Add support for saved search assets in content packages - #1210
Merged
mrodm merged 5 commits intoJul 30, 2026
Conversation
Saved search assets (kibana/search) are already supported in integration packages. Allow them in content packages too, guarded to spec versions >= 3.7.0. Fleet installs Kibana assets for content packages through the same streaming install path as integration packages, with no per-package-type asset filtering, so these assets are installed as-is once present. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Follow the security_rule (elastic#885) and ml_module (elastic#1149) precedent: allow the asset at all content spec versions, since Fleet already installs it. good_content stays at format_version 3.6.0, which also exercises the folder at an older spec version. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mrodm
reviewed
Jul 22, 2026
| type: file | ||
| contentMediaType: "application/json" | ||
| pattern: '^{PACKAGE_NAME}-.+\.json$' | ||
| - description: Folder containing Kibana saved search assets |
Contributor
There was a problem hiding this comment.
how are these assets included on the package? is there an import command within elastic-package we need to update related to this?
Contributor
Author
There was a problem hiding this comment.
the saved searches look like this, i don't think we need any scaffolding to generate these.
{
"id": "saved_search_demo-search-logs",
"type": "search",
"typeMigrationVersion": "8.0.0",
"attributes": {
"title": "Demo logs ES|QL search",
"description": "Simple ES|QL saved search over logs-*",
"columns": [],
"sort": [],
"isTextBasedQuery": true,
"timeRestore": false,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"query\":{\"esql\":\"FROM logs-*\"},\"filter\":[]}"
}
}
}
teresaromero
left a comment
teresaromero
left a comment
Contributor
There was a problem hiding this comment.
waiting to approve for the changelog entry change
mrodm
approved these changes
Jul 30, 2026
teresaromero
approved these changes
Jul 30, 2026
💚 Build Succeeded
History
|
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
andrewkroh
pushed a commit
to andrewkroh/go-package-spec
that referenced
this pull request
Aug 4, 2026
Regenerate the data model from andrewkroh/package-spec-schema at commit e59fb7f, and propagate the new schema surface through to the SQL tables. Schema changes in 3.6.6: - Add top-level `group` field to integration, input, and content package manifests for declaring marketplace group membership (elastic/package-spec#1213). - Allow policy tests to ignore fields (elastic/package-spec#1214). - Add support for saved search assets in content packages (elastic/package-spec#1210). - Remove the search type from by-reference validation checks (elastic/package-spec#1196), plus mode-aware constructors and `source`/`build` validation modes (elastic/package-spec#1177, elastic/package-spec#1178). These are package-spec tooling and validation changes with no schema surface, so they have no effect here. The `group` field is declared on all three manifest types, so list it under the `Manifest` base type in cmd/generate/augment.yml rather than emitting three copies. This is what makes it reachable from SQL: the `packages` table is generated by reflecting over `Manifest`, so a field on a concrete manifest type would be invisible to cmd/gensql. Regeneration then adds a `packages.group` column, quoted because `group` is a SQLite keyword. Absent values store as NULL rather than the empty string. Saved searches in content packages need no code change. readKibanaObjects discovers asset types by scanning subdirectories of kibana/, so kibana/search/*.json already reached the kibana_saved_objects table. Add a test to pin the behavior and document the asset type in CLAUDE.md. Policy test `ignore_fields` needs no SQL change. The policy_tests table is built from PolicyTestConfig, which models the per-case _dev/test/policy/test-*.yml files. The new PolicyConfigTests type belongs to the package-level _dev/test/config.yml, which pkgreader does not read and which is therefore not persisted. BREAKING CHANGE: TestConfig.Policy and InputTestConfig.Policy change type from TestCategoryConfig to the new PolicyConfigTests, which adds `ignore_fields` alongside the existing `parallel`, `skip`, and `requires` keys. Callers reading either field must be updated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds support for Kibana saved search assets (
kibana/search) in content packages, mirroring the existing definition for integration packages (same filename pattern and forbidden-ecs/-ECSsuffix rule).The asset is allowed at all content spec versions (no
versions:guard), following the precedent ofsecurity_rule(#885) andml_module(#1149), and the deliberate relaxation of theslo_template/alerting_rule_templateguards in #1064: since the stack already supports installing these assets, existing content packages can adopt them without aformat_versionbump.Also adds a saved search asset to the
good_contenttest package (which stays atformat_version: 3.6.0, exercising the folder at an older spec version).Why is it important?
Content packages currently cannot ship saved searches, even though integration packages can and Kibana/Fleet is already capable of installing them for content packages.
We are planning to use Integration-managed saved searches to power "inventory views" in Kibana.
Checklist
spec/changelog.yml.🤖 Generated with Claude Code