---
title: Kibana advanced settings
description: List of Kibana advanced settings.
url: https://www.elastic.co/elastic/docs-builder/docs/3167/reference/kibana/advanced-settings
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Kibana advanced settings
**Advanced Settings** control the behavior of Kibana. You can change the settings that apply to a specific space only, or to all of Kibana. For example, you can change the format used to display dates, specify the default data view, and apply your own branding.
<warning>
  Changing a setting can affect Kibana performance and cause problems that are difficult to diagnose. Setting a property value to a blank field reverts to the default behavior, which might not be compatible with other configuration settings. Deleting a custom setting permanently removes it from Kibana.
</warning>

Settings on this page are ordered as they appear in Kibana.

## Required permissions

You must have the `Advanced Settings` Kibana privilege to access the **Advanced Settings** page.
When you have insufficient privileges to edit advanced settings, the edit options are not visible, and the following indicator shows:
![Example of Advanced Settings Management's read only access indicator in Kibana's header](https://www.elastic.co/elastic/docs-builder/docs/3167/reference/kibana/images/settings-read-only-badge.png)
To add the privilege, go to the **Roles** management page using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3167/explore-analyze/find-and-organize/find-apps-and-objects).
For more information on granting access to Kibana, refer to [Granting access to Kibana](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3167/reference/elasticsearch/roles).

## Change the space-specific setting


Change the settings that apply only to a specific Kibana space.
1. Go to the **Advanced settings** page using the navigation menu or the [global search field](https://www.elastic.co/docs/explore-analyze/find-and-organize/find-apps-and-objects).
2. Click **Space Settings**.
3. Scroll or search for the setting.
4. Make your change, then click **Save changes**.


### General
<definitions>
  <definition term="hideAnnouncements">
    <stack-availability>Elastic Stack: Planned for deprecation, Elastic Stack: Generally available from 9.0 to 9.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Stops showing messages and tours that highlight new features.
Datatype: `bool`
Default: `false`

<note>
  <applies-to>Elastic Stack: Planned</applies-to> If this setting is set to `false` but the `hideAnnouncements` setting located in the **Global Settings** tab is set to `true`, then messages and tours that highlight new features won't show for the current space.
</note>

