Update ELK images for 9.1.0 and 8.19.0 #19558

navyau09 · 2025-07-29T11:38:41Z

Update ELK images for 9.1.0 and 8.19.0

navyau09 · 2025-07-29T12:00:54Z

@jbudz Could you please take a look on the failing test for 8.19.0? Thanks

tianon · 2025-07-29T16:17:05Z

elasticsearch:7.17.28 (FROM ubuntu:20.04) -- completely unsupported base!
kibana:7.17.28 (FROM ubuntu:20.04) -- completely unsupported base!

It's been almost two months now since #19184 (comment) (#19167 (comment), #19183 (comment), #19318 (comment), #19515 (comment)). Can we get a status update on the "get 7.x off Ubuntu 20.04" efforts? (or finally commit and remove it from the library file / supported list)

github-actions · 2025-07-31T10:49:52Z

Diff for cd01a42:

diff --git a/_bashbrew-cat b/_bashbrew-cat
index a5ec02b..ab680e5 100644
--- a/_bashbrew-cat
+++ b/_bashbrew-cat
@@ -4,11 +4,6 @@ GitRepo: https://github.com/elastic/dockerfiles.git
 Directory: elasticsearch
 Builder: buildkit
 
-Tags: 7.17.28
-Architectures: amd64, arm64v8
-GitFetch: refs/heads/7.17
-GitCommit: 2ef7e0a0be5abd21cb38a39c3cce65d5278ebfee
-
 Tags: 8.17.9
 Architectures: amd64, arm64v8
 GitFetch: refs/heads/8.17
@@ -19,11 +14,21 @@ Architectures: amd64, arm64v8
 GitFetch: refs/heads/8.18
 GitCommit: 879005c2065f0c8d78fa6d978ce161fd38734600
 
+Tags: 8.19.0
+Architectures: amd64, arm64v8
+GitFetch: refs/heads/8.19
+GitCommit: a01d05345bb7ef65ee8fe2ca4713cc0efa98cf5b
+
 Tags: 9.0.4
 Architectures: amd64, arm64v8
 GitFetch: refs/heads/9.0
 GitCommit: 8052f28559ff55a203e9ce99ecb48251bbc67079
 
+Tags: 9.1.0
+Architectures: amd64, arm64v8
+GitFetch: refs/heads/9.1
+GitCommit: e25a4db7c35942e4deb90532335b7f43710ff5ce
+
 
 # kibana
 Maintainers: Jon Budzenski (@jbudz)
@@ -34,7 +39,7 @@ Builder: buildkit
 Tags: 7.17.28
 Architectures: amd64, arm64v8
 GitFetch: refs/heads/7.17
-GitCommit: 2ef7e0a0be5abd21cb38a39c3cce65d5278ebfee
+GitCommit: 28b876f2aaba7bc27d76a1acd55cbc8ada9b5dea
 
 Tags: 8.17.9
 Architectures: amd64, arm64v8
@@ -46,11 +51,21 @@ Architectures: amd64, arm64v8
 GitFetch: refs/heads/8.18
 GitCommit: 879005c2065f0c8d78fa6d978ce161fd38734600
 
+Tags: 8.19.0
+Architectures: amd64, arm64v8
+GitFetch: refs/heads/8.19
+GitCommit: e4c2da0c16babf1795279cb79aa1bf507363b3f6
+
 Tags: 9.0.4
 Architectures: amd64, arm64v8
 GitFetch: refs/heads/9.0
 GitCommit: 8052f28559ff55a203e9ce99ecb48251bbc67079
 
+Tags: 9.1.0
+Architectures: amd64, arm64v8
+GitFetch: refs/heads/9.1
+GitCommit: e25a4db7c35942e4deb90532335b7f43710ff5ce
+
 
 # logstash
 Maintainers: João Duarte (@jsvd)
@@ -68,7 +83,17 @@ Architectures: amd64, arm64v8
 GitFetch: refs/heads/8.18
 GitCommit: 879005c2065f0c8d78fa6d978ce161fd38734600
 
+Tags: 8.19.0
+Architectures: amd64, arm64v8
+GitFetch: refs/heads/8.19
+GitCommit: a01d05345bb7ef65ee8fe2ca4713cc0efa98cf5b
+
 Tags: 9.0.4
 Architectures: amd64, arm64v8
 GitFetch: refs/heads/9.0
 GitCommit: 8052f28559ff55a203e9ce99ecb48251bbc67079
+
+Tags: 9.1.0
+Architectures: amd64, arm64v8
+GitFetch: refs/heads/9.1
+GitCommit: e25a4db7c35942e4deb90532335b7f43710ff5ce
diff --git a/_bashbrew-list b/_bashbrew-list
index 7718128..24565a1 100644
--- a/_bashbrew-list
+++ b/_bashbrew-list
@@ -1,11 +1,16 @@
-elasticsearch:7.17.28
 elasticsearch:8.17.9
 elasticsearch:8.18.4
+elasticsearch:8.19.0
 elasticsearch:9.0.4
+elasticsearch:9.1.0
 kibana:7.17.28
 kibana:8.17.9
 kibana:8.18.4
+kibana:8.19.0
 kibana:9.0.4
+kibana:9.1.0
 logstash:8.17.9
 logstash:8.18.4
+logstash:8.19.0
 logstash:9.0.4
+logstash:9.1.0
diff --git a/_bashbrew-list-build-order b/_bashbrew-list-build-order
index 7718128..24565a1 100644
--- a/_bashbrew-list-build-order
+++ b/_bashbrew-list-build-order
@@ -1,11 +1,16 @@
-elasticsearch:7.17.28
 elasticsearch:8.17.9
 elasticsearch:8.18.4
+elasticsearch:8.19.0
 elasticsearch:9.0.4
+elasticsearch:9.1.0
 kibana:7.17.28
 kibana:8.17.9
 kibana:8.18.4
+kibana:8.19.0
 kibana:9.0.4
+kibana:9.1.0
 logstash:8.17.9
 logstash:8.18.4
+logstash:8.19.0
 logstash:9.0.4
+logstash:9.1.0
diff --git a/elasticsearch_7.17.28/bin/docker-entrypoint.sh b/elasticsearch_7.17.28/bin/docker-entrypoint.sh
deleted file mode 100755
index eeb9832..0000000
diff --git a/elasticsearch_7.17.28/Dockerfile b/elasticsearch_8.19.0/Dockerfile
similarity index 74%
rename from elasticsearch_7.17.28/Dockerfile
rename to elasticsearch_8.19.0/Dockerfile
index a132d52..7b3e55f 100644
--- a/elasticsearch_7.17.28/Dockerfile
+++ b/elasticsearch_8.19.0/Dockerfile
@@ -1,23 +1,14 @@
-################################################################################
-# This Dockerfile was generated from the template at distribution/src/docker/Dockerfile
-#
-# Beginning of multi stage Dockerfile
-################################################################################
+
 
 ################################################################################
-# Build stage 0 `builder`:
+# Build stage 1 `builder`:
 # Extract Elasticsearch artifact
 ################################################################################
-FROM ubuntu:20.04 AS builder
 
-# Install required packages to extract the Elasticsearch distribution
+FROM ubuntu:24.04 AS builder
 
-RUN for iter in 1 2 3 4 5 6 7 8 9 10; do \
-      apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl  && \
-      exit_code=0 && break || \
-        exit_code=$? && echo "apt-get error: retry $iter in 10s" && sleep 10; \
-    done; \
-    exit $exit_code
+# Install required packages to extract the Elasticsearch distribution
+RUN apt-get update -y && DEBIAN_FRONTEND=noninteractive apt-get install -y curl
 
