Features and enhancements

Alerting and cases

• Add a public API to create, update, and delete case templates (POST, PUT, and DELETE /api/cases/templates), including a dry-run mode that validates a template without saving it #280144.
• Improve the Cases view, cases list, and field library by keeping the case details panel in view as you scroll, saving status and other fields immediately when changed, and adding drag-and-drop field reordering to the field library #282197.
• Add an Agent Builder tool to attach saved dashboards, maps, Discover sessions, and Lens visualizations to a case #279680.

Dashboards and Visualizations

• Restore Defer loading panels below "the fold" (labs:dashboard:deferBelowFold) so off-screen dashboard panels wait to fetch data until they scroll into view. The setting is off by default #284004.

Elastic Observability solution

For the Elastic Observability 9.5.2 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.5.2 release information, refer to Elastic Security Solution Release Notes.

Elasticsearch solution

• Add a toggle to the Manage region preferences modal so you can remove a custom region policy and revert to allowing all regions #282769.

Workflows

• Add step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.
• Enable running a workflow with only the execute privilege, without also requiring the read privilege on the workflow definition #284822.

Fixes

Elastic Agent Builder

• Fix missing screen reader announcements when toggling the Show active only filter on the agent tools page #282276.
• Fix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when you configure cross-cluster search index patterns but the cluster doesn't have the remote cluster client role #281609.
• Fix chat completion streams continuing after you cancel a request, and cap their duration at 10 minutes #285119.
• Fix Agent Builder requests to Google Vertex AI inference endpoints failing when tool schemas include JSON Schema fields that Vertex doesn't accept #284810.
• Fix Agent Builder conversations failing when a prompt contains special tokens such as <|endoftext|>, or when Claude models receive empty text blocks #283177.
• Restore legacy root-level inputs in Agent Builder workflow tool schemas so existing workflow tools keep working #285149.
• Fix concurrent conversations silently dropping a round when two clients replied at the same time. Case attachment requests that now conflict return HTTP 409 instead of appearing to succeed #281887.
• Fix agent custom instructions failing to save because the full edit payload was sent, which broke access control entries #277176.
• Fix visualizations generated from a specified index silently returning an empty chart when the query read from a different source. Agent Builder now retries once and then reports an error #282212.
• Fix the custom answer text field losing focus after you select its radio button when an agent asks a clarifying question #283326.

Alerting and cases

• Fix Cases free-text search failing when a case's extended fields produced too many runtime-field values #284475.
• Fix case Activity recording a row for every unchanged template or global field default when you create a case #284310.
• Fix assigning users to a case creating duplicate activity entries #284035.
• Fix field library toggle filters missing from More filters on the All cases page #283645.
• Fix duplicate required-on-close validation errors when a template references a global field that is also required on close #283922.
• Fix a template $ref field silently dropping its local display and validation overrides #283072.
• Prevent changing a field definition's name or type after creation, which previously orphaned stored case values #282770.
• Resolve case field-definition references without regard to capitalization so renaming a field's casing no longer hides it from templates #282450.
• Fix global case field defaults not being applied to cases created through the API or workflow steps, and prevent the field-migration backfill from overwriting values you've already set or cleared #283185.
• Fix the case details Associated Users and Associated Hosts counts omitting directly attached user and host entities #283036.
• Fix the Alerting V2 update API rejecting a valid change of a signal rule's query format to composed #283754.

Dashboards and Visualizations

• Fix Lens metric trendline breakdown ordering to rank by the trendline's own metric instead of falling back to alphabetical order #283159.
• Fix histogram granularity to preserve the saved bar count instead of resetting to Auto above 7 bars. The effective ceiling remains the histogram:maxBars advanced setting #283058.
• Fix duration format to preserve decimal and compact settings on round-trip, except when using the automatic (auto-approximate) duration format #282815.
• Fix the dashboards list endpoint not sorting by last updated date in descending order when no search query is set #282363.

Data ingestion and Fleet

• Fix deleting a package policy from an agent policy with many agents blocking on a full synchronous redeploy instead of deploying asynchronously #282580.
• Fix Fleet bulk upgrades installing the bundled package version instead of the latest registry version #282829.
• Fix Fleet lookups that treated version-specific policy IDs as base policy IDs, which could return HTTP 404 for Fleet Server policy revisions and miss agents #283071.
• Fix the managed integration enrollment flyout failing to detect enrolled agents assigned to version-specific policies #283434.
• Fix expired Fleet enrollment tokens still showing as Active, and add an Expired status to the enrollment tokens list #284280.
• Fix disabling namespace index templates for a package policy with a custom ILM policy failing with an ILM update error #284818.

Developer tools

• Fix Dev Tools Console showing autocomplete suggestions inside non-query triple-quoted strings #282424.

Discover

• Fix formatted numbers showing a sign when the rounded value is zero #282919.
• Fix the percent field formatter rendering NaN when fractional is false #282915.
• Fix server-side date formatting, including CSV exports, keeping the previous timezone or date pattern after you change those settings #282501.

Elastic Observability solution

For the Elastic Observability 9.5.2 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.5.2 release information, refer to Elastic Security Solution Release Notes.

Kibana platform

• Prevent leaving the role management page without a confirmation when there are unsaved changes #283525.

Machine learning and inference

• Fix the Data Frame Analytics results explorer not updating when you switch to another job of the same type #284964.
• Fix file upload analysis failing for NDJSON files larger than 5 MB #284960.
• Require administrator privileges to test trained models, and run pipeline simulation as the current user so tests can't access data you shouldn't see #282002.

Workflows

• Warn instead of block enabling a workflow when the editor can't statically prove a foreach collection is an array #283360.

Original source

Features and enhancements

FIPS

• Upgrade Bouncy Castle FIPS to 1.0.2.7 and 2.0.2 #156296

Infra/Core

• Upgrade ASM to 9.10.1 #156213
• Upgrade the bundled JDK to 26.0.2 #156203

Mapping

• Upgrade to Lucene 10.5.1 #156643

Security

• Upgrade Jackson to 2.21.5 for ES|QL and Arrow #156368

Fixes

Aggregations

• Fix exponential histogram min/max not being fully respected in rank estimation #156268 (issue: #156057)

Downsampling

• Fix duplicate field in the cumulative histogram reset document #156287 (issue: #156276)

ES|QL

• Account for t-digest percentiles memory in the request circuit breaker #155586
• Fix TS STATS aggregate aliases that collide with grouping keys #155312 (issue: #153507)
• Fix TS queries that name a time bucket after the timestamp field #155623
• Fix incorrect results from Parquet predicate pushdown on multi-valued fields #156604
• Integrate circuit breaker into BestBucketsDeferringCollector #155600 (issue: #148516)
• Replace an IN subquery evaluated as a false filter with an empty local relation #155648 (issue: #155563)

Inference

• Fix Anthropic translation to the unified schema #155314
• Fix Google Vertex AI chat completion tool call argument serialization for non-string values #156665 (issue: #156644)
• Fix BroadcastMessageAction request serialization #156603
• Translate unified tool-calling message blocks to the Anthropic format #154607

Infra/Core

• Fix IllegalStateException when a truncated string cuts off in the middle of a JSON object #156382 (issue: #156289)

Machine Learning

• Fail closed on an incomplete TorchScript pre-load state hook scan #3149
• Fail gracefully when restoring a categorizer with an out-of-range token ID #3143

Search

• Add a limit on aggregation nesting depth #155743
• Count failed _msearch sub-search responses against the circuit breaker #156683
• Ensure batched queries always return a response #155908
• Exclude non-metadata _type from default search hit fields #155706 (issue: #110438)
• Fail the request instead of the node on deeply nested aggregations #155745
• Fix NullPointerException in LongComparator caused by null search_after values #132434 (issue: #132370)
• Fix nested and mode-based sorts on integer fields returning incorrect values on indices created before 8.19 or in 9.0.x #155580 (issue: #155243)
• Keep scroll contexts on transient search queue rejection #155697

Snapshot/Restore

• Ensure Error propagates out of S3BlobContainer #156765

Transform

• Preserve headers when copying a transform configuration #156191

Vector Search

• Fix DOT_PRODUCT and COSINE score clamping in the BBQ vector scorer #156015 (issues: #156010, #156011, #156009, #156012)
• Fix search failures on indices without vector fields when many field patterns are requested #156466
• Fix the auto_calibrate index option being rejected by a leftover experimental flag #156623
• Score nested kNN inner_hits like the query phase #156332 (issue: #138496)

Original source

Features and enhancements

Alerting and cases:

• Add limits on case templates and fields (200 templates and 200 fields per owner, and size limits on template and field definitions) to keep large template libraries performant, and clean up the field library editor #281650.
• Store assignee usernames, full names, and email addresses on cases so case analytics dashboards can show assignee details without an extra lookup. Available by default in traditional deployments #281579.

Data management:

• Add an Import from another stream flow in the Data lifecycle tab to reuse another stream's lifecycle configuration #275948.
• Add transition animations to the Streams data lifecycle phase preview so editing or switching lifecycle methods no longer flashes between states #277149.

Elastic Observability solution:

For the Elastic Observability 9.5.1 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution:

For the Elastic Security 9.5.1 release information, refer to Elastic Security Solution Release Notes.

Fixes

Elastic Agent Builder:

• Fix Agent Builder retrying indefinitely on repeated empty responses from Anthropic models, which could exhaust the conversation before surfacing an error #281616.
• Fix Anthropic chat completion requests unexpectedly setting temperature: 0 when no temperature was configured, which could cause errors for Agent Builder and Attack Discovery #281179.
• Fix the attachment input pill border color in Agent Builder chat #282279.
• Fix ES|QL truncating the Tool Success Rate panel in the Agent Builder overview dashboard to 0% whenever there was at least one failure #282026.

Alerting and cases:

• Fix the all cases list and case activity log to render user-picker, toggle, and checkbox field values correctly, and hide markdown-only fields from the column picker #282870.
• Fix duplicate activity entries when setting legacy custom fields #282813.
• Fix the all cases table column selector and template activity log to read from global fields after migrating to case templates #282129.
• Fix duplicate field-definition records being created when a legacy custom field is edited multiple times #282060.
• Fix the case list metrics bar to reflect the current search, filters, and date range instead of showing unfiltered totals #280576.
• Prevent deleting a field definition that is still referenced by an active case template #280493.
• Fix the timestamp field in the alerting rule query sandbox not updating after the first selection #281854.
• Fix bulk-disabling alerting rules leaving their background execution tasks running after the rule shows as disabled #281468.

Dashboards and Visualizations:

• Fix terms formatting to preserve multi-field grouping and column format on round-trip #282760.
• Fix terms include and exclude values to preserve numbers instead of converting them to strings #282752.
• Fix a Lens panel failing to load after duplicating it and then modifying its ad hoc data view, caused by colliding data view IDs #281786.
• Fix a Visualizations API error when reading back an XY chart with an annotation layer backed by an ad hoc data view #281079.
• Fix the Visualizations API dropping the custom name of an ad hoc, form-based data view on round-trip #280546.
• Fix Metric chart values colored by a value outside the configured range to use the default text color instead of blending into the background #280816.
• Disable Fast mode for Basic and Platinum licenses; approximate results in Discover and Dashboards require an Enterprise license #279903.
• Fix the dashboards listing page failing to load when the savedObjects:listingLimit advanced setting exceeds 1,000 #282100.

