Merge branch 'main' into ml_metrics

docs/changelog/102435.yaml

@@ -0,0 +1,5 @@
+pr: 102435
+summary: S3 first byte latency metric
+area: Search
+type: enhancement
+issues: []

docs/changelog/103024.yaml

@@ -0,0 +1,6 @@
+pr: 103024
+summary: Fix template simulate setting application ordering
+area: Indices APIs
+type: bug
+issues:
+ - 103008

docs/changelog/103025.yaml

@@ -0,0 +1,5 @@
+pr: 103025
+summary: "Metrics: Allow `AsyncCounters` to switch providers"
+area: Infra/Core
+type: bug
+issues: []

docs/changelog/103091.yaml

@@ -0,0 +1,5 @@
+pr: 103091
+summary: "Metrics: Handle null observations in observers"
+area: Infra/Core
+type: bug
+issues: []

docs/changelog/103130.yaml

@@ -0,0 +1,5 @@
+pr: 103130
+summary: Create a DSL health indicator as part of the health API
+area: Health
+type: feature
+issues: []

docs/reference/data-streams/lifecycle/apis/put-lifecycle.asciidoc

@@ -59,6 +59,16 @@ duration the document could be deleted. When empty, every document in this data
 If defined, it turns data streqm lifecycle on/off (`true`/`false`) for this data stream.
 A data stream lifecycle that's disabled (`enabled: false`) will have no effect on the
 data stream. Defaults to `true`.
+
+`downsampling`::
+(Optional, array)
+An optional array of downsampling configuration objects, each defining an `after`
+interval representing when the backing index is meant to be downsampled (the time 
+frame is calculated since the index was rolled over, i.e. generation time) and
+a `fixed_interval` representing the downsampling interval (the minimum `fixed_interval`
+value is `5m`). A maximum number of 10 downsampling rounds can be configured.
+See <<data-streams-put-lifecycle-downsampling-example, configuration example>> below.
+
 ====
 
 [[data-streams-put-lifecycle-example]]
@@ -84,3 +94,29 @@ When the lifecycle is successfully updated in all data streams, you receive the
   "acknowledged": true
 }
 --------------------------------------------------
+
+[[data-streams-put-lifecycle-downsampling-example]]
+==== {api-examples-title}
+
+The following example configures two downsampling rounds, the first one starting
+one day after the backing index is rolled over (or later, if the index is still 
+within its write-accepting <<time-bound-indices, time bounds>>) with an interval
+of `10m`, and a second round starting 7 days after rollover at an interval of `1d`:
+
+[source,console]
+--------------------------------------------------------------------
+PUT _data_stream/my-weather-sensor-data-stream/_lifecycle
+{
+    "downsampling": [
+      {
+        "after": "1d",
+        "fixed_interval": "10m"
+      },
+      {
+        "after": "7d",
+        "fixed_interval": "1d"
+      }
+    ]
+}
+--------------------------------------------------------------------
+//TEST[skip:downsampling requires waiting for indices to be out of time bounds]

docs/reference/data-streams/lifecycle/index.asciidoc

@@ -18,6 +18,10 @@ and backwards incompatible mapping changes.
 * Configurable retention, which allows you to configure the time period for which your data is guaranteed to be stored.
 {es} is allowed at a later time to delete data older than this time period.
 
+A data stream lifecycle also supports downsampling the data stream backing indices.
+See <<data-streams-put-lifecycle-downsampling-example, the downsampling example>> for 
+more details.
+
 [discrete]
 [[data-streams-lifecycle-how-it-works]]
 === How does it work?
@@ -35,7 +39,9 @@ into tiers of exponential sizes, merging the long tail of small segments is only
 fraction of the cost of force mergeing to a single segment. The small segments would usually
 hold the most recent data so tail mergeing will focus the merging resources on the higher-value
 data that is most likely to keep being queried.
-4. Applies retention to the remaining backing indices. This means deleting the backing indices whose
+4. If <<data-streams-put-lifecycle-downsampling-example, downsampling>> is configured it will execute 
+all the configured downsampling rounds.
+5. Applies retention to the remaining backing indices. This means deleting the backing indices whose
 `generation_time` is longer than the configured retention period. The `generation_time` is only applicable to rolled over backing
 indices and it is either the time since the backing index got rolled over, or the time optionally configured in the
 <<index-data-stream-lifecycle-origination-date,`index.lifecycle.origination_date`>> setting.

