1.1, 9.1.2, and 9.1.3 **Impact** After upgrading to 9.1.0 and later, some users may experience inconsistent results when applying filters to the Alerts page. + +**Workaround** + +You can turn off the {{kib}} `courier:ignoreFilterIfFieldNotInIndex` [advanced setting](kibana://reference/advanced-settings.md#kibana-search-settings), which only applies to the current space. However, turning off this setting will prevent dashboards and visualizations with applied filters from displaying properly. If you have important dashboards that this will impact, you can temporarily move them to a new space by doing the following: + +1. Create a [new space](/deploy-manage/manage-spaces.md#spaces-managing). +2. Use the [import saved objects tool](/explore-analyze/find-and-organize/saved-objects.md#saved-objects-import-and-export) to move the dashboards or visualizations to the space you just created. + +:::{note} +Ensure you give any users who will need access to the new space the appropriate permissions. +::: + ::: :::{dropdown} The {{elastic-agent}} Docker image is not available at `docker.elastic.co/beats/elastic-agent:9.0.0` From dc2db80bc3dfbe1c215377270261a218c3be9a79 Mon Sep 17 00:00:00 2001 From: Janeen Roberts Date: Fri, 19 Sep 2025 11:55:25 -0400 Subject: [PATCH 2/2] Update known-issues.md --- release-notes/elastic-security/known-issues.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/release-notes/elastic-security/known-issues.md b/release-notes/elastic-security/known-issues.md index f8a04746db..263b488168 100644 --- a/release-notes/elastic-security/known-issues.md +++ b/release-notes/elastic-security/known-issues.md @@ -26,10 +26,11 @@ After upgrading to 9.1.0 and later, some users may experience inconsistent resul **Workaround** -You can turn off the {{kib}} `courier:ignoreFilterIfFieldNotInIndex` [advanced setting](kibana://reference/advanced-settings.md#kibana-search-settings), which only applies to the current space. However, turning off this setting will prevent dashboards and visualizations with applied filters from displaying properly. If you have important dashboards that this will impact, you can temporarily move them to a new space by doing the following: +You can turn off the {{kib}} `courier:ignoreFilterIfFieldNotInIndex` [advanced setting](kibana://reference/advanced-settings.md#kibana-search-settings), which only applies to the current space. However, turning off this setting might prevent dashboards and visualizations with applied filters from displaying properly. If you have important dashboards that this will impact, you can temporarily move them to a new space by doing the following: 1. Create a [new space](/deploy-manage/manage-spaces.md#spaces-managing). -2. Use the [import saved objects tool](/explore-analyze/find-and-organize/saved-objects.md#saved-objects-import-and-export) to move the dashboards or visualizations to the space you just created. +2. Turn on the {{kib}} `courier:ignoreFilterIfFieldNotInIndex` [advanced setting](kibana://reference/advanced-settings.md#kibana-search-settings) so that filters apply to visualizations only if the index contains the filtering field. +3. Use the [import saved objects tool](/explore-analyze/find-and-organize/saved-objects.md#saved-objects-import-and-export) to move the dashboards or visualizations to the space you just created. :::{note} Ensure you give any users who will need access to the new space the appropriate permissions.