ELSER / interface endpoint installation and management

[legrego]

This is a pre-requisite for the unified knowledge base.

Being able to use semantic search within a cluster has some prerequisites: it requires an inference endpoint deployed on the cluster, and deploying an inference endpoint requires having at least one ML node present on the cluster. Deploying an inference endpoint, even with ELSER, isn’t necessarily trivial in some scenarios (e.g air gap mode).

For internal usages of semantic search (such as retrieval from the knowledge bases), our solution teams are using our internal ELSER model. However, for this, they’re forced to set up the inference endpoint, and to manage its lifecycle.

[elasticmachine]

Pinging @elastic/appex-ai-infra (Team:AI Infra)

[pgayvallet]

From #188554:

Note there are also requirements to allow for the automated configuration of inferences, which would require credentials with the manage_inference cluster privilege. This is out of scope of the current discussion.

Apparently, today the kibana system user does not have the manage_inference cluster privilege. This is going to be blocker for us here.

Note that we don't strictly need to be able to manage any inference endpoint, but we will need the Kibana user to at least be able to create (and then manage) the ELSER-based inference endpoints we're planning to use for the KB indices.

[spong]

Apparently, today the kibana system user does not have the manage_inference cluster privilege. This is going to be blocker for us here.

Here's some prior art from when we tried to enable it a few months back:
elastic/elasticsearch#108262
elastic/elasticsearch#108386

Gist was we would let the search team drive the need and work with Kibana Security on enabling. I think with the requirements we have now we can drive the need now too 🙂

---

And tangentially, since I haven't seen this mentioned, I just wanted to note that some of the Search UI's like within Search Connectors already support some flows where they install ELSER via an Inference Endpoint. This has some interesting interactions with how the assistants currently deploy ELSER via the trainedModels API. I go over those details in this slack thread here, so just a heads up!

edit: Just ran into this again today setting up the Slack Connector semantic_text field after having already set up the Security Assistant. When saving the mappings you'll get this error + modal:

If you click Allow mapping without deployed model it'll update the mapping and deploy the ELSER Inference Endpoint anyway:

Which results in a second ELSER deployment showing up in the ML Trained Models UI:

[legrego]

FYI, we're re-attempting to add the manage_inference cluster privilege to the kibana_system user: elastic/elasticsearch#114051

[emma-raffenne]

We (observability AI assistant) have received requests about supporting other languages. Will this work provide support for E5 as well or is it ELSER only?

[pgayvallet]

elastic/elasticsearch#114051 allowed the Kibana user to manage any kind of inference endpoint, so installing an E5 endpoint can be done too.

Note that this issue may be superseded by the default elastic endpoint feature that ES is currently working on, and we might be able to leverage that feature without any additional work on our side.