Last checked and updated on 10 Jun 2026
What Is New in Elasticsearch 6.5
Elasticsearch 6.5 delivers significant enhancements across search, indexing, and management. This release focuses on improving the developer experience with better SQL support and new index management features.
| Category | Key Updates |
|---|---|
| New Features | SQL access, Index Lifecycle Management, Frozen Indices, Painless Scripting enhancements |
| Improvements | Cross-cluster replication, CCR monitoring, Snapshot lifecycle management |
| Bug Fixes | Various fixes for aggregations, mappings, and node discovery |
How does SQL integration work in 6.5?
Elasticsearch 6.5 introduces a dedicated SQL interface that translates SQL queries into native Elasticsearch DSL. You can now run SELECT statements directly against your indices using REST API or the new CLI.
This matters because it allows database engineers and analysts to interact with Elasticsearch using a familiar language without learning the intricacies of the query DSL. The translation handles WHERE clauses, aggregations, and sorting efficiently.
POST /_xpack/sql?format=txt
{
"query": "SELECT * FROM library ORDER BY page_count DESC"
}What are Frozen Indices and when should I use them?
Frozen Indices are a new read-only index state designed for high-density storage of historical data. They allow you to "freeze" infrequently accessed indices, reducing memory overhead while keeping them searchable.
In practice, you'd use this for archival data that you rarely query but need to keep available. Searching a frozen index is slower than a regular index, but the memory savings are substantial - often reducing heap usage by 90% or more.
POST /my_index/_freeze
POST /my_index/_unfreezeHow does Index Lifecycle Management simplify operations?
Index Lifecycle Management (ILM) provides automated policy-based management for indices through their lifecycle. You define policies that automatically handle rollovers, transitions between hot/warm/cold phases, and eventual deletion.
This eliminates manual curation of time-series data. Instead of writing scripts to manage index rotation, you declare policies like "move to warm after 30 days" and "delete after 365 days" - the system handles the rest.
What Painless scripting improvements should I know about?
Painless scripting gets major enhancements including support for regular expressions and additional methods for String manipulation. The new =~ operator allows regex matching directly in scripts.
These additions make data transformation and conditional logic much more powerful. You can now perform complex string operations like pattern matching and extraction without needing workarounds.
if (ctx.message =~ /error.*disk/) {
ctx.severity = "CRITICAL";
}How is cross-cluster replication monitoring improved?
Cross-cluster replication (CCR) now exposes detailed monitoring metrics through the API. You can track replication lag, check operation status, and monitor transfer rates between clusters.
This visibility is crucial for production deployments where you need to ensure data is replicating properly between datacenters. The metrics help identify bottlenecks and validate that your follower indices are keeping up with leader indices.
FAQ
Can I use SQL JOIN operations between indices?
No, the SQL implementation in 6.5 doesn't support JOIN operations between different indices. Each SQL query operates on a single index or index pattern, similar to how Elasticsearch traditionally handles queries.
Do Frozen Indices affect my shard allocation?
Yes, frozen indices behave differently regarding shard allocation. They have specific memory management that allows them to be allocated to data nodes without consuming significant heap space, enabling much higher index density per node.
Is Index Lifecycle Management compatible with existing index templates?
Yes, ILM policies work alongside existing index templates. You can add a lifecycle policy to your template definition, and new indices created from that template will automatically follow the specified policy.
What regex features are supported in Painless?
Painless supports basic regex matching using the =~ operator, which follows Java's pattern matching syntax. However, it doesn't support all advanced regex features available in other languages - stick to basic patterns for best results.
Can I monitor CCR through Kibana instead of the API?
Yes, the CCR monitoring metrics are exposed through the Elasticsearch monitoring APIs that Kibana uses. You can create custom dashboards in Kibana to visualize replication status and performance across your clusters.