Skip to main content

Elastic Delivers New ES|QL Features for Cross-Cluster Scale, Data Enrichment, and Performance

New capabilities enhance ES|QL with production-ready lookup joins, cross-cluster query execution, observability, and over 30 performance optimizations

Elastic announced a major update to the Elasticsearch Query Language (ES|QL) in Elasticsearch 8.19 and 9.1, bringing advanced data enrichment, improved resilience, and significant performance gains across petabyte-scale environments.

Already in use on over 10,000 clusters each week, ES|QL now supports enterprise-grade use cases with the general availability of LOOKUP JOIN and Cross-Cluster Search (CCS), a new default setting for partial results, enhanced query observability, alongside more than 30 additional internal improvements that further reduce latency and resource usage across large-scale environments.

“With today’s release, ES|QL becomes even more powerful, observable, and fault-tolerant out of the box,” said Ajay Nair, general manager, Platform at Elastic. “Whether you're correlating live security data or running distributed queries across global clusters, these enhancements help developers move faster with more confidence.”

Production-Ready Data Enrichment with LOOKUP JOIN General Availability

LOOKUP JOIN is now generally available, simplifying data correlation across indexes without requiring data denormalization or complex client-side joins. It enables dynamic enrichment scenarios, such as merging security logs with employee directories or threat intelligence data, all within a single piped ES|QL query.

New capabilities include:

  • Mixed-type joins: Seamless joins on compatible numeric types (e.g., long with integer)
  • Index alias support: Cleaner, more flexible queries using alias targets
  • High-precision joins: Full support for date_nanos for high-frequency or financial data use cases

Cross-Cluster Search (GA) for ES|QL

ES|QL now supports Cross-Cluster Search, allowing users to query petabytes of data across geographically distributed Elasticsearch clusters — breaking down silos between workloads such as observability, security, and operational telemetry.

Built-In Resilience and Fault Tolerance

A new allow_partial_results setting (enabled by default) allows queries to complete even when some shards are temporarily unavailable. ES|QL also retries failed shard-level operations automatically — improving stability during rolling upgrades or transient node failures.

Real-time Observability and Query Monitoring

  • Query Logs: Persist logs for all ES|QL queries, enabling usage trend analysis and troubleshooting
  • Live Query Monitoring (Tech Preview): A new API lets users see currently running queries and inspect detailed profiling data for debugging and optimization

Smarter, Faster, More Efficient Execution

The 8.19 and 9.1 releases include over 30 performance and resource optimizations, including:

  • Aggressive pushdowns to Lucene for faster filtering (up to 86x speedup for some operations)
  • Smarter query planning, prioritizing hot data tiers and optimizing resource usage
  • Reduced memory and CPU usage in operations like REPLACE, TO_IP, and data serialization

The Latest

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...

Top-performing businesses prioritize data-driven decision making, enabling leaders to move from intuition and gut feel towards evidence-based judgment. But that judgment is only sound when the data underpinning decisions is accurate. With incident management, data accuracy is particularly important. Long-term revenue, customer trust, and operational stability depend on high-quality data that enables teams to quickly identify and address the root cause of major incidents. Against this backdrop, governance becomes a critical endeavor to ensure the right data drives the right action ...

In MEAN TIME TO INSIGHT Episode 26, Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at EMA discusses network compliance ... 

Elastic Delivers New ES|QL Features for Cross-Cluster Scale, Data Enrichment, and Performance

New capabilities enhance ES|QL with production-ready lookup joins, cross-cluster query execution, observability, and over 30 performance optimizations

Elastic announced a major update to the Elasticsearch Query Language (ES|QL) in Elasticsearch 8.19 and 9.1, bringing advanced data enrichment, improved resilience, and significant performance gains across petabyte-scale environments.

Already in use on over 10,000 clusters each week, ES|QL now supports enterprise-grade use cases with the general availability of LOOKUP JOIN and Cross-Cluster Search (CCS), a new default setting for partial results, enhanced query observability, alongside more than 30 additional internal improvements that further reduce latency and resource usage across large-scale environments.

“With today’s release, ES|QL becomes even more powerful, observable, and fault-tolerant out of the box,” said Ajay Nair, general manager, Platform at Elastic. “Whether you're correlating live security data or running distributed queries across global clusters, these enhancements help developers move faster with more confidence.”

Production-Ready Data Enrichment with LOOKUP JOIN General Availability

LOOKUP JOIN is now generally available, simplifying data correlation across indexes without requiring data denormalization or complex client-side joins. It enables dynamic enrichment scenarios, such as merging security logs with employee directories or threat intelligence data, all within a single piped ES|QL query.

New capabilities include:

  • Mixed-type joins: Seamless joins on compatible numeric types (e.g., long with integer)
  • Index alias support: Cleaner, more flexible queries using alias targets
  • High-precision joins: Full support for date_nanos for high-frequency or financial data use cases

Cross-Cluster Search (GA) for ES|QL

ES|QL now supports Cross-Cluster Search, allowing users to query petabytes of data across geographically distributed Elasticsearch clusters — breaking down silos between workloads such as observability, security, and operational telemetry.

Built-In Resilience and Fault Tolerance

A new allow_partial_results setting (enabled by default) allows queries to complete even when some shards are temporarily unavailable. ES|QL also retries failed shard-level operations automatically — improving stability during rolling upgrades or transient node failures.

Real-time Observability and Query Monitoring

  • Query Logs: Persist logs for all ES|QL queries, enabling usage trend analysis and troubleshooting
  • Live Query Monitoring (Tech Preview): A new API lets users see currently running queries and inspect detailed profiling data for debugging and optimization

Smarter, Faster, More Efficient Execution

The 8.19 and 9.1 releases include over 30 performance and resource optimizations, including:

  • Aggressive pushdowns to Lucene for faster filtering (up to 86x speedup for some operations)
  • Smarter query planning, prioritizing hot data tiers and optimizing resource usage
  • Reduced memory and CPU usage in operations like REPLACE, TO_IP, and data serialization

The Latest

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...

Top-performing businesses prioritize data-driven decision making, enabling leaders to move from intuition and gut feel towards evidence-based judgment. But that judgment is only sound when the data underpinning decisions is accurate. With incident management, data accuracy is particularly important. Long-term revenue, customer trust, and operational stability depend on high-quality data that enables teams to quickly identify and address the root cause of major incidents. Against this backdrop, governance becomes a critical endeavor to ensure the right data drives the right action ...

In MEAN TIME TO INSIGHT Episode 26, Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at EMA discusses network compliance ...