Skip to content

Add Kibana Streams API (/api/streams, /api/streams/_status) to diagnostics#1033

Open
lucabelluccini wants to merge 3 commits into
elastic:mainfrom
lucabelluccini:add-kibana-streams-api
Open

Add Kibana Streams API (/api/streams, /api/streams/_status) to diagnostics#1033
lucabelluccini wants to merge 3 commits into
elastic:mainfrom
lucabelluccini:add-kibana-streams-api

Conversation

@lucabelluccini

@lucabelluccini lucabelluccini commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Adds kibana_streams (GET /api/streams) to kibana-rest.yml so the diagnostic collects Kibana Streams configuration.
  • Adds streams_status (GET /_streams/status) to elastic-rest.yml so the diagnostic collects stream enablement status directly from Elasticsearch. Kibana's own GET /api/streams/_status is a thin proxy over this Elasticsearch endpoint and was rejected by at least one Kibana build ("exists but is not available with the current configuration"), so we query Elasticsearch directly instead.
  • Both are version-gated to >= 8.19.0 < 9.0.0 || >= 9.1.0, matching where these APIs actually exist (confirmed against the 8.19.0/9.0.0/9.1.0 release tags for both Kibana and Elasticsearch — the APIs are present in the 8.19.0 and 9.1.0 trains, but not in 9.0.x).
  • Neither endpoint supports pagination.

Test plan

  • ./gradlew compileJava succeeds
  • ./gradlew test --tests "co.elastic.support.rest.*" passes (existing YAML-loading tests still pass with the new entries)
  • Built the dist zip and ran kibana-api diagnostics against a local Kibana 9.5.0 instance — kibana_streams.json collected real stream data successfully
  • Manually run diagnostics against a Kibana/Elasticsearch 9.1.0+ (or 8.19.0+) instance and confirm streams_status.json is produced
  • Confirm the entries are correctly skipped on 9.0.x

@lucabelluccini
lucabelluccini requested review from a team and pickypg as code owners July 7, 2026 19:20
@pickypg

pickypg commented Jul 7, 2026

Copy link
Copy Markdown
Member

@lucabelluccini I'll wait until you can confirm those last two, then I can merge this.

@lucabelluccini

Copy link
Copy Markdown
Contributor Author

Hello @flash1293 / @3kt - May I ask if those APIs make sense and if we should gate them on a 9.2 or even 9.4 version instead?
Can those APIs leak PII/data?

@lucabelluccini

lucabelluccini commented Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Hello @pickypg - I need a review by Joe/Alexis - Let's hold please

Tests run against 9.5.0-SNAPSHOT

Elasticsearch (streams_status.json, from GET /_streams/status):
{"logs":{"enabled":false},"logs.ecs":{"enabled":true},"logs.otel":{"enabled":true}}

Kibana (kibana_streams.json, from GET /api/streams):
{"streams":[{"type":"wired","name":"logs.ecs",...},{"type":"wired","name":"logs.otel",...},{"type":"classic","name":"logs-elastic_agent-default",...}, ...]}

Adds kibana_streams (/api/streams) and kibana_streams_status
(/api/streams/_status) to the Kibana diagnostic queries.

Both APIs exist starting in the 8.19.0 and 9.1.0 release trains but
not in 9.0.x, so they are gated with ">= 8.19.0 < 9.0.0 || >= 9.1.0".
Neither endpoint supports pagination.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@lucabelluccini
lucabelluccini force-pushed the add-kibana-streams-api branch from a4f8ae4 to da42d09 Compare July 7, 2026 19:29
Kibana's internal GET /api/streams/_status route proxies to
Elasticsearch's native GET /_streams/status and was rejected by at
least one Kibana build ("exists but is not available with the
current configuration"). Query the Elasticsearch endpoint directly
instead, which is where the status actually lives.

Same version gate as the Kibana Streams entries: present in the
8.19.0 and 9.1.0 release trains, absent in 9.0.x.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

@flash1293 flash1293 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, /api/streams is not super light, but since the number of streams is bounded by what Elasticsearch can handle (a couple thousand at max), it shouldn't cause crazy memory pressure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants