How we built PromQL into Elasticsearch
PromQL runs on the same Elasticsearch compute engine as ES|QL, with no plugin and no separate process to operate. Getting there meant changing how the engine evaluates time windows and builds grouping keys.
One query, three data sources: ES|QL subqueries get FROM, TS and ROW
Filter application logs by live metric behavior and combine indexed data with inline test values. Your filter lists pull from time-series data on the fly, so nothing is hard-coded.
One ES|QL query instead of two: WHERE IN subquery replaces the copy-paste loop in Elasticsearch
ES|QL's WHERE clause can filter by another Elasticsearch subquery's results instead of a static ID list you copied by hand, with nested subqueries, NOT IN and compound conditions built in.
Elasticsearch ES|QL: Now with Views, Subqueries, and Schema-on-Read
Query fields you never mapped, combine indices with different schemas in one pipeline, and reuse query logic as named views. ES|QL's most significant data access expansion yet.
Elasticsearch query logs: One coordinator-level line per query for ES|QL, DSL, SQL, and EQL
Easily understand query impact on cluster performance with Elasticsearch query logs. One coordinator-level line records ES|QL, DSL, SQL, and EQL per request and provides full query text, tracing, optional user context, and CCS hints
From Elasticsearch runtime fields to ES|QL: Adapting legacy tools to current techniques
Learn how to migrate five common Elasticsearch runtime field patterns to their ES|QL equivalents, with side-by-side code comparisons and guidance on when each approach makes sense.
Lexical and semantic search with Elasticsearch
In this blog, we'll explore various approaches to retrieving information using Elasticsearch, focusing on lexical and semantic search.