Data ingestion and Fleet:

• Increase the maximum number of hosts allowed on Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs from 10 to 100 #282397.
• Remove the proxy configuration option from Kafka outputs, which never supported it #282313.
• Fix a layout flash and unexpected switch to the Fleet app when you select Add integration from the Integrations app #281493.
• Fix enrollment API keys ignoring the requested expiration so tokens never expired regardless of the value you set #281324.
• Fix Fleet-managed OpenTelemetry metrics data streams to use time series index mode by default for integration packages #281295.
• Fix managed OTLP API keys being created without the required APM privileges, which caused the managed OTLP endpoint to reject events #281261.
• Fix the agent policy filter on the agents list page to match agents assigned to version-specific policies #281195.
• Fix Fleet Server detection to recognize agents assigned to version-specific Fleet Server policies, which could leave the onboarding screen showing indefinitely #281092.
• Fix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.
• Fix the agent policy download endpoint returning an HTTP 500 error for policies that reuse the same permissions object in more than one place #280669.

Data management:

• Fix ILM Explain data not returning results for hidden and system indices in Index Management #282137.

Discover:

• Fix the Short Dots transform dropping single-character path segments, for example rendering a.b.c as a.c #281930.
• Align the null-value label for server-side date fields with the client so CSV exports and the UI both show (null) #281367.
• Fix the Date Nanos formatter ignoring the configured date format for numeric values, such as aggregation results #281343.
• Fix Geo point degrees-minutes-seconds output rounding near-zero coordinates up to a full degree #281336.
• Fix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, this applies only to reports created or re-saved after upgrading; existing schedules keep their previous behavior until recreated #278305.
• Fix cascading drilldowns failing on ES|QL TS queries in Discover #280580.

Elastic Observability solution:

For the Elastic Observability 9.5.1 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution:

For the Elastic Security 9.5.1 release information, refer to Elastic Security Solution Release Notes.

Elasticsearch solution:

• Fix connector log filters showing (null) instead of the connector or agent ID on the agentless connector's View logs page #281155.
• Fix the cursor jumping to the end of the field when editing an inference endpoint ID #280894.
• Reject Query Rules and Synonyms set and rule IDs containing invalid characters before they reach Elasticsearch #276710.

ES|QL editor:

• Fix PromQL queries dropping value columns after the first pipe, keeping only grouping labels #280538.
• Fix autocomplete suggesting continuation columns after TS_INFO and METRICS_INFO, which replace the table with metadata rows #280524.

Machine learning and inference:

• Strengthen trained model ID checks so the infer, update, and stop APIs can't be used to access a different model's deployment #280511.

Workflows:

• Fix custom workflow steps, including security.enableRule and security.disableRule, calling Kibana APIs in the default space instead of the workflow's own space #280986.

Original source

- Elastic Stack: Planned

Features and enhancements

FIPS:

• Update Bouncy Castle FIPS TLS libraries #155937

Infra/Core:

• Upgrade lz4-java to 1.11.1 #155598

Machine Learning:

• Add EuroBERT and Jina v5 ops to the graph validation allowlist #3015
• Downgrade log severity for a batch of recoverable errors #2889
• Harden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
• Improve adherence to memory limits for the bucket gatherer #2848
• Improve error handling for quantiles state documents #2894
• Improve handling of invalid JSON state documents #2895
• Improve messaging for OOM process termination #2841
• Report the actual memory usage of the autodetect process #2846
• Update the PyTorch library to version 2.7.1 #2863

Security:

• Upgrade Apache HttpComponents 5.x to address CVEs #153057
• Upgrade Apache HttpCore 5 to 5.4.3 to fix header DoS CVEs #153467
• Upgrade Bouncy Castle to 1.85 #155819

Vector Search:

• Cache little-endian float layout in the DiskBBQ scalar corrections loop #154373

Fixes

Analysis:

• Trip the request breaker on term and phrase suggesters based on backing array estimates #154837

Codec:

• Fix false positives in boolean queries with must_not clauses on non-indexed fields #155936 (issue: #155653)

ES|QL:

• Allow garbage collection of closed search contexts in ES|QL #155418
• Apply PropagateEmptyRelation to AbstractSubqueryJoin #154768 (issue: #154755)
• Fix BUCKET with very large bucket counts #153392 (issue: #153389)
• Fix FROM_BASE64 generating invalid non-UTF-8 strings. Previously it could create binary values that ES|QL does not support in other operations; only valid UTF-8 is supported, and invalid cases now return null with a warning. #154955
• Fix MV_SORT incorrectly allowing geospatial types, which are not sortable #154417
• Fix exponential histogram merging with zero bucket overlap #155459 (issue: #153665)

ILM:

• Support dynamically enabling history indexes in ILMHistoryTemplateRegistry #155602 (issue: #141807)

Infra/CLI:

• Upgrade JANSI to 2.4.3 to fix terminal detection on zlib-ng based systems (EL10) #155853 (issue: #154510)

Machine Learning:

• Fix flaky CIoManagerTest/testFileIoGood test #3017
• Fix flaky concurrent LFU cache count invariant under lock timeouts #3090
• Mark the ML controller non-dumpable before accepting commands #3081
• Reject TorchScript custom state hooks before load and forbid inductor::_reinterpret_tensor #3078
• Reject non-native ABIs in the ML seccomp filter (socketcall/getuid collision) #3080

PromQL:

• Support date_nanos timestamp indices #153996 (issue: #146923)

Search:

• Clamp merge scheduler thread count when it exceeds max merge count #155693 (issues: #96594, #155678)
• Limit dot-separated identifiers per version part #154572
• Parse scroll ID from a bounded byte array #154542
• Use readArraySize in readImmutableMap and readImmutableOpenMap #154525

Vector Search:

• Fix EUCLIDEAN score clamping order in the BBQ vector scorer #155630 (issue: #155568)

Original source

- Elastic Stack: Generally available since 9.4

Features and enhancements

FIPS

• Update Bouncy Castle FIPS TLS libraries #155937

Infra/Core

• Upgrade lz4-java to 1.11.1 #155598

Infra/Plugins

• Add policy_base_id field to fleet-agents and fleet-policies index templates #154521

Machine Learning

• Add EuroBERT and Jina v5 ops to the graph validation allowlist #3015
• Downgrade log severity for a batch of recoverable errors #2889
• Harden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
• Improve adherence to memory limits for the bucket gatherer #2848
• Improve error handling for quantiles state documents #2894
• Improve handling of invalid JSON state documents #2895
• Improve messaging for OOM process termination #2841
• Report the actual memory usage of the autodetect process #2846
• Restrict file system access for PyTorch models #2851
• Update the PyTorch library to version 2.7.1 #2863

Security

• Add security stats to the monitoring mapping #155552
• Upgrade Apache HttpComponents 5.x to address CVEs #153057
• Upgrade Apache HttpCore 5 to 5.4.3 to fix header DoS CVEs #153467
• Upgrade Bouncy Castle to 1.85 #155819
• Upgrade Jackson to 2.18.9 #154569
• Upgrade Log4j to 2.26.1 #154115

Vector Search

• Cache little-endian float layout in the DiskBBQ scalar corrections loop #154373

Fixes

Analysis

• Add a check against self-referencing filters #154793
• Trip the request breaker on term and phrase suggesters based on backing array estimates #154837

ES|QL

• Allow garbage collection of closed search contexts in ES|QL #155418
• Avoid an integer overflow loop in the REPEAT function #154295
• Fix FROM_BASE64 generating invalid non-UTF-8 strings. Previously it could create binary values that ES|QL does not support in other operations; only valid UTF-8 is supported, and invalid cases now return null with a warning. #154955
• Fix MV_SORT incorrectly allowing geospatial types, which are not sortable #154417
• Fix a cause of lost ES|QL warnings by preserving thread context #154016
• Fix a concurrency issue in InferenceOperator#pollNextRequest for failed responses #154972 (issue: #154866)

ILM

• Support dynamically enabling history indexes in ILMHistoryTemplateRegistry #155602 (issue: #141807)

Infra/CLI

• Upgrade JANSI to 2.4.3 to fix terminal detection on zlib-ng based systems (EL10) #155853 (issue: #154510)

Machine Learning

• Fix double decrement of the pending inference request count #154577 (issue: #154483)
• Fix flaky CIoManagerTest/testFileIoGood test #3017
• Fix flaky concurrent LFU cache count invariant under lock timeouts #3090
• Mark the ML controller non-dumpable before accepting commands #3081
• Reject TorchScript custom state hooks before load and forbid inductor::_reinterpret_tensor #3078
• Reject non-native ABIs in the ML seccomp filter (socketcall/getuid collision) #3080

Mapping

• Fix wildcard queries on keyword fields whose normalizer rewrites wildcard characters #153582 (issue: #150699)

Ranking

• Add a hardcoded limit on nested retrievers #154814
• Fix an error caused by empty reranker results #155099

Search

• Apply max_regex_length limit to intervals regexp and wildcard rules #155231
• Bound numeric string length before parsing #154689
• Clamp merge scheduler thread count when it exceeds max merge count #155693 (issues: #96594, #155678)
• Ensure cancelled _field_caps tasks are removed from the tasks API #153831 (issue: #137475)
• Limit dot-separated identifiers per version part #154572
• Parse scroll ID from a bounded byte array #154542
• Use readArraySize in readImmutableMap and readImmutableOpenMap #154525

Transform

• Retry transient failures during restarts #153298

Vector Search

• Fix EUCLIDEAN score clamping order in the BBQ vector scorer #155630 (issue: #155568)

Original source

Highlights

Verify overwrite protection in repository analysis
The safety of the snapshot algorithm relies on the repository preventing certain objects from being overwritten. From version 9.5.0 onwards, Elasticsearch will verify that the repository implements overwrite protection correctly during repository analysis.

Batched execution in the query phase
Searches that target multiple shards on the same data node now batch shards into a single round-trip per data node, with partial reductions performed on the data nodes. This reduces transport layer overhead and spreads the load of reductions across multiple nodes. The enhancement is controlled by a setting search.batched_query_phase, which is enabled by default in 9.5.0.

Improved reindex resilience and new reindex management APIs
We're making multiple changes to the resilience and ease-of-use of the reindex API. Firstly, asynchronous reindex operations will now survive the graceful shutdown of the node where they are running. This makes long-running operations much more reliable, especially in a managed cluster. Secondly, reindex operations will now normally use the point-in-time API instead of the scroll API for paginated search. This is the preferred approach for deep pagination, and allows reindex to benefit from recent improvements to PIT resilience (where available). Finally, we are adding dedicated new APIs to monitor and manage reindex operations, providing a better user-experience than the older tasks APIs. Read more about these changes in the blog at https://www.elastic.co/search-labs/blog/elasticsearch-reindex-node-relocation-pit-serverless.

