Merge branch 'main' into carlosdelest/get-synonym-rules-api

# Conflicts:
#	rest-api-spec/src/main/resources/rest-api-spec/api/synonym_rule.put.json
#	rest-api-spec/src/yamlRestTest/resources/rest-api-spec/test/synonyms/50_synonym_rule_put.yml
#	server/src/main/java/org/elasticsearch/action/ActionModule.java
#	server/src/main/java/org/elasticsearch/action/synonyms/PutSynonymRuleAction.java
#	server/src/main/java/org/elasticsearch/action/synonyms/SynonymUpdateResponse.java
#	server/src/main/java/org/elasticsearch/action/synonyms/TransportPutSynonymRuleAction.java
#	server/src/main/java/org/elasticsearch/synonyms/SynonymsManagementAPIService.java
#	server/src/test/java/org/elasticsearch/action/synonyms/SynonymUpdateResponseSerializingTests.java
#	x-pack/plugin/security/qa/operator-privileges-tests/src/javaRestTest/java/org/elasticsearch/xpack/security/operator/Constants.java

.ci/matrix-runtime-javas.yml

@@ -11,3 +11,4 @@ ES_RUNTIME_JAVA:
   - openjdk18
   - openjdk19
   - openjdk20
+  - openjdk21

benchmarks/src/main/java/org/elasticsearch/benchmark/search/QueryParserHelperBenchmark.java

@@ -24,6 +24,7 @@
 import org.elasticsearch.common.compress.CompressedXContent;
 import org.elasticsearch.common.io.stream.NamedWriteableRegistry;
 import org.elasticsearch.common.lucene.Lucene;
+import org.elasticsearch.common.settings.ClusterSettings;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.common.xcontent.LoggingDeprecationHandler;
 import org.elasticsearch.core.IOUtils;
@@ -138,6 +139,7 @@ protected SearchExecutionContext buildSearchExecutionContext() {
             0,
             0,
             mapperService.getIndexSettings(),
+            ClusterSettings.createBuiltInClusterSettings(),
             null,
             (ft, fdc) -> ft.fielddataBuilder(fdc).build(new IndexFieldDataCache.None(), new NoneCircuitBreakerService()),
             mapperService,

benchmarks/src/main/java/org/elasticsearch/benchmark/search/aggregations/AggConstructionContentionBenchmark.java

@@ -269,6 +269,11 @@ public IndexSettings getIndexSettings() {
             throw new UnsupportedOperationException();
         }
 
+        @Override
+        public ClusterSettings getClusterSettings() {
+            throw new UnsupportedOperationException();
+        }
+
         @Override
         public Optional<SortAndFormats> buildSort(List<SortBuilder<?>> sortBuilders) throws IOException {
             throw new UnsupportedOperationException();

build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/precommit/ThirdPartyAuditTask.java

@@ -58,6 +58,7 @@
 import javax.inject.Inject;
 
 import static org.gradle.api.JavaVersion.VERSION_20;
+import static org.gradle.api.JavaVersion.VERSION_21;
 
 @CacheableTask
 public abstract class ThirdPartyAuditTask extends DefaultTask {
@@ -337,8 +338,8 @@ private String runForbiddenAPIsCli() throws IOException {
                 spec.setExecutable(javaHome.get() + "/bin/java");
             }
             spec.classpath(getForbiddenAPIsClasspath(), classpath);
-            // Enable explicitly for each release as appropriate. Just JDK 20 for now, and just the vector module.
-            if (isJava20()) {
+            // Enable explicitly for each release as appropriate. Just JDK 20/21 for now, and just the vector module.
+            if (isJavaVersion(VERSION_20) || isJavaVersion(VERSION_21)) {
                 spec.jvmArgs("--add-modules", "jdk.incubator.vector");
             }
             spec.jvmArgs("-Xmx1g");
@@ -363,13 +364,13 @@ private String runForbiddenAPIsCli() throws IOException {
         return forbiddenApisOutput;
     }
 
-    /** Returns true iff the Java version is 20. */
-    private boolean isJava20() {
+    /** Returns true iff the build Java version is the same as the given version. */
+    private boolean isJavaVersion(JavaVersion version) {
         if (BuildParams.getIsRuntimeJavaHomeSet()) {
-            if (VERSION_20.equals(BuildParams.getRuntimeJavaVersion())) {
+            if (version.equals(BuildParams.getRuntimeJavaVersion())) {
                 return true;
             }
-        } else if ("20".equals(VersionProperties.getBundledJdkMajorVersion())) {
+        } else if (version.getMajorVersion().equals(VersionProperties.getBundledJdkMajorVersion())) {
             return true;
         }
         return false;

build-tools-internal/src/main/resources/changelog-schema.json

@@ -35,6 +35,7 @@
             "DLM",
             "Discovery-Plugins",
             "Distributed",
+            "Downsampling",
             "EQL",
             "Engine",
             "FIPS",
@@ -73,7 +74,6 @@
             "Ranking",
             "Recovery",
             "Reindex",
-            "Rollup",
             "SQL",
             "Search",
             "Security",

