CVE-2026-42400

@@ -464,8 +464,9 @@ The number of milliseconds to wait for additional data before restarting
 the <<server-socketTimeout, `server.socketTimeout`>> counter. *Default: `"120000"`*
 
 [[server-maxPayload]] `server.maxPayload`::
-The maximum payload size in bytes
-for incoming server requests. *Default: `1048576`*
+The maximum payload size in bytes for incoming server requests.
+This option controls the maximum payload size Kibana can handle, rather than the incoming request size, which also limits the inflated size when compression is used.
+*Default: `1048576`*
 
 `server.name`::
 A human-readable display name that

@@ -28,6 +28,7 @@ import { createServer } from '@kbn/server-http-tools';
 import { HttpConfig } from './http_config';
 import { HttpServer } from './http_server';
 import { Readable } from 'stream';
+import { gzipSync } from 'zlib';
 import { KBN_CERT_PATH, KBN_KEY_PATH } from '@kbn/dev-utils';
 import moment from 'moment';
 import { of, Observable, BehaviorSubject } from 'rxjs';
@@ -1153,6 +1154,44 @@ describe('body options', () => {
     });
   });
 
+  test('should reject a gzip-bomb that inflates beyond `maxBytes`', async () => {
+    const { registerRouter, server: innerServer } = await server.setup({ config$ });
+
+    const router = new Router('', logger, enhanceWithContext, routerOptions);
+    router.post(
+      {
+        path: '/',
+        validate: { body: schema.object({ test: schema.string() }) },
+        options: { body: { maxBytes: 64 } },
+        security: {
+          authz: {
+            requiredPrivileges: ['foo'],
+          },
+        },
+      },
+      (context, req, res) => res.ok({ body: req.route })
+    );
+    registerRouter(router);
+
+    await server.start();
+    await supertest(innerServer.listener)
+      .post('/')
+      .set('Content-Encoding', 'gzip')
+      .set('Content-Type', 'application/json')
+      .send(
+        gzipSync(
+          JSON.stringify({
+            test: '0'.repeat(1024),
+          })
+        )
+      )
+      .expect(413, {
+        statusCode: 413,
+        error: 'Request Entity Too Large',
+        message: 'Payload content length greater than maximum allowed: 64',
+      });
+  });
+
   test('should not parse the content in the request', async () => {
     const { registerRouter, server: innerServer } = await server.setup({ config$ });
 

@@ -798,6 +798,12 @@ export class HttpServer {
               parse,
               timeout: timeout?.payload,
               multipart: true,
+              compression: maxBytes
+                ? {
+                    gzip: { maxOutputLength: maxBytes },
+                    deflate: { maxOutputLength: maxBytes },
+                  }
+                : undefined,
             }
           : undefined,
         timeout: {

@@ -107,4 +107,16 @@ describe('getServerOptions', () => {
 
     expect(getServerOptions(httpConfig).routes!.payload!.timeout).toEqual(9007);
   });
+
+  it('configures max payload size', () => {
+    const options = getServerOptions(
+      createConfig({
+        maxPayload: ByteSizeValue.parse('1kb'),
+      })
+    );
+
+    expect(options).toHaveProperty('routes.compression.deflate.maxOutputLength', 1024);
+    expect(options).toHaveProperty('routes.compression.gzip.maxOutputLength', 1024);
+    expect(options).toHaveProperty('routes.payload.maxBytes', 1024);
+  });
 });

@@ -25,6 +25,7 @@ export function getServerOptions(config: IHttpConfig, { configureTLS = true } =
         headers: corsAllowedHeaders,
       }
     : false;
+  const maxPayload = config.maxPayload.getValueInBytes();
 
   const options: ServerOptions = {
     host: config.host,
@@ -39,9 +40,13 @@ export function getServerOptions(config: IHttpConfig, { configureTLS = true } =
         privacy: 'private',
         otherwise: 'private, no-cache, no-store, must-revalidate',
       },
+      compression: {
+        deflate: { maxOutputLength: maxPayload },
+        gzip: { maxOutputLength: maxPayload },
+      },
       cors,
       payload: {
-        maxBytes: config.maxPayload.getValueInBytes(),
+        maxBytes: maxPayload,
         timeout: config.payloadTimeout,
       },
       validate: {

@@ -25,7 +25,7 @@ export const registerScrollForCountRoute = (router: IRouter) => {
       },
       validate: {
         body: schema.object({
-          typesToInclude: schema.arrayOf(schema.string()),
+          typesToInclude: schema.arrayOf(schema.string({ maxLength: 1000 })),
           searchString: schema.maybe(schema.string()),
           references: schema.maybe(
             schema.arrayOf(

@@ -129,11 +129,12 @@ export function defineRoutes({ logger, router }: { logger: Logger; router: IRout
                   schema.object({
                     type: schema.string(),
                     metadata: schema.maybe(schema.string()),
-                    values: schema.maybe(schema.arrayOf(schema.string())),
-                  })
+                    values: schema.maybe(schema.arrayOf(schema.string(), { maxSize: 100 })),
+                  }),
+                  { maxSize: 100 }
                 ),
                 actions: schema.object({
-                  ids: schema.maybe(schema.arrayOf(schema.string())),
+                  ids: schema.maybe(schema.arrayOf(schema.string(), { maxSize: 10000 })),
                   docs: schema.maybe(
                     schema.arrayOf(
                       schema.object({
@@ -143,7 +144,8 @@ export function defineRoutes({ logger, router }: { logger: Logger; router: IRout
                     )
                   ),
                 }),
-              })
+              }),
+              { maxSize: 100 }
             ),
           })
         ),

@@ -86700,6 +86700,8 @@ paths:
                 ids:
                   items:
                     type: string
+                  maxItems: 1000
+                  minItems: 1
                   nullable: true
                   type: array
         description: The IDs of the Timelines to export.

@@ -85238,6 +85238,8 @@ paths:
                 ids:
                   items:
                     type: string
+                  maxItems: 1000
+                  minItems: 1
                   nullable: true
                   type: array
         description: The IDs of the Timelines to export.

@@ -27,6 +27,6 @@ export type ExportTimelinesRequestQueryInput = z.input<typeof ExportTimelinesReq
 
 export type ExportTimelinesRequestBody = z.infer<typeof ExportTimelinesRequestBody>;
 export const ExportTimelinesRequestBody = z.object({
-  ids: z.array(z.string()).nullable().optional(),
+  ids: z.array(z.string()).min(1).max(1000).nullable().optional(),
 });
 export type ExportTimelinesRequestBodyInput = z.input<typeof ExportTimelinesRequestBody>;

@@ -33,6 +33,8 @@ paths:
                 ids:
                   nullable: true
                   type: array
+                  minItems: 1
+                  maxItems: 1000
                   items:
                     type: string
       responses:

@@ -552,6 +552,8 @@ paths:
                 ids:
                   items:
                     type: string
+                  maxItems: 1000
+                  minItems: 1
                   nullable: true
                   type: array
         description: The IDs of the Timelines to export.

@@ -552,6 +552,8 @@ paths:
                 ids:
                   items:
                     type: string
+                  maxItems: 1000
+                  minItems: 1
                   nullable: true
                   type: array
         description: The IDs of the Timelines to export.

