Explore Elasticsearch 9.0: Performance Boosts, AI Features & Security Upgrades

Release Overview

Elasticsearch 9.0 was officially released on 2025-04-15, built on Lucene 10.1.0, and is shipped together with version 8.18.

Lucene 10 Upgrade

Lucene 10 introduces improved parallel processing, smarter indexing algorithms, and hardware‑level optimizations that increase throughput for large‑scale data workloads. When deploying Elasticsearch 9.0, set xpack.ml.enabled: false to avoid ML‑related startup errors.

Reference: https://github.com/apache/lucene/milestone/2

Key New Features

Better Binary Quantization (BBQ)

BBQ compresses each vector dimension to a single bit, dramatically reducing storage and memory usage while preserving search quality. Benchmarks show up to a five‑fold speed increase for dense‑vector search compared with OpenSearch.

Elastic Distributions of OpenTelemetry (EDOT)

EDOT provides native OpenTelemetry support for Elasticsearch components, exposing trace, metric, and log signals without additional agents. This simplifies instrumentation in multi‑cloud and hybrid environments.

More information: https://www.elastic.co/observability-labs/blog/elastic-distributions-opentelemetry

LLM Observability

The new observability UI tracks generative AI models (Amazon Bedrock, Google Vertex AI, Azure OpenAI, OpenAI). It records latency, error rates, prompt and response payloads, usage counts, and cost metrics, enabling end‑to‑end monitoring of LLM‑powered applications.

Attack Discovery & Automatic Import

AI‑driven security analysis automatically discovers potential threats and can import external threat‑intelligence feeds, reducing manual rule creation and improving detection coverage.

ES|QL Enhancements

ES|QL (Elasticsearch Query Language) adds several capabilities:

INLINESTATS command for inline statistical aggregations.

Semantic search on the semantic_text field type.

KQL functions are now usable inside ES|QL queries.

Access to the _score field for custom ranking.

Code Example

DELETE test
PUT /test
{
  "mappings": {
    "properties": {
      "a": {"type": "integer"},
      "b": {"type": "integer"}
    }
  }
}
POST test/_bulk
{ "index": {} }{ "a": 5, "b": 2 }
{ "index": {} }{ "a": 3, "b": 2 }
{ "index": {} }{ "a": 4, "b": 3 }
{ "index": {} }{ "a": 2, "b": 3 }
{ "index": {} }{ "a": 6, "b": 1 }
{ "index": {} }{ "a": 1, "b": 1 }

POST test/_search

POST /_query?format=txt
{
  "query": """
    FROM test
    | EVAL ab = a * b
    | STATS m = MAX(ab) BY b
  """
}

Elastic Cloud Availability

Both Elasticsearch 9.0 and 8.18 are offered as fully managed services on Elastic Cloud, allowing rapid provisioning of search, observability, and security workloads without managing underlying infrastructure.

References

Elasticsearch 9.0 release notes: https://www.elastic.co/guide/en/elastic-stack/9.0/release-notes-elasticsearch-9.0.0.html

What’s new in 9.0 guide: https://www.aidoczh.com/elasticsearch/release-highlights.html