Data stream lifecycle can move data to the frozen tier
Data stream lifecycle (DLM) now supports the frozen tier. Set a frozen_after value in a data stream's lifecycle, and DLM moves aging backing indices to the frozen tier as partially-mounted searchable snapshots once they pass that age, reducing storage cost while keeping the data fully searchable. frozen_after sits alongside data_retention and downsampling in the lifecycle configuration, with no ILM policy required. DLM writes frozen data to a new cluster-level default snapshot repository. This capability requires an Enterprise license and is not available in Elastic Cloud Serverless.

Support for flattened fields in ES|QL
ES|QL now supports the flattened field type. Fields mapped as flattened were previously unsupported and could not be referenced in queries. They can now be loaded and, together with the new FIELD_EXTRACT ES|QL function, queried by sub-field.FIELD_EXTRACT(<flattened field>, "<sub-field>") extracts the value of a single sub-field from a flattened object and returns it as a keyword. The second argument is the literal name of the sub-field exactly as it is stored, for example FIELD_EXTRACT(attributes, "host.name"). The dot is part of the key, so the same dotted form addresses both originally-flat and originally-nested sub-fields. When a sub-field holds multiple values, the result is a multi-valued keyword.Both the flattened type support and the FIELD_EXTRACT function are in Technical Preview.

date_range field type available as tech preview
The date_range field type is now available in ES|QL as a technical preview. This unlocks the range-specific functions TO_DATE_RANGE, TO_RANGE, RANGE_MIN, RANGE_MAX, RANGE_CONTAINS, RANGE_INTERSECTS, and RANGE_WITHIN, as well as support for date_range fields in generic functions such as COUNT, PRESENT, ABSENT, and the MV_* family.

Add native support for metric temporality
TSDB now supports metric temporality natively: Counters and histograms can be ingested through the OTLP endpoint with both cumulative and delta temporality. The temporality will be stored as an additional metric dimension and ES|QL TS queries will interpret the data automatically, taking the temporality into account. There is no new query syntax for this functionality. Existing queries will continue to work as expected. The temporality is also respected and preserved during downsampling. Metrics ingested using other means can use the new index.time_series.temporality_field index setting to define the dimension field storing the temporality.

PromQL: Add basic support for native (exponential) histograms
You can now query exponential_histogram fields with PromQL syntax for native histograms. The supported functions are increase(), sum(), histogram_quantile(), histogram_avg(), histogram_count() and histogram_sum().

ES|QL Data Federation
ES|QL Data Federation (experimental) is now available. This feature enables you to create and manage external data sources (Amazon S3 initially) and query datasets using ES|QL.This is an experimental feature and is not enabled by default. To try it out, set esql.federation.enabled: true in your Elasticsearch configuration and xpack.dataFederation.enabled: true in your Kibana configuration.

Columnar index mode (Tech Preview)
Two new index modes, columnar and logsdb_columnar, are now available as a Tech Preview. With columnar mode enabled, Elasticsearch becomes a fully columnar store for search and analytics, offering a significantly smaller storage footprint and the building blocks for faster analytical queries in future releases.Fields are stored once, as doc values only — no inverted index or BKD tree is created by default, which eliminates redundant index structures and significantly reduces the storage footprint. Doc values skippers (compact skip lists with min/max metadata) are enabled by default for number based fields, allowing large blocks of documents to be skipped without scanning individual values. Doc value skippers will be enabled for all applicable fields at a later point. Text fields remain to be indexed by default, but are no longer mapped by default.Mappings are always flat: object and passthrough fields are auto-flattened to leaf fields at mapping time. The original document source is not stored; the columnar source is generated on the fly from doc values at query time. A pre-built columnar representation can be stored on disk using the new columnar_stored source mode (optional for Enterprise licenses).New multi-value semantics: the original ordering of multiple values per field per document (e.g., in arrays) is preserved by default. Optionally, fields in mappings can be configured to only allow one value per document.Single-value enforcement (doc_values.multi_value: false): reject documents that provide more than one value for a field, enabling tighter columnar encoding and stronger schema guarantees.Required-value enforcement (doc_values.nullability: false): reject documents that omit a field or supply an explicit null.There are two columnar index modes:

• logsdb_columnar adds logging-oriented defaults on top of the columnar foundation: a default @timestamp mapping, and index sorting on host.name and @timestamp when those fields are present.
• columnar provides the same column-oriented storage without use-case-specific defaults, suitable for general-purpose indices and data streams.
  Improved columnar storage: An optimized doc values format is used by default, further reducing storage footprint, especially when combined with index sorting.

Create backing indices for backfilling past timestamps in TSDB (opt-in)
Bulk requests that create documents in a time series data stream no longer fail outright when a document's @timestamp falls outside the boundaries of all existing backing indices. If the timestamp is still within the data stream's eligible write window and the new data_stream.past_tsdb_index_creation_enabled cluster setting is enabled (defaults to false), Elasticsearch now creates the necessary backing indices needed to cover it before indexing, instead of rejecting the write. Timestamps outside the eligible window, or in the future, are still rejected.

ES95 is the default TSDB doc values codec
ES95 is now the default doc values codec for new time series indices. On host metrics data it reduces total doc values storage by about 30% versus ES819, driven by @timestamp (up to 90% smaller) and floating-point gauges and counters via adaptive floating-point encoding, at no indexing or query cost. Existing indices keep their codec; opt out with index.time_series.es95_codec.enabled: false.

Release support for match with non-mapped expressions
The match function and : operator can now work with expressions that no longer need to represent a mapped field in an Elasticsearch index.The match function no longer needs to be pushed down as a Lucene query to the shard. When matching on an expression that does not represent an Elasticsearch mapped field, but has the text data type, we evaluate the match function on-the-fly by analyzing the value of the expression for each row and checking whether any of the analyzed tokens match the analyzed tokens of the given query string.

Features and enhancements

Allocation:

• Early publish DesiredBalance when newly created replicas are assigned #149645
• Expose DesiredBalanceStats as metrics #146928

Analysis:

• Allow appending synonyms to existing rules via append=true (default false) #146870 (issue: #146864)
• Allow multiple synonym sets per filter using the synonyms API #147157 (issue: #144941)

Audit:

• Allow audit logging to be turned on/off without server restart #147333

Authentication:

• Change federated feature flag to cluster config #153098
• Introduce feature flag for keyless auth #152684
• Provide default jwt_audience #152362

Authorization:

• [Evaluations] Register .evaluation-* as hidden indices with viewer/editor access #148880

CCS:

• Support -remote:index-style exclusion syntax #148497

CRUD:

• Expand index pressure on update expansion #147151
• Minimize the amount of memory used by CommitReferencesInfo #147976

Codec:

• Update to lucene 10.5 #151959
• Use IOContext to detect random access for bloom filters #147224
• Write skipindex to a separate file in TSDB Codec #147238

Data streams:

• Adding dynamic template for *.lifecycle.last_activity fields #149505
• Allow deleting a backing index via modify data streams API #151137
• Data stream lifecycle (DLM) can move data to the frozen tier #150457
• Throttle concurrent downsampling operations in data stream lifecycle. A new dynamic cluster setting, data_streams.lifecycle.downsampling.max_indices_in_progress (default 10), caps the number of backing indices per data stream that data stream lifecycle will submit to downsampling in a single run. Indices that are deferred are recorded in the error store with a warning and will be retried in a subsequent run. #150802 (issue: #150624)
• Updating ecs@mappings to include new flattened gen_ai fields #148674
• [otel-data] Add HTTP body size, severity aliases #152622

Distributed:

• Improve allocation explain API for canRemain #152121 (issue: #131603)
• Make INDICES_RECOVERY_MAX_CONCURRENT_OUTGOING_RECOVERIES setting dynamic #151138
• Support outbound peer recovery throttling #149319

Downsampling:

• Assign downsampling to least loaded candidate node #148220

ES|QL:

• Add Arrow output support for date_nanos and date_range data types #150479 (issue: #146350)
• Add ENRICH to bytes counting #150677
• Add IP_LOCATION command #149421 (issues: #150231, #132489)
• Add range_intersects and range_contains functions #148713
• Add a BY subclause to CHANGE_POINT command #148473
• Add analyzer option in ES|QL TOP_SNIPPETS function #147369
• Add order option to TOP_SNIPPETS #145946
• Add release hook to Vector and Block #150017
• Avoid tracking group ids for intermediate input #141466
• Bulk-grow TopN UTF-8 string encoding #149022
• Cache FilterOperator/EvalOperator toString #148354
• Chunk time-series aggregation output #151670 (issue: #147286)
• Constant-RHS fast path for MOD and DIV evaluators #148678
• Count read bytes for Lucene operators #150036
• De-snapshot column metadata for BUCKET #152998 (issue: #148508)
• ESQL planning and streaming changes for bulk keyword lookup #148937
• ESQL: Push down unrelated filters past MV_EXPAND #144979 (issue: #144636)
• ES|QL - Add timeout to inference operations COMPLETION, RERANK and TEXT_EMBEDDING #146666 (issue: #146528)
• ES|QL JSON_EXTRACT function is GA #152957
• ES|QL query approximation support for FORK #148412
• ES|QL: unify SET and request-body parameters into one settings framework #149206 (issue: #143239)
• Enable ES|QL EMBEDDING function for calculating dense vector embeddings on multimodal input #146801
• Extend FIRST and EARLIEST aggregations to support additional types including spatial types, version and unsigned_long #149307 (issue: #141596)
• Extend FIRST and EARLIEST to support dense_vector, exponential_histogram and tdigest #149716
• Extend LAST and LATEST to support the same field types as FIRST and EARLIEST #152154 (issue: #149478)
• Fast paths for prefix/suffix/contains LIKE patterns (SIMD substring search for contains) #148680
• Gate field_extract pushdown, use RECHECK #154135
• Highlighting in TOP_SNIPPETS #144742
• Implement DEDUP command #147574 (issue: #133322)
• Implement bucket metadata #146077 (issue: #138146)
• Improve LongLongSwissHash for high cardinality #147078
• Make FUSE command GA #151885 (issue: #123389)
• Make date_range tech preview #151949
• Make the worker queue dynamic #151103
• Make views REST API available in serverless #151431
• Optimize field_extract on flattened fields #148879
• Optimize field_extract on flattened fields #148891
• Ordinal fast path for BytesRefTopNBlockHash #148333
• Parallel TopN Operator #150148
• Prune constant sort keys from TopN #147769 (issue: #143518)
• Prune non-top-N groups during aggregation #148256
• Prune redundant stats groupings #150030
• REPLACE fast-path review fixes #149167
• Release to_text conversion function #152523
• Release flattened type and field_extract #151841
• Release support for match with non-mapped expressions #152941
• Rewrite SUM(X+c) to SUM(X) + c*COUNT(X) #145510 (issue: #140470)
• Route (LONG, BYTES_REF) STATS through an adaptive composite BlockHash #152010
• SIMD contains for literal LIKE patterns #149026
• Share numeric TopN thresholds #149926
• Speed up REPLACE on constant regex #149033
• Support ST_UNION, ST_INTERSECTION, ST_DIFFERENCE, ST_SYMDIFFERENCE #149092
• Support full-text search functions for unmapped fields with LOAD and return null for partially unmapped fields that cannot be implicitly converted #152200 (issue: #144121)
• Support keyword/text in TOP(field,...,outputField) #151767 (issue: #151751)
• Unmapped fields/full text null warning #152973 (issue: #151403)
• Unmapped_fields="load" for views, subqueries and fork #151750 (issue: #142033)
• Unmatched DROP wildcard no-op if unmapped #153090 (issue: #143226)
• Use atomic reference counting for blocks and vectors #153410 (issues: #153394, #153411, #154241, #153752)
• FieldExtract double-sided and single-sided range query pushdown #149710
• RoundTo Block Loader Optimization #144234

