What Is New in Elasticsearch 7.8
| Category | Key Updates |
|---|---|
| New Features | SQL support for EQL, New Anomaly Detection features, Searchable Snapshots (Technical Preview) |
| Enhancements | Faster index recovery, Improved geo queries, Better CCS performance |
| Security | Kerberos realm support, PKI realm improvements, New OpenID Connect claims |
| Deprecations | Deprecation of the `_field_names` field |
What are the key new features in SQL?
Elasticsearch 7.8 introduces SQL support for Event Query Language (EQL). This lets you write EQL queries using familiar SQL syntax, bridging the gap between the two languages for security and operational analytics use cases.
You can now use SELECT * FROM my_eql_index WHERE eql(...) to execute sequence queries directly. This integration makes EQL more accessible to users who are already proficient in SQL, streamlining investigative workflows.
How did anomaly detection get better?
The machine learning anomaly detection features received significant upgrades. You can now preview datafeeds, which helps validate your configuration before starting a long-running job.
New multi-metric jobs allow you to monitor several metrics within a single detector. This is a big deal because it simplifies configuration and reduces the resource overhead of running multiple independent jobs for correlated metrics.
What is the searchable snapshots technical preview?
Searchable snapshots are a major step towards lower-cost storage tiers. This feature allows you to mount index snapshots stored in a repository like S3 as readable, searchable indices without a full restore.
In practice, this means you can keep more historical data searchable without the high cost of keeping it all on hot storage. It's a technical preview, so we don't recommend it for production workloads yet, but the potential for cost savings is huge.
What performance improvements were made?
Index recovery is now faster for indices with soft deletes enabled. The engine optimizes how it processes the operations in the transaction log, leading to quicker shard recovery times.
Geo queries and cross-cluster search (CCS) also saw performance gains. Geo-distance and geo-bounding box queries execute faster, and CCS handles query cancellations more efficiently, preventing unnecessary network traffic.
What security enhancements were added?
The native realm support now includes Kerberos, providing another option for enterprise authentication directly within Elasticsearch. The PKI realm was also improved with better certificate handling.
For OpenID Connect, you can now use the claims.principal setting to specify which claim in the token should be used as the principal username. This offers more flexibility when integrating with different identity providers.
FAQ
Is the searchable snapshots feature production-ready in 7.8?
No, searchable snapshots are released as a technical preview. You should avoid using it for critical production systems until it reaches general availability in a future version.
How does SQL for EQL actually work?
It allows you to embed an EQL query within a standard SQL SELECT statement using the eql() function in the WHERE clause. The SQL layer translates and executes the EQL query against the specified index.
What's the main benefit of multi-metric anomaly detection jobs?
They let you monitor multiple metrics in a single job, which is more efficient than running separate jobs. This is useful for metrics that are related, like CPU load, memory usage, and network traffic on a single host.
Were there any breaking changes in the 7.8 release?
No major breaking changes were introduced. The primary deprecation is for the _field_names field, which will be removed in a future version. Start updating your queries if they rely on this field.
Can I use Kerberos authentication without a reverse proxy now?
Yes, the new built-in Kerberos realm allows for direct authentication, eliminating the previous requirement for an external proxy to handle the Kerberos negotiation.