Blogs
Developer insights and practical how-to articles from our experts to inspire and empower your search experience.
Query rewrite rules in Elasticsearch: 2.3x faster wildcard scans
A second rule makes empty-string filters 1.6x faster. It reads string lengths straight from the offset array and never touches the compressed bytes. Both rules came from the same habit of running real queries and hunting for the special case.
Backfill time series data in Elasticsearch: Load months of historical metrics through the bulk API
Elasticsearch works out the time boundaries and creates the past backing indices as the documents land, so a historical data migration runs on your normal ingest path.
Introducing SPARKLINE in ES|QL: Spot trends at a glance
Spot trends across thousands of groups at a glance without leaving your workflow. ES|QL's new SPARKLINE function turns aggregations into trend lines. One array per row, zero effort.
No more allocation delays: Decoupling snapshots from shard relocation in stateless Elasticsearch
Clusters scale out under load without waiting for a snapshot to finish, because snapshots now read straight from the object store and no longer pin shards in place.
Avoiding and Correcting Hotspots: How Elasticsearch Serverless Balances Shards
Elasticsearch Serverless replaces the Elasticsearch node-weight based shard rebalancing algorithm with resource usage aware rebalancing that avoids index shard colocation, OOM events and write load hotspotting
Dashboard activity logs: Find out which Kibana dashboards get used
Kibana now logs who viewed, edited or deleted each dashboard, how long it took and what failed, so you can catch a broken dashboard before anyone reports it.
Migrating 1,100 files to Redux Toolkit v2 without freezing the Kibana monorepo
Kibana gave Redux Toolkit v2 the default package name and pushed v1 onto an explicit alias, which inverts the usual migration order. Webpack externals, yarn resolutions and an ESLint rule keep React Redux v7 and v9 out of each other's way.
Know your facts: How Elasticsearch AI Indices let agents skip the reading and keep the answer
A technical walkthrough of precomputing facts into an Elasticsearch AI Index, so agents answer from a single ES|QL query instead of reading whole documents, with fewer tokens and lower latency.
Taming PUNKs: How ES|QL queries Elasticsearch fields it was never told about
In Elasticsearch 9.5, ES|QL can query unmapped fields. It reads them from _source or returns nulls, so a query keeps working when a field drops out of the mapping and you avoid a reindex that takes hours.
Three SLOs every search team needs: monitoring search latency, availability and quality with OpenTelemetry
Your OpenTelemetry search spans already carry the signals for SLOs, burn rate alerts, anomaly detection and incident response, and this post shows how to build all four in Elastic Observability.
Let the big model think, let the small model work: Splitting LLM costs in Elastic Workflows
Build an Elastic workflow that sends a data sample to a large model to propose classification labels. A human signs off, then a smaller model applies them across the full corpus.
