Elastic (@elastic) / X

Elastic

10.4K posts

Elastic

@elastic

Where developers learn, build, and share. Your source for hands-on demos, cheat sheets, explainers and more.

Global

Joined October 2009

Elastic
@elastic
16h
Replying to @elastic
When you want one language across logs, metrics, and traces, ES|QL's TS command is the direct equivalent. TS metrics-* | STATS SUM(RATE(http_requests_total, 5m)) BY job, TBUCKET(5m) RATE(metric, 5m) maps to PromQL's rate(metric[5m]). TS groups by time series first and handles
30x faster than Prometheus: How we rebuilt Elasticsearch as a leading columnar metrics datastore -...
From elastic.co
470
Elastic
@elastic
16h
🧵 Your PromQL doesn't have to be rewritten to move to Elastic Observability. 9.4 added native Prometheus support. Ship metrics straight to ES, run your existing PromQL in Kibana. Same queries. Same dashboards. rate(http_requests_total{job="api"}[5m]) That runs in Kibana now.
995
Elastic
@elastic
Jun 9
Replying to @elastic
Follow along in the full tutorial:
How to cut Elasticsearch log storage costs with LogsDB — Elastic Observability Labs
From elastic.co
870
Elastic
@elastic
Jun 9
Replying to @elastic
Already on Elasticsearch 9.2+? Any logs-* data stream uses LogsDB by default. Run GET /.ds-logs-*/_settings?filter_path=*.settings.index.mode to verify.
1.1K
Elastic
@elastic
Jun 9
Learn how to cut Elasticsearch log storage by up to 76% with LogsDB: 1. Create a LogsDB index with "index.mode": "logsdb" 2. Reindex your logs into both a standard and LogsDB index 3. Force merge both indices with _forcemerge?max_num_segments=1 4. Measure the difference with the
612K
Elastic
@elastic
Jun 8
Replying to @elastic
Good fit for the speculative query patterns LLM agents generate: fast, approximate, cheap. Won't approximate DISTINCT_COUNT, MIN, or MAX yet. No support for TS, JOIN, or FORK pipelines. Falls back to exact. Gist: go.es.io/4fbZdcH Blog: go.es.io/4nUElst
single_query_compare.py
From gist.github.com
928
Elastic
@elastic
Jun 8
Replying to @elastic
ES|QL 9.4 approximate mode samples and extrapolates instead of scanning everything. Accuracy depends on data shape, not row count. Full benchmark on 5M events in Serverless:
1.2K
Elastic
@elastic
Jun 8
🧵 p95 latency tile in Kibana. 5 million events. Takes 296ms exact. Add one line to the ES|QL pipeline: SET approximation=true; Same query. 110ms. Every result comes with a confidence interval. Drop the interval (SET approximation={"confidence_level": null}) and it runs in
1.6K
Elastic
@elastic
Jun 5
Replying to @elastic
Full breakdown with code samples in the blog:
Elasticsearch autocomplete: search as you type, query time & more - Elasticsearch Labs
From elastic.co
626
Elastic
@elastic
Jun 5
Replying to @elastic
TL;DR: - 4 approaches: search-as-you-type, query time, completion suggester, index time - match_bool_prefix is the underused middle ground for query time - Empty prefix queries can bring down a cluster — always set a minimum character threshold - Completion suggester is for
830
Elastic
@elastic
Jun 5
Replying to @elastic
The core choice is index time vs query time cost. Index time approaches: fast queries, larger storage, more operational overhead. Query time approaches: slower queries, smaller storage, easier to iterate. Most performance issues in autocomplete trace back to this trade-off
17
Elastic
@elastic
Jun 5
Replying to @elastic
4/ Index time is the fastest approach at query time (It's also the most expensive to operate.) Custom analysers with edge n-gram or n-gram tokenisers generate partial tokens at index time. At query time, you're doing exact match lookups, which are fast. The cost:
17
Elastic
@elastic
Jun 5
Replying to @elastic
3/ Completion suggester is for a different use case entirely. It suggests search terms instead of search results. Think e-commerce: the search bar offers "running shoes" as a suggestion before showing any products. Suggestions are indexed separately, with optional weights for
27