@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { FrameworkRequest } from '../../../../framework';
+import type { TimelineResponse } from '../../../../../../common/api/timeline';
+import { getExportTimelineByObjectIds } from './helpers';
+import { getSelectedTimelines } from '../../../saved_object/timelines';
+import * as noteLib from '../../../saved_object/notes';
+import * as pinnedEventLib from '../../../saved_object/pinned_events';
+
+jest.mock('../../../saved_object/timelines', () => ({
+  getSelectedTimelines: jest.fn(),
+}));
+
+jest.mock('../../../saved_object/notes', () => ({
+  getNotesByTimelineId: jest.fn(),
+}));
+
+jest.mock('../../../saved_object/pinned_events', () => ({
+  getAllPinnedEventsByTimelineId: jest.fn(),
+}));
+
+describe('export timelines helpers', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('enriches notes and pinned events in bounded batches', async () => {
+    const timelines = Array.from({ length: 11 }, (_, index) => ({
+      savedObjectId: `timeline-${index}`,
+      status: 'active',
+    })) as unknown as TimelineResponse[];
+
+    (getSelectedTimelines as jest.Mock).mockResolvedValue({
+      timelines,
+      errors: [],
+    });
+
+    const pendingNotes: Array<() => void> = [];
+    const pendingPinnedEvents: Array<() => void> = [];
+    (noteLib.getNotesByTimelineId as jest.Mock).mockImplementation((_, timelineId: string) => {
+      return new Promise((resolve) => {
+        pendingNotes.push(() => resolve([{ timelineId }]));
+      });
+    });
+    (pinnedEventLib.getAllPinnedEventsByTimelineId as jest.Mock).mockImplementation(
+      (_, timelineId: string) => {
+        return new Promise((resolve) => {
+          pendingPinnedEvents.push(() => resolve([{ timelineId, eventId: `event-${timelineId}` }]));
+        });
+      }
+    );
+
+    const exportPromise = getExportTimelineByObjectIds({
+      frameworkRequest: {} as FrameworkRequest,
+      ids: timelines.map((timeline) => timeline.savedObjectId),
+    });
+
+    await Promise.resolve();
+
+    expect(noteLib.getNotesByTimelineId).toHaveBeenCalledTimes(10);
+    expect(pinnedEventLib.getAllPinnedEventsByTimelineId).toHaveBeenCalledTimes(10);
+
+    pendingNotes.splice(0, 10).forEach((resolveNote) => resolveNote());
+    pendingPinnedEvents.splice(0, 10).forEach((resolvePinnedEvent) => resolvePinnedEvent());
+    await new Promise(process.nextTick);
+
+    expect(noteLib.getNotesByTimelineId).toHaveBeenCalledTimes(11);
+    expect(pinnedEventLib.getAllPinnedEventsByTimelineId).toHaveBeenCalledTimes(11);
+
+    pendingNotes.forEach((resolveNote) => resolveNote());
+    pendingPinnedEvents.forEach((resolvePinnedEvent) => resolvePinnedEvent());
+
+    await expect(exportPromise).resolves.toContain('timeline-0');
+  });
+});

@@ -22,6 +22,8 @@ import * as pinnedEventLib from '../../../saved_object/pinned_events';
 
 import { getSelectedTimelines } from '../../../saved_object/timelines';
 
+const EXPORT_TIMELINE_ENRICHMENT_BATCH_SIZE = 10;
+
 const getGlobalEventNotesByTimelineId = (currentNotes: Note[]): ExportedNotes => {
   const initialNotes: ExportedNotes = {
     eventNotes: [],
@@ -42,34 +44,50 @@ const getPinnedEventsIdsByTimelineId = (currentPinnedEvents: PinnedEvent[]): str
   return currentPinnedEvents.map((event) => event.eventId) ?? [];
 };
 
+const getTimelineNotesAndPinnedEvents = async (
+  request: FrameworkRequest,
+  exportedIds: string[]
+): Promise<{ notes: Note[]; pinnedEvents: PinnedEvent[] }> => {
+  const notes: Note[] = [];
+  const pinnedEvents: PinnedEvent[] = [];
+
+  for (let index = 0; index < exportedIds.length; index += EXPORT_TIMELINE_ENRICHMENT_BATCH_SIZE) {
+    const timelineIdsBatch = exportedIds.slice(
+      index,
+      index + EXPORT_TIMELINE_ENRICHMENT_BATCH_SIZE
+    );
+    const [batchNotes, batchPinnedEvents] = await Promise.all([
+      Promise.all(
+        timelineIdsBatch.map((timelineId) => noteLib.getNotesByTimelineId(request, timelineId))
+      ),
+      Promise.all(
+        timelineIdsBatch.map((timelineId) =>
+          pinnedEventLib.getAllPinnedEventsByTimelineId(request, timelineId)
+        )
+      ),
+    ]);
+    notes.push(...batchNotes.flat());
+    pinnedEvents.push(...batchPinnedEvents.flat());
+  }
+
+  return { notes, pinnedEvents };
+};
+
 const getTimelinesFromObjects = async (
   request: FrameworkRequest,
   ids?: string[] | null
 ): Promise<Array<TimelineResponse | ExportTimelineNotFoundError>> => {
   const { timelines, errors } = await getSelectedTimelines(request, ids);
   const exportedIds = timelines.map((t) => t.savedObjectId);
+  const timelinesById = new Map(timelines.map((timeline) => [timeline.savedObjectId, timeline]));
 
-  const [notes, pinnedEvents] = await Promise.all([
-    Promise.all(exportedIds.map((timelineId) => noteLib.getNotesByTimelineId(request, timelineId))),
-    Promise.all(
-      exportedIds.map((timelineId) =>
-        pinnedEventLib.getAllPinnedEventsByTimelineId(request, timelineId)
-      )
-    ),
-  ]);
-
-  const myNotes = notes.reduce<Note[]>((acc, note) => [...acc, ...note], []);
-
-  const myPinnedEventIds = pinnedEvents.reduce<PinnedEvent[]>(
-    (acc, pinnedEventId) => [...acc, ...pinnedEventId],
-    []
-  );
+  const { notes, pinnedEvents } = await getTimelineNotesAndPinnedEvents(request, exportedIds);
 
   const myResponse = exportedIds.reduce<TimelineResponse[]>((acc, timelineId) => {
-    const myTimeline = timelines.find((t) => t.savedObjectId === timelineId);
+    const myTimeline = timelinesById.get(timelineId);
     if (myTimeline != null) {
-      const timelineNotes = myNotes.filter((n) => n.timelineId === timelineId);
-      const timelinePinnedEventIds = myPinnedEventIds.filter((p) => p.timelineId === timelineId);
+      const timelineNotes = notes.filter((n) => n.timelineId === timelineId);
+      const timelinePinnedEventIds = pinnedEvents.filter((p) => p.timelineId === timelineId);
       const exportedTimeline = omit(['status', 'excludedRowRendererIds'], myTimeline);
       return [
         ...acc,

@@ -52,6 +52,12 @@ describe('export timelines', () => {
   let clients: MockClients;
   let context: SecuritySolutionRequestHandlerContextMock;
 
+  const registerRoute = (overrides?: Partial<ReturnType<typeof createMockConfig>>) => {
+    const routeConfig = { ...createMockConfig(), ...overrides };
+    exportTimelinesRoute(server.router, routeConfig);
+    return routeConfig;
+  };
+
   beforeEach(() => {
     server = serverMock.create();
     ({ clients, context } = requestContextMock.createTools());
@@ -62,7 +68,6 @@ describe('export timelines', () => {
     (convertSavedObjectToSavedPinnedEvent as unknown as jest.Mock).mockReturnValue(
       mockPinnedEvents()
     );
-    exportTimelinesRoute(server.router, createMockConfig());
   });
 
   afterEach(() => {
@@ -72,6 +77,7 @@ describe('export timelines', () => {
 
   describe('status codes', () => {
     test('returns 200 when finding selected timelines', async () => {
+      registerRoute();
       const response = await server.inject(
         getExportTimelinesRequest(),
         requestContextMock.convertContext(context)
@@ -80,6 +86,7 @@ describe('export timelines', () => {
     });
 