 # `tini` is a tiny but valid init for containers. This is used to cleanly
 # control how ES and any child processes are shut down.
@@ -25,24 +16,21 @@ RUN for iter in 1 2 3 4 5 6 7 8 9 10; do \
 # The tini GitHub page gives instructions for verifying the binary using
 # gpg, but the keyservers are slow to return the key and this can fail the
 # build. Instead, we check the binary against the published checksum.
-RUN set -eux ; \
-    tini_bin="" ; \
+RUN set -eux; \
     case "$(arch)" in \
-        aarch64) tini_bin='tini-arm64' ;; \
-        x86_64)  tini_bin='tini-amd64' ;; \
-        *) echo >&2 ; echo >&2 "Unsupported architecture $(arch)" ; echo >&2 ; exit 1 ;; \
+        aarch64) tini_bin='tini-arm64'; tini_sum='07952557df20bfd2a95f9bef198b445e006171969499a1d361bd9e6f8e5e0e81' ;; \
+        x86_64)  tini_bin='tini-amd64'; tini_sum='93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c' ;; \
+        *) echo >&2 "Unsupported architecture $arch"; exit 1 ;; \
     esac ; \
-    curl --retry 10 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/${tini_bin} ; \
-    curl --retry 10 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/${tini_bin}.sha256sum ; \
-    sha256sum -c ${tini_bin}.sha256sum ; \
-    rm ${tini_bin}.sha256sum ; \
-    mv ${tini_bin} /bin/tini ; \
+    curl -f --retry 10 -S -L -o /tmp/tini https://github.com/krallin/tini/releases/download/v0.19.0/${tini_bin}; \
+    echo "${tini_sum}  /tmp/tini" | sha256sum -c -; \
+    mv /tmp/tini /bin/tini; \
     chmod 0555 /bin/tini
 
 RUN mkdir /usr/share/elasticsearch
 WORKDIR /usr/share/elasticsearch
 
-RUN curl --retry 10 -S -L --output /tmp/elasticsearch.tar.gz https://artifacts-no-kpi.elastic.co/downloads/elasticsearch/elasticsearch-7.17.28-linux-$(arch).tar.gz
+RUN curl --retry 10 -S -L --output /tmp/elasticsearch.tar.gz https://artifacts-no-kpi.elastic.co/downloads/elasticsearch/elasticsearch-8.19.0-linux-$(arch).tar.gz
 
 RUN tar -zxf /tmp/elasticsearch.tar.gz --strip-components=1
 
@@ -71,22 +59,22 @@ RUN sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elas
     find config -type f -exec chmod 0664 {} +
 
 ################################################################################
-# Build stage 1 (the actual Elasticsearch image):
+# Build stage 2 (the actual Elasticsearch image):
 #
-# Copy elasticsearch from stage 0
+# Copy elasticsearch from stage 1
 # Add entrypoint
 ################################################################################
 
-FROM ubuntu:20.04
+FROM ubuntu:24.04
 
 # Change default shell to bash, then install required packages with retries.
 RUN yes no | dpkg-reconfigure dash && \
-    for iter in 1 2 3 4 5 6 7 8 9 10; do \
+for iter in 1 2 3 4 5 6 7 8 9 10; do \
       export DEBIAN_FRONTEND=noninteractive && \
       apt-get update && \
       apt-get upgrade -y && \
       apt-get install -y --no-install-recommends \
-        ca-certificates curl netcat p11-kit unzip zip && \
+        ca-certificates curl netcat-openbsd p11-kit unzip zip  && \
       apt-get clean && \
       rm -rf /var/lib/apt/lists/* && \
       exit_code=0 && break || \
@@ -94,20 +82,21 @@ RUN yes no | dpkg-reconfigure dash && \
     done; \
     exit $exit_code
 
-RUN groupadd -g 1000 elasticsearch && \
-    adduser --uid 1000 --gid 1000 --home /usr/share/elasticsearch elasticsearch && \
-    adduser elasticsearch root && \
+RUN userdel -r ubuntu && \
+    groupadd -g 1000 elasticsearch && \
+    useradd --uid 1000 --gid 1000 --home-dir /usr/share/elasticsearch --create-home elasticsearch && \
+    usermod -aG root elasticsearch && \
     chown -R 0:0 /usr/share/elasticsearch
 
-ENV ELASTIC_CONTAINER true
+ENV ELASTIC_CONTAINER=true
 
 WORKDIR /usr/share/elasticsearch
 
 COPY --from=builder --chown=0:0 /usr/share/elasticsearch /usr/share/elasticsearch
 COPY --from=builder --chown=0:0 /bin/tini /bin/tini
 
-ENV PATH /usr/share/elasticsearch/bin:$PATH
-
+ENV PATH=/usr/share/elasticsearch/bin:$PATH
+ENV SHELL=/bin/bash
 COPY bin/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
 # 1. Sync the user and group permissions of /etc/passwd
@@ -134,25 +123,25 @@ RUN /etc/ca-certificates/update.d/docker-openjdk
 
 EXPOSE 9200 9300
 
-LABEL org.label-schema.build-date="2025-02-20T09:05:31.349013687Z" \
+LABEL org.label-schema.build-date="2025-07-23T22:10:18.138212839Z" \
   org.label-schema.license="Elastic-License-2.0" \
   org.label-schema.name="Elasticsearch" \
   org.label-schema.schema-version="1.0" \
   org.label-schema.url="https://www.elastic.co/products/elasticsearch" \
   org.label-schema.usage="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \
-  org.label-schema.vcs-ref="139cb5a961d8de68b8e02c45cc47f5289a3623af" \
+  org.label-schema.vcs-ref="93788a8c2882eb5b606510680fac214cff1c7a22" \
   org.label-schema.vcs-url="https://github.com/elastic/elasticsearch" \
   org.label-schema.vendor="Elastic" \
-  org.label-schema.version="7.17.28" \
-  org.opencontainers.image.created="2025-02-20T09:05:31.349013687Z" \
+  org.label-schema.version="8.19.0" \
+  org.opencontainers.image.created="2025-07-23T22:10:18.138212839Z" \
   org.opencontainers.image.documentation="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \
   org.opencontainers.image.licenses="Elastic-License-2.0" \
-  org.opencontainers.image.revision="139cb5a961d8de68b8e02c45cc47f5289a3623af" \
+  org.opencontainers.image.revision="93788a8c2882eb5b606510680fac214cff1c7a22" \
   org.opencontainers.image.source="https://github.com/elastic/elasticsearch" \
   org.opencontainers.image.title="Elasticsearch" \
   org.opencontainers.image.url="https://www.elastic.co/products/elasticsearch" \
   org.opencontainers.image.vendor="Elastic" \
-  org.opencontainers.image.version="7.17.28"
+  org.opencontainers.image.version="8.19.0"
 
 # Our actual entrypoint is `tini`, a minimal but functional init program. It
 # calls the entrypoint we provide, while correctly forwarding signals.
@@ -160,6 +149,8 @@ ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
 # Dummy overridable parameter parsed by entrypoint
 CMD ["eswrapper"]
 
+USER 1000:0
+
 ################################################################################
 # End of multi-stage Dockerfile
 ################################################################################
diff --git a/elasticsearch_8.17.9/bin/docker-entrypoint.sh b/elasticsearch_8.19.0/bin/docker-entrypoint.sh
similarity index 100%
copy from elasticsearch_8.17.9/bin/docker-entrypoint.sh
copy to elasticsearch_8.19.0/bin/docker-entrypoint.sh
diff --git a/elasticsearch_7.17.28/bin/docker-openjdk b/elasticsearch_8.19.0/bin/docker-openjdk
similarity index 100%
rename from elasticsearch_7.17.28/bin/docker-openjdk
rename to elasticsearch_8.19.0/bin/docker-openjdk
diff --git a/elasticsearch_7.17.28/config/elasticsearch.yml b/elasticsearch_8.19.0/config/elasticsearch.yml
similarity index 100%
copy from elasticsearch_7.17.28/config/elasticsearch.yml
copy to elasticsearch_8.19.0/config/elasticsearch.yml
diff --git a/elasticsearch_7.17.28/config/log4j2.properties b/elasticsearch_8.19.0/config/log4j2.properties
similarity index 68%
rename from elasticsearch_7.17.28/config/log4j2.properties
rename to elasticsearch_8.19.0/config/log4j2.properties
index b46562d..c53ebcb 100644
--- a/elasticsearch_7.17.28/config/log4j2.properties
+++ b/elasticsearch_8.19.0/config/log4j2.properties
@@ -3,8 +3,8 @@ status = error
 ######## Server JSON ############################
 appender.rolling.type = Console
 appender.rolling.name = rolling
-appender.rolling.layout.type = ESJsonLayout
-appender.rolling.layout.type_name = server
+appender.rolling.layout.type = ECSJsonLayout
+appender.rolling.layout.dataset = elasticsearch.server
 