  </definition>
  <definition term="dateFormat">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The format to use for displaying [pretty formatted dates](https://momentjs.com/docs/#/displaying/format/).
Datatype: `string`
  </definition>
  <definition term="dateFormat:tz">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The timezone that Kibana uses.
Datatype: `string`
Default: `Browser`
  </definition>
  <definition term="dateFormat:scaled">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The values that define the format to use to render ordered time-based data. Formatted timestamps must adapt to the interval between measurements. Keys are [ISO8601 intervals](http://en.wikipedia.org/wiki/ISO_8601#Time_intervals).
Datatype: `string`
  </definition>
  <definition term="dateFormat:dow">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The day that a week should start on.
Datatype: `string`
  </definition>
  <definition term="dateNanosFormat">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The format to use for displaying [pretty formatted dates](https://momentjs.com/docs/#/displaying/format/) of [Elasticsearch date_nanos type](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/date_nanos).
Datatype: `string`
  </definition>
  <definition term="theme:darkMode">
    <stack-availability>Elastic Stack: Deprecated since 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The UI theme that the Kibana UI should use. Set to `enabled` or `disabled` to enable or disable the dark theme. Set to `system` to have the Kibana UI theme follow the system theme. You must refresh the page to apply the setting.
Datatype: `enum`
Options:
- `enabled`
- `disabled`
- `system`
  </definition>
  <definition term="state:storeInSessionStorage">
    <stack-availability>Elastic Stack: Planned for deprecation, Elastic Stack: Preview from 9.0 to 9.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Kibana tracks UI state in the URL, which can lead to problems when there is a lot of state information, and the URL gets long. Enabling this setting stores part of the URL in your browser session to keep the URL short.
Datatype: `bool`
  </definition>
  <definition term="savedObjects:perPage">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The number of objects to show on each page of the list of saved objects.
Datatype: `int`
Default: `20`
  </definition>
  <definition term="savedObjects:listingLimit">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The number of objects to fetch for lists of saved objects. Do not set above `10000`.
Datatype: `int`
Default: `1000`
  </definition>
  <definition term="csv:separator">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The separator for exported values.
Datatype: `string`
Default: `,`
  </definition>
  <definition term="csv:quoteValues">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Quotes exported values in CSV exports when activated.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="shortDots:enable">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Shortens long field names in visualizations. For example, shows `f.b.baz` instead of `foo.bar.baz`.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="format:defaultTypeMap">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A map of the default format name for each field type. Field types that are not explicitly mentioned use "_default_".
Datatype: `string`
  </definition>
  <definition term="format:number:defaultPattern">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The [numeral pattern](https://www.elastic.co/docs/explore-analyze/numeral-formatting) for the "number" format.
Datatype: `string`
Default: `0,0.[000]`
  </definition>
  <definition term="format:percent:defaultPattern">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The [numeral pattern](https://www.elastic.co/docs/explore-analyze/numeral-formatting) for the "percent" format.
Datatype: `string`
Default: `0,0.[000]%`
  </definition>
  <definition term="format:bytes:defaultPattern">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default [numeral pattern](https://www.elastic.co/docs/explore-analyze/numeral-formatting) format for the "bytes" format.
Datatype: `string`
Default: `0,0.[0]b`
  </definition>
  <definition term="format:currency:defaultPattern">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default [numeral pattern](https://www.elastic.co/docs/explore-analyze/numeral-formatting) format for the "currency" format.
Datatype: `string`
Default: `($0,0.[00])`
  </definition>
  <definition term="format:number:defaultLocale">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The [numeral pattern](https://www.elastic.co/docs/explore-analyze/numeral-formatting) locale.
Datatype: `string`
Default: `en`
  </definition>
  <definition term="data_views:fields_excluded_data_tiers">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Allows the exclusion of listed data tiers when getting a field list for faster performance.
Datatype: `string`
  </definition>
  <definition term="data_views:cache_max_age">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets how long data view fields API requests are cached in seconds. A value of 0 turns off caching. Modifying this value might not take immediate effect, users need to clear browser cache or wait until the current cache expires. To get immediate changes, try a hard reload of Kibana.
Datatype: `int`
Default: `5`
  </definition>
  <definition term="metaFields">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Fields that exist outside of `_source`. Kibana merges these fields into the document when displaying it.
Datatype: `string`
Default: `_source, _id, _index, _score, _ignored`
  </definition>
  <definition term="query:queryString:options">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Options for the Lucene query string parser. Only used when `search:queryLanguage` is set to **Lucene**.
Datatype: `string`
  </definition>
  <definition term="query:allowLeadingWildcards">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Allows a wildcard (*) as the first character in a query clause. To disallow leading wildcards in Lucene queries, use `query:queryString:options`.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="search:queryLanguage">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The query language to use in the query bar. Choices are [KQL](https://www.elastic.co/docs/reference/query-languages/kql), a language built specifically for Kibana, and the [Lucene query syntax](https://www.elastic.co/docs/explore-analyze/query-filter/languages/lucene-query-syntax).
Datatype: `string`
Default: `KQL`
  </definition>
  <definition term="sort:options">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Options for the Elasticsearch [sort](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/sort-search-results) parameter.
Datatype: `string`
  </definition>
  <definition term="defaultIndex">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default data view to access if none is set in Discover and Dashboards.
Datatype: `string`
Default: `null`
  </definition>
  <definition term="histogram:barTarget">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

When date histograms use the `auto` interval, Kibana attempts to generate this number of bars.
Datatype: `int`
Default: `50`
  </definition>
  <definition term="histogram:maxBars">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Limits the density of date and number histograms across Kibana using a test query to improve performance. When the test query contains too many buckets, the interval between buckets increases. Applies separately to each histogram aggregation, and does not apply to other types of aggregations. To find the maximum value, divide the Elasticsearch `search.max_buckets` value by the maximum number of aggregations in each visualization.
Datatype: `int`
Default: `1000`
  </definition>
  <definition term="history:limit">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

In fields that have history, such as query inputs, shows this many recent values.
Datatype: `int`
Default: `10`
  </definition>
  <definition term="timepicker:refreshIntervalDefaults">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default refresh interval for the time filter. Specify the `value` parameter in milliseconds.
Datatype: `string`
Default: `{"pause": true, "value": 60000}`
  </definition>
  <definition term="timepicker:timeDefaults">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default selection in the time filter. Must be an object containing "from" and "to" (refer to [accepted formats](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math)).
Datatype: `string`
Default: `{"from": "now-15m", "to": "now"}`
  </definition>
  <definition term="timepicker:quickRanges">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The list of ranges to show in the Quick section of the time filter. This must be an array of objects, with each object containing `from`, `to` (refer to [accepted formats](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math)), and `display` (the title to be displayed).
Datatype: `string`
  </definition>
  <definition term="filters:pinnedByDefault">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Makes filters have a global state and be pinned by default when activated.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="filterEditor:suggestValues">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the filter editor and KQL autocomplete to suggest values for fields.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="defaultRoute">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default route when opening Kibana. Use this setting to route users to a specific dashboard, application, or saved object as they enter each space.
Datatype: `string`
  </definition>
  <definition term="fileUpload:maxFileSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets the file size limit when importing files. The highest supported value for this setting is `1GB`.
Datatype: `string`
Default: `100MB`
  </definition>
  <definition term="enableESQL">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables ES|QL in Kibana.
When deactivated, hides the ES|QL user interface from various applications. However, users can still access existing ES|QL-based Discover sessions, visualizations, and other objects.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="metrics:max_buckets">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Affects the **TSVB** histogram density. Must be set higher than `histogram:maxBars`.
Datatype: `int`
Default: `2000`
  </definition>
  <definition term="metrics:allowStringIndices">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables you to use Elasticsearch indices in **TSVB** visualizations.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="workflows:ui:enabled">
    <stack-availability>Elastic Stack: Preview since 9.3</stack-availability>
    <supported-on>Elastic Cloud Serverless: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables Elastic Workflows and related experiences.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="fields:popularLimit">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The top N most popular fields to show.
Datatype: `int`
Default: `10`
  </definition>
  <definition term="aiAssistant:preferredAIAssistantType">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