     test('catch error when status search throws error', async () => {
+      registerRoute();
       clients.savedObjectsClient.bulkGet.mockReset();
       clients.savedObjectsClient.bulkGet.mockRejectedValue(new Error('Test error'));
       const response = await server.inject(
@@ -92,10 +99,56 @@ describe('export timelines', () => {
         status_code: 500,
       });
     });
+
+    test('returns 400 when requested ids exceed export size limit', async () => {
+      const config = registerRoute({ maxTimelineImportExportSize: 1 });
+      const response = await server.inject(
+        requestMock.create({
+          method: 'post',
+          path: TIMELINE_EXPORT_URL,
+          query: {
+            file_name: 'mock_export_timeline.ndjson',
+          },
+          body: {
+            ids: ['id-1', 'id-2'],
+          },
+        }),
+        requestContextMock.convertContext(context)
+      );
+
+      expect(response.status).toEqual(400);
+      expect(response.body).toEqual({
+        message: `Can't export more than ${config.maxTimelineImportExportSize} timelines`,
+        status_code: 400,
+      });
+    });
+
+    test('deduplicates ids before applying export size limit', async () => {
+      registerRoute({ maxTimelineImportExportSize: 1 });
+      const response = await server.inject(
+        requestMock.create({
+          method: 'post',
+          path: TIMELINE_EXPORT_URL,
+          query: {
+            file_name: 'mock_export_timeline.ndjson',
+          },
+          body: {
+            ids: ['f0e58720-57b6-11ea-b88d-3f1a31716be8', 'f0e58720-57b6-11ea-b88d-3f1a31716be8'],
+          },
+        }),
+        requestContextMock.convertContext(context)
+      );
+
+      expect(response.status).toEqual(200);
+      expect(clients.savedObjectsClient.bulkGet).toHaveBeenCalledWith([
+        { id: 'f0e58720-57b6-11ea-b88d-3f1a31716be8', type: 'siem-ui-timeline' },
+      ]);
+    });
   });
 
   describe('request validation', () => {
     test('return validation error for request body', async () => {
+      registerRoute();
       const request = requestMock.create({
         method: 'get',
         path: TIMELINE_EXPORT_URL,
@@ -107,6 +160,7 @@ describe('export timelines', () => {
     });
 
     test('return validation error for request params', async () => {
+      registerRoute();
       const request = requestMock.create({
         method: 'get',
         path: TIMELINE_EXPORT_URL,

@@ -49,8 +49,10 @@ export const exportTimelinesRoute = (router: SecuritySolutionPluginRouter, confi
           const frameworkRequest = await buildFrameworkRequest(context, request);
 
           const exportSizeLimit = config.maxTimelineImportExportSize;
+          const normalizedIds =
+            request.body?.ids != null ? [...new Set(request.body.ids)] : request.body?.ids;
 
-          if (request.body?.ids != null && request.body.ids.length > exportSizeLimit) {
+          if (normalizedIds != null && normalizedIds.length > exportSizeLimit) {
             return siemResponse.error({
               statusCode: 400,
               body: `Can't export more than ${exportSizeLimit} timelines`,
@@ -59,7 +61,7 @@ export const exportTimelinesRoute = (router: SecuritySolutionPluginRouter, confi
 
           const responseBody = await getExportTimelineByObjectIds({
             frameworkRequest,
-            ids: request.body?.ids,
+            ids: normalizedIds,
           });
 
           return response.ok({

@@ -7,6 +7,8 @@
 
 import expect from '@kbn/expect';
 import type { CreateTimelinesResponse } from '@kbn/security-solution-plugin/common/api/timeline';
+import { TIMELINE_EXPORT_URL } from '@kbn/security-solution-plugin/common/constants';
+import type TestAgent from 'supertest/lib/agent';
 import type { FtrProviderContextWithSpaces } from '../../../../ftr_provider_context_with_spaces';
 import {
   getTimelines,
@@ -35,6 +37,15 @@ export default function ({ getService }: FtrProviderContextWithSpaces) {
   const isServerless = config.get('serverless');
   const isEss = !isServerless;
 
+  const MAX_TIMELINE_EXPORT_IDS = 1000;
+
+  const exportTimeline = async (supertest: TestAgent, ids: string[]) =>
+    supertest
+      .post(`${TIMELINE_EXPORT_URL}?file_name=timelines_export.ndjson`)
+      .set('kbn-xsrf', 'true')
+      .set('elastic-api-version', '2023-10-31')
+      .send({ ids });
+
   describe('Timeline privileges', () => {
     before(async () => {
       if (isEss) {
@@ -104,6 +115,55 @@ export default function ({ getService }: FtrProviderContextWithSpaces) {
       });
     });
 
+    describe('export timelines', () => {
+      let getTimelineId = () => '';
+
+      before(async () => {
+        const superTest = await utils.createSuperTestWithUser(users.secTimelineAllUser);
+        const {
+          body: { savedObjectId },
+        } = await createBasicTimeline(superTest, 'timeline for export');
+        getTimelineId = () => savedObjectId;
+      });
+
+      canWriteOrReadUsers.forEach((user) => {
+        it(`user "${user.username}" can export timelines`, async () => {
+          const superTest = await utils.createSuperTestWithUser(user);
+          const exportTimelineResponse = await exportTimeline(superTest, [getTimelineId()]);
+          expect(exportTimelineResponse.status).to.be(200);
+        });
+      });
+
+      cannotAccessUsers.forEach((user) => {
+        it(`user "${user.username}" cannot export timelines`, async () => {
+          const superTest = await utils.createSuperTestWithUser(user);
+          const exportTimelineResponse = await exportTimeline(superTest, [getTimelineId()]);
+          expect(exportTimelineResponse.status).to.be(403);
+        });
+      });
+
+      it('rejects export requests above the max ids limit for timeline read users', async () => {
+        const superTest = await utils.createSuperTestWithUser(users.secTimelineReadUser);
+        const oversizedIds = Array.from(
+          { length: MAX_TIMELINE_EXPORT_IDS + 1 },
+          (_, index) => `non-existent-timeline-${index}`
+        );
+        const exportTimelineResponse = await exportTimeline(superTest, oversizedIds);
+        expect(exportTimelineResponse.status).to.be(400);
+      });
+
+      it('accepts duplicate timeline ids for timeline read users', async () => {
+        const superTest = await utils.createSuperTestWithUser(users.secTimelineReadUser);
+        const timelineId = getTimelineId();
+        const exportTimelineResponse = await exportTimeline(superTest, [
+          timelineId,
+          timelineId,
+          timelineId,
+        ]);
+        expect(exportTimelineResponse.status).to.be(200);
+      });
+    });
+
     describe('create and delete timelines', () => {
       canWriteUsers.forEach((user) => {
         it(`user "${user.username}" can create and delete timelines`, async () => {

@@ -16,17 +16,18 @@ import { acceptedHttpVerb, nonEmptyString } from '../proxy/validation_config';
 
 const routeValidationConfig = {
   query: schema.object({
-    language: schema.string(),
-    esHost: schema.string(),
-    kibanaHost: schema.string(),
+    language: schema.string({ maxLength: 100 }),
+    esHost: schema.string({ maxLength: 1000 }),
+    kibanaHost: schema.string({ maxLength: 1000 }),
   }),
   body: schema.maybe(
     schema.arrayOf(
       schema.object({
         method: acceptedHttpVerb,
         url: nonEmptyString,
-        data: schema.arrayOf(schema.string()),
-      })
+        data: schema.arrayOf(schema.string({ maxLength: 10000 }), { maxSize: 1000 }),
+      }),
+      { maxSize: 100 }
     )
   ),
 };

@@ -21,9 +21,9 @@ export const registerCreateRoute = ({
 }: RouteDependencies) => {
   const bodySchema = schema.object({
     id: schema.string({ maxLength: 1000 }),
-    remoteCluster: schema.string(),
-    leaderIndexPatterns: schema.arrayOf(schema.string()),
-    followIndexPattern: schema.string(),
+    remoteCluster: schema.string({ maxLength: 1000 }),
+    leaderIndexPatterns: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
+    followIndexPattern: schema.string({ maxLength: 1000 }),
   });
 
   router.post(

@@ -20,13 +20,13 @@ export const registerUpdateRoute = ({
   lib: { handleEsError },
 }: RouteDependencies) => {
   const paramsSchema = schema.object({
-    id: schema.string(),
+    id: schema.string({ maxLength: 1000 }),
   });
 
   const bodySchema = schema.object({
     active: schema.boolean(),
     remoteCluster: schema.string(),
-    leaderIndexPatterns: schema.arrayOf(schema.string()),
+    leaderIndexPatterns: schema.arrayOf(schema.string(), { maxSize: 1000 }),
     followIndexPattern: schema.string(),
   });
 