docs/reference/esql/functions/binary.asciidoc

@@ -9,4 +9,12 @@ These binary comparison operators are supported:
 * less than: `<`
 * less than or equal: `<=`
 * larger than: `>`
-* larger than or equal: `>=`
+* larger than or equal: `>=`
+
+And these mathematical operators are supported:
+
+[.text-center]
+image::esql/functions/signature/add.svg[Embedded,opts=inline]
+
+[.text-center]
+image::esql/functions/signature/sub.svg[Embedded,opts=inline]

docs/reference/esql/functions/cos.asciidoc

@@ -4,7 +4,7 @@
 [.text-center]
 image::esql/functions/signature/cos.svg[Embedded,opts=inline]
 
-https://en.wikipedia.org/wiki/Sine_and_cosine[Cosine] trigonometric function.
+https://en.wikipedia.org/wiki/Sine_and_cosine[Cosine] trigonometric function. Input expected in radians.
 
 [source.merge.styled,esql]
 ----

docs/reference/esql/functions/operators.asciidoc

@@ -9,6 +9,7 @@ Boolean operators for comparing against one or multiple expressions.
 
 // tag::op_list[]
 * <<esql-binary-operators>>
+* <<esql-unary-operators>>
 * <<esql-logical-operators>>
 * <<esql-predicates>>
 * <<esql-cidr_match>>
@@ -23,6 +24,7 @@ Boolean operators for comparing against one or multiple expressions.
 // end::op_list[]
 
 include::binary.asciidoc[]
+include::unary.asciidoc[]
 include::logical.asciidoc[]
 include::predicates.asciidoc[]
 include::cidr_match.asciidoc[]

docs/reference/esql/functions/sin.asciidoc

@@ -4,7 +4,7 @@
 [.text-center]
 image::esql/functions/signature/sin.svg[Embedded,opts=inline]
 
-https://en.wikipedia.org/wiki/Sine_and_cosine[Sine] trigonometric function.
+https://en.wikipedia.org/wiki/Sine_and_cosine[Sine] trigonometric function. Input expected in radians.
 
 [source.merge.styled,esql]
 ----

docs/reference/esql/functions/tan.asciidoc

@@ -4,7 +4,7 @@
 [.text-center]
 image::esql/functions/signature/tan.svg[Embedded,opts=inline]
 
-https://en.wikipedia.org/wiki/Sine_and_cosine[Tangent] trigonometric function.
+https://en.wikipedia.org/wiki/Sine_and_cosine[Tangent] trigonometric function. Input expected in radians.
 
 [source.merge.styled,esql]
 ----

docs/reference/esql/functions/unary.asciidoc

@@ -0,0 +1,8 @@
+[discrete]
+[[esql-unary-operators]]
+=== Unary operators
+
+These unary mathematical operators are supported:
+
+[.text-center]
+image::esql/functions/signature/neg.svg[Embedded,opts=inline]

docs/reference/search/search.asciidoc

@@ -111,6 +111,13 @@ By default, you cannot page through more than 10,000 hits using the `from` and
 
 include::{es-repo-dir}/rest-api/common-parms.asciidoc[tag=ignore_throttled]
 
+`include_named_queries_score`::
+(Optional, Boolean) If `true`, includes the score contribution from any named queries.
+This functionality reruns each named query on every hit in a search
+response. Typically, this adds a small overhead to a request. However, using
+computationally expensive named queries on a large number of hits may add
+significant overhead. Defaults to `false`.
+
 include::{es-repo-dir}/rest-api/common-parms.asciidoc[tag=index-ignore-unavailable]
 
 include::{es-repo-dir}/rest-api/common-parms.asciidoc[tag=lenient]

docs/reference/security/authentication/saml-guide.asciidoc

@@ -328,24 +328,15 @@ groups:: _(Recommended)_
 +
 [NOTE]
 ====
-Some IdPs are configured to send the `groups` list as a comma-separated string,
-but {es} can't parse this string into an array of groups. To map this SAML
-attribute to the `attributes.groups` setting in the {es} realm, a cluster
-security administrator can use a wildcard when
-<<saml-role-mapping,configuring role mappings>>. While flexible, wildcards are
-less accurate and can match on unwanted patterns. Instead, a cluster security
-administrator can use a regular expression to create a role mapping rule that
-matches only a single group. For example, the following regular expression
-matches only on the `elasticsearch-admins` group:
-
-[source,sh]
-----
-/^(.*,)?elasticsearch-admins(,.*)?$/
-----
-
-These regular expressions are based on Lucene’s
-{ref}/regexp-syntax.html[regular expression syntax], and can match more complex
-patterns. All regular expressions must start and end with a forward slash.
+Some IdPs are configured to send the `groups` list as a single value, comma-separated
+string. To map this SAML attribute to the `attributes.groups` setting in the {es}
+realm, you can configure a string delimiter using the `attribute_delimiters.group`
+setting.
+
+For example, splitting the SAML attribute value
+`engineering,elasticsearch-admins,employees` on a delimiter value of `,` will
+result in `engineering`, `elasticsearch-admins`, and `employees` as the list of
+groups for the user.
 ====
 
 name:: _(Optional)_ The user's full name.

