What Changed
The Elastic Agent CCF Data Connector has been promoted from public preview to generally available with a patch release (v3.0.0 to v3.0.1).
Two substantive changes accompany the GA promotion:
1. Template variable substitution removed from graph queries
The connector definition previously used a graphQueriesTableName top-level field with placeholder references in each baseQuery. This has been replaced with the literal table name ElasticAgentLogsV2_CL inlined directly into all six baseQuery values. The CCF runtime does not perform template substitution in graphQueries blocks in the same way as other fields, so retaining the template syntax caused the connector UI data-volume graphs to fail silently, showing no ingestion activity even when data was flowing.
2. Preview flag cleared
availability.isPreview set to false. This is a Content Hub display change only, removing the preview badge from the connector tile.
Security Impact (Visibility and Fidelity)
Deployments running v3.0.0 would have seen blank data-volume graphs in the connector UI for all six monitored streams (ElasticAgentLogsV2_CL total, system.cpu, system.memory, system.network, system.filesystem, and logs). This is a UI fidelity gap: data ingestion itself was not blocked, but operators had no connector-side visibility into whether data was arriving. Upgrading to v3.0.1 restores accurate ingestion volume display across all streams.
No changes were made to DCR transform KQL, polling configuration, authentication, or the underlying ElasticAgentLogsV2_CL table schema.
Affected Files
Solutions/ElasticAgent/Data Connectors/ElasticAgent_CCF/ElasticAgent_ConnectorDefinition.json
Solutions/ElasticAgent/Package/testParameters.json
(packaging artefacts: 3.0.1.zip, ReleaseNotes.md, Solution_ElasticAgent.json, mainTemplate.json)