Engine:

• Avoid storing in BlobTranslogFile totalOps for active shards when it is equal to zero #148992
• Log BCC upload progress and BCC queueing time #149484
• Merging is now more aggressive by default, especially for segments under 16MB. #133946 (issues: #120624, #129764, #130328)
• Reduce the amount of memory used by TranslogReplicator#BlobTranslogFile #148881
• Wire internal refresh listeners on SearchEngine #149889

Geo:

• Support BufferParameters in ST_BUFFER #147615

ILM:

• ILM & DLM create snapshots with partial: true to prevent blocking cluster recovery actions #153774 (issue: #153643)

Indices APIs:

• Rollover ignoring active shards can ignore reroute #149859 (issue: #149730)

Inference:

• Add chat_completion task type to the Anthropic inference service #148539 (issue: #147188)
• Add support for audio, video and pdf inputs for embedding task #147329 (issue: #146432)
• Add timeout support to the update inference endpoint API #152179 (issue: #140501)
• Change EIS rerank request format to use objects for query and documents #150172
• Determine inference timeout based on task type #146089
• Enable EMBEDDING task for OpenAiService #145833
• Enable multiple items per content object for Elastic service #148340
• Support jina-embeddings-v5-omni input format for Jina integration #148551
• Support multimodal (image) rerank for the Elastic Inference Service #152012
• Support the Google Vertex AI global endpoint for inference endpoints #151054 (issue: #150990)
• Update the rerank endpoint for the Elastic inference service #152869
• [Inference API] Add product use case and origin to telemetry #148140
• [Inference API] Add reasoning fields to Elastic Service TaskSettings #152230
• [Inference API] Add stack version and production environment to APM attributes #147633
• [Inference API] Adding OpenAI OAuth2 implementation #150132
• [Inference API] Adding deployment type to Inference API telemetry #149098
• [Inference API] Apply Retry-After header if present in EIS responses #147985
• [Inference API] Region policy for inference requests #153093

Infra/Core:

• Ability to configure a number of replicas for system indices #149892 (issue: #99720)
• Wire OTel SDK self-monitoring metrics into the span exporter #150026

Infra/Logging:

• Introduce params support for query logging (ESQL & SQL) #150266

Infra/Metrics:

• APM OTel SDK: flush metrics and traces under a single shared timeout #149220 (issue: #149072)
• Add missing OTel resource information #150354
• Add stack trace suppression for OTel traces #150626
• Buffer metrics if APM server returns an error #146401
• ES-14041: Add regression test suite for trace/span export #146095
• ES-14041: Lock APM-agent trace contract in regression test #147729
• ES-14041: Port trace/span export from APM agent to OTel SDK #146096
• Flush OTel SDK metrics at shutdown #145839
• Flush OTel traces at shutdown #145939
• Set OTel span status ERROR for HTTP 5xx responses #151593
• Setting for trace sampling and batch processor #150876

Infra/Plugins:

• Add config.name mapping to fleet-agents index #148703
• Add effective_config_hash keyword mapping to fleet-agents index #146975
• [Fleet] Add policy_base_id field to fleet-agents and fleet-policies index templates #154521

Infra/REST API:

• Support form encoded REST bodies for authenticated requests #149005

Infra/Scripting:

• Add Painless allocation counter mechanics #151085
• Add Painless allocation-limit setting scaffolding #151017
• Add Painless cancellation checks to fetch, agg-reduce, and bulk-write script contexts #149754
• Emit Painless array runtime-size allocation pre-checks #151687
• Emit Painless compile-time allocation pre-checks #151339
• Emit Painless static-type string concat allocation pre-checks #152326
• Painless: cancellation_aware augmentation infrastructure #150092
• Painless: script_aware Iterable/Collection/Map augmentations #151016
• Painless: script_aware Stream.collect(Collector) and primitive forEachRemaining #151337
• Painless: script_aware String search + regex limit-factor for replaceAll/replaceFirst #151086
• Painless: script_aware wrappers for native iteration methods #151059
• Painless: script_aware wrappers for stream terminal ops #151080
• Painless: honor search timeout in score scripts #148260
• Wire search-timeout cancellation to Painless script contexts #149346

Ingest Node:

• Add AI bots to user-agent regex #148665
• Add max_field_bytes to attachment processor and ingest.attachment.max_field_size node setting #148493
• Adding support for IPinfo Plus database #149885

Logs:

• Enable OTLP logs and traces by default #147811
• Optimize sorted numeric field data loading for dense fields #150138

Machine Learning:

• Add ECS event.ingested to ML anomaly detection result documents #148583 (issue: #144836)
• Add EuroBERT and Jina v5 ops to graph validation allowlist #3015
• Add byte_level_bpe ML tokenization with merges #147217
• Add maintenance task to close idle AD jobs #144904
• Better error handling regarding quantiles state documents #2894
• Better handling of invalid JSON state documents #2895
• Better messaging regarding OOM process termination #2841
• Create settings for platform architecture #147496
• Downgrade log severity for a batch of recoverable errors #2889
• Expose datafeed authorization.cloud_api_key.id on GET for CPS operator visibility #150473
• Harden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
• Improve adherence to memory limits for the bucket gatherer #2848
• Lookup join and Inline stats support for query approximation #145980
• Report the actual memory usage of the autodetect process #2846
• Update the PyTorch library to version 2.7.1 #2863

Mapping:

• Add doc_values mapping attribute to RoutingFieldMapper #146576
• Cache FieldInfo instances per shard Directory #148865
• Columnar index modes available as Tech Preview #152481
• Improve DocumentParser#parseObjectDynamic() if subobjects are disabled and dynamic templates #150553
• Release semantic field #152528 (issue: #143287)
• Restrict doc values multi_value/nullability parameters to columnar mode #152111
• Store semantic_text input in doc values #152387
• Support nested fields under subobjects:false #152357
• Wire columnar index mode through synthetic source test framework #152231

PromQL:

• Add GET /_prometheus/api/v1/metadata endpoint #146044 (issue: #146045)
• Add TS_COLLAPSE command #148690
• ES|QL PromQL: implicit type coercion for counter/gauge #149985 (issue: #140035)
• Fix PromQL round(to_nearest) floating point accuracy #149972
• Implement GET /_prometheus/api/v1/status/buildinfo #150235
• Implement PromQL set operator: top-level or (UNION) #151486
• PromQL: Add support for histogram_count, histogram_sum and histogram_avg #151502
• PromQL: Add support for increase on histograms #152065
• PromQL: Add support for sum aggregation on exponential histograms #152082
• PromQL: Support histogram_quantile for exponential histograms #152171 (issue: #150074)
• Route Prometheus remote write via data_stream labels #148910
• Support form-encoded POST on PromQL HTTP query and discovery routes when security and HTTP TLS are enabled #148974
• Use MetricsInfo for Prometheus labels API #150948

Recovery:

• Remove RecoveryMonitor #144762 (issue: #93544)
• ThrottlingRecoveryService can throttle recoveries on data node #149317

Reindex:

• Improved reindex resilience and new reindex management APIs #148786
• Reindex parse exception has document index and ID #145146 (issue: #48432)
• Reject reindexes with wrong parameters #145290 (issue: #37855)
• Track remote reindex HTTP response bytes in REQUEST circuit breaker #149389

Search:

• Add PIT context relocation metrics to stateless recovery #150604
• Add cache-miss wait time to search response #151576
• Add circuit breaker to TransportMultiSearchAction #150115
• Add diagnostic fields to reader context lifecycle logs #147552 (issue: #112680)
• Add inference flag to field caps #152102 (issues: #147575, #124567)
• Add points memory estimate to tier heap estimate #150545
• Add reader-heap circuit breaker for the stateless search engine #149062
• Add stats parameter support to Count API #140143 (issue: #67528)
• Align bfloat16 vector data to minimize page crossings #147225
• Allow semantic text use with embedding models #144796
• Blob store prefetching: Allow for all nodes #150175
• Caching: Prefetch from blob storage, if local prefetching fails #147964
• Collapse SearchHit.readFrom and SearchHits.readFrom signatures #147155
• Enable the adaptive replica selection formula adjustment #152793
• Enable the batched query phase #148622
• Estimate PointRangeQuery memory in the circuit breaker #151211
• Expose _clusters metadata in open point-in-time response for CCS #149466 (issue: #84400)
• FSDirectoryFactory: fix read advice for slices inside CFS #147222
• Generalize per-fetch directory metrics to all pluggable metrics #153433
• Honor search timeout by not retrying on replicas #150075 (issue: #149508)
• Include index and shard id in shard failure exception message #147566 (issue: #113489)
• Include target indices and query in profiled search results #145230 (issue: #143783)
• Make synonym rule limit configurable at the cluster level and increase the limit from 10,000 to 100,000 #146087
• Migrate rank-eval SearchHits from unpooled to pooled #146673
• Pool ClientHit PIT hits via ref-counting #146868
• Ref count EQL _source (search hits and events) #146182
• Reject pathPrefix containing consecutive slashes #147541 (issue: #117048)
• Reserve CB memory for automaton construction #148722 (issue: #147428)
• Scrolling ref counts hits #144426
• Stop carrying shard request with each shard search result #146931 (issue: #146684)
• Stop retrying shard requests on replicas for non-retriable errors #149506 (issue: #72349)
• Synonyms search_after pagination #146965
• Track search phase request/result bytes at coordinator #151987
• Upgrade qa/vector opentelemetry dependency for security vulnerability #152225
• Use ref-counted SearchHits in data frame analytics paths #145361
• Wait for shard readiness before executing search on data node #146378 (issue: #139672)
• CompletionSuggestion: ref-count hits, released by SearchResponse #144351
• ExpandSearchPhase: fix inner hits lifecycle to use pooled hits #144342
• SearchHitRowSet uses pooled SearchHits #145235

Searchable Snapshots:

• Azure event loop default threads #151913
• Cache miss no longer blocked by fetch #146207

Security:

