Elastic , the Search AI Company, announced a significant update to the Elasticsearch Query Language (ES|QL) in versions 8.19 and 9.1 on July 30, 2025, delivering advanced data enrichment, cross-cluster scalability, and over 30 performance optimizations. As shown in the finance card above, Elastic’s stock price reflects a current value of $88.655, with a year-to-date high of $192.055 and a low of $69.00, indicating market interest in its ongoing innovations. Used weekly on over 10,000 clusters, ES|QL now supports enterprise-grade use cases with enhanced resilience and observability.
ES|QL updates in Elasticsearch 8.19 and 9.1 include LOOKUP JOIN and Cross-Cluster Search (CCS).
Over 30 performance optimizations, with up to 86x faster filtering operations.
LOOKUP JOIN enables dynamic data enrichment without denormalization.
Cross-Cluster Search queries petabytes across distributed clusters.
New allow_partial_results setting and query retries improve fault tolerance.
Live Query Monitoring (Tech Preview) enhances observability.
The general availability of LOOKUP JOIN simplifies data correlation across indexes, eliminating the need for complex client-side joins or data denormalization. It supports dynamic enrichment scenarios, such as merging security logs with employee directories or threat intelligence, within a single piped ES|QL query. New features include:
Mixed-Type Joins: Seamlessly join compatible numeric types (e.g., long with integer).
Index Alias Support: Simplifies queries using aliases for lookup indexes.
High-Precision Joins: Supports date_nanos for finance and high-frequency use cases.
Cross-Cluster Search (CCS), now generally available, enables querying petabytes of data across geographically distributed Elasticsearch clusters. This breaks down silos between workloads like observability, security, and operational telemetry, offering unified insights from a single query. This is critical for enterprises managing large, distributed environments, requiring an Enterprise-level license for full functionality.
A new allow_partial_results setting, enabled by default, ensures queries complete even if some shards are unavailable, while automatic retries of failed shard-level operations improve stability during upgrades or node failures. These features enhance ES|QL’s reliability in dynamic, large-scale environments.
ES|QL introduces robust observability tools:
Query Logs: Persist all ES|QL queries for trend analysis and troubleshooting.
Live Query Monitoring (Tech Preview): A new API provides real-time visibility into running queries, with detailed profiling for optimization.
The release includes over 30 enhancements, such as:
Aggressive pushdowns to the Lucene search library, achieving up to 86x faster filtering.
Smarter query planning prioritizing hot data tiers.
Reduced resource usage in operations like REPLACE, TO_IP, and data serialization.
“With today’s release, ES|QL becomes even more powerful, observable, and fault-tolerant out of the box,” said Ajay Nair, General Manager, Platform at Elastic. These updates empower developers to handle complex security and observability workloads with greater efficiency.
ES|QL’s enhancements align with Elastic’s mission to simplify data investigations, as seen in its use by organizations like Chat Leap for global campaigns and Lawrence Livermore National Laboratory for security analytics. The platform’s ability to handle petabyte-scale data with real-time insights positions Elastic as a leader in search AI, reflected in its stock performance (current price: $88.655, market cap: $9.37B).
Elastic (NYSE: ESTC), the Search AI Company, integrates its deep expertise in search technology with artificial intelligence to help everyone transform all of their data into answers, actions, and outcomes. Elastic's Search AI Platform — the foundation for its search, observability, and security solutions — is used by thousands of companies, including more than 50% of the Fortune 500.