 ################################################
 
@@ -16,16 +16,15 @@ rootLogger.appenderRef.rolling.ref = rolling
 ######## Deprecation JSON #######################
 appender.deprecation_rolling.type = Console
 appender.deprecation_rolling.name = deprecation_rolling
-appender.deprecation_rolling.layout.type = ESJsonLayout
-appender.deprecation_rolling.layout.type_name = deprecation.elasticsearch
-appender.deprecation_rolling.layout.esmessagefields=x-opaque-id,key,category,elasticsearch.elastic_product_origin
+appender.deprecation_rolling.layout.type = ECSJsonLayout
+# Intentionally follows a different pattern to above
+appender.deprecation_rolling.layout.dataset = deprecation.elasticsearch
 appender.deprecation_rolling.filter.rate_limit.type = RateLimitingFilter
 
 appender.header_warning.type = HeaderWarningAppender
 appender.header_warning.name = header_warning
 #################################################
 
-#################################################
 logger.deprecation.name = org.elasticsearch.deprecation
 logger.deprecation.level = WARN
 logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling
@@ -35,9 +34,8 @@ logger.deprecation.additivity = false
 ######## Search slowlog JSON ####################
 appender.index_search_slowlog_rolling.type = Console
 appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling
-appender.index_search_slowlog_rolling.layout.type = ESJsonLayout
-appender.index_search_slowlog_rolling.layout.type_name = index_search_slowlog
-appender.index_search_slowlog_rolling.layout.esmessagefields=message,took,took_millis,total_hits,types,stats,search_type,total_shards,source,id
+appender.index_search_slowlog_rolling.layout.type = ECSJsonLayout
+appender.index_search_slowlog_rolling.layout.dataset = elasticsearch.index_search_slowlog
 
 #################################################
 
@@ -50,11 +48,8 @@ logger.index_search_slowlog_rolling.additivity = false
 ######## Indexing slowlog JSON ##################
 appender.index_indexing_slowlog_rolling.type = Console
 appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling
-appender.index_indexing_slowlog_rolling.layout.type = ESJsonLayout
-appender.index_indexing_slowlog_rolling.layout.type_name = index_indexing_slowlog
-appender.index_indexing_slowlog_rolling.layout.esmessagefields=message,took,took_millis,doc_type,id,routing,source
-
-#################################################
+appender.index_indexing_slowlog_rolling.layout.type = ECSJsonLayout
+appender.index_indexing_slowlog_rolling.layout.dataset = elasticsearch.index_indexing_slowlog
 
 #################################################
 
@@ -63,12 +58,63 @@ logger.index_indexing_slowlog.level = trace
 logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling
 logger.index_indexing_slowlog.additivity = false
 
+######## ES|QL query log JSON ####################
+appender.esql_querylog_rolling.type = Console
+appender.esql_querylog_rolling.name = esql_querylog_rolling
+appender.esql_querylog_rolling.layout.type = ECSJsonLayout
+appender.esql_querylog_rolling.layout.dataset = elasticsearch.esql_querylog
+
+#################################################
+
+logger.esql_querylog_rolling.name = esql.querylog
+logger.esql_querylog_rolling.level = trace
+logger.esql_querylog_rolling.appenderRef.esql_querylog_rolling.ref = esql_querylog_rolling
+logger.esql_querylog_rolling.additivity = false
+
+logger.org_apache_pdfbox.name = org.apache.pdfbox
+logger.org_apache_pdfbox.level = off
+
+logger.org_apache_poi.name = org.apache.poi
+logger.org_apache_poi.level = off
+
+logger.org_apache_fontbox.name = org.apache.fontbox
+logger.org_apache_fontbox.level = off
+
+logger.org_apache_xmlbeans.name = org.apache.xmlbeans
+logger.org_apache_xmlbeans.level = off
+
+logger.entitlements_ingest_attachment.name = org.elasticsearch.entitlement.runtime.policy.PolicyManager.ingest-attachment.ALL-UNNAMED
+logger.entitlements_ingest_attachment.level = error
+
+logger.entitlements_repository_gcs.name = org.elasticsearch.entitlement.runtime.policy.PolicyManager.repository-gcs.ALL-UNNAMED
+logger.entitlements_repository_gcs.level = error
+
+logger.com_amazonaws.name = com.amazonaws
+logger.com_amazonaws.level = warn
+
+logger.com_amazonaws_jmx_SdkMBeanRegistrySupport.name = com.amazonaws.jmx.SdkMBeanRegistrySupport
+logger.com_amazonaws_jmx_SdkMBeanRegistrySupport.level = error
+
+logger.com_amazonaws_metrics_AwsSdkMetrics.name = com.amazonaws.metrics.AwsSdkMetrics
+logger.com_amazonaws_metrics_AwsSdkMetrics.level = error
+
+logger.com_amazonaws_auth_profile_internal_BasicProfileConfigFileLoader.name = com.amazonaws.auth.profile.internal.BasicProfileConfigFileLoader
+logger.com_amazonaws_auth_profile_internal_BasicProfileConfigFileLoader.level = error
+
+logger.com_amazonaws_services_s3_internal_UseArnRegionResolver.name = com.amazonaws.services.s3.internal.UseArnRegionResolver
+logger.com_amazonaws_services_s3_internal_UseArnRegionResolver.level = error
+
+logger.entitlements_repository_s3.name = org.elasticsearch.entitlement.runtime.policy.PolicyManager.repository-s3.ALL-UNNAMED
+logger.entitlements_repository_s3.level = error
+
 appender.audit_rolling.type = Console
 appender.audit_rolling.name = audit_rolling
 appender.audit_rolling.layout.type = PatternLayout
 appender.audit_rolling.layout.pattern = {\
                 "type":"audit", \
                 "timestamp":"%d{yyyy-MM-dd'T'HH:mm:ss,SSSZ}"\
+                %varsNotEmpty{, "cluster.name":"%enc{%map{cluster.name}}{JSON}"}\
+                %varsNotEmpty{, "cluster.uuid":"%enc{%map{cluster.uuid}}{JSON}"}\
                 %varsNotEmpty{, "node.name":"%enc{%map{node.name}}{JSON}"}\
                 %varsNotEmpty{, "node.id":"%enc{%map{node.id}}{JSON}"}\
                 %varsNotEmpty{, "host.name":"%enc{%map{host.name}}{JSON}"}\
@@ -80,16 +126,21 @@ appender.audit_rolling.layout.pattern = {\
                 %varsNotEmpty{, "user.run_by.name":"%enc{%map{user.run_by.name}}{JSON}"}\
                 %varsNotEmpty{, "user.run_as.name":"%enc{%map{user.run_as.name}}{JSON}"}\
                 %varsNotEmpty{, "user.realm":"%enc{%map{user.realm}}{JSON}"}\
+                %varsNotEmpty{, "user.realm_domain":"%enc{%map{user.realm_domain}}{JSON}"}\
                 %varsNotEmpty{, "user.run_by.realm":"%enc{%map{user.run_by.realm}}{JSON}"}\
+                %varsNotEmpty{, "user.run_by.realm_domain":"%enc{%map{user.run_by.realm_domain}}{JSON}"}\
                 %varsNotEmpty{, "user.run_as.realm":"%enc{%map{user.run_as.realm}}{JSON}"}\
+                %varsNotEmpty{, "user.run_as.realm_domain":"%enc{%map{user.run_as.realm_domain}}{JSON}"}\
                 %varsNotEmpty{, "user.roles":%map{user.roles}}\
                 %varsNotEmpty{, "apikey.id":"%enc{%map{apikey.id}}{JSON}"}\
                 %varsNotEmpty{, "apikey.name":"%enc{%map{apikey.name}}{JSON}"}\
                 %varsNotEmpty{, "authentication.token.name":"%enc{%map{authentication.token.name}}{JSON}"}\
                 %varsNotEmpty{, "authentication.token.type":"%enc{%map{authentication.token.type}}{JSON}"}\
+                %varsNotEmpty{, "cross_cluster_access":%map{cross_cluster_access}}\
                 %varsNotEmpty{, "origin.type":"%enc{%map{origin.type}}{JSON}"}\
                 %varsNotEmpty{, "origin.address":"%enc{%map{origin.address}}{JSON}"}\
                 %varsNotEmpty{, "realm":"%enc{%map{realm}}{JSON}"}\
+                %varsNotEmpty{, "realm_domain":"%enc{%map{realm_domain}}{JSON}"}\
                 %varsNotEmpty{, "url.path":"%enc{%map{url.path}}{JSON}"}\
                 %varsNotEmpty{, "url.query":"%enc{%map{url.query}}{JSON}"}\
                 %varsNotEmpty{, "request.method":"%enc{%map{request.method}}{JSON}"}\
@@ -120,16 +171,21 @@ appender.audit_rolling.layout.pattern = {\
 # "user.run_by.name" the original authenticated subject name that is impersonating another one.
 # "user.run_as.name" if this "event.action" is of a run_as type, this is the subject name to be impersonated as.
 # "user.realm" the name of the realm that authenticated "user.name"
+# "user.realm_domain" if "user.realm" is under a domain, this is the name of the domain
 # "user.run_by.realm" the realm name of the impersonating subject ("user.run_by.name")
+# "user.run_by.realm_domain" if "user.run_by.realm" is under a domain, this is the name of the domain
 # "user.run_as.realm" if this "event.action" is of a run_as type, this is the realm name the impersonated user is looked up from
+# "user.run_as.realm_domain" if "user.run_as.realm" is under a domain, this is the name of the domain
 # "user.roles" the roles array of the user; these are the roles that are granting privileges
 # "apikey.id" this field is present if and only if the "authentication.type" is "api_key"
 # "apikey.name" this field is present if and only if the "authentication.type" is "api_key"
 # "authentication.token.name" this field is present if and only if the authenticating credential is a service account token
 # "authentication.token.type" this field is present if and only if the authenticating credential is a service account token
+# "cross_cluster_access" this field is present if and only if the associated authentication occurred cross cluster
 # "event.type" informs about what internal system generated the event; possible values are "rest", "transport", "ip_filter" and "security_config_change"
 # "origin.address" the remote address and port of the first network hop, i.e. a REST proxy or another cluster node
 # "realm" name of a realm that has generated an "authentication_failed" or an "authentication_successful"; the subject is not yet authenticated
+# "realm_domain" if "realm" is under a domain, this is the name of the domain
 # "url.path" the URI component between the port and the query string; it is percent (URL) encoded
 # "url.query" the URI component after the path and before the fragment; it is percent (URL) encoded
 # "request.method" the method of the HTTP request, i.e. one of GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH, TRACE, CONNECT
@@ -157,3 +213,9 @@ logger.samlxml_decrypt.name = org.opensaml.xmlsec.encryption.support.Decrypter
 logger.samlxml_decrypt.level = fatal
 logger.saml2_decrypt.name = org.opensaml.saml.saml2.encryption.Decrypter
 logger.saml2_decrypt.level = fatal
+
+logger.entitlements_xpack_security.name = org.elasticsearch.entitlement.runtime.policy.PolicyManager.x-pack-security.org.elasticsearch.security
+logger.entitlements_xpack_security.level = error
+
+logger.entitlements_inference.name = org.elasticsearch.entitlement.runtime.policy.PolicyManager.x-pack-inference.software.amazon.awssdk.profiles
+logger.entitlements_inference.level = error
diff --git a/elasticsearch_9.0.4/Dockerfile b/elasticsearch_9.1.0/Dockerfile
similarity index 93%
copy from elasticsearch_9.0.4/Dockerfile
copy to elasticsearch_9.1.0/Dockerfile
index ab45c48..edb2487 100644
--- a/elasticsearch_9.0.4/Dockerfile
+++ b/elasticsearch_9.1.0/Dockerfile
@@ -28,7 +28,7 @@ RUN set -eux; \
     chmod 0555 /bin/tini
 