docs/reference/settings/security-settings.asciidoc

@@ -1222,7 +1222,7 @@ _Distinguished Name_.
 `attribute_patterns.principal` {ess-icon}::
 (<<static-cluster-setting,Static>>)
 A Java regular expression that is matched against the SAML attribute specified
-by `attributes.pattern` before it is applied to the user's _principal_ property.
+by `attributes.principal` before it is applied to the user's _principal_ property.
 The attribute value must match the pattern and the value of the first
 _capturing group_ is used as the principal. For example, `^([^@]+)@example\\.com$`
 matches email addresses from the "example.com" domain and uses the local-part as
@@ -1257,13 +1257,13 @@ As per `attribute_patterns.principal`, but for the _dn_ property.
 `attribute_delimiters.groups` {ess-icon}::
 (<<static-cluster-setting,Static>>)
 A plain string that is used as a delimiter to split a single-valued SAML
-attribute specified by attributes.groups before it is applied to the user's
-groups property. For example, splitting the SAML attribute value
-engineering,elasticsearch-admins,employees on a delimiter value of , will
-result in engineering, elasticsearch-admins, and employees as the list of
+attribute specified by `attributes.groups` before it is applied to the user's
+_groups_ property. For example, splitting the SAML attribute value
+`engineering,elasticsearch-admins,employees` on a delimiter value of `,` will
+result in `engineering`, `elasticsearch-admins`, and `employees` as the list of
 groups for the user. The delimiter will always be split on, regardless of
 escaping in the input string. This setting does not support multi-valued SAML
-attributes. It cannot be used together with the attribute_patterns setting.
+attributes. It cannot be used together with the `attribute_patterns` setting.
 You can only configure this setting for the groups attribute.
 // end::saml-attributes-delimiters-groups-tag[]
 

modules/analysis-common/src/internalClusterTest/java/org/elasticsearch/analysis/common/ReloadAnalyzerTests.java

@@ -11,9 +11,9 @@
 import org.elasticsearch.action.admin.indices.analyze.AnalyzeAction;
 import org.elasticsearch.action.admin.indices.analyze.AnalyzeAction.AnalyzeToken;
 import org.elasticsearch.action.admin.indices.analyze.AnalyzeAction.Response;
-import org.elasticsearch.action.admin.indices.analyze.ReloadAnalyzerAction;
 import org.elasticsearch.action.admin.indices.analyze.ReloadAnalyzersRequest;
 import org.elasticsearch.action.admin.indices.analyze.ReloadAnalyzersResponse;
+import org.elasticsearch.action.admin.indices.analyze.TransportReloadAnalyzersAction;
 import org.elasticsearch.index.mapper.MapperException;
 import org.elasticsearch.index.query.QueryBuilders;
 import org.elasticsearch.plugins.Plugin;
@@ -121,7 +121,7 @@ private void updateSynonyms(Path synonymsFile, boolean preview) throws IOExcepti
             out.println("foo, baz, buzz");
         }
         ReloadAnalyzersResponse reloadResponse = client().execute(
-            ReloadAnalyzerAction.INSTANCE,
+            TransportReloadAnalyzersAction.TYPE,
             new ReloadAnalyzersRequest(null, preview, INDEX_NAME)
         ).actionGet();
         assertNoFailures(reloadResponse);
@@ -183,7 +183,7 @@ public void testSynonymsInMultiplexerUpdateable() throws FileNotFoundException,
             out.println("foo, baz, buzz");
         }
         ReloadAnalyzersResponse reloadResponse = client().execute(
-            ReloadAnalyzerAction.INSTANCE,
+            TransportReloadAnalyzersAction.TYPE,
             new ReloadAnalyzersRequest(null, false, INDEX_NAME)
         ).actionGet();
         assertNoFailures(reloadResponse);
@@ -303,7 +303,7 @@ public void testKeywordMarkerUpdateable() throws IOException {
         }
 
         ReloadAnalyzersResponse reloadResponse = client().execute(
-            ReloadAnalyzerAction.INSTANCE,
+            TransportReloadAnalyzersAction.TYPE,
             new ReloadAnalyzersRequest(null, false, INDEX_NAME)
         ).actionGet();
         assertNoFailures(reloadResponse);