[gurevichdmitry]

Summary

generate-entity-maintainers-data (the relationships maintainer) writes entity.relationships.<type> as bare string arrays, for example owns: ['laptop-ab12']. Since elastic/kibana#262242 (merged 2026-04-13), Entity Store v2 maps every relationship except resolution as an object of { raw_identifiers, ids }, so Elasticsearch rejects these documents.

The command still exits 0, so the failure is easy to miss. On a 9.6.0-SNAPSHOT stack with --space default --quick it logged about 27,000 failed writes, on both the history indices (.entities.v2.history.security_default.*) and the latest index (.entities.v2.latest.default-00001):

document_parsing_exception: object mapping for [entity.relationships.owns] tried to parse field [null] as object, but found a concrete value
document_parsing_exception: failed to parse field [entity.relationships.supervises] of type [text] ...

The relationship code was written in #326 (2026-03-13), when Kibana's schema still used string arrays, and hasn't changed since.

Change

generateRelationshipsFields now emits { raw_identifiers: { user | host | service: { name: [...] } } }:

• Targets are classified by kind: synthetic hosts as host, synthetic services as service, other entity names as user. owns targets are devices, so they default to host.
• Nested rather than dotted keys, so the result deep-merges cleanly with the entity _source, which Elasticsearch returns in nested form (snapshot merges it into the history documents).
• The identifier kinds used (user.name, host.name, service.name) are all in Kibana's EntityRelationship.raw_identifiers schema.

ids is not populated: it holds target entity EUIDs, and this generator only has names.

Test plan

• tsc, eslint and prettier --check pass.
• Run generate-entity-maintainers-data --space default --quick against a 9.6 stack after org-data and confirm there are no document_parsing_exception errors and that entity.relationships.* is populated on entities and in the history snapshots.

Opened as a draft until the runtime check is done.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Validation of latest-index and history writes against a 9.6 stack remains pending.

No open issues 🎉

What changed in this PR

Updates entity maintainer relationship data to match Entity Store v2’s object schema, addressing Elasticsearch parsing failures.

Changes:

• Wraps relationship targets in nested raw_identifiers objects.
• Classifies targets as users, hosts, or services, with owned devices defaulting to hosts.

File	Description
src/​commands/​entity_store/​entity_maintainers.ts	Converts relationship arrays into typed identifier objects compatible with snapshot merging.

_{Review effort: Balanced}

[tiansivive]

non blocking, but we do have a 4th type called 'generic', although there's been discussion on moving away from it

[gurevichdmitry]

@tiansivive, thanks for the review. Checked with @uri-weisman , and it’s okay to omit generic.

[tiansivive]

LGTM