This setting allows you to choose which AI Assistants are available to use and where. You can choose to only show the AI Assistants in their solutions, in other Kibana applications (for example, Discover, Dashboards, and Stack Management pages), or nowhere.
Datatype: `string`

<note>
  <applies-to>Elastic Stack: Generally available since 9.2</applies-to> Configure the `aiAssistant:preferredAIAssistantType` setting from the **GenAI Settings** page, which you can find using the Classic navigation menu or the [global search field](https://www.elastic.co/docs/explore-analyze/find-and-organize/find-apps-and-objects). Note that this setting is unavailable from the **GenAI Settings** page when using a [solution view](https://www.elastic.co/docs/deploy-manage/manage-spaces).
</note>

  </definition>
</definitions>

### Presentation Labs
<definitions>
  <definition term="labs:dashboard:deferBelowFold">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables deferred loading of dashboard panels below the fold. *Below the fold* refers to panels that are not immediately visible when you open a dashboard, but become visible as you scroll.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="labs:canvas:byValueEmbeddable">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables support for by-value embeddables in Canvas.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="labs:dashboard:enable_ui">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Provides access to the experimental **Labs** features for **Dashboard** when activated.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="labs:canvas:enable_ui">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Provides access to the experimental **Labs** features for **Canvas** when activated.
Datatype: `bool`
Default: `false`
  </definition>
</definitions>

### Accessibility
<definitions>
  <definition term="accessibility:disableAnimations">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Turns off all optional animations in the Kibana UI. Refresh the page to apply the changes.
Datatype: `bool`
Default: `false`
  </definition>
</definitions>

### Autocomplete
<definitions>
  <definition term="autocomplete:valueSuggestionMethod">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The method to retrieve values for KQL autocomplete suggestions.
- When set to `terms_enum`, autocomplete uses the terms enum API for value suggestions. Kibana returns results faster, but suggestions are approximate, sorted alphabetically, and can be outside the selected time range. (Note that this API is incompatible with [Document-Level-Security](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level).)
- When set to `terms_agg`, Kibana uses a terms aggregation for value suggestions, which is slower, but suggestions include all values that optionally match your time range and are sorted by popularity.

Datatype: `enum`
Default: `terms_enum`
Options:
- `terms_enum`
- `terms_agg`
  </definition>
  <definition term="autocomplete:useTimeRange">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

When off, autocomplete suggestions come from your data set instead of the time range.
Datatype: `bool`
Default: `true`
  </definition>
</definitions>

### Banners

<note>
  Banners are a [subscription feature](https://www.elastic.co/subscriptions).
</note>

<definitions>
  <definition term="banners:placement">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The placement of the banner for this space. Set to `Top` to display a banner above the Elastic header. Uses the value of the `xpack.banners.placement` configuration property by default.
Datatype: `string`
  </definition>
  <definition term="banners:textContent">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The text to display inside the banner for this space, either plain text or Markdown. Uses the value of the `xpack.banners.textContent` configuration property by default.
Datatype: `string`
  </definition>
  <definition term="banners:textColor">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The color for the banner text for this space. Uses the value of the `xpack.banners.textColor` configuration property by default.
Datatype: `string`
  </definition>
  <definition term="banners:linkColor">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The color for the banner link text for this space. Uses the value of the `xpack.banners.linkColor` configuration property by default.
Datatype: `string`
  </definition>
  <definition term="banners:backgroundColor">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The color of the banner background for this space. Uses the value of the `xpack.banners.backgroundColor` configuration property by default.
Datatype: `string`
  </definition>
</definitions>