@@ -22,18 +22,18 @@ export const registerCreateRoute = ({
 }: RouteDependencies) => {
   const bodySchema = schema.object({
     name: schema.string({ maxLength: 1000 }),
-    remoteCluster: schema.string(),
-    leaderIndex: schema.string(),
+    remoteCluster: schema.string({ maxLength: 1000 }),
+    leaderIndex: schema.string({ maxLength: 1000 }),
     maxReadRequestOperationCount: schema.maybe(schema.number()),
     maxOutstandingReadRequests: schema.maybe(schema.number()),
-    maxReadRequestSize: schema.maybe(schema.string()), // byte value
+    maxReadRequestSize: schema.maybe(schema.string({ maxLength: 1000 })),
     maxWriteRequestOperationCount: schema.maybe(schema.number()),
-    maxWriteRequestSize: schema.maybe(schema.string()), // byte value
+    maxWriteRequestSize: schema.maybe(schema.string({ maxLength: 1000 })),
     maxOutstandingWriteRequests: schema.maybe(schema.number()),
     maxWriteBufferCount: schema.maybe(schema.number()),
-    maxWriteBufferSize: schema.maybe(schema.string()), // byte value
-    maxRetryDelay: schema.maybe(schema.string()), // time value
-    readPollTimeout: schema.maybe(schema.string()), // time value
+    maxWriteBufferSize: schema.maybe(schema.string({ maxLength: 1000 })),
+    maxRetryDelay: schema.maybe(schema.string({ maxLength: 1000 })),
+    readPollTimeout: schema.maybe(schema.string({ maxLength: 1000 })),
   });
 
   router.post(

@@ -21,7 +21,8 @@ export const DataStreamsResponseSchema = {
       schema.object({
         name: schema.string(),
         storageSizeBytes: schema.number(),
-      })
+      }),
+      { maxSize: 1000 }
     ),
 };
 

@@ -72,6 +72,7 @@ export const UsageMetricsRequestSchema = schema.object({
   to: DateSchema,
   metricTypes: schema.arrayOf(schema.string(), {
     minSize: 1,
+    maxSize: 1000,
     validate: (values) => {
       const trimmedValues = values.map((v) => v.trim());
       if (trimmedValues.some((v) => !v.length)) {
@@ -82,6 +83,7 @@ export const UsageMetricsRequestSchema = schema.object({
     },
   }),
   dataStreams: schema.arrayOf(schema.string(), {
+    maxSize: 1000,
     validate: (values) => {
       if (values.map((v) => v.trim()).some((v) => !v.length)) {
         return 'list cannot contain empty values';
@@ -104,9 +106,11 @@ export const UsageMetricsResponseSchema = {
             schema.object({
               x: schema.number(),
               y: schema.number(),
-            })
+            }),
+            { maxSize: 1000 }
           ),
-        })
+        }),
+        { maxSize: 1000 }
       )
     ),
 };

@@ -38,6 +38,7 @@ export const configSchema = schema.object({
    */
   enableExperimental: schema.arrayOf(schema.string(), {
     defaultValue: () => [],
+    maxSize: 1000,
   }),
 });
 

@@ -23,7 +23,7 @@ const schemaLatest = schema.object(
       enabled: schema.boolean({ defaultValue: true }),
     }),
     // Cloud requires the ability to hide internal node attributes from users.
-    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [], maxSize: 1000 }),
     /**
      * Disables the plugin.
      * Added back in 8.8.
@@ -57,7 +57,7 @@ const schema7x = schema.object(
       enabled: schema.boolean({ defaultValue: true }),
     }),
     // Cloud requires the ability to hide internal node attributes from users.
-    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [], maxSize: 1000 }),
   },
   { defaultValue: undefined }
 );

@@ -24,7 +24,7 @@ async function removeLifecycle(client: ElasticsearchClient, indexNames: string[]
 }
 
 const bodySchema = schema.object({
-  indexNames: schema.arrayOf(schema.string()),
+  indexNames: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerRemoveRoute({

@@ -25,7 +25,7 @@ async function retryLifecycle(client: ElasticsearchClient, indexNames: string[])
 }
 
 const bodySchema = schema.object({
-  indexNames: schema.arrayOf(schema.string()),
+  indexNames: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerRetryRoute({ router, license, lib: { handleEsError } }: RouteDependencies) {

@@ -20,11 +20,11 @@ const bodyValidation = schema.object({
   name: schema.string({ maxLength: 1000 }),
   skipUnavailable: schema.boolean(),
   mode: schema.oneOf([schema.literal(PROXY_MODE), schema.literal(SNIFF_MODE)]),
-  seeds: schema.nullable(schema.arrayOf(schema.string())),
+  seeds: schema.nullable(schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 })),
   nodeConnections: schema.nullable(schema.number()),
-  proxyAddress: schema.nullable(schema.string()),
+  proxyAddress: schema.nullable(schema.string({ maxLength: 1000 })),
   proxySocketConnections: schema.nullable(schema.number()),
-  serverName: schema.nullable(schema.string()),
+  serverName: schema.nullable(schema.string({ maxLength: 1000 })),
 });
 
 type RouteBody = TypeOf<typeof bodyValidation>;

@@ -18,7 +18,7 @@ import { licensePreRoutingFactory } from '../../lib/license_pre_routing_factory'
 const bodyValidation = schema.object({
   skipUnavailable: schema.boolean(),
   mode: schema.oneOf([schema.literal(PROXY_MODE), schema.literal(SNIFF_MODE)]),
-  seeds: schema.nullable(schema.arrayOf(schema.string())),
+  seeds: schema.nullable(schema.arrayOf(schema.string(), { maxSize: 1000 })),
   nodeConnections: schema.nullable(schema.number()),
   proxyAddress: schema.nullable(schema.string()),
   proxySocketConnections: schema.nullable(schema.number()),

@@ -25,7 +25,7 @@ export const registerDeleteRoute = ({
       },
       validate: {
         body: schema.object({
-          jobIds: schema.arrayOf(schema.string()),
+          jobIds: schema.arrayOf(schema.string(), { maxSize: 1000 }),
         }),
       },
     },

@@ -25,7 +25,7 @@ export const registerStartRoute = ({
       },
       validate: {
         body: schema.object({
-          jobIds: schema.arrayOf(schema.string()),
+          jobIds: schema.arrayOf(schema.string(), { maxSize: 1000 }),
         }),
         query: schema.maybe(
           schema.object({

@@ -25,7 +25,7 @@ export const registerStopRoute = ({
       },
       validate: {
         body: schema.object({
-          jobIds: schema.arrayOf(schema.string()),
+          jobIds: schema.arrayOf(schema.string(), { maxSize: 1000 }),
         }),
         query: schema.object({
           waitForCompletion: schema.maybe(schema.string()),

@@ -26,9 +26,10 @@ export const registerSearchRoute = ({
       validate: {
         body: schema.arrayOf(
           schema.object({
-            index: schema.string(),
+            index: schema.string({ maxLength: 1000 }),
             query: schema.any(),
-          })
+          }),
+          { maxSize: 1000 }
         ),
       },
     },

@@ -98,8 +98,8 @@ export function registerRestoreRoutes({
 
   // Restore snapshot
   const restoreParamsSchema = schema.object({
-    repository: schema.string(),
-    snapshot: schema.string(),
+    repository: schema.string({ maxLength: 1000 }),
+    snapshot: schema.string({ maxLength: 1000 }),
   });
 
   router.post(

@@ -240,7 +240,8 @@ export function registerSnapshotsRoutes({
     schema.object({
       repository: schema.string(),
       snapshot: schema.string(),
-    })
+    }),
+    { maxSize: 1000 }
   );
 
