Last checked and updated on 06 Jun 2026
What Is New in Elasticsearch 8.2
Elasticsearch 8.2 brings significant enhancements to search performance, security, and data management. This release focuses on making complex queries faster and simplifying how you work with your clusters day-to-day.
| Category | Key Updates |
|---|---|
| New Features | Synonyms API, knn query, Downsampling, EQL sequence queries |
| Improvements | Faster terms enumeration, Frozen tier storage, CCS latency reduction |
| Security | FIPS 140-2 compliance, Service Account tokens for CLI |
| Deprecations | Deprecated REST API parameters |
How does Elasticsearch 8.2 improve search and analytics?
The core search experience gets a major boost with the new knn query option. You can now run approximate k-nearest neighbor searches directly within a search request, blending semantic and keyword-based results in a single query. This is a game-changer for building hybrid search applications.
For time-series data, the downsampling feature lets you automatically reduce the granularity of old data. This shrinks storage costs on the frozen tier while preserving historical trends for analysis. It's like automated rollups but with more flexibility.
Event Query Language (EQL) now supports sequence queries, allowing you to find a series of related events within your data. This is huge for security analytics use cases where you need to trace the steps of a potential incident.
What are the new developer tools and APIs?
The new Synonyms API provides a centralized way to manage synonym sets across indices. Instead of updating synonym files on every node, you can now manage them through a REST API, making synonym updates dynamic and much less operational overhead.
For those working with cross-cluster search (CCS), latency has been significantly reduced. The coordination phase now runs concurrently, which means searches across multiple remote clusters return results faster. In practice, this makes geo-distributed architectures feel more responsive.
We also see improvements in the terms enumeration API, which is now faster and more efficient. This matters for applications that need to build autocomplete widgets or aggregate over a large number of unique terms.
What security enhancements were introduced?
Elasticsearch 8.2 is now FIPS 140-2 compliant when running on a FIPS-enabled JVM. This is critical for government and financial sector deployments that operate under strict cryptographic module requirements.
Service Account tokens are now supported for use with the Elasticsearch CLI tools. This allows you to write secure scripts and automation that interact with your cluster without needing to handle user passwords, streamlining DevOps workflows.
FAQ
Can I use the new k-NN search without a dedicated dense_vector field?
No, the new knn query option still requires your vectors to be indexed in a dense_vector field. The improvement is in the query flexibility, not the underlying data structure.
How does downsampling differ from rollups?
Downsampling reduces the granularity of existing time-series data stored on the frozen tier, saving storage. Rollups pre-aggregate data into a secondary index. Downsampling is for cost reduction on historical data you already have.
Is the Synonyms API available for all index types?
The Synonyms API manages synonym sets that can be referenced by any analyzer configuration. You can use the same synonym set across multiple indices, simplifying management.
Do I need to change my code to benefit from the CCS latency improvements?
No, the cross-cluster search latency improvements are internal optimizations. Your existing client code and queries will automatically run faster without any changes required.
What happens if I use a deprecated REST API parameter?
Using a deprecated parameter will result in a deprecation warning in the response headers. The API will still function, but you should plan to update your clients as these parameters will be removed in a future major version.