### Discover
<definitions>
  <definition term="doc_table:highlight">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Highlights search results in **Discover** and Discover session panels on dashboards. Highlighting slows requests when working on large documents.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="defaultColumns">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The columns that appear by default on the **Discover** page. When empty, displays a summary of the document.
Datatype: `string`
  </definition>
  <definition term="discover:maxDocFieldsDisplayed">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Specifies the maximum number of fields to show in the document column of the **Discover** table.
Datatype: `int`
Default: `200`
  </definition>
  <definition term="discover:sampleSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets the maximum number of rows for the entire document table. This is the maximum number of documents fetched from Elasticsearch.
Datatype: `int`
Default: `500`
  </definition>
  <definition term="discover:sampleRowsPerPage">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Limits the number of rows per page in the document table.
Datatype: `int`
Default: `100`
  </definition>
  <definition term="discover:sort:defaultOrder">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default sort direction for time-based data views.
Datatype: `string`
Default: `Descending`
  </definition>
  <definition term="discover:searchOnPageLoad">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Controls whether a search runs when **Discover** first loads. This setting does not have an effect when loading a saved Discover session.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="doc_table:hideTimeColumn">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Hides the "Time" column in **Discover** and in all Discover session panels on dashboards.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="context:defaultSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The number of surrounding entries to display in the context view.
Datatype: `int`
Default: `5`
  </definition>
  <definition term="context:step">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The number by which to increment or decrement the context size.
Datatype: `int`
Default: `5`
  </definition>
  <definition term="context:tieBreakerFields">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A comma-separated list of fields to use for breaking a tie between documents that have the same timestamp value. The first field that is present and sortable in the current data view is used.
Datatype: `string`
Default: `_doc`
  </definition>
  <definition term="discover:modifyColumnsOnSwitch">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Removes columns that are not in the newly selected data view when changing data views.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="discover:showFieldStatistics">
    <stack-availability>Elastic Stack: Beta</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the Field statistics view. Examine details such as the minimum and maximum values of a numeric field or a map of a geo field.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="discover:showMultiFields">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Controls the display of multi-fields in the expanded document view. This option is only available when `searchFieldsFromSource` is off.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="discover:rowHeightOption">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The number of lines to allow in a row. A value of -1 automatically adjusts the row height to fit the contents. A value of 0 displays the content in a single line.
Datatype: `int`
Default: `3`
  </definition>
</definitions>

### Machine Learning
<definitions>
  <definition term="ml:anomalyDetection:results:enableTimeDefaults">
    <supported-on>Serverless Observability projects: Generally available, Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Uses the default time filter in the **Single Metric Viewer** and **Anomaly Explorer** when activated. When deactivated, shows results for the full time range.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="ml:anomalyDetection:results:timeDefaults">
    <supported-on>Serverless Observability projects: Generally available, Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default time filter for viewing anomaly detection job results. Must contain from and to values (refer to [accepted formats](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math)). Ignored unless the `ml:anomalyDetection:results:enableTimeDefaults` setting is activated.
Datatype: `string`
Default: `{"from": "now-15m", "to": "now"}`
  </definition>
</definitions>

### Notifications
<definitions>
  <definition term="notifications:banner">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A custom banner intended for temporary notices to all users. Supports [Markdown syntax](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax).
Datatype: `string`
  </definition>
  <definition term="notifications:lifetime:banner">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The duration, in milliseconds, for banner notification displays.
Datatype: `int`
Default: `3000000`
  </definition>
  <definition term="notifications:lifetime:error">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The duration, in milliseconds, for error notification displays.
Datatype: `int`
Default: `300000`
  </definition>
  <definition term="notifications:lifetime:warning">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The duration, in milliseconds, for warning notification displays.
Datatype: `int`
Default: `10000`
  </definition>
  <definition term="notifications:lifetime:info">
    <supported-on>Elastic Cloud Serverless: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The duration, in milliseconds, for information notification displays.
Datatype: `int`
Default: `5000`
  </definition>
</definitions>

### Observability
<definitions>
  <definition term="ai:anonymizationSettings">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Elasticsearch projects: Preview, Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of anonymization rules for AI Assistant. Includes rules for Named Entity Recognition (NER) models and regular expression patterns to identify and anonymize sensitive data.
<dropdown title="Default configuration">
  ```json
  {
    "rules": [
      {
        "entityClass": "EMAIL",
        "type": "RegExp",
        "pattern": "([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})",
        "enabled": false
      },
      {
        "type": "NER",
        "modelId": "elastic__distilbert-base-uncased-finetuned-conll03-english",
        "enabled": false,
        "allowedEntityClasses": [
          "PER",
          "ORG",
          "LOC"
        ],
        "timeoutSeconds": 30
      }
    ]
  }
  ```
</dropdown>

Datatype: `string`
  </definition>
  <definition term="observability:logSources">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sources to use for logs data. If the data of these indices is not logs data, you can experience degraded functionality. Changes to this setting can potentially impact the sources queried in Log Threshold rules.
Datatype: `string`
Default: `logs-*-*, logs-*, filebeat-*`
  </definition>
  <definition term="observability:streamsEnableContentPacks">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable Streams content packs.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:aiAssistantSimulatedFunctionCalling">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Elasticsearch projects: Preview, Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Simulated function calling does not need API support for functions or tools, but it can decrease performance. Currently always activated for connectors that do not have API support for Native function calling.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:aiAssistantSearchConnectorIndexPattern">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Elasticsearch projects: Generally available, Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Index pattern used by the AI Assistant when querying search connectors indices (part of the knowledge base). Empty by default: the index for every search connector is queried.
Datatype: `string`
  </definition>
  <definition term="observability:newLogsOverview">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable the new logs overview experience.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:enableInspectEsQueries">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

