What Is New in Elasticsearch 7.5
Elasticsearch 7.5 delivers significant enhancements across search, observability, and security. This release introduces vector fields for machine learning, improves cross-cluster search, and adds new snapshot lifecycle management capabilities.
| Category | Key Updates |
|---|---|
| New Features | Vector fields, New EQL syntax, CCS minimatch, SLM retention |
| Enhancements | Faster rank_feature queries, GeoIP processor performance, Painless default methods |
| Bug Fixes | Over 100 issues resolved across clustering, indexing, and search |
| Deprecations | Deprecated the `_threadpool` and `_nodehotthreads` endpoints |
How does Elasticsearch 7.5 improve machine learning workflows?
The introduction of the dense_vector field type is the headline feature for ML. This allows you to index numeric vectors directly and use them for document scoring in k-nearest neighbor (kNN) search operations.
In practice, this means you can build semantic search or recommendation systems without needing to maintain a separate vector database. The vectors are stored within your Elasticsearch documents, keeping your data architecture simple.
What search enhancements should I know about?
Event Query Language (EQL) now supports pipe syntax and sequence queries, making it more powerful for investigating event sequences, especially for security analytics use cases. The syntax feels familiar if you've used other pipe-based languages.
Cross-cluster search (CCS) gets a major usability boost with cluster name matching patterns. You can now use wildcards like cluster*:index to query multiple remote clusters at once without listing each one individually. This simplifies operations in large, multi-cluster environments.
Are there any performance improvements for existing features?
Yes, the rank_feature and rank_features field queries are now significantly faster. These fields are commonly used for boosting search results based on numeric signals like popularity or relevance scores.
The GeoIP processor in an ingest pipeline has been optimized for better memory usage and performance. Since many users rely on this for enriching data with location information, this upgrade reduces the overhead of data ingestion.
What's new for data management and resilience?
Snapshot Lifecycle Management (SLM) now includes retention policies. You can automatically delete older snapshots based on a configurable policy, which is crucial for managing storage costs in production environments.
For developers, Painless scripting now supports default methods in interfaces. This is a Java 8 feature that makes writing more complex scripts easier and more maintainable.
FAQ
Can I use the new vector fields for image similarity search?
Yes, the dense_vector field type is designed for this exact use case. You would generate a vector representation of your images (e.g., using a model) and then store those vectors in Elasticsearch to perform kNN searches.
How do the new CCS wildcards work?
You can now use patterns like cluster*:index or *-debug:index in your search requests. This matches remote cluster names against the pattern, allowing a single query to span multiple clusters that match, which is much more flexible than hardcoding cluster names.
Is the SLM retention policy automatic?
Yes. Once you configure a retention policy for a snapshot lifecycle, it will run automatically after a successful snapshot is taken. It will delete any snapshots that fall outside the policy you defined, like keeping only the last 30 days of daily snapshots.
What replaced the deprecated _threadpool endpoint?
The Node Stats API is the replacement. You can get the same threadpool information by using the /_nodes/stats/thread_pool endpoint or the /_nodes/{node_id}/stats/thread_pool endpoint for a specific node.
Do the rank_feature query improvements require reindexing?
No. The performance improvements for rank_feature and rank_features queries are internal optimizations. You'll see the speedup immediately after upgrading without any changes to your existing indices or data.