 WORKDIR /usr/share/elasticsearch
-RUN arch="$(rpm --query --queryformat='%{ARCH}' rpm)" && curl -f --retry 10 -S -L --output /tmp/elasticsearch.tar.gz https://artifacts-no-kpi.elastic.co/downloads/elasticsearch/elasticsearch-9.0.4-linux-$arch.tar.gz
+RUN arch="$(rpm --query --queryformat='%{ARCH}' rpm)" && curl -f --retry 10 -S -L --output /tmp/elasticsearch.tar.gz https://artifacts-no-kpi.elastic.co/downloads/elasticsearch/elasticsearch-9.1.0-linux-$arch.tar.gz
 RUN tar -zxf /tmp/elasticsearch.tar.gz --strip-components=1 && \
 # Configure the distribution for Docker
     sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elasticsearch-env && \
@@ -99,30 +99,30 @@ RUN chmod g=u /etc/passwd && \
 
 EXPOSE 9200 9300
 
-LABEL org.label-schema.build-date="2025-07-16T22:08:05.257395109Z" \
+LABEL org.label-schema.build-date="2025-07-23T22:09:53.891289976Z" \
   org.label-schema.license="Elastic-License-2.0" \
   org.label-schema.name="Elasticsearch" \
   org.label-schema.schema-version="1.0" \
   org.label-schema.url="https://www.elastic.co/products/elasticsearch" \
   org.label-schema.usage="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \
-  org.label-schema.vcs-ref="e03b6699309ed1458e07dbcd94918b36f5ffee9e" \
+  org.label-schema.vcs-ref="00e7d33bf08f1476229d9d1642e2da46cfebdd53" \
   org.label-schema.vcs-url="https://github.com/elastic/elasticsearch" \
   org.label-schema.vendor="Elastic" \
-  org.label-schema.version="9.0.4" \
-  org.opencontainers.image.created="2025-07-16T22:08:05.257395109Z" \
+  org.label-schema.version="9.1.0" \
+  org.opencontainers.image.created="2025-07-23T22:09:53.891289976Z" \
   org.opencontainers.image.documentation="https://www.elastic.co/guide/en/elasticsearch/reference/index.html" \
   org.opencontainers.image.licenses="Elastic-License-2.0" \
-  org.opencontainers.image.revision="e03b6699309ed1458e07dbcd94918b36f5ffee9e" \
+  org.opencontainers.image.revision="00e7d33bf08f1476229d9d1642e2da46cfebdd53" \
   org.opencontainers.image.source="https://github.com/elastic/elasticsearch" \
   org.opencontainers.image.title="Elasticsearch" \
   org.opencontainers.image.url="https://www.elastic.co/products/elasticsearch" \
   org.opencontainers.image.vendor="Elastic" \
-  org.opencontainers.image.version="9.0.4"
+  org.opencontainers.image.version="9.1.0"
 
 LABEL name="Elasticsearch" \
   maintainer="[email protected]" \
   vendor="Elastic" \
-  version="9.0.4" \
+  version="9.1.0" \
   release="1" \
   summary="Elasticsearch" \
   description="You know, for search."
diff --git a/elasticsearch_8.17.9/bin/docker-entrypoint.sh b/elasticsearch_9.1.0/bin/docker-entrypoint.sh
similarity index 100%
copy from elasticsearch_8.17.9/bin/docker-entrypoint.sh
copy to elasticsearch_9.1.0/bin/docker-entrypoint.sh
diff --git a/elasticsearch_7.17.28/config/elasticsearch.yml b/elasticsearch_9.1.0/config/elasticsearch.yml
similarity index 100%
rename from elasticsearch_7.17.28/config/elasticsearch.yml
rename to elasticsearch_9.1.0/config/elasticsearch.yml
diff --git a/elasticsearch_9.0.4/config/log4j2.properties b/elasticsearch_9.1.0/config/log4j2.properties
similarity index 95%
copy from elasticsearch_9.0.4/config/log4j2.properties
copy to elasticsearch_9.1.0/config/log4j2.properties
index 1bb0222..9b6435e 100644
--- a/elasticsearch_9.0.4/config/log4j2.properties
+++ b/elasticsearch_9.1.0/config/log4j2.properties
@@ -58,6 +58,19 @@ logger.index_indexing_slowlog.level = trace
 logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling
 logger.index_indexing_slowlog.additivity = false
 