   // DELETE one or multiple snapshots

@@ -8,21 +8,30 @@
 import { schema } from '@kbn/config-schema';
 
 export const nameParameterSchema = schema.object({
-  name: schema.string(),
+  name: schema.string({ maxLength: 1000 }),
 });
 
 const snapshotConfigSchema = schema.object({
-  indices: schema.maybe(schema.oneOf([schema.string(), schema.arrayOf(schema.string())])),
+  indices: schema.maybe(
+    schema.oneOf([
+      schema.string({ maxLength: 1000 }),
+      schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
+    ])
+  ),
   ignoreUnavailable: schema.maybe(schema.boolean()),
   includeGlobalState: schema.maybe(schema.boolean()),
-  featureStates: schema.maybe(schema.arrayOf(schema.string())),
+  featureStates: schema.maybe(
+    schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 })
+  ),
   partial: schema.maybe(schema.boolean()),
-  metadata: schema.maybe(schema.recordOf(schema.string(), schema.string())),
+  metadata: schema.maybe(
+    schema.recordOf(schema.string({ maxLength: 1000 }), schema.string({ maxLength: 1000 }))
+  ),
 });
 
 const snapshotRetentionSchema = schema.object({
   expireAfterValue: schema.maybe(schema.oneOf([schema.number(), schema.literal('')])),
-  expireAfterUnit: schema.maybe(schema.string()),
+  expireAfterUnit: schema.maybe(schema.string({ maxLength: 1000 })),
   maxCount: schema.maybe(schema.oneOf([schema.number(), schema.literal('')])),
   minCount: schema.maybe(schema.oneOf([schema.number(), schema.literal('')])),
 });
@@ -55,36 +64,45 @@ export const snapshotListSchema = schema.object({
 export const policySchema = schema.object({
   name: schema.string({ maxLength: 1000 }),
   snapshotName: schema.string({ maxLength: 1000 }),
-  schedule: schema.string(),
-  repository: schema.string(),
+  schedule: schema.string({ maxLength: 1000 }),
+  repository: schema.string({ maxLength: 1000 }),
   config: schema.maybe(snapshotConfigSchema),
   retention: schema.maybe(snapshotRetentionSchema),
   isManagedPolicy: schema.boolean(),
 });
 
 // Only validate required settings, everything else is optional
-const fsRepositorySettings = schema.object({ location: schema.string() }, { unknowns: 'allow' });
+const fsRepositorySettings = schema.object(
+  { location: schema.string({ maxLength: 1000 }) },
+  { unknowns: 'allow' }
+);
 
 const readOnlyRepositorySettings = schema.object({
-  url: schema.string(),
+  url: schema.string({ maxLength: 1000 }),
 });
 
 // Only validate required settings, everything else is optional
-const s3RepositorySettings = schema.object({ bucket: schema.string() }, { unknowns: 'allow' });
+const s3RepositorySettings = schema.object(
+  { bucket: schema.string({ maxLength: 1000 }) },
+  { unknowns: 'allow' }
+);
 
 // Only validate required settings, everything else is optional
 const hdsRepositorySettings = schema.object(
   {
-    uri: schema.string(),
-    path: schema.string(),
+    uri: schema.string({ maxLength: 1000 }),
+    path: schema.string({ maxLength: 1000 }),
   },
   { unknowns: 'allow' }
 );
 
 const azureRepositorySettings = schema.object({}, { unknowns: 'allow' });
 
 // Only validate required settings, everything else is optional
-const gcsRepositorySettings = schema.object({ bucket: schema.string() }, { unknowns: 'allow' });
+const gcsRepositorySettings = schema.object(
+  { bucket: schema.string({ maxLength: 1000 }) },
+  { unknowns: 'allow' }
+);
 
 const sourceRepositorySettings = schema.oneOf([
   fsRepositorySettings,
@@ -95,15 +113,15 @@ const sourceRepositorySettings = schema.oneOf([
   gcsRepositorySettings,
   schema.object(
     {
-      delegateType: schema.string(),
+      delegateType: schema.string({ maxLength: 1000 }),
     },
     { unknowns: 'allow' }
   ),
 ]);
 
 export const repositorySchema = schema.object({
   name: schema.string({ maxLength: 1000 }),
-  type: schema.string(),
+  type: schema.string({ maxLength: 1000 }),
   settings: schema.oneOf([
     fsRepositorySettings,
     readOnlyRepositorySettings,
@@ -116,14 +134,23 @@ export const repositorySchema = schema.object({
 });
 
 export const restoreSettingsSchema = schema.object({
-  indices: schema.maybe(schema.oneOf([schema.string(), schema.arrayOf(schema.string())])),
-  renamePattern: schema.maybe(schema.string()),
-  renameReplacement: schema.maybe(schema.string()),
+  indices: schema.maybe(
+    schema.oneOf([
+      schema.string({ maxLength: 1000 }),
+      schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
+    ])
+  ),
+  renamePattern: schema.maybe(schema.string({ maxLength: 1000 })),
+  renameReplacement: schema.maybe(schema.string({ maxLength: 1000 })),
   includeGlobalState: schema.maybe(schema.boolean()),
-  featureStates: schema.maybe(schema.arrayOf(schema.string())),
+  featureStates: schema.maybe(
+    schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 })
+  ),
   partial: schema.maybe(schema.boolean()),
-  indexSettings: schema.maybe(schema.string()),
-  ignoreIndexSettings: schema.maybe(schema.arrayOf(schema.string())),
+  indexSettings: schema.maybe(schema.string({ maxLength: 1000 })),
+  ignoreIndexSettings: schema.maybe(
+    schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 })
+  ),
   ignoreUnavailable: schema.maybe(schema.boolean()),
   includeAliases: schema.maybe(schema.boolean()),
 });

@@ -13,8 +13,9 @@ import { TRANSFORM_STATE } from '../../../common/constants';
 
 export const transformIdsSchema = schema.arrayOf(
   schema.object({
-    id: schema.string(),
-  })
+    id: schema.string({ maxLength: 1000 }),
+  }),
+  { maxSize: 1000 }
 );
 
 export type TransformIdsSchema = TypeOf<typeof transformIdsSchema>;
@@ -38,7 +39,7 @@ export const dataViewTitleSchema = schema.object({
 export type DataViewTitleSchema = TypeOf<typeof dataViewTitleSchema>;
 
 export const transformIdParamSchema = schema.object({
-  transformId: schema.string(),
+  transformId: schema.string({ maxLength: 1000 }),
 });
 
 export type TransformIdParamSchema = TypeOf<typeof transformIdParamSchema>;

@@ -20,7 +20,8 @@ export const deleteTransformsRequestSchema = schema.object({
     schema.object({
       id: schema.string(),
       state: transformStateSchema,
-    })
+    }),
+    { maxSize: 1000 }
   ),
   deleteDestIndex: schema.maybe(schema.boolean()),
   deleteDestDataView: schema.maybe(schema.boolean()),

@@ -15,7 +15,7 @@ export const fieldHistogramsRequestSchema = schema.object({
   /** Query to match documents in the index. */
   query: schema.any(),
   /** The fields to return histogram data. */
-  fields: schema.arrayOf(schema.any()),
+  fields: schema.arrayOf(schema.any(), { maxSize: 1000 }),
   /** Optional runtime fields */
   runtimeMappings: runtimeMappingsSchema,
   /** Number of documents to be collected in the sample processed on each shard, or -1 for no sampling. */

@@ -19,7 +19,8 @@ export const resetTransformsRequestSchema = schema.object({
     schema.object({
       id: schema.string(),
       state: transformStateSchema,
-    })
+    }),
+    { maxSize: 1000 }
   ),
 });
 

@@ -15,7 +15,8 @@ export const stopTransformsRequestSchema = schema.arrayOf(
   schema.object({
     id: schema.string(),
     state: transformStateSchema,
-  })
+  }),
+  { maxSize: 1000 }
 );
 
 export type StopTransformsRequestSchema = TypeOf<typeof stopTransformsRequestSchema>;

@@ -26,7 +26,8 @@ export const getTransformsRequestSchema = schema.arrayOf(
   schema.object({
     id: schema.string(),
     state: transformStateSchema,
-  })
+  }),
+  { maxSize: 1000 }
 );
 
 export type GetTransformsRequestSchema = TypeOf<typeof getTransformsRequestSchema>;
@@ -39,8 +40,8 @@ export interface GetTransformsResponseSchema {
 
