Did you know you can do K8s analysis with ES|QL on Elastic Observability?
Bookmark this: go.es.io/4iw4ITy
Bookmark this: go.es.io/4iw4ITy
0
2
16
1,908
Your alerts are data now. So query them like data.
Kibana Universal Alerting is GA on Elastic Cloud Serverless.
One ES|QL query shows which 10 rules created the most alerts this week. Then you tune them.
- Alert and recovery delays keep a short spike pending instead of ies route and throttle across rules: one edit changes who gets paged for 100 rules
It runs alongside Classic Alerting. Nothing migrates automatically, so move one rule at a time.
Full walkthrough with the rule YAML and queries: go.es.io/4iMLjin
Kibana Universal Alerting is GA on Elastic Cloud Serverless.
One ES|QL query shows which 10 rules created the most alerts this week. Then you tune them.
- Alert and recovery delays keep a short spike pending instead of ies route and throttle across rules: one edit changes who gets paged for 100 rules
It runs alongside Classic Alerting. Nothing migrates automatically, so move one rule at a time.
Full walkthrough with the rule YAML and queries: go.es.io/4iMLjin
1
0
9
1,349
When a detection rule disappears, the first question is who deleted it.
The second is when, and in which space.
Elastic Cloud Serverless can now ship its audit trail to a Security project in the same organization. Log delivery is generally available, and 8 alerting rules and 7 the data.
The dashboards include:
• Kibana Object Forensics: who created, changed or deleted a saved object, and in which space
• Elasticsearch Data Access: who read which index, and who was denied
• Identity & Access: failed sign-ins by credential type, with API keys tracked separately from people
For security and compliance teams, the evidence lands where you already investigate, encrypted in transit and at rest.
5 ignore filters drop noisy events before delivery, so you don't pay to store UI clicks nobody will read.
Filter guide and a closer look at 3 of the dashboards in the blog: go.es.io/4jGSoSC
The second is when, and in which space.
Elastic Cloud Serverless can now ship its audit trail to a Security project in the same organization. Log delivery is generally available, and 8 alerting rules and 7 the data.
The dashboards include:
• Kibana Object Forensics: who created, changed or deleted a saved object, and in which space
• Elasticsearch Data Access: who read which index, and who was denied
• Identity & Access: failed sign-ins by credential type, with API keys tracked separately from people
For security and compliance teams, the evidence lands where you already investigate, encrypted in transit and at rest.
5 ignore filters drop noisy events before delivery, so you don't pay to store UI clicks nobody will read.
Filter guide and a closer look at 3 of the dashboards in the blog: go.es.io/4jGSoSC
1
1
5
1,094
Ask a 56-page scanned PDF a question in plain language.
Get an answer stamped with the page it came from.
jina-ocr-v1 turns every page into structured Markdown, tables included. Elasticsearch embeds it at ingest, so there's no chunking or embedding code to write.
Walkthrough linked below 👇
Get an answer stamped with the page it came from.
jina-ocr-v1 turns every page into structured Markdown, tables included. Elasticsearch embeds it at ingest, so there's no chunking or embedding code to write.
Walkthrough linked below 👇
1
1
12
1,471
Searching Claude's plugin directory for Elastic used to return nothing.
Now you'll find a plugin with nearly 30 skills across Elasticsearch, Kibana, Security and Observability.
In the video: install the Elastic CLI, add the plugin, then ask Claude to find an error spike in web dashboard around it.
Install it from Settings > Plugins > Discover and search "elastic".
What it took to get into Claude's directory, including the 3 review warnings and why we stopped pointing at main: go.es.io/4yD1HXn
Now you'll find a plugin with nearly 30 skills across Elasticsearch, Kibana, Security and Observability.
In the video: install the Elastic CLI, add the plugin, then ask Claude to find an error spike in web dashboard around it.
Install it from Settings > Plugins > Discover and search "elastic".
What it took to get into Claude's directory, including the 3 review warnings and why we stopped pointing at main: go.es.io/4yD1HXn
0
1
20
2,221
Opting into DiskBBQ auto calibration raised average QPS 16.7%.