docs/changelog/94954.yaml

@@ -0,0 +1,5 @@
+pr: 94954
+summary: Asset tracking - geo_line for TSDB
+area: Geo
+type: enhancement
+issues: []

docs/changelog/95512.yaml

@@ -1,5 +1,5 @@
 pr: 95512
-summary: Adding `manage_dlm` index privilege and expanding `view_index_metadata` for access to data lifecycle APIs
+summary: Adding `manage_data_stream_lifecycle` index privilege and expanding `view_index_metadata` for access to data stream lifecycle APIs
 area: DLM
 type: enhancement
 issues: []

docs/changelog/96224.yaml

@@ -0,0 +1,14 @@
+pr: 96224
+summary: Add multiple queries for ranking to the search endpoint
+area: Ranking
+type: enhancement
+issues: []
+highlight:
+  title: Add multiple queries for ranking to the search endpoint
+  body: "The search endpoint adds a new top-level element called `sub_searches`. \
+  This top-level element is a list of searches used for ranking where each \
+  \"sub search\" is executed independently. The `sub_searches` element is \
+  used instead of `query` to allow a search using ranking to execute \
+  multiple queries. The `sub_searches` and `query` elements cannot be used \
+  together."
+  notable: true

docs/changelog/96321.yaml

@@ -0,0 +1,6 @@
+pr: 96321
+summary: Trigger refresh when shard becomes search active
+area: Engine
+type: enhancement
+issues:
+ - 95544

docs/changelog/96551.yaml

@@ -0,0 +1,5 @@
+pr: 96551
+summary: Make cluster health API cancellable
+area: Distributed
+type: bug
+issues: []

docs/changelog/96605.yaml

@@ -0,0 +1,6 @@
+pr: 96605
+summary: "Feature: include unit support for time series rate aggregation"
+area: TSDB
+type: enhancement
+issues:
+ - 94630

docs/changelog/96624.yaml

@@ -0,0 +1,5 @@
+pr: 96624
+summary: Enable analytics geoip in behavioral analytics
+area: "Application"
+type: feature
+issues: []

docs/changelog/96712.yaml

@@ -0,0 +1,5 @@
+pr: 96712
+summary: "Adjust ECS dynamic templates to support `subobjects: false`"
+area: Data streams
+type: enhancement
+issues: []

docs/changelog/96744.yaml

@@ -0,0 +1,5 @@
+pr: 96744
+summary: Support restricting access of API keys to only certain workflows
+area: Authorization
+type: feature
+issues: []

docs/changelog/96782.yaml

@@ -0,0 +1,5 @@
+pr: 96782
+summary: Increase concurrent request of opening point-in-time
+area: Search
+type: bug
+issues: []

docs/changelog/96794.yaml

@@ -0,0 +1,5 @@
+pr: 96794
+summary: Make TDigestState configurable
+area: Aggregations
+type: enhancement
+issues: []

docs/changelog/96821.yaml

@@ -0,0 +1,6 @@
+pr: 96821
+summary: Change rollup thread pool settings
+area: TSDB
+type: enhancement
+issues:
+ - 96758

docs/changelog/96824.yaml

@@ -0,0 +1,5 @@
+pr: 96824
+summary: Introduce a filtered collector manager
+area: Search
+type: enhancement
+issues: []

docs/changelog/96834.yaml

@@ -0,0 +1,5 @@
+pr: 96834
+summary: Introduce minimum score collector manager
+area: Search
+type: enhancement
+issues: []

docs/changelog/96843.yaml

@@ -0,0 +1,6 @@
+pr: 96843
+summary: Uses `ClusterSettings` instead of Node `Settings` in `HealthMetadataService`
+area: Health
+type: bug
+issues:
+ - 96219

docs/changelog/96863.yaml

@@ -0,0 +1,5 @@
+pr: 96863
+summary: Add brute force approach to `GeoHashGridTiler`
+area: Geo
+type: enhancement
+issues: []

docs/changelog/96878.yaml

@@ -0,0 +1,5 @@
+pr: 96878
+summary: Min score for time series
+area: TSDB
+type: bug
+issues: []

docs/changelog/96885.yaml

@@ -0,0 +1,5 @@
+pr: 96885
+summary: Add Search ALC filter index prefix to the enterprise search user
+area: Authorization
+type: enhancement
+issues: []

docs/changelog/96904.yaml

@@ -0,0 +1,18 @@
+pr: 96904
+summary: Switch TDigestState to use `HybridDigest` by default
+area: Aggregations
+type: breaking
+issues: []
+breaking:
+  title: Switch TDigestState to use `HybridDigest` by default
+  area: REST API
+  details: "The default implementation for TDigest in percentile calculations switches\
+    \ to a new internal implementation offering superior performance (2x-10x speedup),\
+    \ at a very small accuracy penalty for very large sample populations."
+  impact: "This change leads to generating slightly different results in percentile\
+    \ calculations. If the highest possible accuracy is desired, or it's crucial to\
+    \ produce exactly the same results as in previous versions, one can either set\
+    \ `execution_hint` to `high_accuracy` in the `tdigest` spec of a given percentile\
+    \ calculation, or set `search.aggs.tdigest_execution_hint` to `high_accuracy`\
+    \ in cluster settings to apply to all percentile queries."
+  notable: true