+######## ES|QL query log JSON ####################
+appender.esql_querylog_rolling.type = Console
+appender.esql_querylog_rolling.name = esql_querylog_rolling
+appender.esql_querylog_rolling.layout.type = ECSJsonLayout
+appender.esql_querylog_rolling.layout.dataset = elasticsearch.esql_querylog
+
+#################################################
+
+logger.esql_querylog_rolling.name = esql.querylog
+logger.esql_querylog_rolling.level = trace
+logger.esql_querylog_rolling.appenderRef.esql_querylog_rolling.ref = esql_querylog_rolling
+logger.esql_querylog_rolling.additivity = false
+
 logger.org_apache_pdfbox.name = org.apache.pdfbox
 logger.org_apache_pdfbox.level = off
 
diff --git a/kibana_7.17.28/Dockerfile b/kibana_7.17.28/Dockerfile
index a254906..010782a 100644
--- a/kibana_7.17.28/Dockerfile
+++ b/kibana_7.17.28/Dockerfile
@@ -9,14 +9,14 @@
 # Build stage 0 `builder`:
 # Extract Kibana artifact
 ################################################################################
-FROM ubuntu:20.04 AS builder
+FROM ubuntu:24.04 AS builder
 
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl
 
 RUN cd /tmp && \
   curl --retry 8 -s -L \
     --output kibana.tar.gz \
-     https://artifacts.elastic.co/downloads/kibana/kibana-7.17.28-linux-$(arch).tar.gz && \
+     https://artifacts.elastic.co/downloads/kibana/kibana-7.17.29-linux-$(arch).tar.gz && \
   cd -
 
 
@@ -36,7 +36,7 @@ RUN chmod -R g=u /usr/share/kibana
 # Copy kibana from stage 0
 # Add entrypoint
 ################################################################################
-FROM ubuntu:20.04
+FROM ubuntu:24.04
 EXPOSE 5601
 
 RUN for iter in {1..10}; do \
@@ -99,30 +99,30 @@ RUN chmod g+ws /usr/share/kibana && \
 RUN find / -xdev -perm -4000 -exec chmod u-s {} +
 
 # Provide a non-root user to run the process.
-RUN groupadd --gid 1000 kibana && \
+RUN userdel -r ubuntu && groupadd --gid 1000 kibana && \
     useradd --uid 1000 --gid 1000 -G 0 \
       --home-dir /usr/share/kibana --no-create-home \
       kibana
 
-LABEL org.label-schema.build-date="2025-02-19T12:12:43.403Z" \
+LABEL org.label-schema.build-date="2025-06-18T11:10:23.947Z" \
   org.label-schema.license="Elastic License" \
   org.label-schema.name="Kibana" \
   org.label-schema.schema-version="1.0" \
   org.label-schema.url="https://www.elastic.co/products/kibana" \
   org.label-schema.usage="https://www.elastic.co/guide/en/kibana/reference/index.html" \
-  org.label-schema.vcs-ref="e13d3db4d0479be06aa5447d35797f750b8121f3" \
+  org.label-schema.vcs-ref="f6e2f2e44cc0a6a11435f1b6350f735e23bef4b4" \
   org.label-schema.vcs-url="https://github.com/elastic/kibana" \
   org.label-schema.vendor="Elastic" \
-  org.label-schema.version="7.17.28" \
-  org.opencontainers.image.created="2025-02-19T12:12:43.403Z" \
+  org.label-schema.version="7.17.29" \
+  org.opencontainers.image.created="2025-06-18T11:10:23.947Z" \
   org.opencontainers.image.documentation="https://www.elastic.co/guide/en/kibana/reference/index.html" \
   org.opencontainers.image.licenses="Elastic License" \
-  org.opencontainers.image.revision="e13d3db4d0479be06aa5447d35797f750b8121f3" \
+  org.opencontainers.image.revision="f6e2f2e44cc0a6a11435f1b6350f735e23bef4b4" \
   org.opencontainers.image.source="https://github.com/elastic/kibana" \
   org.opencontainers.image.title="Kibana" \
   org.opencontainers.image.url="https://www.elastic.co/products/kibana" \
   org.opencontainers.image.vendor="Elastic" \
-  org.opencontainers.image.version="7.17.28"
+  org.opencontainers.image.version="7.17.29"
 
 
 ENTRYPOINT ["/bin/tini", "--"]
diff --git a/kibana_9.0.4/Dockerfile b/kibana_8.19.0/Dockerfile
similarity index 77%
copy from kibana_9.0.4/Dockerfile
copy to kibana_8.19.0/Dockerfile
index b72253f..9e974e8 100644
--- a/kibana_9.0.4/Dockerfile
+++ b/kibana_8.19.0/Dockerfile
@@ -9,15 +9,20 @@
 # Build stage 0 `builder`:
 # Extract Kibana artifact
 ################################################################################
-FROM redhat/ubi9-minimal:latest AS builder
+FROM ubuntu:24.04 AS builder
 
-RUN microdnf install -y findutils tar gzip
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y curl
 
 RUN cd /tmp && \
-  arch="$(rpm --query --queryformat='%{ARCH}' rpm)" && \
+  arch="$(dpkg --print-architecture)" && \
+  case "$arch" in \
+    amd64) arch='x86_64' ;; \
+    arm64) arch='aarch64' ;; \
+    *) echo >&2 "Unsupported architecture $arch" ; exit 1 ;; \
+  esac && \
   curl -f --retry 8 -s -L \
     --output kibana.tar.gz \
-     https://artifacts.elastic.co/downloads/kibana/kibana-9.0.4-linux-${arch}.tar.gz && \
+     https://artifacts.elastic.co/downloads/kibana/kibana-8.19.0-linux-${arch}.tar.gz && \
   cd -
 
 RUN mkdir /usr/share/kibana
@@ -35,13 +40,13 @@ RUN chmod -R g=u /usr/share/kibana
 # Add an init process, check the checksum to make sure it's a match
 RUN set -e ; \
     TINI_BIN="" ; \
-    arch="$(rpm --query --queryformat='%{ARCH}' rpm)"; \
+    arch="$(dpkg --print-architecture)" ; \
     case "$arch" in \
-        aarch64) \
+        arm64) \
             TINI_BIN='tini-arm64' ; \
             TINI_CHECKSUM='07952557df20bfd2a95f9bef198b445e006171969499a1d361bd9e6f8e5e0e81' ; \
             ;; \
-        x86_64) \
+        amd64) \
             TINI_BIN='tini-amd64' ; \
             TINI_CHECKSUM='93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c' ; \
             ;; \
@@ -49,6 +54,7 @@ RUN set -e ; \
     esac ; \
   TINI_VERSION='v0.19.0' ; \
   curl -f --retry 8 -S -L -O "https://github.com/krallin/tini/releases/download/${TINI_VERSION}/${TINI_BIN}" ; \
+  curl -f --retry 8 -S -L -O "https://github.com/krallin/tini/releases/download/${TINI_VERSION}/${TINI_BIN}.sha256sum" ; \
   echo "${TINI_CHECKSUM} ${TINI_BIN}" | sha256sum -c - ; \
   mv "${TINI_BIN}" /bin/tini ; \
   chmod +x /bin/tini
@@ -63,12 +69,14 @@ RUN mkdir -p /usr/share/fonts/local && \
 # Copy kibana from stage 0
 # Add entrypoint
 ################################################################################
-FROM redhat/ubi9-minimal:latest
+FROM ubuntu:24.04
 EXPOSE 5601
 
