Elasticsearch 8.15: What's New, Release History & Support Lifecycle

What Is New in Elasticsearch 8.15

Elasticsearch 8.15 delivers key enhancements across search, observability, and data management. This release focuses on improving developer experience with better query performance and more flexible data handling.

How is vector search performance improved?

Vector search now uses the HNSW graph for approximate kNN searches even when the mapping specifies a different similarity algorithm. This change means that if your mapping defines l2_norm but you perform a search with cosine, the system will automatically use the HNSW graph instead of falling back to an exact, brute-force search.

In practice, this delivers a massive speed boost for production workloads where query-time similarity needs differ from index-time configuration. You get the performance benefits of approximate search without being locked into a single similarity algorithm.

What's new for document ingestion and scripting?

You can now generate document _id values directly from an ingest pipeline script. This eliminates the previous two-step process of generating an ID and then indexing the document, streamlining data ingestion workflows.

The Painless script compiler was upgraded to a newer version, which improves overall script performance and reliability. For developers, this means your complex scripting logic in search queries and ingest pipelines will execute more efficiently.

How are terms aggregations faster now?

Significant performance improvements were made to global ordinals for keyword fields. Global ordinals are the internal data structure that powers terms aggregations, and they're now built much more efficiently.

This optimization is most noticeable on large datasets with high-cardinality fields. Your dashboard and analytic queries that rely on terms aggregations should see reduced latency and lower memory overhead.

What enrichment policies were added?

A new terms enrichment policy type allows you to enrich incoming documents based on matching exact values in a reference dataset. This complements the existing match policy which uses range queries.

You might use this for adding metadata to documents based on specific product codes, user IDs, or other discrete values. The policy works by creating a terms query under the hood against your enrichment index.

What changed for EQL sequence queries?

Event Query Language (EQL) now supports the until keyword in sequence queries, letting you define an explicit termination condition for event sequences. This gives you more precise control over the temporal boundaries of your sequence matching.

Security analysts will find this particularly useful for threat hunting, as they can now define exactly when a sequence of suspicious events should stop being evaluated, reducing false positives and improving query performance.