Elasticsearch 7.2: What's New, Release History & Support Lifecycle

What Is New in Elasticsearch 7.2

Elasticsearch 7.2 delivers significant enhancements in data ingestion, security, and query performance. This release focuses on making it easier to work with time series data and tightening cluster security out of the box.

How does Elasticsearch 7.2 improve data transformation?

This release introduces Data Frame Transforms, a powerful feature for pivoting your data into a new entity-centric index. It's designed for aggregating and summarizing large datasets, which is perfect for creating reporting indices or preparing data for machine learning jobs.

You define a transform with a source index, an aggregation query, and a destination index. The transform will continuously run in the background, making it a set-and-forget operation for creating new summarized datasets from your incoming data.

What security changes should I be aware of in 7.2?

Elasticsearch 7.2 now enables TLS for internode communication by default on basic license levels. This means traffic between nodes in your cluster is encrypted right from the start, a major step up for securing cluster traffic without extra configuration.

New built-in roles like `viewer` and `editor` are also included. These provide more granular, read-only or write-only permissions, making it easier to adhere to the principle of least privilege when assigning access to users.

Are there performance improvements for geo queries?

Yes, geo-point queries have seen substantial performance gains. The underlying Lucene library improvements make common geo queries like `geo_distance` and `geo_bounding_box` significantly faster, which is a big deal for applications with heavy location-based searching.

In practice, this reduces latency for queries that find documents within a specific geographic area. You'll see the most benefit if your use case involves real-time location filtering on large datasets.

What's new for managing time-series data?

Index Lifecycle Management (ILM) is now generally available. It lets you automate how you handle indices over time, like moving them from hot to warm storage based on age or size and eventually deleting them. This is essential for managing the lifecycle of time-series data such as logs and metrics without manual intervention.

You define policies that attach to indices, and Elasticsearch handles the transitions between phases (hot, warm, cold, delete) automatically. This replaces the need for external tools like Curator for most common lifecycle operations.

Has the EQL language been updated?

The Event Query Language (EQL) syntax has been expanded with a new `sample` command. This allows you to retrieve matching events without having to sequence them first, which is useful for getting a quick sample of relevant data during investigations.

EQL itself is powerful for tracing sequences of events, like a process execution chain in security data. The new `sample` command adds flexibility for the initial discovery phase of an analysis.