 // schemas shared by parts of the preview, create and update endpoint
 export const destSchema = schema.object({
-  index: schema.string(),
-  pipeline: schema.maybe(schema.string()),
+  index: schema.string({ maxLength: 1000 }),
+  pipeline: schema.maybe(schema.string({ maxLength: 1000 })),
 });
 
 export const pivotSchema = schema.object({
@@ -50,8 +51,8 @@ export const pivotSchema = schema.object({
 });
 
 export const latestFunctionSchema = schema.object({
-  unique_key: schema.arrayOf(schema.string()),
-  sort: schema.string(),
+  unique_key: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
+  sort: schema.string({ maxLength: 1000 }),
 });
 
 export type PivotConfig = TypeOf<typeof pivotSchema>;
@@ -60,8 +61,8 @@ export type LatestFunctionConfig = TypeOf<typeof latestFunctionSchema>;
 
 export const retentionPolicySchema = schema.object({
   time: schema.object({
-    field: schema.string(),
-    max_age: schema.string(),
+    field: schema.string({ maxLength: 1000 }),
+    max_age: schema.string({ maxLength: 1000 }),
   }),
 });
 
@@ -78,14 +79,17 @@ export const settingsSchema = schema.object({
 
 export const sourceSchema = schema.object({
   runtime_mappings: runtimeMappingsSchema,
-  index: schema.oneOf([schema.string(), schema.arrayOf(schema.string())]),
-  query: schema.maybe(schema.recordOf(schema.string(), schema.any())),
+  index: schema.oneOf([
+    schema.string({ maxLength: 1000 }),
+    schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
+  ]),
+  query: schema.maybe(schema.recordOf(schema.string({ maxLength: 1000 }), schema.any())),
 });
 
 export const syncSchema = schema.object({
   time: schema.object({
-    delay: schema.maybe(schema.string()),
-    field: schema.string(),
+    delay: schema.maybe(schema.string({ maxLength: 1000 })),
+    field: schema.string({ maxLength: 1000 }),
   }),
 });
 
@@ -110,9 +114,9 @@ export const _metaSchema = schema.object(
 // PUT transforms/{transformId}
 export const putTransformsRequestSchema = schema.object(
   {
-    description: schema.maybe(schema.string()),
+    description: schema.maybe(schema.string({ maxLength: 1000 })),
     dest: destSchema,
-    frequency: schema.maybe(schema.string()),
+    frequency: schema.maybe(schema.string({ maxLength: 1000 })),
     /**
      * Pivot and latest are mutually exclusive, i.e. exactly one must be specified in the transform configuration
      */

@@ -25,7 +25,7 @@ export function registerClusterSettingsRoute({
       },
       validate: {
         body: schema.object({
-          settings: schema.arrayOf(schema.string()),
+          settings: schema.arrayOf(schema.string(), { maxSize: 1000 }),
         }),
       },
     },

@@ -245,7 +245,7 @@ export function registerMigrateDataStreamRoutes({
       },
       validate: {
         body: schema.object({
-          indices: schema.arrayOf(schema.string()),
+          indices: schema.arrayOf(schema.string(), { maxSize: 1000 }),
         }),
         params: schema.object({
           dataStreamName: schema.string(),

@@ -25,7 +25,7 @@ export function registerUpdateSettingsRoute({ router }: RouteDependencies) {
           indexName: schema.string(),
         }),
         body: schema.object({
-          settings: schema.arrayOf(schema.string()),
+          settings: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
         }),
       },
     },

@@ -34,11 +34,12 @@ export function registerUpdateIndexRoute({
       },
       validate: {
         params: schema.object({
-          index: schema.string(),
+          index: schema.string({ maxLength: 1000 }),
         }),
         body: schema.object({
           operations: schema.arrayOf(
-            schema.oneOf([schema.literal('blockWrite'), schema.literal('unfreeze')])
+            schema.oneOf([schema.literal('blockWrite'), schema.literal('unfreeze')]),
+            { maxSize: 1000 }
           ),
         }),
       },

@@ -12,7 +12,7 @@ import { Fields } from '../../models/fields';
 import { RouteDependencies } from '../../types';
 
 const bodySchema = schema.object({
-  indexes: schema.arrayOf(schema.string()),
+  indexes: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 function fetchFields(dataClient: IScopedClusterClient, indexes: string[]) {

@@ -11,7 +11,7 @@ import { IScopedClusterClient } from '@kbn/core/server';
 import { RouteDependencies } from '../../../types';
 
 const bodySchema = schema.object({
-  watchIds: schema.arrayOf(schema.string()),
+  watchIds: schema.arrayOf(schema.string(), { maxSize: 1000 }),
 });
 
 type DeleteWatchPromiseArray = Promise<{

@@ -12,12 +12,12 @@ import { serializeJsonWatch, serializeThresholdWatch } from '../../../../common/
 import { RouteDependencies } from '../../../types';
 
 const paramsSchema = schema.object({
-  id: schema.string(),
+  id: schema.string({ maxLength: 1000 }),
 });
 
 const bodySchema = schema.object(
   {
-    type: schema.string(),
+    type: schema.string({ maxLength: 1000 }),
     isNew: schema.boolean(),
     isActive: schema.boolean(),
   },

@@ -16,7 +16,7 @@ export const componentTemplateSchema = schema.object({
     lifecycle: schema.maybe(
       schema.object({
         enabled: schema.boolean(),
-        data_retention: schema.maybe(schema.string()),
+        data_retention: schema.maybe(schema.string({ maxLength: 1000 })),
       })
     ),
     // Allowing unknowns here to support data stream options that are not yet defined in the schema
@@ -25,7 +25,7 @@ export const componentTemplateSchema = schema.object({
   version: schema.maybe(schema.number()),
   _meta: schema.maybe(schema.object({}, { unknowns: 'allow' })),
   _kbnMeta: schema.object({
-    usedBy: schema.arrayOf(schema.string()),
+    usedBy: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
     isManaged: schema.boolean(),
   }),
   deprecated: schema.maybe(schema.boolean()),

@@ -11,7 +11,7 @@ import { RouteDependencies } from '../../../types';
 import { addBasePath } from '..';
 
 const bodySchema = schema.object({
-  dataStreams: schema.arrayOf(schema.string()),
+  dataStreams: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerDeleteRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -21,8 +21,8 @@ export const getEsWarningText = (warning: string): string | null => {
 
 export function registerPutDataRetention({ router, lib: { handleEsError } }: RouteDependencies) {
   const bodySchema = schema.object({
-    dataStreams: schema.arrayOf(schema.string()),
-    dataRetention: schema.maybe(schema.string()),
+    dataStreams: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
+    dataRetention: schema.maybe(schema.string({ maxLength: 1000 })),
     enabled: schema.maybe(schema.boolean()),
   });
 
@@ -83,7 +83,7 @@ export function registerPutDataStreamFailureStore({
   lib: { handleEsError },
 }: RouteDependencies) {
   const bodySchema = schema.object({
-    dataStreams: schema.arrayOf(schema.string()),
+    dataStreams: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
     dsFailureStore: schema.boolean(),
   });
 

@@ -12,7 +12,7 @@ import { addBasePath } from '..';
 import { executeAsyncByChunks } from './helpers';
 
 const bodySchema = schema.object({
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerClearCacheRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -12,7 +12,7 @@ import { addBasePath } from '..';
 import { executeAsyncByChunks } from './helpers';
 
 const bodySchema = schema.object({
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerCloseRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -12,8 +12,8 @@ import { RouteDependencies } from '../../../types';
 import { addInternalBasePath } from '..';
 
 const bodySchema = schema.object({
-  indexName: schema.string(),
-  indexMode: schema.string(),
+  indexName: schema.string({ maxLength: 1000 }),
+  indexMode: schema.string({ maxLength: 1000 }),
 });
 
 export function registerCreateRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -12,7 +12,7 @@ import { addBasePath } from '..';
 import { executeAsyncByChunks } from './helpers';
 
 const bodySchema = schema.object({
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerDeleteRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -12,7 +12,7 @@ import { addBasePath } from '..';
 import { executeAsyncByChunks } from './helpers';
 
 const bodySchema = schema.object({
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerFlushRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -12,7 +12,7 @@ import { addBasePath } from '..';
 import { executeAsyncByChunks } from './helpers';
 
 const bodySchema = schema.object({
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
   maxNumSegments: schema.maybe(schema.number()),
 });
 

