Elastic 9.1/8.19: BBQ by default, ES|QL with CCS GA, JOINS GA, Azure AI Foundry integration

Let’s dig into the new releases and the high-impact capabilities they bring across our portfolio, including these highlights:

• Better Binary Quantization, which is 5x faster than OpenSearch, is now on by default (for 9.1 only).

• Elastic Observability's Azure AI Foundry integration centralizes observability by pulling logs and metrics from any AI model hosted on Azure AI Foundry.

• Attack Discovery now supports automated scheduling and actions, persistent results, and easy sharing.

• LOOKUP join, which provides a powerful, performant alternative to the enrich command, and ES|QL on cross-cluster search (CCS), now with a re-engineered, resilient architecture, are both generally available. 

Read about these and additional highlights by solution below.

Elasticsearch helps developers build AI-powered search experiences on the industry's most used vector database with out-of-the-box semantic search and generative AI capabilities.

Highlights in 9.1/8.19:

• Better Binary Quantization (BBQ), which is 5x faster than OpenSearch, is now on by default (for 9.1 only). BBQ reduces memory footprint by over 95%, making it by far the most efficient quantization method.

• ACORN is a new algorithm for filtered vector search that integrates filtering directly into the HNSW graph traversal and provides the flexibility to define filtering fields after documents are ingested — delivering up to 5x faster filtered search and no compromise on accuracy, all out of the box (for 9.1 only).

• Token pruning for sparse vectors is now generally available and enabled by default — bringing faster, more efficient semantic search for ELSER users.

Find more details in the BBQ by default and ACORN blog and in the 9.1/8.19 release notes.

Elastic Observability prevents outages with search-based relevance, no-compromise data retention, improved operational efficiency and cost, and an open and future-proofed investment. 

Highlights in 9.1/8.19: 

• Elastic Observability's Azure AI Foundry integration, in technical preview, centralizes observability by pulling logs and metrics from any AI model hosted on Azure AI Foundry.

• Elastic’s managed OTLP endpoint makes it easy to send OpenTelemetry data, logs, metrics, and traces, without OTel Collectors or semantic conversions.

• Alerting enhancements for SREs provide smarter alert grouping, built-in investigation guides, and enriched recovery messages to speed up incident response and simplify SLO management. All these capabilities are GA.

Find more details in the Azure AI Foundry blog and in the 9.1/8.19 Observability release notes.

Elastic Security future-proofs SecOps with AI-driven security analytics, accelerating threat detection, investigation, and response.

Highlights in 9.1/8.19 (all generally available):

• Scheduled Attack Discovery and Actions automates threat scans on a schedule, each with custom filters, models, and actions to reduce repetitive work, improve threat coverage, and streamline investigations. 

• Attack Discovery Persistence and sharing gives a clear, accessible record of recent findings to support faster and more collaborative investigations.
• Detection and remediation of Rule Execution Gaps enables users to easily identify and fill the gaps in detection rule execution and allows for bulk actions to schedule filling multiple gaps and rules at once. 
• Natural Language Investigations with automatic validation enables the AI Assistant to generate, validate, and self-correct Elastic’s piped query language — ensuring it is accurate and will return relevant results.

Find more details in the 9.1/8.19 Security release notes.

The developer-centric, open source Search AI Platform is built for scale and speed. All users — regardless of use case — can benefit from core enhancements.

Highlights in 9.1/8.19 (all generally available): 

• ES|QL language is now fully production-ready with the general availability of two major features: LOOKUP join, a powerful and performant alternative to the enrich command that simplifies data architectures, and ES|QL on cross-cluster search (CCS), built on a re-engineered, resilient architecture that prioritizes partial results over total query failure.

• Kibana user experience improves with a unified traces view in Discover, collapsible sections in Dashboards for better organization, and enhanced query variable support for more dynamic interactions with Kibana dashboards.

• Failure Store is a new dedicated data stream that automatically captures and retains any documents that fail during ingestion — such as those with mapping errors — enabling users to analyze, correct, and re-ingest them rather than losing them silently.

• Global Fleet Management simplifies Agent management by now enabling consolidation of Agent upgrade management and policy configuration into a global agent control plane with a single UI while Agents continue to send their collected logs and metrics directly into local/regional data clusters.

Find more details in the ES|QL for 9.1/8.19 blog and in the 9.1/8.19 release notes.

Ready to get started? 

Elastic 9.1/8.19 is now available on Elastic Cloud — the hosted Elasticsearch service that includes all of the new features in this latest release. 

You can also see many of the 9.1/8.19 features in action in our What’s New webinar.