That's indices with auto_calibrate: true vs DiskBBQ's fixed defaults, across 18 public benchmarks.
Quantization bits, oversampling, preconditioning: the right mix depends on your dataset and embedding model, and it nts merge.
With auto calibration on, Elasticsearch samples vectors at merge time and predicts recall @ 10 for each candidate encoding and rerank depth.
It stores the most efficient configuration predicted to hit 90% recall @ 10 in that segment's metadata, then re-evaluates on the next merge.
Opted-in indices vs the fixed defaults:
- QPS up 16.7% on average, and up on 15 of 18 datasets
- Over 50% higher QPS on FiQA GTE, Fashion-MNIST and GloVe-200
- Recall up on 15 of 18, including +296% on Fashion-MNIST
- Where either metric dipped, QPS stayed within 1.5% and recall within 2%
The trade-off is at index time. Overhead was under 2% on more than half the datasets and at most 11% on large ones like DBPedia-Entity and HotpotQA. Small datasets saw more, up to 35%, because the calibration sample is a fixed size.
Jina v3 embeddings quantize well enough that calibration chose 1-bit documents on all 3 corpora we tested.
Opt in with one line in index_options:
"type": "bbq_disk", "auto_calibrate": true
That's indices with auto_calibrate: true vs DiskBBQ's fixed defaults, across 18 public benchmarks.
Quantization bits, oversampling, preconditioning: the right mix depends on your dataset and embedding model, and it nts merge.
With auto calibration on, Elasticsearch samples vectors at merge time and predicts recall @ 10 for each candidate encoding and rerank depth.
It stores the most efficient configuration predicted to hit 90% recall @ 10 in that segment's metadata, then re-evaluates on the next merge.
Opted-in indices vs the fixed defaults:
- QPS up 16.7% on average, and up on 15 of 18 datasets
- Over 50% higher QPS on FiQA GTE, Fashion-MNIST and GloVe-200
- Recall up on 15 of 18, including +296% on Fashion-MNIST
- Where either metric dipped, QPS stayed within 1.5% and recall within 2%
The trade-off is at index time. Overhead was under 2% on more than half the datasets and at most 11% on large ones like DBPedia-Entity and HotpotQA. Small datasets saw more, up to 35%, because the calibration sample is a fixed size.
Jina v3 embeddings quantize well enough that calibration chose 1-bit documents on all 3 corpora we tested.
Opt in with one line in index_options:
"type": "bbq_disk", "auto_calibrate": true
1
1
6
1,387
Tommaso Teofili and Thomas Veasey break down the cost model and error estimation: go.es.io/4iavgt6
0
0
3
439
You have a specific visual in your head, but have no idea which file it’s in.
This walkthrough uses Jina embeddings + Elasticsearch to search video by describing what you’re looking for, in natural language: go.es.io/4siXJBX
You receive back the matching scene with timestamps.
This walkthrough uses Jina embeddings + Elasticsearch to search video by describing what you’re looking for, in natural language: go.es.io/4siXJBX
You receive back the matching scene with timestamps.
2
4
14
1,611
Proud to make it official with the @audif1_ !
Our relationship started with the team's engineers using Elastic to search and investigate issues across their connected engineering applications. Now, we're building on that foundation through a multi-year partnership, with plans to bring those capabilities to even more applications.
Here's to the seasons ahead and everything we'll build together.
Our relationship started with the team's engineers using Elastic to search and investigate issues across their connected engineering applications. Now, we're building on that foundation through a multi-year partnership, with plans to bring those capabilities to even more applications.
Here's to the seasons ahead and everything we'll build together.
New name on the R26 for Austin. 🇺🇸
Welcome, Elastic. Official Race Partner this weekend, Official Search and Observability Supplier from 2027.