• Add EncryptionService for encrypt/decrypt operations using PEK #147418
• Add KibanaCasesImplicitPrivilegesProvider contributing implicit index privileges for Kibana Cases #152714
• Add x-pack-kibana plugin contributing implicit index privileges for Kibana Alerting V2 #148331
• Add automatic key rotation for primary encryption key #148203
• Add destructive reset endpoint for project encryption key #150466
• Add encryption at rest for primary encryption key #148568
• Add primary encryption key generation and distribution #145990
• Bump ES|QL/Arrow Jackson to 2.21.4 #153005
• Implicit Index Privileges SPI #147176
• Move encryption key management into a dedicated x-pack-encryption module #149668
• Reuse resolved privilege automata in implicit SPI #152938
• Support wildcard application names in implicit privilege SPI #148121
• Surface implicit privileges in get-role API #147781
• Upgrade the version of log4j to 2.26.1 #154115
• [Encryption] Add encryption password to auto-configuration #151522
• [Encryption] Graceful degradation when no password configured #151405
• [Encryption] Move PEK password wrap/unwrap to disk write/read only #151609
• [Encryption] Remove PEK Feature Flag #152290
• [kibana_system] add significant_events-* data access for kibana_system user #150465

Snapshot/Restore:

• Add data_access_tier and metadata_access_tier settings to Azure repository #149345
• Add data_storage_class and metadata_storage_class settings for GCP repository #151058
• Add azure snapshot repository access tier settings #150396
• Add distinct storage class settings for S3 #148920
• Add resumable write buffer size client setting for GCS repository #150838
• Adding a check to verify that BlobContainer::blobExists works as expected in the repository analysis tool #146595 (issue: #119303)
• Adding a check to verify that BlobContainer::listBlobsByPrefix works as expected #146440
• S3HttpFixture: track and expose storage class on blobs #149069
• Verify overwrite protection in repository analysis #143701 (issue: #134632)

Suggesters:

• Return 400 instead of 500 for suggest requests across indices with different analysis chains. #150608

TSDB:

• Add TO_COUNTER() function and ::counter cast operator #149687
• Add TO_GAUGE() function and ::gauge cast operator #149713
• Add native support for metric temporality #152091
• Add raw histogram mapping hint #148938
• Create backing indices for backfilling past timestamps in TSDB (opt-in) #152716 (issue: #149856)
• Handle OTLP explicit-bounds histograms without buckets in tdigest and exponential histogram conversion paths #149591
• Make ES95 the default TSDB doc values codec #152861
• Two-phase iterator for TSDB numeric range doc values #152515

Transform:

• Add Defer Flag #145693 (issue: #140456)
• Integrate with UIAM tokens #149637

Vector Search:

• Add AVX-512 f32 dot product and squared L2 kernels #145674
• Advise MADV_RANDOM on blob cache regions backing vector data files #150066
• BF16 bulk AVX-512 K-unroll for sequential paths #147672
• DiskBBQ - add symmetric 1-bit OSQ vector scorer #149339
• DiskBBQ - wire auto calibration at merge time #152894
• DiskBBQ Bulk collect knn docs to improve query latency #146588
• DiskBBQ: switches from striped dibit to packed #149344 (issue: #144608)
• Improve float & byte comparisons for RankVectors #147507
• Native BBQ apply corrections (all distance types) #145567
• Report vectordb_document usage in _xpack/usage #152780
• Tuned AVX-512 int4 dot product implementations (~20% gain) #148287
• Use panama bulk methods for bulk vector scoring #150906
• [DiskBBQ] Version DiskBBQ format to ES950 #153012
• [Native] AVX-512 BBQ vector operations #146069
• [Native] head+spread prefetch in amd64 bulk kernels #148945
• [Native] i7u bulk AVX-512 shared-b #147999
• [Native] i8 bulk AVX-512 shared-b #147865
• DenseVectorQuery: lazy filter evaluation and use bulk scorer #147504 (issue: #137042)

Original source

Features and enhancements

Elastic Agent Builder

• Create skills in Agent Builder chat, preview drafts in attachments, and save them from the conversation #265883.
• Enable Agent Builder to pause and ask up to five clarifying multiple-choice questions before acting, then resume after you answer #274672.
• Share private agents with selected people using per-agent access control alongside Public, Shared, and Private visibility #267530.
• Add an embeddable Agent Builder conversation input that opens Agent Builder and sends the message with attachments preserved #272166.
• Enable Agent Builder tracing by default so you can view trace waterfalls for each response, use the built-in traces skill, and monitor activity in the overview dashboard while excluding sensitive prompts and tool parameters by default #276174.
• Add install, open, and delete controls to the Agent Builder Traces option on the GenAI Settings page, and prevent deleted dashboards from being reinstalled when Kibana restarts #276643.
• Set a resizable custom width for Agent Builder attachment canvas flyouts in full-screen view and overlay mode in the sidebar #265200.
• Add optional connector_ids to the Agent Builder conversation API to limit which connectors a request can use #267333.
• Show permitted system indices and aliases in Agent Builder index selection, including alerts, ML anomaly results, SLOs, the entity store, exception lists, SIEM signals, and Stack Monitoring #265819.
• Run several Agent Builder conversations at the same time, and track each conversation's status in the chats panel with In progress, Awaiting your input, Unread, and Error indicators #267980 #271689.
• Route low-effort Agent Builder operations such as ES|QL generation and conversation title generation to a configurable fast model, set per feature in Feature settings, with automatic fallback to the default model #265520 #274849 #275607.

Alerting and cases

• Enable Cases as Data by default so you can analyze cases, activity, and attachments through dedicated indices and a prebuilt Case Analytics data view that stays current as custom fields change without replacing the space's default data view #279831 #280001.
• Enable the redesigned Cases list, details, and settings pages by default #279367.
• Snooze and unsnooze individual alerts with optional expiry or auto-unsnooze conditions #264090.
• Add a Stack Alerts feature privilege so roles can read and act on alerts without rule management access #273804.
• Add an Inspect action to view and run the Elasticsearch query used by custom threshold rules from the rule details page #262354.
• Move the unified Rules page into Stack Management so navigation context remains visible #269568.
• Search, summarize, and update cases from Agent Builder chat with a cases skill, tools, and case attachments #271438.
• Add Add to chat and Summarize case actions to the case details page #276635 #279105.
• Attach Lens visualizations to cases from Attach saved object #274959 #277040.
• Attach Discover sessions, dashboards, and maps to cases #272423.
• Redesign case attachments with a unified Attachments tab, collapsible sections and item counts by type, Type and Author filters, Refresh, and an Attach action on the Activity and Attachments tabs #270518 #272759 #269560.
• Add a warning when a selected file already exists in a case #279327.
• Extract case observables automatically when alerts are added through the API, workflows, or Agent Builder #273455.
• Improve case templates with toggle fields, unique template names, and a simplified default starter template #277626.
• Split the case template editor into Fields and Configuration tabs #277269.
• Add autocomplete and inline validation to the case template YAML editor #279346.
• Set default connectors and case settings in case templates #275690.
• Add a display-only Markdown field type to case templates #278329.
• Add public Cases APIs to discover applicable extended_fields and apply template defaults when creating a case #279684 #280143.
• Add xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control Elasticsearch index.mapping.total_fields.limit on .alerts-* indices and templates #274024.

Connectivity

• Add a OneDrive connector to search files, browse drives, and read file content in Agent Builder and Workflows #275244.
• Add a Box connector to search files and folders and read file content in Agent Builder and Workflows #271306.
• Add an Outlook connector to search and browse email messages and download attachments in Agent Builder and Workflows #266766.
• Add a Snowflake connector to run SQL queries, explore databases and tables, and search with Cortex Search in Agent Builder and Workflows #264827.
• Add an Azure Blob Storage connector to list containers and blobs, read blob content, and search storage in Agent Builder and Workflows #259439.
• Add a HubSpot connector to search and retrieve contacts, companies, deals, tickets, and engagements in Agent Builder and Workflows #257675.
• Add a Sublime Security connector to investigate and act on email threats in Agent Builder and Workflows #279707.
• Add a Filter by feature control to the create-connector flyout, and show the HTTP connector in standard connector lists #271686.
• Improve authentication options for Agent Builder connectors by listing recommended methods first with a Recommended badge and hiding legacy options when you create new connectors #273410.
• Add secretQueryParams support to the HTTP connector so encrypted query parameters are stored in connector secrets and injected into request URLs #258291.
• Add Slack (v2) connector actions for looking up conversation history, channel details, workspace users, and users by email in Agent Builder and Workflows #273548.
• Enable OAuth authorization for the GitHub and Slack (v2) connectors so you can connect using your own OAuth apps #259549.
• Add OAuth Client Credentials (Private Key JWT) authentication to the SharePoint Online connector so you can authenticate with a certificate instead of a client secret #268847.

Dashboards and Visualizations

• Make the Dashboards and Visualizations APIs generally available, with breaking request and response schema changes detailed in Kibana 9.5.0 breaking changes.
• Make dashboards and visualizations in Agent Builder chat generally available.
• Add and remove Options list, Range slider, and Time slider controls on dashboards from Agent Builder chat #275584.
• Create and edit custom Vega visualizations in Agent Builder chat #275257.
• Add Links panel support to the Dashboards API #268965.
• Add access_control.access_mode support to PUT /api/dashboards/{id} for updating dashboard permissions #266700.
• Add a Write a query values source for filter controls so you can pre-filter options-list and range-slider values with ES|QL #266492.
• Highlight related dashboard panels when you select an ES|QL control label #264426.
• Add feedback when filters or drilldowns cannot apply to computed values on ES|QL XY, heatmap, and partition charts #269722.
• Show unavailable filter and drilldown actions with an explanation when a ES|QL data table column is not filterable #269635.
• Make the Fast mode approximation option applicable to Vega visualizations that use an ES|QL query #276999.
• Apply the dashboard time range, query bar, filters, and controls to Vega panels that use ES|QL #277120 #280070.
• Add a Use global filters layer setting to ES|QL visualizations in Lens #264613.
• Add background trendlines to ES|QL metric visualizations #272499.
• Add a Density option to Lens Metric charts, with Default used for new charts and Compact preserved for existing ones #265526.
• Add Style template presets (Top, Middle, Bottom, Custom) to Lens Metric charts #265304.
• Place unpinned controls above the top dashboard section instead of below it #273089.
• Change the default Include empty rows setting in Lens to depend on visualization type #271856.
• Update the dashboard empty state in edit mode to card-style actions aligned with Add to dashboard #269407.
• Set numeric Lens heatmap Y-axis buckets to descending sort by default for natural numeric order #268961.
• Add a Go to dashboard button to the dashboard save toast when saving from outside the Dashboard app #268326.
• Re-enable Go to Discover drilldowns for ES|QL Lens charts, carrying filters and the query bar state #267245.
• Record dashboard create, update, delete, view, and refresh actions as structured user activity events #265821.
• Redesign Add to dashboard with New and From library tabs, featured items, and a renamed Vega entry #264457.
• Update default Lens annotation colors to improve contrast with chart palettes while preserving colors you set #262507.
• Add spacing above collapsible dashboard section headers to clarify which panels belong to each section #274377.
• Increase the maximum combined panels, sections, and pinned controls on a dashboard from 100 to 1,000 #272931.

