[Request] Add instructions for enabling logsdb by default

[marshallmain]

Description

In https://www.elastic.co/guide/en/security/current/detections-logsdb-index-mode-impact.html, we describe the impact of using logsdb with the Elastic Security and recommend that users do not enable logsdb at this time. In 9.0, logsdb will be enabled by default on clusters that have no logs indices yet. logsdb will still be disabled by default for clusters that already have logs-*-* indices. We need to document the process for enabling logsdb so customers can take advantage of the storage savings.

To opt in, users need to set cluster.logsdb.enabled: true in their cluster settings. The dev tools request to do this is

PUT _cluster/settings
{
   "persistent": {
       "cluster.logsdb.enabled": true
   }
}

Background & resources

• PRs: n/a
• Issues/metas:
  • https://github.com/elastic/kibana-team/issues/1358
• Point of contact: @marshallmain
• Test environments: n/a

Which documentation set does this change impact?

ESS only

ESS release

8.18 and 9.0

Serverless release

n/a

Feature differences

Opting out is only recommended for ESS

API docs impact

No API changes

Prerequisites, privileges, feature flags

Users must have the manage cluster privilege to update the cluster settings (https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-update-settings.html)

[nicpenning]

Curious to why forcing this as a default if it's not ready? This sounds like a recipe for disaster?

[tylerperk]

Hi @nicpenning appreciate your concern. We are still evaluating whether it makes sense to enable logsdb by default in 9.0 or if it might be too disruptive at this time.

[nicpenning]

Thank you!

If anything, at least automating the disablement for Security with notification would be a an interesting concept. You may need to consider people that may have this enabled already if they are using it some capacity. We are not yet, but have been excited to track its capabilities over time.

[marshallmain]

Updated issue description to reflect decision to only have logsdb enabled by default for clusters that don't have existing logs-*-* indices that would be affected. We instead need to document the steps customers should take prior to enabling logsdb and getting the storage savings.

[nastasha-solomon]

No longer needed.