What Is New in Elasticsearch 7.4
| Category | Key Updates |
|---|---|
| New Features | Vector tiles for zoomable maps, Data frame analytics for outlier detection, New EQL (Event Query Language) |
| Enhancements | Faster top k queries, Frozen index improvements, SQL query performance gains |
| Deprecations | Deprecated Java transport client, Several /_xpack endpoints removed |
| Bug Fixes & Security | Multiple stability and security patches, including a fix for a leak in the Netty library |
How does Elasticsearch 7.4 improve mapping and search?
This release introduces the search_as_you_type field, a game-changer for building responsive autocomplete experiences. It indexes prefixes and shingles automatically, delivering fast lookahead results without complex ngram configurations. In practice, this means simpler mappings and more intuitive prefix, infix, and phrase matching directly out of the box.
For complex event processing, the new Event Query Language (EQL) allows you to search for sequences of events across time series data. This is huge for security and operational analytics use cases where correlating events is more valuable than just filtering them.
What geospatial capabilities were added?
Elasticsearch 7.4 adds support for vector tiles in Kibana, enabling highly performant and zoomable maps. This moves beyond static raster tiles by sending vector data to the client for rendering, which results in sharper visuals and a smoother user experience when panning and zooming.
The underlying geo_shape field also got smarter with the introduction of the shape_relation parameter for the geo_grid query. You can now check if a shape is within, contains, or intersects a grid cell more precisely.
Are there new machine learning features?
Yes, data frame analytics now includes outlier detection. This unsupervised ML job identifies unusual entries in your data, which is perfect for spotting anomalies in fraud detection or system monitoring. It works right alongside your existing classification and regression jobs.
The results are stored in an new index, and you can use the standard Kibana ML UI to analyze and interpret the findings. This integration makes it straightforward to operationalize outlier detection without switching contexts.
What performance optimizations should I know about?
The performance of top k queries, like those used for aggregations, has been significantly improved. The team reworked the logic for the terms aggregation when size is less than 50, which is a very common scenario. You should see faster response times on your dashboards and aggregated searches.
Frozen indices are now more practical with reduced overhead. The process of searching them is more efficient, making this cold storage tier a more viable option for archiving large volumes of data you still need to query occasionally.
FAQ
Is the Java Transport Client finally gone?
It's on its way out. The Transport Client is deprecated in 7.4. You should be moving to the High Level REST Client for all new development. The deprecation warnings in the logs are your signal to start migrating.
What's the deal with the Netty leak fix?
A bug in the Netty library could cause a direct buffer memory leak under certain heavy load conditions. This patch is crucial for long-running clusters with high throughput to maintain stability and prevent out-of-memory errors.
Can I use SQL to query EQL sequences?
No, EQL and SQL are separate query domains. EQL is specifically designed for event sequences in time-series indices, like those used for logging or security events, while SQL is for structured querying and aggregation.
Does the new search_as_you_type field replace ngrams?
In many autocomplete cases, yes. It handles prefix, infix, and phrase completion internally, so you no longer need to configure custom ngram analyzers for basic type-ahead functionality. It simplifies the mapping considerably.
Are frozen indices now as fast as regular indices?
No, they are still slower because they are unloaded from memory after each query. The improvement in 7.4 reduces the overhead of the process, making them less slow than before, but they are not a replacement for hot indices.