0
1
11
1,469
Elastic is now an Official Supplier of the @audif1_
Behind every engineering breakthrough is a complex, distributed software environment. To keep technical teams moving fast and focused, organizations require immediate visibility into the software and systems that power their tic is helping the Audi Revolut F1® Team understand what is happening across its engineering software stack to find signals that matter and act faster. The goal is one operational view from factory to track.
The team already uses Elastic technology as the foundation for its central software logging platform. Starting with the 2027 season, Elastic will become its Official Search and Observability Supplier.
More on the partnership: go.es.io/4yD5GTV
Behind every engineering breakthrough is a complex, distributed software environment. To keep technical teams moving fast and focused, organizations require immediate visibility into the software and systems that power their tic is helping the Audi Revolut F1® Team understand what is happening across its engineering software stack to find signals that matter and act faster. The goal is one operational view from factory to track.
The team already uses Elastic technology as the foundation for its central software logging platform. Starting with the 2027 season, Elastic will become its Official Search and Observability Supplier.
More on the partnership: go.es.io/4yD5GTV
0
11
21
1,460
Elastic retweeted
Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
You can still focus on detection coverage today.
Security Labs writeup (coverage + guidance): elastic.co/security-labs/…
Most PHP RCEs converge atever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.
• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root
The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.
We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.
The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.
(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)
Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.
Guidance + every rule link below.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
You can still focus on detection coverage today.
Security Labs writeup (coverage + guidance): elastic.co/security-labs/…
Most PHP RCEs converge atever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.
• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root
The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.
We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.
The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.
(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)
Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.
Guidance + every rule link below.
3
22
75
7,219
Building search into a Java music library with plain Lucene, one step at a time.
The tracks are indexed. Now we query them.
Should "Bob" in a title count for more than "Bob" in an album?
Step 1: start with no criteria. Open an IndexSearcher and fetch the first 10 hits. Each c number, so read the stored id and join back to your beans.
The tracks are indexed. Now we query them.
Should "Bob" in a title count for more than "Bob" in an album?
Step 1: start with no criteria. Open an IndexSearcher and fetch the first 10 hits. Each c number, so read the stored id and join back to your beans.
We're building search into a Java music library with plain Lucene, one step at a time.
Next up is analysis: what happens to your text before it reaches the index. An analyzer cuts it into tokens, lowercases them and folds the accents away.
Step 1: add lucene-analysis-common for the same version as lucene-core
2
3
8
1,733
Step 3: filter and exclude.
Wrap the text query as MUST. Add a FILTER on genre = Club: 62 → 26 hits. Add a MUST_NOT on keys 4A or 4B: 26 → 23.
FILTER and MUST_NOT narrow the results without touching the score.
Gotcha: a query with only MUST_NOT matches nothing. When users add a MatchAllDocsQuery as MUST.
Wrap the text query as MUST. Add a FILTER on genre = Club: 62 → 26 hits. Add a MUST_NOT on keys 4A or 4B: 26 → 23.
FILTER and MUST_NOT narrow the results without touching the score.
Gotcha: a query with only MUST_NOT matches nothing. When users add a MatchAllDocsQuery as MUST.
1
0
0
423
Step 4: ask Lucene why a track ranked where it did.
searcher.explain(query, doc) breaks the BM25 score down per term: boost × idf × tf.
On a track with "bob" in both title and album, the title clause adds 10.77 and the album clause 4.08. So yes, the title counts for more.
what users can click.
Code for the series, built by @dadoonet github.com/dadoonet/lucen…
searcher.explain(query, doc) breaks the BM25 score down per term: boost × idf × tf.
On a track with "bob" in both title and album, the title clause adds 10.77 and the album clause 4.08. So yes, the title counts for more.
what users can click.
Code for the series, built by @dadoonet github.com/dadoonet/lucen…
1
0
0
308
Why share an Agent Builder conversation instead of a summary? elastic.co/search-labs/bl…
0
1
2
414
Stop moving Grafana dashboards by hand
Elastic’s tools make dashboard migration a whole lot easier: elastic.co/observability-…
Elastic’s tools make dashboard migration a whole lot easier: elastic.co/observability-…
1
0
6
1,331