When activated, allows you to inspect Elasticsearch queries in API responses.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:maxSuggestions">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Maximum number of suggestions fetched in autocomplete selection boxes.
Datatype: `int`
Default: `100`
  </definition>
  <definition term="observability:enableComparisonByDefault">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the comparison feature by default in the APM app.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmDefaultServiceEnvironment">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default environment for the APM app. When left empty, displays data from all environments by default.
Datatype: `string`
  </definition>
  <definition term="observability:apmProgressiveLoading">
    <stack-availability>Elastic Stack: Generally available since 9.1, Elastic Stack: Preview in 9.0</stack-availability>
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables progressive loading of some APM views. Data can be requested with a lower sampling rate first, with lower accuracy but faster response times, while the unsampled data loads in the background.
Datatype: `string`
Default: `Off`
  </definition>
  <definition term="observability:apmServiceInventoryOptimizedSorting">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Preview in 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sort services without anomaly detection rules on the APM Service inventory page by service name.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:apmServiceGroupMaxNumberOfServices">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Limit the number of services in a given service group.
Datatype: `int`
Default: `500`
  </definition>
  <definition term="observability:apmTraceExplorerTab">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Preview in 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable the APM Trace Explorer feature, that allows you to search and inspect traces with KQL or EQL.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmLabsButton">
    <stack-availability>Elastic Stack: Removed in 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Activates the APM Labs button, a quick way to enable and disable technical preview features in APM.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:enableInfrastructureProfilingIntegration">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Preview in 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the Profiling view in Host details within Infrastructure.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:enableInfrastructureAssetCustomDashboards">
    <stack-availability>Elastic Stack: Preview since 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the option to link custom dashboards in the Asset Details view.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:enableAwsLambdaMetrics">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Preview in 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Display Amazon Lambda metrics in the service metrics tab.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmAgentExplorerView">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Beta in 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable the Agent explorer view.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmEnableTableSearchBar">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables faster searching in APM tables by adding a handy search bar with live filtering. Available for the following tables: Services, Transactions, and Errors.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmEnableServiceInventoryTableSearchBar">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables faster searching in the APM Service inventory table by adding a handy search bar with live filtering.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmAWSLambdaPriceFactor">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set the price per Gb-second for your AWS Lambda functions.
Datatype: `string`
Default: `{"x86_64": 0.0000166667,"arm": 0.0000133334}`
  </definition>
  <definition term="observability:apmAWSLambdaRequestCostPerMillion">
    <supported-on>Serverless Observability projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set the AWS Lambda cost per million requests.
Datatype: `float`
Default: `0.2`
  </definition>
  <definition term="observability:apmEnableServiceMetrics">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Beta in 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable the usage of service transaction metrics, which are low cardinality metrics that can be used by certain views like the service inventory for faster loading times.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmEnableContinuousRollups">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Beta in 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

When continuous rollups is activated, the UI selects metrics with the appropriate resolution. On larger time ranges, lower resolution metrics are used, which improves loading times.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:apmEnableCriticalPath">
    <stack-availability>Elastic Stack: Removed in 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

When activated, displays the critical path of a trace.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:syntheticsThrottlingEnabled">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable the throttling setting in Synthetics monitor configurations. Throttling might still not be available for your monitors even if the setting is active.
Datatype: `bool`
Default: `false`

<warning>
  This setting is intended for Elastic-internal use only. [Learn more](https://github.com/elastic/synthetics/blob/main/docs/throttling.md)
</warning>

  </definition>
  <definition term="observability:enableLegacyUptimeApp">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

By default, the legacy Uptime app is hidden from the interface when it doesn't have any data for more than a week. Enabling this option always shows it.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:apmEnableProfilingIntegration">
    <stack-availability>Elastic Stack: Removed in 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable the Universal Profiling integration in APM.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:profilingShowErrorFrames">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Show error frames in the Universal Profiling views to indicate stack unwinding failures.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:profilingPervCPUWattX86">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The average amortized per-core power consumption (based on 100% CPU utilization) for x86 architecture.
Datatype: `float`
Default: `7`
  </definition>
  <definition term="observability:profilingPervCPUWattArm64">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The average amortized per-core power consumption (based on 100% CPU utilization) for arm64 architecture.
Datatype: `float`
Default: `2.8`
  </definition>
  <definition term="observability:profilingDatacenterPUE">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Data center power usage effectiveness (PUE) measures how efficiently a data center uses energy. The average on-premise data center PUE according to the [Uptime Institute](https://ela.st/uptimeinstitute) survey.
Datatype: `float`
Default: `1.7`
  </definition>
  <definition term="observability:profilingCo2PerKWH">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Carbon intensity measures how clean your data center electricity is. Specifically, it measures the average amount of CO2 emitted per kilowatt-hour (kWh) of electricity consumed in a particular region. Use the [cloud carbon footprint data sheet](https://ela.st/grid-datasheet) to update this value according to your region. Defaults to US East (N. Virginia).
Datatype: `float`
  </definition>
  <definition term="observability:profilingAWSCostDiscountRate">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

