Elastic @elastic

Stop moving Grafana dashboards by hand Elastic’s tools make dashboard migration a whole lot easier: elastic.co/observability-…

Step 3: the index holds terms, not text. After commit, each term points to the documents that contain it. Look up artist:bob and you get docs 1, 2 and 3. It works like the index at the back of a book: jump to the term, skip the scan. Next: type "Bob" and build the query a real search engine runs. Code for the series, built by @dadoonet github.com/dadoonet/lucen…

Step 2: build the analyzer chain. StandardTokenizer splits the text. LowerCaseFilter lowercases it. ASCIIFoldingFilter turns "François" into "francois". No stemming, so artist names stay intact. No stop words, so "Around The World" stays searchable. Use the same analyzer at index time and query time, or your query terms won't match.

We're building search into a Java music library with plain Lucene, one step at a time. Next up is analysis: what happens to your text before it reaches the index. An analyzer cuts it into tokens, lowercases them and folds the accents away. Step 1: add lucene-analysis-common for ASCIIFoldingFilter. Pin the same version as lucene-core

Elastic @elastic

4 days ago

Your beans are mapped. Now, who owns the index? Step 1: wrap Directory + IndexWriter in a small class dedicated to your bean. ByteBuffersDirectory for in-memory, FSDirectory to persist

3 3 13 3K 3

📣 Attention #DevRel friends! @elastic are hiring Senior Developer Advocates in NYC, US and Sao Paulo, Brazil. Job specs 👇 . jobs.elastic.co/jobs/marketing… jobs.elastic.co/jobs/marketing… If you are based in these locations and have a background in #DevRel or software engineering, apply!

Full walkthrough with the ES|QL queries, alert rules, and a companion notebook that rebuilds the whole lab: go.es.io/4yVMeTm

Same 1.25 GiB load, twice. 1 run alerted, 1 didn't.

Step 4: close the writer first, then the directory Order matters If request threads share the index, put every mutation behind the same lock. Rule of thumb: upsert or delete for single-row edits, full rebuild for bulk changes. Next: what happens to a token before it reaches the index. Code for the series, built by @dadoonet github.com/dadoonet/lucen…

Step 3: edit one row, not the whole index updateDocument deletes by term, then adds, in one call. Key it on the id StringField from part 1. It's never analyzed, so the term matches exactly.

Your beans are mapped. Now, who owns the index? Step 1: wrap Directory + IndexWriter in a small class dedicated to your bean. ByteBuffersDirectory for in-memory, FSDirectory to persist

Elastic @elastic

6 days ago

Get any Java bean ready for Lucene in 3 steps You have a Track bean. You need search. Step 1: embed Apache Lucene in-process. One dependency, no native code, no server to run. Elasticsearch does this for you on top of Lucene. Here's what it looks like by hand 👇

2 2 16 4K 4

In an agentic trace with 20 LLM calls, you can see which span is using the most tokens and read the prompt that caused it. Both live in Elastic APM, so there's no second tool to run. x.com/i/article/2109…

Indexing and search build on this. That's next. Code for the series, built by @dadoonet 👇 go.es.io/47NixYB

Step 3: map your bean to a Lucene Document. Copy only what you need to find it, and always store the id.

Get any Java bean ready for Lucene in 3 steps You have a Track bean. You need search. Step 1: embed Apache Lucene in-process. One dependency, no native code, no server to run. Elasticsearch does this for you on top of Lucene. Here's what it looks like by hand 👇

An early look at Elastic nightshift AI SRE (private preview)

Same agent, same model, same question. 71% fewer tokens. Connecting an agent to enterprise data works in the demo. In production it spends most of its budget on discovery: what the schemas are, what the fields mean, how entities relate across sources. The usual fix is adjusting prompts and skills by hand until it behaves. We tested this on a simulated environment. The question: "Give me a summary of the issues hitting our largest customers." Left alone, the agent lists indices, reads mappings, pulls contracts one by one to work out what "largest" means. 33 tool calls, 213 seconds. And it still missed that LongHaul is a subsidiary of Orion Holdings, so one of the top accounts came up short. Honestly, that miss bothered us more than the token bill. So we moved the discovery earlier. Automations read each source and save what they learn as Knowledge Indicators: what an index is for, how to query it, which entities are related, which fields tend to be empty. They refresh as the data changes. When a question comes in, the agent pulls the few that matter. Same question again: 9 tool calls, 64 seconds, and this time it caught the parent company. The precompute isn't free. But it runs once, on deterministic workflows and small cheap models, and the heavy reasoning model gets to use it on every question after. We're calling this layer Context Engine. It's in beta, and we're looking for developers running agents in production to help shape it. Tell us where it breaks. Full write-up, including the model and harness we used: go.es.io/4dvSxVb

AlertZero, the agentic layer of Elastic Security, is heading to technical preview. Full walkthrough from @jamesspi, including the ES|QL query Detection Watch uses to rank rules by false-positive closures: go.es.io/4drpzpg AlertZero has 4 Watches, each a group of named agents with one SOC responsibility. • Triage Watch: alert analysis plus Attack Discovery, one Investigation per attack • Hunt Watch: threat research tested against your telemetry, exact lookups first, behavior second • Detection Watch: investigates rule gaps and FPs, proposing the edit with a backtest • Forensics Watch: reconstructs the endpoint, then proposes response actions through Elastic Defend Every consequential change arrives as a Proposed Action. Approved and executed are logged as separate states.

What’s under the hood Context: what makes the other three work. It maps the services and hosts in your environment and how they relate, from your telemetry, and reads your wikis, runbooks, and code. Every investigation, postmortem, and piece of feedback adds to its long-term memory, so it knows your systems before the incident event starts. Investigation: starts from any alert, fired in Elastic or in a tool you already use. It forms hypotheses and tests them in parallel against logs, metrics, traces, and profiles. Dead ends get dropped. Every investigation ends with a conclusion, impact, proposed actions, and blind spots: what it couldn't verify. Drill from any step to the raw data. Detection: continuously evaluates your telemetry, with no rules to write. When related signals show up across services, it groups them into one Significant Event and can start an investigation before anyone looks. Remediation: picks an existing Elastic Workflow or connector action and fills in the parameters from this incident, or hands you commands for a terminal or coding agent. You can review each action before it runs, or let it apply fixes on its own. Elastic's own SRE team already runs this in production. See the announcement: go.es.io/3WfjrdO

Introducing the Elastic nightshift AI SRE – your always-on SRE coworker. •Investigates like an SRE, ruling out dead ends and showing you how it got there • Uses complete context from all your telemetry, not just what you could afford to keep • Finds unknown issues your alert rules don't cover • Recommends a fix and the evidence behind it • Works from the Kibana UI, a terminal, or an agent of your choice Now in Private Preview. Free on Serverless during the promotional period.