🎉 What’s new in Elastic 9.5

Announcements
1

:tada: What’s new in Elastic 9.5

9.5-blog
9.5-blog1400×840 11.6 KB

Elastic 9.5 promotes native PromQL, Dashboards API, Cases as Data, and natural language authoring to general availability. 9.5 also introduces Columnar Mode, VectorDB index mode, a new multimodal semantic field, and Agent Builder tracing in technical preview.

Columnar Mode

Columnar Mode is a new index mode available in technical preview. It stores each field once in the column store with no inverted index by default. The result is a smaller storage footprint and a faster foundation for analytical queries and long data retention. It ships alongside existing index modes with zero changes to APIs, dashboards, or integrations.

Built on Columnar Mode, Columnar Logs is the first specialized profile designed for log data. It keeps a single inverted index on the message field so full-text search stays fast, while storing all other fields in a columnar format. Storage use is significantly lower than standard logs without changing the search experience. Both modes are opt-in and existing indices are not affected.

VectorDB index mode and Auto-calibration

Two technical preview features reduce the setup and tuning work for vector search.

  1. VectorDB index mode sets up a vector index with a single setting. It applies defaults already tuned for vector workloads, including quantization, merge policy, and cache loading, so there is nothing to configure manually:
PUT my-index
{
  "settings": {
    "index": {
      "mode": "vectordb_document"
    }
  }
}
  1. Auto-calibration for DiskBBQ vector search automatically sets quantization depth, preconditioning, and oversampling by analyzing the actual vectors in the index. The tuning that normally requires expertise and repeated testing now happens on its own:
PUT my_vector_index
{
  "mappings": {
    "properties": {
      "my_vector_field": {
        "type": "dense_vector",
        "dims": 1536,
        "index_options": {
          "type": "bbq-disk",
          "auto_calibration": true
        }
      }
    }
  }
}

Together, these two features mean a vector search index can be created and tuned with minimal configuration.

Multimodal Semantic Search: Images, Audio, Video, and PDFs

The new semantic field extends semantic search to images, audio, video, and PDF files. It works the same way as semantic_text for text: define a field, index your content, and query. Embeddings are generated at ingest time automatically.

PUT example-index
{
  "mappings": {
    "properties": {
      "my_semantic_field": {
        "type": "semantic",
        "inference_id": ".jina-embeddings-v5-omni-small"
      }
    }
  }
}

You can mix content types in a single field. A document can hold a text description, an image, and an audio clip together. A text query then retrieves the best match across all of them. To search by image rather than text, send the image as a query and Elasticsearch generates the embedding on the fly.

The feature is powered by the jina-embeddings-v5-omni model, which places text, images, audio, video, and PDFs into a shared vector space. It is available as a technical preview in Elasticsearch 9.5 and Serverless.

Agent Builder: Tracing, Human Approvals, and Faster Responses

Elastic 9.5 adds three new Agent Builder capabilities:

  1. Agent Observability and Monitoring (technical preview) records every LLM call, tool invocation, and reasoning step as OpenTelemetry telemetry in Elasticsearch.

agent-builder-otel-trace
agent-builder-otel-trace1999×1436 227 KB

  1. Human-in-the-loop approvals let an agent pause and wait for a person to confirm a sensitive action before continuing, providing a recorded audit trail. Approval requests can be sent to external tools such as Slack, so the decision does not require the approver to be in Kibana.
  2. Agent Builder also delivers faster responses at lower token cost by routing specific tasks to faster models and removing redundant LLM calls. These improvements apply automatically to all Agent Builder users with no configuration change needed.

Prometheus and PromQL Now GA

Native Prometheus and PromQL support is now generally available. Teams can point existing Grafana dashboards and Prometheus tooling at Elastic and run PromQL queries alongside ES|QL with no changes to their existing setup. A migration tool, also now GA, helps bring Grafana and Datadog dashboards and alerts into Kibana.

migrated-dashboard-1
migrated-dashboard-11583×1348 228 KB

The new ES95 codec stores metrics at roughly 3 bytes per sample, about 20% lower than 9.4, and significantly more efficiently than a plain Prometheus storage backend. Elastic also now supports all OpenTelemetry metric temporalities, so any OTel-instrumented application can send metrics over OTLP exactly as emitted, with no workarounds.

Elastic Workflows Versioning

Elastic Workflows in 9.5 adds versioning so teams can see who changed a workflow, compare any two versions, and roll back in one click. A new Visual Mode shows the workflow as a graph with its triggers, steps, and logic visible alongside the YAML.

Security: AlertZero, Workflows, and Rule Version History

The goal of AlertZero is an alert queue that contains only what matters. In 9.5, Attack Discovery works toward that goal by investigating alerts the way an analyst would:

  1. It checks entity risk, searches raw events, and looks for supporting evidence before calling something an attack.
  2. When it finds a coverage gap, it drafts an ES|QL detection rule for analyst review.

Attack Discovery can now run automatically via an Elastic Workflow, on a schedule, or manually.

Detection Rule Version History (technical preview) keeps a full log of every saved rule state, including who made each change and when. Teams can view any past version, compare it to the one before, and restore it in a single action. This is useful for finding out when a rule stopped generating alerts, and for compliance frameworks that require evidence of change control.

Elastic 9.5 is available now on Elastic Cloud and for self-managed deployments.

2 Likes