Data ingestion and Fleet

• Add opt-in namespace-level customization for integrations so you can apply a {namespace}@custom component template (for example, production@custom) to a namespace's data streams, backed by dedicated namespace-level index templates #262568.
• Add an ILM policy picker to Data retention settings in the integration policy editor so you can assign an ILM policy to an integration namespace (requires opt-in for namespace-level customization) #275197.
• Add bulk revoke and delete actions and status and agent policy filters to the Enrollment tokens page in Fleet #265916.
• Add a Cancel unenrollment action in the agent activity flyout so you can cancel a scheduled automatic unenrollment of inactive agents during the grace period #271270.
• Add Remove collector actions for OpAMP collectors in Fleet, including bulk removal, as a technical preview #268711.
• Show dedicated Health, Info, and Config tabs and the collector configuration view on the details page for OpAMP-managed collectors in Fleet as a technical preview #278816.
• Add an Elastic Agent and OTel Contrib Collector runtime selector to the Add Collector flyout as a technical preview #280137.
• Enable automatic installation of dependencies for composable integration packages during package installation #263762.
• Rename user-facing Cloud Connector copy to Federated Identity across Fleet federated-identity onboarding flows #261353.
• Enable OpenTelemetry-based permission verification for Federated Identity setups in Fleet by default #265619.
• Replace the Status filter on Browse integrations with a More filter, and hide deprecated integrations and content packs by default #277812.
• Add an optional dryRun parameter to Fleet bulk agent API endpoints so you can preview affected agent counts without creating actions #276377.
• Remove the Give feedback button from the Fleet top navigation #273641.
• Update the Add Collector flyout in Fleet to generate collector configs that ship through the Elastic Cloud Managed OTLP Endpoint when available #270324.
• Add Condition fields to integration, input, and stream settings in the package policy editor #270315.
• Add support for using a remote Elasticsearch output as the exporter target for OpenTelemetry integrations as a technical preview #270267.
• Add a data_stream.type variable to the simplified package policy API so input-only packages can route data to a different index prefix (for example, logs-* instead of metrics-*) #269895.

Data management

• Add ES|QL Data Federation management UI in Stack Management. This feature enables you to create and manage external data sources (Amazon S3 initially) and query datasets using ES|QL #265681.
  • This is an experimental feature and is not enabled by default. To try it out, set esql.federation.enabled: true in your Elasticsearch configuration and xpack.dataFederation.enabled: true in your Kibana configuration.
• Add hot, frozen, and delete phases to Data lifecycle in the index and component template wizards, and add a unified editor for successful and failed data lifecycles in data stream details #273960 #273965 #275740.
• Add min_age, min_docs, min_size, min_primary_shard_docs, and min_primary_shard_size rollover conditions to Index Lifecycle Management hot-phase actions #270398.
• Add Force merge index and Force merge on clone settings for searchable snapshots in the Index Lifecycle Management policy editor for hot, cold, and frozen phases #264698.

Developer tools

• Add response filtering in Dev Tools Console so you can filter output with JQ expression or Regular expression mode #272078.

Discover

• Add Save to Dashboard in Discover so you can save sessions directly to a dashboard from the save modal #260092.
• Add a change point chart view for ES|QL change-point results #265331.
• Show a Change point chart in the row flyout for ES|QL change-point result rows #271793.
• Remove the Technical preview badge from change point views in Discover and on the Change point detection page #274950.
• Show sparkline charts in the table for ES|QL queries that return a Sparkline column #268785.
• Integrate Agent Builder with ES|QL Discover for data analysis, context sync, drill-down queries, and Run in new tab #261970.
• Improve Agent Builder time-over-time analysis in Discover by overlaying the selected and preceding time ranges as separate lines on the same time axis #270338.
• Render inline highlighting in Discover for ES|QL TOP_SNIPPETS results when the highlight option is enabled #271519.
• Add tab-scoped actions to Discover's application menu, including inspect and mode switching #269590.
• Open background-search Inspect details in a child flyout from Background searches in Discover #250252.

Elastic Observability solution

For the Elastic Observability 9.5.0 release information, refer to Elastic Observability Solution Release Notes.

Elastic Security solution

For the Elastic Security 9.5.0 release information, refer to Elastic Security Solution Release Notes.

Elasticsearch solution

• Add a trial usage badge with period progress and a Manage subscription link to the Search homepage #268598.
• Add Elastic Cloud, Usage, and Organization links to the Search homepage header on Elastic Cloud deployments #267434.
• Add Out-of-range date handling to the MongoDB native connector so syncs clamp or convert out-of-range dates instead of failing #277685.

ES|QL editor

• Enable Fast mode in Discover and Dashboards to run eligible ES|QL STATS queries faster by using approximate results #276384.
• Add AI-driven inline code completion in the ES|QL editor, including ghost hints and Undo AI fix / Keep AI fix review actions #256857.
• Add Fix with AI quick-fix actions for ES|QL validation errors in the editor #269455.
• Enable Natural language to ES|QL in the ES|QL editor when your subscription level includes this feature #266561.
• Warn when a closed lookup index is referenced in LOOKUP JOIN instead of offering Create lookup index #274534.
• Sort columns in the Lookup Index editor #273734.
• Replace free-text filtering with KQL search and autocomplete in the Lookup Index editor #271284.
• Make the ES|QL FUSE command generally available #273994.
• Improve recommended ES|QL queries for remote-cluster sources #273292.

Kibana platform

• Add a customization modal for reordering and hiding solution navigation items, with personalized preferences preserved across sessions #270276.
• Add a new date range picker in Discover and Dashboards that accepts flexible relative and absolute time ranges in plain text #260163.
• Add nine commonly used presets to the time picker, including Yesterday, Last 3 hours, and This week until now #270254.
• Add display language selection (Beta) to the profile and user menu #260835.
• Use the browser Accept-Language header to select the UI language on all deployment types when no profile language or locale cookie is set #275996.
• Persist your last selected space in the user profile and restore it on the next visit when Remember last selected space is enabled #268053.
• Set the theme:darkMode default to System so Kibana matches your OS appearance on first visit #273826.
• Search within Inspect flyouts for request and response details, background searches, and saved objects #269744.
• Add UI in Snapshot and Restore to view and set the persistent.repositories.default_repository cluster setting #265592.
• Add create, read, update, and delete routes at /api/tags for saved-object tags while keeping legacy /api/saved_objects_tagging routes deprecated #266220.
• Enforce the form-action Content Security Policy directive, previously available only in report-only mode #267937.
• Add notifications.connectors.default.email as a Docker environment variable #272761.

Machine learning and inference

• Replace the standalone Select data view page with an inline data source picker on AIOps and Data Visualizer pages #266672.
• Show warnings on the Feature settings page when assigned models or endpoints are unavailable #262262.
• Add Manage region preferences to the Elastic Inference Service page, including a Geographies tab for restricting inference routing by geography or cloud region and region availability badges in model details #278461 #277331.
• Add a read-only privilege tier for browsing inference endpoints and Feature settings in Model Management without write access #272204.
• Add Feature settings entries for ai.prompt, ai.summarize, and ai.classify workflow steps so each step can use a model configured per space #268945.
• Show Preview, Deprecated, and End-of-life badges on Elastic Inference Service models and the Feature settings page, with callouts when assigned models are deprecated or past end of life #268083.
• Restructure Feature settings with Use AI features, Global model, and Feature specific models toggles and clearer save validation #266184.
• Improve the Add inference endpoint and Edit inference endpoint flyouts with clearer task-type selection, always-visible endpoint ID, and a footer Save button that remains unavailable until the form passes validation #262143.
• Hide the Elasticsearch service provider from the Add inference endpoint flyout on the External Inference page #261851.
• Prefer Jina Embeddings v5 when installing Elastic documentation on Elastic Inference Service, with ELSER as a fallback #275461.
• Add Token usage tracking for inference calls, and install a token usage dashboard when you enable the setting in GenAI Settings #260956.
• Add SPARKLINE to the recommended ES|QL query for Identify patterns in Log Pattern Analysis #269438.
• Add model memory estimation to the edit-job flyout for anomaly detection and data frame analytics jobs, with Apply on Model memory limit #266590.
• Route anomaly detection and data frame analytics feedback through the shared Give feedback experience with ML-specific questions #265015.
• Restore Start deployment and Update deployment for rerank trained models, and tailor the deployment flyout for rerank models #261119.

Workflows

• Integrate Agent Builder into the Elastic Workflows YAML editor: open the sidebar automatically with What do you want to automate?, and align workflow attachment and diff previews with the editor #276297 #275765 #278343.
• Add human-in-the-loop approval and external input steps to approve, reject, or submit structured input in Kibana or through signed links and Slack notifications #275273.
• Add a built-in Agent Builder tool to list recent workflow runs without an execution ID #269335.
• Add a cases.removeTags workflow step to remove tags from a case in one step #268465.
• Add a cases.pushCases workflow step to push cases to their external connectors #267539.
• Add case workflow triggers so workflows can start when cases are created, updated, change status, receive attachments, or receive comments #257284.
• Make Elastic Workflows version history generally available, recording every save so you can compare versions and restore a previous definition #276311.
• Add a queue concurrency strategy so excess runs wait in a durable backlog until a slot opens, with configurable queue-size and queue-ttl #268596.
• Add a date range filter when you select a historical workflow or step execution for replay or testing #266706.
• Show a read-only workflow graph in the editor when Elastic Workflows: Experimental Features is enabled in Advanced Settings #276383.
• Sort the Name and Enabled columns in the Elastic Workflows list #271286.
• Add optional descriptions to ai.classify step categories to provide richer classification context #271134.
• Support built-in JSON Schema input types with $ref: '#/kibana/definitions/' in workflow YAML for validation, autocomplete, and automatically filled manual-run inputs #270006.
• Combine Triggers and Steps into one Triggers and Steps column in the workflows list #269454.
• Add go-to-definition in the workflow YAML editor for template references to steps, inputs, constants, and variables #259339.
• Make the search.rerank workflow step available across Kibana deployments so you can reorder documents by relevance using a rerank inference endpoint #263706.

Original source

Elastic Cloud Serverless now supports Azure Private Link, generally available (GA) as of August 4, 2026. With this release, you can connect your Azure workloads directly to your Serverless projects over Azure's private network backbone without exposing your Elastic endpoints to the public internet. AWS PrivateLink support shipped in February 2026; Azure is the second cloud provider to reach GA.

What Azure Private Link does

When you associate an Azure Private connection policy with a Serverless project, traffic between your Azure Virtual Network and Elastic travels entirely within Azure's network fabric. The public Elastic endpoints remain resolvable, but once a policy is attached, any request that does not arrive through a matching private endpoint or IP filter is rejected with 403 Forbidden. There is no separate "private endpoint only" toggle; the policy attachment itself enforces the access boundary.

The connection runs through an Azure private endpoint in your VNet. Elastic hosts a Private Link service on our side; you create the private endpoint in your subscription, and Elastic auto-approves it when your VNet is whitelisted by a policy you create. All data — ingestion, search, and Kibana — travels through that private path.