-RUN microdnf install --setopt=tsflags=nodocs -y \
-      fontconfig liberation-fonts-common freetype shadow-utils nss findutils && \
-      microdnf clean all
+RUN export DEBIAN_FRONTEND=noninteractive && \
+      apt-get update && \
+      apt-get install -y --no-install-recommends fontconfig fonts-liberation libnss3 curl ca-certificates && \
+      apt-get clean && \
+      rm -rf /var/lib/apt/lists/*
 
 # Bring in Kibana from the initial stage.
 COPY --from=builder --chown=1000:0 /usr/share/kibana /usr/share/kibana
@@ -98,40 +106,31 @@ RUN chmod g+ws /usr/share/kibana && \
 RUN find / -xdev -perm -4000 -exec chmod u-s {} +
 
 # Provide a non-root user to run the process.
-RUN groupadd --gid 1000 kibana && \
+RUN userdel -r ubuntu && groupadd --gid 1000 kibana && \
     useradd --uid 1000 --gid 1000 -G 0 \
       --home-dir /usr/share/kibana --no-create-home \
       kibana
 
-LABEL org.label-schema.build-date="2025-07-16T20:30:14.744Z" \
+LABEL org.label-schema.build-date="2025-07-23T19:53:14.974Z" \
   org.label-schema.license="Elastic License" \
   org.label-schema.name="Kibana" \
   org.label-schema.schema-version="1.0" \
   org.label-schema.url="https://www.elastic.co/products/kibana" \
   org.label-schema.usage="https://www.elastic.co/guide/en/kibana/reference/index.html" \
-  org.label-schema.vcs-ref="03b282993fdee5b68ef61c0877f7c25d4098bfbd" \
+  org.label-schema.vcs-ref="ffd7cbf34ac1234c78354f2a22ef5f1703c04eaf" \
   org.label-schema.vcs-url="https://github.com/elastic/kibana" \
   org.label-schema.vendor="Elastic" \
-  org.label-schema.version="9.0.4" \
-  org.opencontainers.image.created="2025-07-16T20:30:14.744Z" \
+  org.label-schema.version="8.19.0" \
+  org.opencontainers.image.created="2025-07-23T19:53:14.974Z" \
   org.opencontainers.image.documentation="https://www.elastic.co/guide/en/kibana/reference/index.html" \
   org.opencontainers.image.licenses="Elastic License" \
-  org.opencontainers.image.revision="03b282993fdee5b68ef61c0877f7c25d4098bfbd" \
+  org.opencontainers.image.revision="ffd7cbf34ac1234c78354f2a22ef5f1703c04eaf" \
   org.opencontainers.image.source="https://github.com/elastic/kibana" \
   org.opencontainers.image.title="Kibana" \
   org.opencontainers.image.url="https://www.elastic.co/products/kibana" \
   org.opencontainers.image.vendor="Elastic" \
-  org.opencontainers.image.version="9.0.4"
-
-LABEL name="Kibana" \
-  maintainer="[email protected]" \
-  vendor="Elastic" \
-  version="9.0.4" \
-  release="1" \
-  summary="Kibana" \
-  description="Your window into the Elastic Stack."
+  org.opencontainers.image.version="8.19.0"
 
-RUN mkdir /licenses && ln LICENSE.txt /licenses/LICENSE
 
 ENTRYPOINT ["/bin/tini", "--"]
 
diff --git a/kibana_8.18.4/bin/kibana-docker b/kibana_8.19.0/bin/kibana-docker
similarity index 98%
copy from kibana_8.18.4/bin/kibana-docker
copy to kibana_8.19.0/bin/kibana-docker
index 1bb7215..74d3b96 100755
--- a/kibana_8.18.4/bin/kibana-docker
+++ b/kibana_8.19.0/bin/kibana-docker
@@ -40,6 +40,7 @@ kibana_vars=(
     csp.report_uri
     csp.report_to
     csp.report_only.form_action
+    csp.report_only.object_src
     permissionsPolicy.report_to
     data.autocomplete.valueSuggestions.terminateAfter
     data.autocomplete.valueSuggestions.timeout
@@ -215,6 +216,9 @@ kibana_vars=(
     xpack.actions.allowedHosts
     xpack.actions.customHostSettings
     xpack.actions.email.domain_allowlist
+    xpack.actions.email.services.ses.host
+    xpack.actions.email.services.ses.port
+    xpack.actions.email.services.enabled
     xpack.actions.enableFooterInEmail
     xpack.actions.enabledActionTypes
     xpack.actions.maxResponseContentLength
@@ -229,6 +233,7 @@ kibana_vars=(
     xpack.actions.responseTimeout
     xpack.actions.ssl.proxyVerificationMode
     xpack.actions.ssl.verificationMode
+    xpack.actions.webhook.ssl.pfx.enabled
     xpack.alerting.healthCheck.interval
     xpack.alerting.invalidateApiKeysTask.interval
     xpack.alerting.invalidateApiKeysTask.removalDelay
@@ -241,11 +246,12 @@ kibana_vars=(
     xpack.alerting.rules.run.actions.max
     xpack.alerting.rules.run.alerts.max
     xpack.alerting.rules.run.actions.connectorTypeOverrides
+    xpack.alerting.rules.maxScheduledPerMinute
     xpack.alerts.healthCheck.interval
     xpack.alerts.invalidateApiKeysTask.interval
     xpack.alerts.invalidateApiKeysTask.removalDelay
-    xpack.alerting.rules.maxScheduledPerMinute
     xpack.alerting.disabledRuleTypes
+    xpack.alerting.enabledRuleTypes
     xpack.apm.indices.error
     xpack.apm.indices.metric
     xpack.apm.indices.onboarding
diff --git a/kibana_7.17.28/config/kibana.yml b/kibana_8.19.0/config/kibana.yml
similarity index 100%
copy from kibana_7.17.28/config/kibana.yml
copy to kibana_8.19.0/config/kibana.yml
diff --git a/kibana_9.0.4/Dockerfile b/kibana_9.1.0/Dockerfile
similarity index 92%
copy from kibana_9.0.4/Dockerfile
copy to kibana_9.1.0/Dockerfile
index b72253f..cc08b57 100644
--- a/kibana_9.0.4/Dockerfile
+++ b/kibana_9.1.0/Dockerfile
@@ -17,7 +17,7 @@ RUN cd /tmp && \
   arch="$(rpm --query --queryformat='%{ARCH}' rpm)" && \
   curl -f --retry 8 -s -L \
     --output kibana.tar.gz \
-     https://artifacts.elastic.co/downloads/kibana/kibana-9.0.4-linux-${arch}.tar.gz && \
+     https://artifacts.elastic.co/downloads/kibana/kibana-9.1.0-linux-${arch}.tar.gz && \
   cd -
 
 RUN mkdir /usr/share/kibana
@@ -103,30 +103,30 @@ RUN groupadd --gid 1000 kibana && \
       --home-dir /usr/share/kibana --no-create-home \
       kibana
 
-LABEL org.label-schema.build-date="2025-07-16T20:30:14.744Z" \
+LABEL org.label-schema.build-date="2025-07-23T22:29:20.996Z" \
   org.label-schema.license="Elastic License" \
   org.label-schema.name="Kibana" \
   org.label-schema.schema-version="1.0" \
   org.label-schema.url="https://www.elastic.co/products/kibana" \
   org.label-schema.usage="https://www.elastic.co/guide/en/kibana/reference/index.html" \
-  org.label-schema.vcs-ref="03b282993fdee5b68ef61c0877f7c25d4098bfbd" \
+  org.label-schema.vcs-ref="9f30374092edd41719399f7ef81cb7ae78d8a3ab" \
   org.label-schema.vcs-url="https://github.com/elastic/kibana" \
   org.label-schema.vendor="Elastic" \
-  org.label-schema.version="9.0.4" \
-  org.opencontainers.image.created="2025-07-16T20:30:14.744Z" \
+  org.label-schema.version="9.1.0" \
+  org.opencontainers.image.created="2025-07-23T22:29:20.996Z" \
   org.opencontainers.image.documentation="https://www.elastic.co/guide/en/kibana/reference/index.html" \
   org.opencontainers.image.licenses="Elastic License" \
-  org.opencontainers.image.revision="03b282993fdee5b68ef61c0877f7c25d4098bfbd" \
+  org.opencontainers.image.revision="9f30374092edd41719399f7ef81cb7ae78d8a3ab" \
   org.opencontainers.image.source="https://github.com/elastic/kibana" \
   org.opencontainers.image.title="Kibana" \
   org.opencontainers.image.url="https://www.elastic.co/products/kibana" \
   org.opencontainers.image.vendor="Elastic" \
-  org.opencontainers.image.version="9.0.4"
+  org.opencontainers.image.version="9.1.0"
 
