Elasticsearch 7.12: What's New, Release History & Support Lifecycle

What Is New in Elasticsearch 7.12

Elasticsearch 7.12 delivers significant enhancements in search speed, data resilience, and operational simplicity. This release focuses on making frozen indices a first-class citizen and streamlining how you manage data across different tiers.

How does searchable snapshot change cold storage?

Searchable Snapshot moves out of beta and into General Availability, fundamentally changing how we interact with cold data. You can now mount a snapshot as a searchable index directly from a repository like S3, without a full restore.

In practice, this turns your object storage into an extension of your cluster. Queries on these mounted indices are a bit slower than on local shards, but the trade-off in cost savings for archival data is massive. You effectively get read-only, searchable access to your entire historical dataset without the overhead of keeping it all on hot storage.

What's new for managing data streams?

Data streams now support index lifecycle management (ILM) natively, making it the recommended way to manage time-series data like logs and metrics. This integration automates the entire lifecycle from hot to frozen tier.

You define one policy that handles rollovers, forcemerges, and the transition to searchable snapshots. This is a huge step up from manually configuring ILM for each index template. It simplifies operations significantly by treating a stream of data as a single, manageable entity.

Are there any performance boosts for search?

Yes, this release includes several under-the-hood optimizations. Most notably, GeoIP database lookups are now faster due to a more efficient binary format. This speeds up any ingestion pipeline or search that relies on geo-enrichment.

Cross-cluster search (CCS) also gets a performance bump. The coordinating node now handles remote clusters more intelligently, reducing overhead and improving query latency when you're searching across multiple deployments. These are the kinds of incremental gains that add up in large-scale environments.

How is alerting integrated now?

Elasticsearch now has a built-in alerting feature that works alongside Kibana's alerting framework. You can manage and execute alerts directly from Elasticsearch, which is crucial for use cases where Kibana isn't present or for automated systems.

This matters because it decouples alerting execution from the Kibana UI. Your automated infrastructure can now trigger alerts based on Elasticsearch data without any intermediate steps, making your monitoring stack more robust and scriptable.

What's improved in Event Query Language (EQL)?

EQL, the language for tracing events, now supports sequences. This allows you to query for a series of related events that occur in a specific order, which is fundamental for sophisticated security hunting or tracing a user journey.

For example, you can now write a query to find a process start event followed by a network connection event. This moves EQL beyond simple event correlation into true causality tracking, which is exactly what security analysts need for investigating threats.