On Azure, a private connection policy is required (not optional). The policy carries the resource IDs of the private endpoints you want to admit, and Elastic uses it to auto-approve connection requests. This differs from AWS, where the policy is optional, and you can approve connections manually.

For the list of supported Azure regions, see Elastic Cloud Serverless regions. Due to a limitation in Azure, Private Link support is not yet available in northeurope region even though Elastic Cloud Serverless is.

How to set it up

The full configuration steps are in the Azure private connectivity documentation. At a high level:

• In Azure, create a private endpoint pointing to the Elastic Private Link service for your project.
• Update your DNS to resolve the Elastic endpoint hostnames to the private IP of your endpoint.
• In Elastic Cloud, create a private connection policy and add the Resource name and Resource ID of your private endpoint. Elastic uses properties.resourceGUID from the Azure resource — the field labeled Resource ID in the Azure portal.
• Optionally, you can associate the policy with your Serverless project in Elastic Cloud Console.

You can create up to 1,024 network security policies per organization with up to 128 sources (private endpoints or IP ranges) per policy. A single policy can be shared across multiple projects.

IP filters and private endpoints can coexist. When you attach both an IP filter policy and a private connection policy to the same project, each incoming request must match at least one attached policy; it does not need to match all of them. Traffic arriving through the private endpoint matches the private connection policy. Traffic arriving from a listed IP range matches the IP filter. Any traffic that matches neither is rejected.

Packaging and availability

Private connectivity for Serverless is included in the following tiers at no additional charge and is effective August 4, 2026:

• Observability Serverless projects: require Observability Complete
• Security Serverless projects: require Security Analytics Complete
• For other project types, such as Elasticsearch Serverless projects, the feature is available with no tier requirement.

Projects created before August 4, 2026 are grandfathered regardless of tier. Any Serverless project created before that date can use traffic filtering — both private connections and IP filters — without restriction for the project's lifetime. This applies even if the project is not currently using traffic filtering; projects created before the cutoff date can configure it at any time.

If you upgrade an observability or security project to the Complete tier after August 4, the platform automatically applies your default network security policies to the newly eligible project — no manual reconfiguration needed.

Gating is enforced in both the Elastic Cloud Console UI and the API. Projects that do not meet the tier requirement and were created on or after August 4 will not have the option to associate a private connection or IP filter policy.

Private connectivity across cloud providers

Azure Private Link now joins AWS PrivateLink, which has been available for Serverless since February 2026, as part of Elastic's ongoing investment in network security across major cloud providers. For the current list of supported providers and regions, see the private connectivity documentation.

Frequently asked questions

Does Azure Private Link also work for Elastic Cloud Hosted deployments?

Azure Private Link for Hosted deployments has been available via a separate API. This release covers Elastic Cloud Serverless specifically.

Can I use both an IP filter and a Private connection policy on the same project?

Yes. Each request must match at least one attached policy. A private-endpoint connection matches the Private connection policy; traffic from a listed IP range matches the IP filter. Traffic matching neither is rejected.

Is a policy required on Azure to secure a private connection?

Yes, for Azure Private Link, you must create a policy in Elastic Cloud Console and add your private endpoint’s Resource name and Resource ID before Elastic will approve the connection. This differs from AWS, where the policy is optional. Associating the policy with specific projects is optional and only needed if you want to filter the traffic coming from specific private endpoints.

Do I need a separate endpoint per project or per solution type?

One private connection policy referring to your Azure private endpoint can be attached to multiple projects. Each Serverless project has its own private hostname that uses a private connection. See the documentation for the per-endpoint configuration details.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

Original source

The Elasticsearch Platform

What’s new in Elastic 9.5?

Elastic 9.5 continues the advancement of Elasticsearch in efficiency, visibility, and performance to help make enterprise data more accessible and useful. With Elastic 9.5, users can:

• Store more, query faster, and retain longer with Columnar Mode — Elasticsearch as a native columnar database
• Skip the setup and index tuning with VectorDB index mode and auto-calibration — vector search that works out of the box
• Migrate Prometheus workloads to Elasticsearch with the GA of native Prometheus and PromQL support
• Help reach Alert Zero; the SOC's version of inbox zero — a queue worked down to what actually matters, reached by agents and analysts together
• Build smarter AI agents with the latest Elastic Agent Builder enhancements, including Agent Observability and Monitoring and advanced human-in-the-loop approvals

Read more about these and additional feature highlights below.

Elasticsearch

Elastic 9.5 brings advancements designed to help every user move faster, operate with greater confidence, and get more value from their data with less friction. This release innovates on multiple aspects of the Elasticsearch Platform from storing and querying data to building and governing AI agents alongside Kibana dashboard enhancements. Read on for details.

The multi-signal datastore for any workload

Elastic is pleased to announce the technical preview of Columnar Mode, an opt-in indexing mode that stores each field once in a column store with no inverted index by default, delivering meaningfully smaller storage footprints and a foundation for faster indexing, analytical queries, and longer data retention. It ships alongside existing index modes with zero changes to APIs, dashboards, or integrations. Building on that foundation, Columnar Logs is the first specialized profile purpose-built for log data; it keeps a single inverted index on the message field, so full-text search stays fast while storing everything else fully columnar. The result is significantly less storage than logs use today without changing the search experience teams rely on. Both modes are opt-in and existing indices are untouched.

Vector database

Teams building retrieval for retrieval augmented generation (RAG) applications and agentic AI usually have to make many configuration decisions at index time, and that work grows at production scale. We're introducing these capabilities to take the setup and index tuning off your plate, so vector search works out of the box.

VectorDB index mode delivers high-performance vector search with a single setting; there’s no manual configuration required. It applies defaults already optimized for vectors, tuning quantization, merge policy, and cache loading for you, so vector search is simpler to stand up and performs out of the box.

Auto-calibration for DiskBBQ vector search automatically configures quantization depth, preconditioning, and oversampling based on statistical analysis of the vectors in the index. The tuning that normally takes expertise and experimentation now happens on its own, using unique algorithms developed at Elastic.

Multimodal semantic search makes image search easier for developers. Searching images normally means setting up embeddings, ingesting and embedding images, and embedding the query. The new semantic field simplifies these steps, so users can search images as easily as they search text with semantic_text.

More Agent Builder enhancements!

Elastic 9.5 gives developers greater visibility and control when building AI agents for production. Agent Observability and Monitoring, now available in technical preview, traces large language model (LLM) calls, tool invocations, and reasoning steps as OpenTelemetry (OTel) in Elasticsearch while human-in-the-loop approvals gate sensitive actions and record each decision in an audit trail. Developers can also create skills, queries, and workflows directly from chat by describing the capability they need, such as a workflow to generate a dashboard. Agent Builder then drafts, names, and saves the configuration without requiring them to leave the conversation, reducing setup time and the need to understand the underlying configuration model.

AI-native Kibana

With 9.5, our Dashboards & Visualizations API becomes generally available, providing platform teams with a stable and supported way to create, update, and manage dashboards and visualizations in code. Additionally, dashboards in chat is now GA with improved chat quality as well as controls creation and delivers higher speed. These advancements dramatically reduce time-to-insight and eliminate the need for users to build dashboards manually, expediting incident investigation, where speed to a clear visual directly shortens time-to-resolution. And, for use cases where speed is paramount, toggle-on Fast Mode UI allows STATS-based queries in Dashboards and Discover to run on a sampled dataset instead of scanning full data, extrapolating results back to real scale while keeping accuracy very close to exact.

Enhanced automation where your data lives

Elastic Workflows in 9.5 makes automations faster to build and shows exactly what a workflow will do before it runs. Natural language authoring is now generally available and on by default, so teams can describe the automation they want in plain language that’s generated automatically. Versioning is built in, tracking every change, letting teams compare any two versions, and rolling back to a working one in a click, so there’s always a record of who changed what and when. Visual mode shows a workflow as a graph with its triggers, steps, branches, and logic visible at a glance alongside the YAML; drag-and-drop editing is coming next. And human-in-the-loop now reaches outside Kibana. When a workflow needs a person to approve or weigh in, it pauses and sends the request to tools like Slack. Automation handles the routine while teams stay on top of the decisions that need judgment. These are Elasticsearch Platform capabilities, available across Search, Observability, and Security.

Elastic Observability

Elastic 9.5 delivers observability upgrades designed to make unified monitoring faster to adopt and easier to scale. Whether you're migrating from Prometheus, onboarding Kubernetes, or connecting cloud and SaaS data, it's easier to get started with less operational overhead. Improved SRE workflows, managed integrations, and AI-ready context help teams move from detection to diagnosis faster.

Native Prometheus and PromQL support, now GA

With 9.5, it is easier than ever to consolidate observability with best-in-class metrics. With the Prometheus remote-write endpoint and native PromQL support embedded directly in ES|QL, teams can point existing Grafana dashboards and queries at Elastic with minimal migration effort — no need to abandon the query language and workflows they've spent years building. A new migration tool is also now GA, helping bring Grafana and Datadog dashboards and alerts into Elastic automatically and making it easier for users to benefit from Elasticsearch's storage efficiency (up to 2.5x better than Prometheus) and faster query performance (up to 30x faster than Prometheus) without starting from scratch. In 9.5, a new codec (ES95) builds on Elasticsearch's already substantial efficiency gains with columnar metrics to push storage costs down a further ~20% to roughly 3 bytes per sample, so users can monitor more services and retain metrics longer without ballooning the bill. Along with dashboards-as-code and dashboards in chat, these updates let users unify metrics, logs, and traces on a single platform and correlate across all three for faster root cause analysis while keeping the workflows and standards they already rely on.

Complete integrations fully loaded with AI

Elastic's latest out-of-the-box integrations for Kubernetes and AWS (tech preview) mean you can go from zero to fully monitored in minutes. Kubernetes monitoring is now GA and ships complete with preconfigured dashboards, alerts, SLOs, and machine learning jobs. Plus, Agent Skills and an Observability MCP app make health monitoring, anomaly detection, incident investigation, and remediation available through any MCP-enabled AI tool where SREs already work. These comprehensive integration packages enable teams to get immediate value from metrics from the moment they connect.

Easier onboarding of cloud native data

Elastic managed integrations eliminate the operational burden of ingesting cloud data sources. With just a few clicks, users can now ingest and start getting value without deploying or maintaining on-prem agents. In the spirit of the “easy button,” we’ve also simplified Kubernetes and AWS onboarding by streamlining both setup flows to default to the recommended OTel path, meaning platform engineers and SREs can get up and running without navigating multiple screens and decisions.

Enhanced APM and LLM observability

9.5 delivers a major quality of life improvement for SREs and developers investigating service incidents. Dependency analysis in alerts and dashboards introduces a faster route to triage, eliminating context-switching by surfacing service maps directly in an alert or custom dashboard. Better surfacing of anomalies in APM service health views makes ML-based degradation signals easier to spot.