If you're enrolled in the AWS Enterprise Discount Program (EDP), enter your discount rate to update the profiling cost calculation.
Datatype: `float`
  </definition>
  <definition term="observability:profilingAzureCostDiscountRate">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

If you have an Azure Enterprise Agreement with Microsoft, enter your discount rate to update the profiling cost calculation.
Datatype: `float`
  </definition>
  <definition term="observability:profilingCostPervCPUPerHour">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Default Hourly Cost per CPU Core for machines not on AWS or Azure.
Datatype: `float`
Default: `0,0425`
  </definition>
  <definition term="observability:apmEnableTransactionProfiling">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables Universal Profiling on Transaction view.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="observability:profilingFetchTopNFunctionsFromStacktraces">
    <stack-availability>Elastic Stack: Removed in 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Switch to fetch the TopN Functions from the Stacktraces API.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:searchExcludedDataTiers">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Specify the data tiers to exclude from search, such as data_cold or data_frozen. When configured, indices allocated in the selected tiers are ignored from search requests. Affected apps: APM, Infrastructure.
Datatype: `string`
  </definition>
  <definition term="observability:enableDiagnosticMode">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable diagnostic mode for debugging and troubleshooting capabilities. Currently available only in the Service map view.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="observability:streamsEnableSignificantEvents">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Observability projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enable streams significant events.
Datatype: `bool`
Default: `false`
  </definition>
</definitions>

### Reporting
<definitions>
  <definition term="xpackReporting:customPdfLogo">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A custom image to use in the footer of the PDF.
Datatype: `string`
  </definition>
</definitions>

### Rollup
<definitions>
  <definition term="rollups:enableIndexPatterns">
    <stack-availability>Elastic Stack: Deprecated since 8.15</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the creation of data views that capture rollup indices, which in turn enables visualizations based on rollup data. Refresh the page to apply the changes.
Datatype: `bool`
  </definition>
</definitions>

### Elasticsearch
<definitions>
  <definition term="query_activity:minRunningTime">
    <stack-availability>Elastic Stack: Planned</stack-availability>
    <supported-on>Serverless Elasticsearch projects: Preview since 9.4, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The minimum time in milliseconds that a query must be running before it appears on the [Query activity](https://www.elastic.co/docs/deploy-manage/monitor/query-activity) page. Increase this value to filter out fast-completing queries and focus on long-running ones. `100` by default.
Datatype: `int`
Default: `100`
  </definition>
  <definition term="courier:ignoreFilterIfFieldNotInIndex">
    <supported-on>Serverless Elasticsearch projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enhances support for dashboards containing visualizations accessing several dissimilar data views. When activated, filters are ignored for a visualization when the visualization's data view does not contain the filtering field. When deactivated, all filters are applied to all visualizations.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="courier:setRequestPreference">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets which shards handle your search requests.
- **Session ID** (default): Restricts operations to execute all search requests on the same shards. This has the benefit of reusing shard caches across requests.
- **Custom**: Allows you to define your own preference. Use `courier:customRequestPreference` to customize your preference value.
- **None**: Do not set a preference. This might provide better performance because requests can be spread across all shard copies. However, results might be inconsistent because different shards might be in different refresh states.

Datatype: `string`
Default: `Session ID`
  </definition>
  <definition term="courier:customRequestPreference">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

[Request preference](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search#operation-search-preference) to use when `courier:setRequestPreference` uses `custom`.
Datatype: `string`
Default: `_local`
  </definition>
  <definition term="courier:maxConcurrentShardRequests">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Controls the [max_concurrent_shard_requests](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-msearch) setting used for `_msearch` requests sent by Kibana. Set to 0 to disable this config and use the Elasticsearch default.
Datatype: `int`
Default: `0`
  </definition>
  <definition term="search:includeFrozen">
    <stack-availability>Elastic Stack: Deprecated since 7.16</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Includes [frozen indices](https://www.elastic.co/docs/manage-data/lifecycle/data-tiers#frozen-tier) in results. Searching through frozen indices might increase the search time.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="search:timeout">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum timeout, in milliseconds, for search requests. To deactivate the timeout and allow queries to run to completion, set to `0`.
Datatype: `int`
Default: `600000`
  </definition>
</definitions>