 LABEL name="Kibana" \
   maintainer="[email protected]" \
   vendor="Elastic" \
-  version="9.0.4" \
+  version="9.1.0" \
   release="1" \
   summary="Kibana" \
   description="Your window into the Elastic Stack."
diff --git a/kibana_9.0.4/bin/kibana-docker b/kibana_9.1.0/bin/kibana-docker
similarity index 98%
copy from kibana_9.0.4/bin/kibana-docker
copy to kibana_9.1.0/bin/kibana-docker
index 3cfb2b7..4e0db24 100755
--- a/kibana_9.0.4/bin/kibana-docker
+++ b/kibana_9.1.0/bin/kibana-docker
@@ -212,6 +212,9 @@ kibana_vars=(
     xpack.actions.allowedHosts
     xpack.actions.customHostSettings
     xpack.actions.email.domain_allowlist
+    xpack.actions.email.services.ses.host
+    xpack.actions.email.services.ses.port
+    xpack.actions.email.services.enabled
     xpack.actions.enableFooterInEmail
     xpack.actions.enabledActionTypes
     xpack.actions.maxResponseContentLength
@@ -224,6 +227,7 @@ kibana_vars=(
     xpack.actions.responseTimeout
     xpack.actions.ssl.proxyVerificationMode
     xpack.actions.ssl.verificationMode
+    xpack.actions.webhook.ssl.pfx.enabled
     xpack.alerting.healthCheck.interval
     xpack.alerting.invalidateApiKeysTask.interval
     xpack.alerting.invalidateApiKeysTask.removalDelay
@@ -237,6 +241,7 @@ kibana_vars=(
     xpack.alerting.rules.run.actions.connectorTypeOverrides
     xpack.alerting.rules.maxScheduledPerMinute
     xpack.alerting.disabledRuleTypes
+    xpack.alerting.enabledRuleTypes
     xpack.apm.indices.error
     xpack.apm.indices.metric
     xpack.apm.indices.onboarding
diff --git a/kibana_7.17.28/config/kibana.yml b/kibana_9.1.0/config/kibana.yml
similarity index 100%
copy from kibana_7.17.28/config/kibana.yml
copy to kibana_9.1.0/config/kibana.yml
diff --git a/logstash_8.18.4/Dockerfile b/logstash_8.19.0/Dockerfile
similarity index 90%
copy from logstash_8.18.4/Dockerfile
copy to logstash_8.19.0/Dockerfile
index f5d7f92..3825ab3 100644
--- a/logstash_8.18.4/Dockerfile
+++ b/logstash_8.19.0/Dockerfile
@@ -26,9 +26,9 @@ RUN userdel -r ubuntu && groupadd --gid 1000 logstash && \
   useradd --uid 1000 --gid 1000 --home /usr/share/logstash --no-create-home logstash
 
 # Add Logstash itself.
-RUN curl -Lo - https://artifacts.elastic.co/downloads/logstash/logstash-8.18.4-linux-$(arch).tar.gz | \
+RUN curl -Lo - https://artifacts.elastic.co/downloads/logstash/logstash-8.19.0-linux-$(arch).tar.gz | \
   tar zxf - -C /usr/share && \
-  mv /usr/share/logstash-8.18.4 /usr/share/logstash && \
+  mv /usr/share/logstash-8.19.0 /usr/share/logstash && \
   chown --recursive logstash:logstash /usr/share/logstash/ && \
   chown -R logstash:root /usr/share/logstash && \
   chmod -R g=u /usr/share/logstash && \
@@ -42,6 +42,8 @@ WORKDIR /usr/share/logstash
 ENV ELASTIC_CONTAINER true
 ENV PATH=/usr/share/logstash/bin:$PATH
 
+# Add FIPS configuration for observability-sre image flavor
+
 # Provide a minimal configuration, so that simple invocations will provide
 # a good experience.
   COPY config/logstash-full.yml config/logstash.yml
@@ -82,14 +84,14 @@ LABEL  org.label-schema.schema-version="1.0" \
   org.opencontainers.image.vendor="Elastic" \
   org.label-schema.name="logstash" \
   org.opencontainers.image.title="logstash" \
-  org.label-schema.version="8.18.4" \
-  org.opencontainers.image.version="8.18.4" \
+  org.label-schema.version="8.19.0" \
+  org.opencontainers.image.version="8.19.0" \
   org.label-schema.url="https://www.elastic.co/products/logstash" \
   org.label-schema.vcs-url="https://github.com/elastic/logstash" \
   org.label-schema.license="Elastic License" \
   org.opencontainers.image.licenses="Elastic License" \
   org.opencontainers.image.description="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \
-  org.label-schema.build-date=2025-07-14T19:37:28+00:00 \
-  org.opencontainers.image.created=2025-07-14T19:37:28+00:00
+  org.label-schema.build-date=2025-07-14T19:43:28+00:00 \
+  org.opencontainers.image.created=2025-07-14T19:43:28+00:00
 
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint"]
diff --git a/logstash_8.17.9/bin/docker-entrypoint b/logstash_8.19.0/bin/docker-entrypoint
similarity index 100%
copy from logstash_8.17.9/bin/docker-entrypoint
copy to logstash_8.19.0/bin/docker-entrypoint
diff --git a/logstash_8.17.9/config/log4j2.file.properties b/logstash_8.19.0/config/log4j2.file.properties
similarity index 100%
copy from logstash_8.17.9/config/log4j2.file.properties
copy to logstash_8.19.0/config/log4j2.file.properties
diff --git a/logstash_8.17.9/config/log4j2.properties b/logstash_8.19.0/config/log4j2.properties
similarity index 100%
copy from logstash_8.17.9/config/log4j2.properties
copy to logstash_8.19.0/config/log4j2.properties
diff --git a/logstash_8.17.9/config/logstash-full.yml b/logstash_8.19.0/config/logstash-full.yml
similarity index 100%
copy from logstash_8.17.9/config/logstash-full.yml
copy to logstash_8.19.0/config/logstash-full.yml
diff --git a/logstash_8.17.9/config/pipelines.yml b/logstash_8.19.0/config/pipelines.yml
similarity index 100%
copy from logstash_8.17.9/config/pipelines.yml
copy to logstash_8.19.0/config/pipelines.yml
diff --git a/logstash_8.17.9/env2yaml/env2yaml-amd64 b/logstash_8.19.0/env2yaml/env2yaml-amd64
similarity index 100%
copy from logstash_8.17.9/env2yaml/env2yaml-amd64
copy to logstash_8.19.0/env2yaml/env2yaml-amd64
diff --git a/logstash_8.17.9/env2yaml/env2yaml-arm64 b/logstash_8.19.0/env2yaml/env2yaml-arm64
similarity index 100%
copy from logstash_8.17.9/env2yaml/env2yaml-arm64
copy to logstash_8.19.0/env2yaml/env2yaml-arm64
diff --git a/logstash_8.17.9/pipeline/default.conf b/logstash_8.19.0/pipeline/default.conf
similarity index 100%
copy from logstash_8.17.9/pipeline/default.conf
copy to logstash_8.19.0/pipeline/default.conf
diff --git a/logstash_9.0.4/Dockerfile b/logstash_9.1.0/Dockerfile
similarity index 90%
copy from logstash_9.0.4/Dockerfile
copy to logstash_9.1.0/Dockerfile
index 83f4441..8c8779c 100644
--- a/logstash_9.0.4/Dockerfile
+++ b/logstash_9.1.0/Dockerfile
@@ -35,10 +35,10 @@ RUN groupadd --gid 1000 logstash && \
   --no-create-home \
   logstash && \
   arch="$(rpm --query --queryformat='%{ARCH}' rpm)" && \
-  curl -f -Lo logstash.tar.gz https://artifacts.elastic.co/downloads/logstash/logstash-9.0.4-linux-${arch}.tar.gz && \
+  curl -f -Lo logstash.tar.gz https://artifacts.elastic.co/downloads/logstash/logstash-9.1.0-linux-${arch}.tar.gz && \
   tar -zxf logstash.tar.gz -C /usr/share && \
   rm logstash.tar.gz && \
-  mv /usr/share/logstash-9.0.4 /usr/share/logstash && \
+  mv /usr/share/logstash-9.1.0 /usr/share/logstash && \
   chown -R logstash:root /usr/share/logstash && \
   chmod -R g=u /usr/share/logstash && \
   mkdir /licenses && \
@@ -59,20 +59,20 @@ USER 1000
 