Elastic’s new Anthropic integration for LLM observability polls Anthropic's Admin APIs to ingest organization-wide telemetry from the Claude API platform, token usage, cost, and rate limit configuration into Elasticsearch with prebuilt Kibana dashboards and out-of-the-box alerts.

Identify dependencies directly on your alert detail pages.

Elastic Security

Elastic Security 9.5 gives analysts more time to decide and fewer alerts to sort. Stronger endpoint protection stops more threats before they ever raise an alert. Attack Discovery works the alerts that do fire the way an analyst would, surfacing the real attacks so that teams don't start their day buried in raw alerts. And automation runs underneath it all, triggering those investigations and handling the mechanical work, so the decisions stay with analysts.

Alert Zero: From alert queue to validated threats

Alert Zero is the SOC's version of inbox zero, a queue worked down to what actually matters, reached by agents and analysts together. It’s a goal teams move toward. It doesn't mean zero alerts, and it doesn't mean replacing the analysts. Attack Discovery is what gets a SOC closer to Alert Zero. It now investigates like an analyst by threat-hunting raw events, checking entity risk, and corroborating beyond the alerts that first fired before it calls anything an attack, so teams open a short list of validated attacks instead of a wall of raw alerts. When it finds something the rules missed, it drafts an ES|QL rule to close the gap with an analyst approving before anything is saved.

Every run goes through the same investigation now, whether kicked off manually, set on a recurring cadence, or triggered from an Elastic Workflow. A separate alert analysis workflow works the noise from the other side, classifying alerts as true or false positives so that analysts stop losing hours to low-fidelity ones, leaving Attack Discovery a cleaner set to investigate.

Enhanced endpoint protection

With Elastic Security 9.5, new endpoint capabilities make protection stronger and extend coverage across more devices. For vulnerable drivers, which attackers bring in already signed and trusted to reach the kernel, our threat research team monitors public disclosure sources like VirusTotal, loldrivers.io and Microsoft's blocklist. Through an always-on process, Elastic automatically generates and instantly deploys YARA rules as new drivers are disclosured, so protection keeps pace instead of waiting on a release cycle. That speed matters when AI-driven attacks can move from one machine to the next in under a minute, faster than any response workflow can react. Windows on ARM is now fully covered in Elastic Defend, bringing Surface and other ARM-based laptops into full coverage. And a new endpoint troubleshooting skill in Agent Builder flags policy and performance issues, so teams spend less time chasing endpoint problems.

Automation across your SOC

Elastic Workflows brings native automation to the SOC, so a detection can trigger enrichment, case creation, and response automatically with no separate SOAR to buy, integrate, or maintain. Humans stay on the decisions that need judgment.

In case you missed it …

In between stack releases, we’re not just resting on our laurels. The time between Elastic 9.4 and 9.5 was anything but quiet. Here's a roundup of some key announcements ICYMI:

• Jina AI updates:
  • jina-embeddings-v5-omni extends the v5-text model family with native image, audio, and video support, carrying nearly 100 languages across all four modalities in a single embedding space with no reindexing required.
  • Jina On-Prem is now available for teams with strict data residency requirements. It packages the full Jina AI model lineup (e.g., reader, embedding, and reranking) to run entirely on your own hardware, fully air-gapped with zero outbound calls once deployed. Costs are fixed and predictable, not metered per token. The embedding models search text, images, audio, and video across nearly 100 languages in a single embedding space with accuracy that rivals much larger models on commodity hardware.
  • We've released jina-reranker-v3.5, a drop-in successor to jina-reranker-v3. jina-reranker-v3.5, at just 600M parameters, beats its predecessor by 50%+ on case law with further gains on medical and financial reranking and runs up to 56% faster on long documents. Against Qwen3-Reranker-4B, a widely used open source reranker more than seven times its size, it wins outright on general-purpose search and one structured-data benchmark and closes most of the remaining gap everywhere else.
• Reindex from remote is now generally available in Elastic Cloud Serverless, giving teams a seamless way to migrate indices from any Elastic Cloud Hosted deployment or Serverless project, regardless of region, directly into their Serverless environment. The operation is built for the realities of Serverless infrastructure; it automatically resumes through node shutdowns triggered by scaling events or software deployments, so your migration keeps moving without manual intervention.

Start here now

Elastic 9.5 is packed to the brim with new and enhanced features ready to help organizations get the most out of their data.
Elastic 9.5 is now available on Elastic Cloud, the hosted Elasticsearch service that includes all of the new features in this latest release.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

In this blog post, we may have used or referred to third party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use.

Elastic, Elasticsearch, and associated marks are trademarks, logos or registered trademarks of elasticsearch B.V. in the United States and other countries. All other company and product names are trademarks, logos or registered trademarks of their respective owners.

Original source

Features and enhancements

Authentication:

• Upgrade OpenTelemetry in ms-graph-authz [#151968]

ES|QL:

• Implement watchdog timeout for GROK [#152851]

Inference:

• Update commons-text library version to match commons-lang3 [#152092]

Infra/Core:

• Upgrade jackson [#152163]

Machine Learning:

• Add EuroBERT and Jina v5 ops to graph validation allowlist [#3015]
• Downgrade log severity for a batch of recoverable errors [#2889]
• Harden pytorch_inference with TorchScript model graph validation [#3008] (issue: [#2890])
• Improve adherence to memory limits for the bucket gatherer [#2848]
• Improve error handling for quantiles state documents [#2894]
• Improve handling of invalid JSON state documents [#2895]
• Improve messaging for OOM process termination [#2841]
• Report the actual memory usage of the autodetect process [#2846]
• Restrict file system access for PyTorch models [#2851]
• Update the PyTorch library to version 2.7.1 [#2863]

Fixes

Aggregations:

• Avoid OOMs by accounting for memory during cardinality agg reduction phase [#152773] (issue: [#150290])
• Fix NPE when aggregation param scripts return null [#152152] (issue: [#136639])

Authentication:

• Fix Clone API Key silently dropping fields that follow a null expiration [#152874]

Authorization:

• Fix data stream privilege checking [#148179]
• Improve simulate bulk action authz [#152148]

ES|QL:

• Avoid dense run-length allocation in HLL [#152035]
• Call Project.output() only when Project.expressionsResolved() is true [#151697] (issue: [#149681])
• Fix UnsupportedOperationException for partially unmapped keyword fields with multi-fields [#150676] (issue: [#150667])
• Fix errors and warnings with spatial functions that parse invalid BBOX [#152877] (issue: [#152876])
• Resolve prefixed searchable-snapshot backing indices to their data stream in METRICS_INFO/TS_INFO [#153128]
• Resolve NoSuchElementException in ViewUnionAll analyzer retries [#152867]
• Treat empty list query parameters as null [#152098] (issue: [#152271])

Geo:

• Fix infinite loop in GeoLineDecomposer dateline crossing checks [#152096] (issue: [#152066])

Inference:

• Translate tools and tool_choice to Anthropic format for Google Model Garden Anthropic chat completion [#152427]

Ingest Node:

• Include ingest metadata in self reference checks [#152932]

Machine Learning:

• Automatically repair ML anomaly results aliases pointing at a .reindexed-v7 index [#147688] (issue: [#147686])
• Extend AD results template for reindexed indices and generalize heal beyond job_id mapping [#153755] (issue: [#147686])
• Fix ML jobs stuck in starting state on Serverless trial projects [#150362]
• Fix flaky CIoManagerTest/testFileIoGood test [#3017]
• Retry datafeed STARTED state write on system reassignment [#151399]
• Roll reindexed ML state indices in daily maintenance [#149555]

Mapping:

• Fix flattened field array-offset corruption with preserve_leaf_arrays: exact [#153043] (issue: [#153014])

Network:

• Fix remote write with audit request bodies [#153581] (issue: [#152713])

Search:

• Add more defensive protections when parsing query_string [#152385]
• Apply search timeout to the DFS phase query rewrite [#153479]
• Apply search timeout to the query rewrite step [#153082] (issue: [#104187])
• Fork ensureShardSearchActive callbacks off the refresh thread [#152509] (issue: [#97280])
• Return a 400 (Bad Request) for invalid tokens in a script query [#152476]
• Trip request breaker on big completion suggest size/shardSize [#152552]
• Trivial hardening of data URI validation [#152664]

Snapshot/Restore:

• Fix snapshot creation on CIFS shares in case of access denied exception [#153219] (issue: [#152053])

TSDB:

• Ignore OTLP number data points without a value [#152733]

Transform:

• Tighten retry startup logic [#152803]

Original source

The 9.3.8 release contains fixes for potential security vulnerabilities. For details, go to security announcements.

Features and enhancements

Authentication

• Upgrade OpenTelemetry in ms-graph-authz [#151968]

ES|QL

• Implement watchdog timeout for GROK [#152851]

Inference

• Update the commons-text library version to match commons.lang3 [#152092]

Infra/Core

• Upgrade Jackson [#152163]

Machine Learning

• Better messaging regarding OOM process termination [#2841]
• Improve adherence to memory limits for the bucket gatherer [#2848]
• Report the actual memory usage of the autodetect process [#2846]
• Restrict file system access for pytorch models [#2851]
• Update the PyTorch library to version 2.7.1 [#2863]

Fixes

Aggregations

• Avoid out-of-memory errors by accounting for memory during the cardinality aggregation reduction phase [#152773] (issue: [#150290])
• Fix non-monotonic T-Digest centroids caused by floating-point errors [#151979]
• Fix null pointer exception when aggregation parameter scripts return null [#152152] (issue: [#136639])

Authorization

• Fix data stream privilege checking [#148179]
• Improve authorization for the simulate bulk action [#152148]

ES|QL

• Avoid dense run-length allocation in HyperLogLog [#152035]

Geo

• Fix infinite loop in GeoLineDecomposer dateline crossing checks [#152096] (issue: [#152066])

Inference

• Translate tools and tool_choice to Anthropic format for Google Model Garden Anthropic chat completion [#152427]

Ingest Node

• Include ingest metadata in self-reference checks [#152932]

Machine Learning

• Automatically repair ML anomaly results aliases pointing at a .reindexed-v7 index [#147688] (issue: [#147686])
• Extend the anomaly detection results template for reindexed indices and generalize healing beyond job_id mapping [#153755] (issue: [#147686])
• Fix ML jobs stuck in starting state on Serverless trial projects [#150362]
• Roll reindexed ML state indices in daily maintenance [#149555]

Search

• Add defensive protections when parsing query_string [#152385]
• Apply search timeout to the DFS phase query rewrite [#153479]
• Apply search timeout to the query rewrite step [#153082] (issue: [#104187])
• Fork ensureShardSearchActive callbacks off the refresh thread [#152509] (issue: [#97280])
• Return a 400 (Bad Request) for invalid tokens in a script query [#152476]
• Trip request breaker on large completion suggest size/shardSize [#152552]

Snapshot/Restore

• Fix snapshot creation on CIFS shares when an access-denied exception occurs [#153219] (issue: [#152053])

TSDB

• Ignore OTLP number data points without a value [#152733]

Transform

• Tighten retry startup logic [#152803]

Original source