### Security solution
<definitions>
  <definition term="securitySolution:refreshIntervalDefaults">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default refresh interval for the Security time filter, in milliseconds.
Datatype: `string`
Default: `300000`
  </definition>
  <definition term="securitySolution:timeDefaults">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default period of time of the Security solution time filter.
Datatype: `string`
Default: `{"from": "now/d","to": "now/d"}`
  </definition>
  <definition term="securitySolution:defaultIndex">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A comma-delimited list of Elasticsearch indices from which the Elastic Security app collects events.
Datatype: `string`
Default: `apm-*-transaction*, auditbeat-*, endgame-*, filebeat-*, logs-*, packetbeat-*, traces-apm*, winlogbeat-*, -*elastic-cloud-logs-*`
  </definition>
  <definition term="securitySolution:defaultThreatIndex">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A comma-delimited list of Threat Intelligence indices from which the Elastic Security app collects indicators.
Datatype: `string`
Default: `logs-ti_*`
  </definition>
  <definition term="securitySolution:defaultAnomalyScore">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The threshold above which machine learning job anomalies are displayed in the Elastic Security app. The value must be between `0` and `100`.
Datatype: `int`
Default: `50`
  </definition>
  <definition term="securitySolution:enableNewsFeed">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the security news feed on the Security **Overview** page.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="securitySolution:excludeColdAndFrozenTiersInAnalyzer">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Skips cold and frozen tiers in Analyzer's queries when activated.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="securitySolution:enableGraphVisualization">
    <stack-availability>Elastic Stack: Planned for removal, Elastic Stack: Preview from 9.1 to 9.3</stack-availability>
    <supported-on>Elastic Cloud Serverless: Removed, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the Graph Visualization feature within the Security solution.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="securitySolution:enableAssetInventory">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Security projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the Asset Inventory experience within the Security solution. When activated, you can access the Inventory feature through the Security solution navigation.
Datatype: `bool`
Default: `false`

<note>
  Disabling this setting will not disable the Entity Store or clear persistent Entity metadata. To manage or disable the Entity Store, visit the **Entity Store Management** page.
</note>

  </definition>
  <definition term="securitySolution:enableCloudConnector">
    <stack-availability>Elastic Stack: Preview</stack-availability>
    <supported-on>Serverless Security projects: Preview, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the Cloud Connector experience within the Security solution.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="securitySolution:rulesTableRefresh">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables auto refresh on the rules and monitoring tables, in milliseconds.
Datatype: `string`
Default: `{"on": true,"value": 60000}`
  </definition>
  <definition term="securitySolution:newsFeedUrl">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The URL to retrieve the security news feed content from.
Datatype: `string`
Default: `https://feeds.elastic.co/security-solution`
  </definition>
  <definition term="securitySolution:ipReputationLinks">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A JSON array containing links for verifying the reputation of an IP address. The links are displayed on [IP detail](https://www.elastic.co/docs/solutions/security/explore/network-page) pages.
<dropdown title="Default array">
  ```json
  [
    { "name": "virustotal.com", "url_template": "https://www.virustotal.com/gui/search/{{ip}}" },
    { "name": "talosIntelligence.com", "url_template": "https://talosintelligence.com/reputation_center/lookup?search={{ip}}" }
  ]
  ```
</dropdown>

Datatype: `string`
  </definition>
  <definition term="securitySolution:enableCcsWarning">
    <stack-availability>Elastic Stack: Planned for removal, Elastic Stack: Generally available from 9.0 to 9.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables privilege check warnings in rules for CCS indices.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="securitySolution:suppressionBehaviorOnAlertClosure">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

If an alert is closed while suppression is active, you can choose whether suppression continues or resets.
Datatype: `string`
Default: `Restart suppression`
  </definition>
  <definition term="securitySolution:showRelatedIntegrations">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Shows related integrations on the rules and monitoring tables.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="securitySolution:alertTags">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of tag options for use with alerts generated by Security Solution rules.
Datatype: `string`
Default: `Duplicate, False Positive, Further investigation required`
  </definition>
  <definition term="securitySolution:excludedDataTiersForRuleExecution">
    <supported-on>Serverless Security projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Specifies data tiers to exclude from searching during rule execution. Excludes events from the specified data tiers, which might help improve rule performance or reduce execution time. For example: `data_frozen,data_cold`.
Datatype: `string`
  </definition>
  <definition term="securitySolution:enablePrivilegedUserMonitoring">
    <stack-availability>Elastic Stack: Removed in 9.3, Elastic Stack: Preview from 9.1 to 9.2</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the privileged user monitoring dashboard and onboarding experience, which are in technical preview.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="securitySolution:enableEsqlRiskScoring">
    <stack-availability>Elastic Stack: Removed in 9.3, Elastic Stack: Preview from 9.0 to 9.2</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables risk scoring based on ES|QL queries. Disabling this reverts to using scripted metrics.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="securitySolution:defaultAIConnector">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Serverless Security projects: Generally available</supported-on>

