Elasticsearch 9.2: What's New, Release History & Support Lifecycle

What is new in Elasticsearch 9.2

Elasticsearch 9.2 introduces important improvements for data reliability, vector search efficiency, and query capabilities. The release makes it easier to handle imperfect data, reduces memory usage for large vector workloads, and adds powerful new ways to enrich and analyze data with ES|QL.

Key additions include the failure store for logs, the DiskBBQ index type for vectors, enhanced lookup joins, and several performance optimizations across storage and search.

Key Highlights in Elasticsearch 9.2

Failure Store for Better Data Reliability

The failure store is now automatically enabled for newly created logs data streams matching the logs-*-* pattern. Documents that fail parsing or validation are written to a dedicated failure index instead of causing the entire indexing request to fail.

When the failure store is used, the HTTP response changes from 400 Bad Request to 201 Created with an indicator that the failure store was used. You can also enable it manually on existing data streams.

This feature gives operators better visibility into data quality issues while ensuring no logs are lost.

DiskBBQ Vector Index Type

Elasticsearch 9.2 releases the bbq_disk index option for dense_vector fields. It partitions and quantizes vectors into compact clusters stored on disk, allowing searches without loading the full index into memory.

Example mapping:

PUT /vectors
{
  "mappings": {
    "properties": {
      "vector_field": {
        "type": "dense_vector",
        "index_options": {
          "type": "disk_bbq"
        }
      }
    }
  }
}

Queries use the standard knn syntax. This approach offers faster indexing than HNSW and maintains strong performance with very low memory usage.

Improved ES|QL Lookup Joins

LOOKUP JOIN in ES|QL now supports joining on multiple fields and complex expressions (tech preview). It also works with remote indices for cross-cluster enrichment.

Examples:

FROM index1 
| LOOKUP JOIN lookup_index ON field1, field2

FROM logs-*, remote:logs-* 
| LOOKUP JOIN clients ON ip 
| SORT timestamp 
| LIMIT 100

These enhancements make in-query data enrichment more powerful and flexible for analytics and observability use cases.

Vector Search and Storage Improvements

Several changes help manage vector data more efficiently:

• New dense_vector off-heap statistics in node and index stats APIs.
• Option to explicitly include or exclude vectors from _source retrieval.
• Direct IO support for BBQ rescoring via JVM option vector.rescoring.directio=true (helpful in low-memory scenarios).
• Performance improvements from the Lucene 10.3.0 upgrade, including better HNSW handling and bulk scoring.

Together these reduce storage costs and memory pressure for semantic search and AI workloads.

Ingest and Pipeline Enhancements

The ingest layer received useful updates:

• New recover_failure_document processor to help remediate documents stored in the failure store.
• Append processor now supports copy_from and better handling of empty values.
• Improved simulate API with merge_type parameter and better mapping simulation.
• Templates now record created and modified dates.

These changes simplify pipeline development and troubleshooting.

Other Notable Changes

Elasticsearch 9.2 also includes:

• Improved security statistics and DLS cache monitoring.
• Many ES|QL improvements including new functions like v_hamming, contains, v_magnitude, and better support for unsigned longs.
• Storage optimizations in the TSDB codec and doc values handling.
• Enhanced snapshot safety for S3 repositories.
• Performance gains from Lucene upgrade and various internal optimizations.

These updates contribute to more reliable operation and better overall performance at scale.

How These Changes Help in Practice

For observability teams, the failure store reduces data loss from malformed logs. Vector users benefit from lower memory costs with DiskBBQ while keeping good search quality. Analysts gain more expressive power in ES|QL for enrichment and time-series work. Infrastructure teams appreciate safer snapshots and more efficient storage.

Most features integrate smoothly with existing setups, often requiring only minor mapping or pipeline adjustments.