Product release

Elastic Stack 6.3.0 Released

Editor's Note (August 3, 2021): This post uses deprecated features. Please reference the map custom regions with reverse geocoding documentation for current instructions.

Want to learn more about the differences between the Amazon Elasticsearch Service and our official Elasticsearch Service? Visit our AWS Elasticsearch comparison page.

6.3.0 is here.

There are some releases that fix bugs. There are some releases that add features. There are some releases that do both, and make a fairly major change in how you are entitled to interact with the software…this is of the latter variety. You should download it now or use it via the Elasticsearch Service (your favorite hosted Elasticsearch and Kibana provider).

Opening X-Pack

If you've followed along from Elastic{ON}, or on the website, you will know that we are Doubling Down on Open by opening the code of our X-Pack features. The previously linked blog explains the thought process and dives into the details. But, to summarize:

As of the 6.3 release, in the $PRODUCT (Elasticsearch, Kibana, Beats, and Logstash) repositories:

  • All existing Apache 2.0-licensed code maintains the same license, nothing changes.
  • We will create a new X-Pack folder, and move the x-pack-$PRODUCT code into that folder under the Elastic License allowing for some derivative works and contribution.
  • We will change the top-level license to simply note that some files in the repo are Apache 2.0 and some are covered by the Elastic License.

Also, X-Pack features will now be bundled into the default distribution. All free features are included and enabled by default and will never 'expire', and commercial features are opt-in via a trial license. The license for free features never expires, you no longer need to register to use these capabilities. In addition to this, an Apache 2.0-only distribution will be created for download.


Hot on the heels of GA of APM, we are adding new features. Including the oft-requested capability of generating watches that alert you to errors in your APM data. With the new Watcher Assistant UI you are able to specify an error group occurrence threshold and a trigger schedule. At a fixed interval, you will receive an email or slack notification if an error group has more than the specified number of occurrences.

APM Watcher Integration


The summary, or aggregation, of features is in the detail post.

  • SELECT delight FROM feature WHERE MATCH(featurename, 'SQL') - It's here. It's experimental. Your feedback will help us make it even better.
  • Rollups - Depending on your use case, the relative value of data may decrease over age. Take historic data and generate aggregate statistics directly in Elasticsearch.


Visualize the future of interacting with your data in the detail post because there is MUCH more than can be listed here.

  • Auto-complete in the Query bar - Enjoy using the new language for Kibana's query bar but want autocomplete. Yup, it's here.
  • Recently viewed - Spend a fair bit of time in Kibana? You'll <3 the ability to quickly jump back to where you left off.
  • Index management - A UI for managing indexes is now available in the Management section. Browse your indexes, see details about an individual, and change some options (close, force merge, clear cache, etc.) directly from the UI.


Grok the details in the detail post.

  • Persistent Queues - Significant fixes for PQ. But be aware, an upgrade requires draining or deleting the queue
  • Multi-staged processing pipelines - You want to connect pipelines within a Logstash process? The pipeline inputs and outputs feature, in Beta, might be your processing best friend.
  • Java execution - Substantial work has gone into the Java pipeline execution engine. This is a major refactor of a core piece of Logstash and your testing will help us get it dialed in for the future.


If you want all the details, 'Go' read the detail post.

  • Kubernetes & Docker - The Autodiscover feature allows for configuration via Kubernetes annotations or Docker labels. Keep your logging and monitoring config near the app deployment config!
  • Syslog input - With this release, you can send logs to Filebeat using syslog over UDP or TCP.
  • New modules - Moar modules. Moar simplicity. There are now Filebeat modules for MongoDB, Logstash, and IIS. Also, we've added Metricbeat modules for Etcd, Graphite, Logstash, and Munin.


  • Machine Learning jobs can now take advantage of Elasticsearch's Cross Cluster Search.
  • New Validate Job option allows users to test their ML configuration during ML Job creation and provides feedback and suggestions on the configuration.
  • Additional options for custom URL link within ML jobs to link to Discover and/or APM interface with ML job filters.


Map your eyes over all the details in the detail post.

  • Spark 2.3 support - It's here starting in 6.3
  • Bug Fixes - Fixing things never felt so good. Including fixes in serialization code, array data types, nested data, field filtering, etc.

Get It Now!