 EXPOSE 9600 5044
 
-LABEL org.label-schema.build-date=2025-07-11T13:18:17+00:00 \
+LABEL org.label-schema.build-date=2025-07-23T17:25:12+00:00 \
   org.label-schema.license="Elastic License" \
   org.label-schema.name="logstash" \
   org.label-schema.schema-version="1.0" \
   org.label-schema.url="https://www.elastic.co/products/logstash" \
   org.label-schema.vcs-url="https://github.com/elastic/logstash" \
   org.label-schema.vendor="Elastic" \
-  org.label-schema.version="9.0.4" \
-  org.opencontainers.image.created=2025-07-11T13:18:17+00:00 \
+  org.label-schema.version="9.1.0" \
+  org.opencontainers.image.created=2025-07-23T17:25:12+00:00 \
   org.opencontainers.image.description="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \
   org.opencontainers.image.licenses="Elastic License" \
   org.opencontainers.image.title="logstash" \
   org.opencontainers.image.vendor="Elastic" \
-  org.opencontainers.image.version="9.0.4" \
+  org.opencontainers.image.version="9.1.0" \
   description="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \
   license="Elastic License" \
   maintainer="[email protected]" \
diff --git a/logstash_8.17.9/bin/docker-entrypoint b/logstash_9.1.0/bin/docker-entrypoint
similarity index 100%
copy from logstash_8.17.9/bin/docker-entrypoint
copy to logstash_9.1.0/bin/docker-entrypoint
diff --git a/logstash_8.17.9/config/log4j2.file.properties b/logstash_9.1.0/config/log4j2.file.properties
similarity index 100%
copy from logstash_8.17.9/config/log4j2.file.properties
copy to logstash_9.1.0/config/log4j2.file.properties
diff --git a/logstash_8.17.9/config/log4j2.properties b/logstash_9.1.0/config/log4j2.properties
similarity index 100%
copy from logstash_8.17.9/config/log4j2.properties
copy to logstash_9.1.0/config/log4j2.properties
diff --git a/logstash_9.0.4/config/logstash-full.yml b/logstash_9.1.0/config/logstash-full.yml
similarity index 100%
copy from logstash_9.0.4/config/logstash-full.yml
copy to logstash_9.1.0/config/logstash-full.yml
diff --git a/logstash_8.17.9/config/pipelines.yml b/logstash_9.1.0/config/pipelines.yml
similarity index 100%
copy from logstash_8.17.9/config/pipelines.yml
copy to logstash_9.1.0/config/pipelines.yml
diff --git a/logstash_9.0.4/env2yaml/env2yaml.go b/logstash_9.1.0/env2yaml/env2yaml.go
similarity index 99%
copy from logstash_9.0.4/env2yaml/env2yaml.go
copy to logstash_9.1.0/env2yaml/env2yaml.go
index dc2641e..95fc569 100644
--- a/logstash_9.0.4/env2yaml/env2yaml.go
+++ b/logstash_9.1.0/env2yaml/env2yaml.go
@@ -57,7 +57,7 @@ var validSettings = []string{
 	"queue.max_bytes",
 	"queue.checkpoint.acks",
 	"queue.checkpoint.writes",
-	"queue.checkpoint.interval",
+	"queue.checkpoint.interval", // remove it for #17155
 	"queue.drain",
 	"dead_letter_queue.enable",
 	"dead_letter_queue.max_bytes",
diff --git a/logstash_9.0.4/env2yaml/go.mod b/logstash_9.1.0/env2yaml/go.mod
similarity index 100%
copy from logstash_9.0.4/env2yaml/go.mod
copy to logstash_9.1.0/env2yaml/go.mod
diff --git a/logstash_9.0.4/env2yaml/go.sum b/logstash_9.1.0/env2yaml/go.sum
similarity index 100%
copy from logstash_9.0.4/env2yaml/go.sum
copy to logstash_9.1.0/env2yaml/go.sum
diff --git a/logstash_8.17.9/pipeline/default.conf b/logstash_9.1.0/pipeline/default.conf
similarity index 100%
copy from logstash_8.17.9/pipeline/default.conf
copy to logstash_9.1.0/pipeline/default.conf

Relevant Maintainers:

elasticsearch: @breskeby
kibana: @jbudz
logstash: @jsvd

tianon · 2025-07-31T17:03:30Z

+  curl -f --retry 8 -S -L -O "https://github.com/krallin/tini/releases/download/${TINI_VERSION}/${TINI_BIN}.sha256sum" ; \

This is odd, given it's unused and the checksum is embedded above it and verified below it, but it's also pretty harmless.

tianon · 2025-07-31T17:05:29Z

We should also remove any minor versions that are EOL/unsupported, but that can happen separately. Looking at https://endoflife.date/elasticsearch it appears only 9.x, 8.x, and 7.x are the supported granularities, but y'all admittedly would know much better than I or even endoflife.date. 😄

Update ELK images

280e42d

navyau09 requested a review from a team as a code owner July 29, 2025 11:38

github-actions bot added library/elasticsearch library/kibana library/logstash labels Jul 29, 2025

This comment has been minimized.

Sign in to view

jbudz mentioned this pull request Jul 30, 2025

[8.19] Fix Kibana build elastic/dockerfiles#296

Merged

navyau09 mentioned this pull request Jul 30, 2025

Update actions to build/test new branches elastic/dockerfiles#297

Open

Remove 7.17.x from search

d2dc10b

This comment has been minimized.

Sign in to view

Update 8.19 sha for Kibana

cd01a42

tianon approved these changes Jul 31, 2025

View reviewed changes

tianon merged commit f61f884 into docker-library:master Jul 31, 2025
21 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update ELK images for 9.1.0 and 8.19.0 #19558

Update ELK images for 9.1.0 and 8.19.0 #19558

Uh oh!

navyau09 commented Jul 29, 2025

Uh oh!

This comment has been minimized.

navyau09 commented Jul 29, 2025

Uh oh!

tianon commented Jul 29, 2025

Uh oh!

This comment has been minimized.

github-actions bot commented Jul 31, 2025

Uh oh!

tianon commented Jul 31, 2025

Uh oh!

tianon commented Jul 31, 2025

Uh oh!

Uh oh!

Uh oh!

Update ELK images for 9.1.0 and 8.19.0 #19558

Update ELK images for 9.1.0 and 8.19.0 #19558

Uh oh!

Conversation

navyau09 commented Jul 29, 2025

Uh oh!

This comment has been minimized.

navyau09 commented Jul 29, 2025

Uh oh!

tianon commented Jul 29, 2025

Uh oh!

This comment has been minimized.

github-actions bot commented Jul 31, 2025

Uh oh!

tianon commented Jul 31, 2025

Uh oh!

tianon commented Jul 31, 2025

Uh oh!

Uh oh!

Uh oh!