@@ -12,7 +12,7 @@ import { addBasePath } from '..';
 import { executeAsyncByChunks } from './helpers';
 
 const bodySchema = schema.object({
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerOpenRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -12,7 +12,7 @@ import { addBasePath } from '..';
 import { executeAsyncByChunks } from './helpers';
 
 const bodySchema = schema.object({
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
 });
 
 export function registerRefreshRoute({ router, lib: { handleEsError } }: RouteDependencies) {

@@ -15,7 +15,7 @@ import { addBasePath } from '..';
 
 const bodySchema = schema.maybe(
   schema.object({
-    indexNames: schema.maybe(schema.arrayOf(schema.string())),
+    indexNames: schema.maybe(schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 })),
   })
 );
 

@@ -18,7 +18,8 @@ const bodySchema = schema.object({
       name: schema.string(),
       isLegacy: schema.maybe(schema.boolean()),
       type: schema.maybe(schema.string()),
-    })
+    }),
+    { maxSize: 1000 }
   ),
 });
 

@@ -9,13 +9,13 @@ import { schema } from '@kbn/config-schema';
 
 export const templateSchema = schema.object({
   name: schema.string({ maxLength: 1000 }),
-  indexPatterns: schema.arrayOf(schema.string()),
+  indexPatterns: schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 }),
   version: schema.maybe(schema.number()),
   order: schema.maybe(schema.number()),
   priority: schema.maybe(schema.number()),
-  indexMode: schema.maybe(schema.string()),
+  indexMode: schema.maybe(schema.string({ maxLength: 1000 })),
   // Not present for legacy templates
-  allowAutoCreate: schema.maybe(schema.string()),
+  allowAutoCreate: schema.maybe(schema.string({ maxLength: 1000 })),
   template: schema.maybe(
     schema.object({
       settings: schema.maybe(schema.object({}, { unknowns: 'allow' })),
@@ -24,15 +24,17 @@ export const templateSchema = schema.object({
       lifecycle: schema.maybe(
         schema.object({
           enabled: schema.boolean(),
-          data_retention: schema.maybe(schema.string()),
+          data_retention: schema.maybe(schema.string({ maxLength: 1000 })),
         })
       ),
       // Allowing unknowns here to support data stream options that are not yet defined in the schema
       data_stream_options: schema.maybe(schema.object({}, { unknowns: 'allow' })),
     })
   ),
-  composedOf: schema.maybe(schema.arrayOf(schema.string())),
-  ignoreMissingComponentTemplates: schema.maybe(schema.arrayOf(schema.string())),
+  composedOf: schema.maybe(schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 })),
+  ignoreMissingComponentTemplates: schema.maybe(
+    schema.arrayOf(schema.string({ maxLength: 1000 }), { maxSize: 1000 })
+  ),
   dataStream: schema.maybe(
     schema.object(
       {
@@ -44,12 +46,12 @@ export const templateSchema = schema.object({
   _meta: schema.maybe(schema.object({}, { unknowns: 'allow' })),
   ilmPolicy: schema.maybe(
     schema.object({
-      name: schema.maybe(schema.string()),
-      rollover_alias: schema.maybe(schema.string()),
+      name: schema.maybe(schema.string({ maxLength: 1000 })),
+      rollover_alias: schema.maybe(schema.string({ maxLength: 1000 })),
     })
   ),
   _kbnMeta: schema.object({
-    type: schema.string(),
+    type: schema.string({ maxLength: 1000 }),
     hasDatastream: schema.maybe(schema.boolean()),
     isLegacy: schema.maybe(schema.boolean()),
   }),

@@ -8,9 +8,11 @@
 import { schema } from '@kbn/config-schema';
 
 export const pipelineSchema = {
-  description: schema.maybe(schema.string()),
-  processors: schema.arrayOf(schema.recordOf(schema.string(), schema.any())),
+  description: schema.maybe(schema.string({ maxLength: 1000 })),
+  processors: schema.arrayOf(schema.recordOf(schema.string(), schema.any()), { maxSize: 1000 }),
   version: schema.maybe(schema.number()),
-  on_failure: schema.maybe(schema.arrayOf(schema.recordOf(schema.string(), schema.any()))),
+  on_failure: schema.maybe(
+    schema.arrayOf(schema.recordOf(schema.string(), schema.any()), { maxSize: 1000 })
+  ),
   _meta: schema.maybe(schema.object({}, { unknowns: 'allow' })),
 };

@@ -13,7 +13,7 @@ import { pipelineSchema } from './shared';
 
 const bodySchema = schema.object({
   pipeline: schema.object(pipelineSchema),
-  documents: schema.arrayOf(schema.recordOf(schema.string(), schema.any())),
+  documents: schema.arrayOf(schema.recordOf(schema.string(), schema.any()), { maxSize: 1000 }),
   verbose: schema.maybe(schema.boolean()),
 });
 

@@ -70384,12 +70384,12 @@ paths:
                       pattern: '[smdh]$'
                       type: string
                     maxLogsPerPage:
-                      default: 40000
+                      default: 50000
                       maximum: 9007199254740991
                       minimum: 1
                       type: integer
                     maxLogsPerWindow:
-                      default: 500000
+                      default: 100000
                       maximum: 9007199254740991
                       minimum: 0
                       type: integer

@@ -74377,12 +74377,12 @@ paths:
                       pattern: '[smdh]$'
                       type: string
                     maxLogsPerPage:
-                      default: 40000
+                      default: 50000
                       maximum: 9007199254740991
                       minimum: 1
                       type: integer
                     maxLogsPerWindow:
-                      default: 500000
+                      default: 100000
                       maximum: 9007199254740991
                       minimum: 0
                       type: integer

@@ -112,6 +112,7 @@ function createMockGlobalStateClient(
     lookbackPeriod: string;
     delay: string;
     maxTimeWindowSize: string;
+    maxLogsPerWindow: number;
     excludedIndexPatterns: string[];
     additionalIndexPatterns: string[];
   }>
@@ -125,6 +126,9 @@ function createMockGlobalStateClient(
     // Default to a very large cap so existing tests run as a single sub-window. The dedicated
     // sub-window cap describe block overrides this to exercise capping behavior.
     maxTimeWindowSize: logExtractionOverrides?.maxTimeWindowSize ?? '999d',
+    // Default to 0 (disabled) so volume-cap logic doesn't interfere with unrelated tests.
+    // The dedicated volume-cap describe block overrides this via setupVolCapTest.
+    maxLogsPerWindow: logExtractionOverrides?.maxLogsPerWindow ?? 0,
   });
   const state = { logsExtraction } as EntityStoreGlobalState;
   return {
@@ -975,9 +979,6 @@ describe('LogsExtractionClient', () => {
             ['2025-01-15T11:00:01.000Z', 'hash2', '2025-01-15T11:00:01.000Z', 'entity2'],
           ],
         };
-        // effectiveMaxLogsPerPage = min(40000, maxLogsPerWindow=1) = 1.
-        // Probe LIMIT 1 → total_logs = 1 → sliceLogCount = 1.
-        // totalLogs = 1 >= maxLogsPerWindow=1 → cap fires.
         setupVolCapTest({ maxLogsPerWindow: 1, maxLogsPerWindowCapBehavior: 'defer' });
         mockExtractSuccessSequence(mainExtractionResponse, 1);
         mockIngestEntities.mockResolvedValue(undefined);
@@ -1014,9 +1015,6 @@ describe('LogsExtractionClient', () => {
             ['2025-01-15T11:00:01.000Z', 'hash2', '2025-01-15T11:00:01.000Z', 'entity2'],
           ],
         };
-        // effectiveMaxLogsPerPage = min(40000, maxLogsPerWindow=1) = 1.
-        // Probe LIMIT 1 → total_logs = 1 → sliceLogCount = 1.
-        // totalLogs = 1 >= maxLogsPerWindow=1 → cap fires.
         setupVolCapTest({ maxLogsPerWindow: 1, maxLogsPerWindowCapBehavior: 'drop' });
         mockExtractSuccessSequence(mainExtractionResponse, 1);
         mockIngestEntities.mockResolvedValue(undefined);
@@ -1108,7 +1106,6 @@ describe('LogsExtractionClient', () => {
         expect(result.success).toBe(true);
         if (!result.success) return;
         expect(result.logsCapApplied).toBe(true);
-        // effectiveMaxLogsPerPage = min(40000, maxLogsPerWindow=1) = 1 → sliceLogCount = 1
         expect(result.logsProcessed).toBe(1);
         // defer: lastSearchTimestamp is where the loop stopped, NOT the window end
         expect(result.lastSearchTimestamp).toBe(lastPageTimestamp);
@@ -1142,7 +1139,6 @@ describe('LogsExtractionClient', () => {
         expect(result.success).toBe(true);
         if (!result.success) return;
         expect(result.logsCapApplied).toBe(true);
-        // effectiveMaxLogsPerPage = min(40000, maxLogsPerWindow=1) = 1 → sliceLogCount = 1
         expect(result.logsProcessed).toBe(1);
         // drop: lastSearchTimestamp is advanced to the window end
         expect(result.lastSearchTimestamp).toBe(toDateISO);