docs/changelog/96924.yaml

@@ -0,0 +1,6 @@
+pr: 96924
+summary: Interpret microseconds cpu stats from cgroups2 properly as nanos
+area: Infra/Core
+type: bug
+issues:
+ - 96089

docs/changelog/96941.yaml

@@ -0,0 +1,6 @@
+pr: 96941
+summary: Trim field references in reroute processor
+area: Ingest Node
+type: bug
+issues:
+ - 96939

docs/changelog/96943.yaml

@@ -0,0 +1,5 @@
+pr: 96943
+summary: Add cluster setting to `SearchExecutionContext` to configure `TDigestExecutionHint`
+area: Aggregations
+type: enhancement
+issues: []

docs/changelog/96956.yaml

@@ -0,0 +1,6 @@
+pr: 96956
+summary: Error message for misconfigured TSDB index
+area: TSDB
+type: bug
+issues:
+ - 96445

docs/changelog/96958.yaml

@@ -0,0 +1,5 @@
+pr: 96958
+summary: "Ingest: expose reroute inquiry/reset via Elastic-internal API bridge"
+area: Ingest Node
+type: enhancement
+issues: []

docs/changelog/96970.yaml

@@ -0,0 +1,5 @@
+pr: 96970
+summary: Ensure checking application privileges work with nested-limited roles
+area: Authorization
+type: enhancement
+issues: []

docs/reference/aggregations/bucket/rare-terms-aggregation.asciidoc

@@ -79,7 +79,7 @@ A `rare_terms` aggregation looks like this in isolation:
 |`field` |The field we wish to find rare terms in |Required |
 |`max_doc_count` |The maximum number of documents a term should appear in. |Optional |`1`
 |`precision` |The precision of the internal CuckooFilters. Smaller precision leads to
-better approximation, but higher memory usage. Cannot be smaller than `0.00001` |Optional |`0.01`
+better approximation, but higher memory usage. Cannot be smaller than `0.00001` |Optional |`0.001`
 |`include` |Terms that should be included in the aggregation|Optional |
 |`exclude` |Terms that should be excluded from the aggregation|Optional |
 |`missing` |The value that should be used if a document does not have the field being aggregated|Optional |
@@ -352,4 +352,4 @@ that require `depth_first`. In particular, scoring sub-aggregations that are ins
 in `depth_first` mode. This will throw an exception since RareTerms is unable to process `depth_first`.
 
 As a concrete example, if `rare_terms` aggregation is the child of a `nested` aggregation, and one of the child aggregations of `rare_terms`
-needs document scores (like a `top_hits` aggregation), this will throw an exception.
+needs document scores (like a `top_hits` aggregation), this will throw an exception.

docs/reference/aggregations/metrics/boxplot-aggregation.asciidoc

@@ -55,9 +55,9 @@ The response will look like this:
     "load_time_boxplot": {
       "min": 0.0,
       "max": 990.0,
-      "q1": 165.0,
+      "q1": 167.5,
       "q2": 445.0,
-      "q3": 725.0,
+      "q3": 722.5,
       "lower": 0.0,
       "upper": 990.0
     }
@@ -114,9 +114,9 @@ GET latency/_search
     "load_time_boxplot": {
       "min": 0.0,
       "max": 99.0,
-      "q1": 16.5,
+      "q1": 16.75,
       "q2": 44.5,
-      "q3": 72.5,
+      "q3": 72.25,
       "lower": 0.0,
       "upper": 99.0
     }
@@ -166,6 +166,35 @@ GET latency/_search
 
 include::percentile-aggregation.asciidoc[tags=t-digest]
 
+==== Execution hint
+
+The default implementation of TDigest is optimized for performance, scaling to millions or even
+billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error
+for millions of samples in some cases). There's an option to use an implementation optimized
+for accuracy by setting parameter `execution_hint` to value `high_accuracy`:
+
+[source,console]
+--------------------------------------------------
+GET latency/_search
+{
+  "size": 0,
+  "aggs": {
+    "load_time_boxplot": {
+      "boxplot": {
+        "field": "load_time",
+        "execution_hint": "high_accuracy"    <1>
+      }
+    }
+  }
+}
+--------------------------------------------------
+// TEST[setup:latency]
+
+<1> Optimize TDigest for accuracy, at the expense of performance
+
+This option can lead to improved accuracy (relative error close to 0.01% for millions of samples in some
+cases) but then percentile queries take 2x-10x longer to complete.
+
 ==== Missing value
 
 The `missing` parameter defines how documents that are missing a value should be treated.