Last checked and updated on 10 Jun 2026
What Is New in Elasticsearch 8.5
Elasticsearch 8.5 delivers significant enhancements across search, security, and operational management. This release focuses on making vector search more powerful, securing data more easily, and simplifying how you manage your clusters.
| Category | Key Updates |
|---|---|
| New Features | Text Embedding Inference Service, ELSER v2, Searchable Snapshots on Frozen Tier, Cross-Cluster Replication for Security Models |
| Improvements | Faster Synonym Lookups, Geohex Grid Aggregation, Downsampling API, Async Search Usability |
| Security | FIPS 140-2 Compliance, Service Account Tokens for File-Based Settings |
| Deprecations | Deprecation of the `_thread_pool` endpoint |
How is vector search improved in 8.5?
Vector search gets a major upgrade with two new native features. The big news is the built-in text embedding inference service, which lets you generate vector embeddings directly within your Elasticsearch cluster without needing an external service.
We also see the next iteration of ELSER (Elastic Learned Sparse Encoder), our proprietary model for semantic search. This matters because it provides a powerful out-of-the-box semantic search capability that understands user intent beyond literal keyword matching.
What search performance enhancements are included?
Search performance gets several meaningful boosts. Synonym lookups are now significantly faster, especially for large synonym sets, which directly improves query latency for applications using extensive synonym expansion.
The new geohex_grid aggregation provides an efficient hexagonal binning method for geospatial data analysis, offering better visualization options than traditional rectangular grids. For time-series data, the downsampling API moves to general availability, helping you reduce storage costs while maintaining query performance on historical data.
How does 8.5 improve cluster management?
Operational management becomes smoother with several key updates. Searchable snapshots now work on the frozen tier, letting you cost-effectively archive data while keeping it searchable without a full restore operation.
Async search gets usability improvements with better API responses that include more detailed status information. We also get cross-cluster replication for security models, allowing you to synchronize role mappings and API keys across clusters - a huge time saver for multi-cluster deployments.
What security enhancements should I know about?
Security gets tighter with full FIPS 140-2 compliance for deployments running in FIPS-enabled JVMs. This ensures Elasticsearch can operate in environments with strict cryptographic requirements.
For secure automation, service account tokens can now be used for file-based settings, providing a more secure alternative to storing credentials in plaintext files. In practice, this means your configuration management can follow better security principles without complicating your automation workflows.
FAQ
Do I need external services for text embedding with Elasticsearch 8.5?
No, the new text embedding inference service is built directly into Elasticsearch. You can generate vector embeddings natively without setting up or managing external machine learning services.
How does ELSER v2 improve my search results?
ELSER v2 provides better semantic understanding of search queries. It goes beyond literal keyword matching to understand user intent and context, returning more relevant results for natural language queries.
Can I search my archived data without restoring it first?
Yes, with searchable snapshots on the frozen tier, you can directly search your archived data without performing a full restore operation, significantly reducing both storage costs and access latency.
Is cross-cluster replication available for security settings?
Yes, 8.5 introduces cross-cluster replication for security models. You can now synchronize role mappings, API keys, and other security configurations across multiple clusters automatically.
What happens if I'm using the _thread_pool endpoint?
The `_thread_pool` endpoint is now deprecated. You should migrate to using the nodes stats API instead, which provides more comprehensive monitoring information including thread pool statistics.