Default AI connector for serverless AI features (Elastic AI SOC Engine).
Datatype: `string`
Default: `Elastic Managed LLM`
  </definition>
  <definition term="securitySolution:defaultValueReportMinutes">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Serverless Security projects: Generally available</supported-on>

The average review time in minutes for an analyst to review an alert. Used for calculations in the Value report.
Datatype: `int`
Default: `8`
  </definition>
  <definition term="securitySolution:defaultValueReportRate">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Serverless Security projects: Generally available</supported-on>

The average hourly rate for a security analyst. Used for calculations in the Value report.
Datatype: `int`
Default: `75`
  </definition>
  <definition term="securitySolution:defaultValueReportTitle">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Serverless Security projects: Generally available</supported-on>

The title of the Value report.
Datatype: `string`
Default: `Elastic AI value report`
  </definition>
</definitions>

### Timelion
<definitions>
  <definition term="timelion:es.timefield">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default field containing a timestamp when using the `.es()` query.
Datatype: `string`
Default: `@timestamp`
  </definition>
  <definition term="timelion:es.default_index">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The default index when using the `.es()` query.
Datatype: `string`
Default: `_all`
  </definition>
  <definition term="timelion:target_buckets">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Used for calculating automatic intervals in visualizations, this is the number of buckets to try to represent.
Datatype: `int`
Default: `200`
  </definition>
  <definition term="timelion:max_buckets">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of buckets a single data source can return. This value is used for calculating automatic intervals in visualizations.
Datatype: `int`
Default: `2000`
  </definition>
  <definition term="timelion:min_interval">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The smallest interval to calculate when using "auto".
Datatype: `string`
Default: `1ms`
  </definition>
</definitions>

### Visualization
<definitions>
  <definition term="visualization:heatmap:maxBuckets">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of buckets a datasource can return. High numbers can have a negative impact on your browser rendering performance.
Datatype: `int`
Default: `50`
  </definition>
  <definition term="visualization:visualize:legacyHeatmapChartsLibrary">
    <stack-availability>Elastic Stack: Deprecated</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables legacy charts library for heatmap charts in visualize.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="visualization:useLegacyTimeAxis">
    <stack-availability>Elastic Stack: Removed in 9.1, Elastic Stack: Deprecated from 8.10 to 9.0</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables the legacy time axis for charts in Lens, Discover, Visualize, and TSVB.
Datatype: `bool`
Default: `true`
  </definition>
</definitions>

### Developer tools
<definitions>
  <definition term="devTools:enablePersistentConsole">
    <supported-on>Serverless Elasticsearch projects: Generally available, Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Enables a persistent console in the Kibana UI. This setting does not affect the standard Console in Dev Tools.
Datatype: `bool`
Default: `true`
  </definition>
</definitions>


## Change the global settings

<applies-to>
  - Elastic Cloud Serverless: Unavailable
  - Elastic Stack: Generally available
</applies-to>


Change the settings that apply to all of Kibana.
1. Go to the **Advanced settings** page using the navigation menu or the [global search field](https://www.elastic.co/docs/explore-analyze/find-and-organize/find-apps-and-objects).
2. Click **Global Settings**.
3. Scroll or search for the setting.
4. Make your change, then click **Save changes**.


### General
<definitions>
  <definition term="hideAnnouncements">
    <stack-availability>Elastic Stack: Planned</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Stops showing messages and tours that highlight new features.
Datatype: `bool`
Default: `false`
  </definition>
</definitions>

### Custom branding

<note>
  Custom branding is a [subscription feature](https://www.elastic.co/subscriptions).
</note>

<definitions>
  <definition term="xpackCustomBranding:logo">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A custom image that appears in the header of all Kibana pages. Images must have a transparent background, and 128x128 pixels or smaller.
Datatype: `image`
  </definition>
  <definition term="xpackCustomBranding:customizedLogo">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The custom image that replaces the text next to the logo in the header of all Kibana pages. Images look best when they are no larger than 200 x 84 pixels and have a transparent background.
Datatype: `string`
  </definition>
  <definition term="xpackCustomBranding:pageTitle">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The custom text that appears on Kibana browser tabs.
Datatype: `string`
  </definition>
  <definition term="xpackCustomBranding:faviconSVG">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The URL of a custom SVG image that appears on Kibana browser tabs. Images must be 16x16 pixels.
Datatype: `string`
  </definition>
  <definition term="xpackCustomBranding:faviconPNG">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The URL of a custom PNG image that appears on Kibana browser tabs.
Datatype: `string`
  </definition>
</definitions>