@@ -15,11 +15,11 @@ export const LOG_EXTRACTION_FREQUENCY_DEFAULT = '1m';
 // Max amount of entities to extract in one ESQL query
 export const LOG_EXTRACTION_DOCS_LIMIT_DEFAULT = 10000;
 // Max raw log documents per logs to be processed in a query (inside elastic search)
-export const LOG_EXTRACTION_MAX_LOGS_PER_PAGE_DEFAULT = 40000;
+export const LOG_EXTRACTION_MAX_LOGS_PER_PAGE_DEFAULT = 50_000;
 export const LOG_EXTRACTION_TIMEOUT_DEFAULT = '59s';
 export const LOG_EXTRACTION_MAX_TIME_WINDOW_SIZE_DEFAULT = '15m';
 // Max total raw log documents to process per task run; 0 = no cap
-export const LOG_EXTRACTION_MAX_LOGS_PER_WINDOW_DEFAULT = 500_000;
+export const LOG_EXTRACTION_MAX_LOGS_PER_WINDOW_DEFAULT = 100_000;
 export const LOG_EXTRACTION_CAP_BEHAVIOR_DEFAULT = 'drop' as const;
 
 export type LogExtractionConfig = z.infer<typeof LogExtractionConfig>;

@@ -1,5 +1,5 @@
 {
-  "sha1": "50b5dfba62ac64690de376d8bc22cd52d75b4e93",
+  "sha1": "d17dc6f8487721a630d816876f7496bd8d02b0cc",
   "tests": [
     {
       "id": "709f30ae5fb788f-05a1663c9e84f0e",
@@ -221,7 +221,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 71,
+        "line": 74,
         "column": 7
       }
     },
@@ -235,7 +235,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 77,
+        "line": 80,
         "column": 7
       }
     },
@@ -249,7 +249,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 100,
+        "line": 103,
         "column": 7
       }
     },
@@ -263,7 +263,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 108,
+        "line": 111,
         "column": 7
       }
     },
@@ -277,7 +277,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 112,
+        "line": 115,
         "column": 7
       }
     },
@@ -291,7 +291,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 118,
+        "line": 121,
         "column": 7
       }
     },
@@ -305,7 +305,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 137,
+        "line": 141,
         "column": 7
       }
     },
@@ -319,7 +319,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 144,
+        "line": 148,
         "column": 7
       }
     },
@@ -333,7 +333,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 152,
+        "line": 156,
         "column": 7
       }
     },
@@ -347,7 +347,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 161,
+        "line": 165,
         "column": 7
       }
     },
@@ -361,7 +361,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 177,
+        "line": 181,
         "column": 7
       }
     },
@@ -375,7 +375,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 192,
+        "line": 196,
         "column": 7
       }
     },
@@ -389,7 +389,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 202,
+        "line": 206,
         "column": 7
       }
     },
@@ -403,7 +403,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 218,
+        "line": 222,
         "column": 7
       }
     },
@@ -417,7 +417,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 226,
+        "line": 233,
         "column": 7
       }
     },
@@ -431,7 +431,7 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 233,
+        "line": 240,
         "column": 7
       }
     },
@@ -445,7 +445,119 @@
       ],
       "location": {
         "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/discovery.spec.ts",
-        "line": 243,
+        "line": 250,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-79d3cf13237ee2d",
+      "title": "Discover ES|QL should switch the query bar to ES|QL and display the default sample query",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 155,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-75f10f82cef9fbf",
+      "title": "Discover ES|QL should display a metric visualization for ES|QL STATS queries (count and sum)",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 174,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-1081a7397d42c88",
+      "title": "Discover ES|QL should open the inline edit visualization flyout for an ES|QL chart",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 189,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-4b67968e425b300",
+      "title": "Discover ES|QL should save an ES|QL visualization to a new dashboard from Discover",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 210,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-dc0e7a2eb6e2df6",
+      "title": "Discover ES|QL should edit, explore in Discover, and copy an ES|QL panel from a dashboard",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 230,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-f21c2c6ffe20444",
+      "title": "Discover ES|QL should restrict sidebar fields and grid columns to KEEP-listed fields",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 284,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-8bbbfff9121d488",
+      "title": "Discover ES|QL should embed a saved ES|QL Discover session on a dashboard and interact with its table",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 305,
+        "column": 7
+      }
+    },
+    {
+      "id": "7b807c730155cc2-ab47176f22b71bd",
+      "title": "Discover ES|QL should save an ES|QL bar histogram to a dashboard and edit it inline",
+      "expectedStatus": "passed",
+      "tags": [
+        "@local-stateful-classic",
+        "@cloud-stateful-classic"
+      ],
+      "location": {
+        "file": "x-pack/platform/packages/private/kbn-scout-release-testing/test/scout/ui/tests/discover/esql.spec.ts",
+        "line": 347,
         "column": 7
       }
     },

@@ -549,19 +549,31 @@ export const createTestTracks: Command<void> = {
             : [...new Set(loads.map((load) => load.config.server.configSet))];
 
         // Each server config set gets its own track
-        return configSets.map((configSet) => {
+        return configSets.flatMap((configSet): TestTrack[] => {
           log.info(
             `Building test track for test target '${target.tag}' with server config set '${configSet}'`
           );
+
+          const enabledLoads = loads.filter(
+            (load) => load.enabled && load.config.server.configSet === configSet
+          );
+
+          if (enabledLoads.length === 0) {
+            log.warning(
+              `No enabled test loads found for test target '${target.tag}' and server config set '${configSet}'`
+            );
+            return [];
+          }
+
           const track = buildTrack(
             Math.max(minimumRuntime, runtimeTarget),
             estimatedLaneSetupDuration,
             target,
-            loads.filter((load) => load.enabled && load.config.server.configSet === configSet),
+            enabledLoads,
             log
           );
           track.metadata.server = { configSet };
-          return track;
+          return [track];
         });
       })
       .toArray();

@@ -19,6 +19,16 @@ describe('TestTrack', () => {
     expect(track.leastLoadedOpenLane).toBe(undefined);
   });
 
+  it('should produce valid stats for an empty track specification', () => {
+    const track = new TestTrack({ runtimeTarget: 10 });
+    const spec = track.specification;
+
+    expect(spec.stats.lane.count).toBe(0);
+    expect(spec.stats.lane.saturationPercent).toBe(0);
+    expect(spec.stats.combinedRuntime.target).toBe(0);
+    expect(spec.lanes).toEqual([]);
+  });
+
   it('closes the lane when one load fills it entirely', () => {
     const track = new TestTrack({ runtimeTarget: 10 });
 

@@ -236,7 +236,10 @@ export class TestTrack {
       stats: {
         lane: {
           count: this.laneCount,
-          saturationPercent: parseFloat(((expectedRuntime / provisionedRuntime) * 100).toFixed(2)),
+          saturationPercent:
+            provisionedRuntime !== 0
+              ? parseFloat(((expectedRuntime / provisionedRuntime) * 100).toFixed(2))
+              : 0,
           longestEstimate: longestLaneEstimate,
           shortestEstimate: shortestLaneEstimate,
         },