@elastic

Where developers learn, build, and share. Your source for hands-on demos, cheat sheets, explainers and more.

 Global
elastic.co
Joined October 2009
  • Tweets10.6K
  • Following185
  • Followers65.9K
4KMedia
When people say “hybrid search,” they usually mean keyword + semantic. But what about semantic + geospatial? If I search for “a quiet café to work from,” understanding what I mean is only half the job. I also need it to be nearby.
2
9
1,112
Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. • Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. You can still focus on detection coverage today. Security Labs writeup (coverage + guidance): elastic.co/security-labs/thr… Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately. • a shell to confirm access: id, whoami, uname -a • a second stage pulled in: curl http://... | bash • a reverse shell: bash -i >& /dev/tcp// • a webshell written into the web root The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect. We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint. The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top. (PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.) Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now. Guidance + every rule link below.
2
21
2
72
6,033
Building search into a Java music library with plain Lucene, one step at a time. The tracks are indexed. Now we query them. Should "Bob" in a title count for more than "Bob" in an album? Step 1: start with no criteria. Open an IndexSearcher and fetch the first 10 hits. Each hit carries a Lucene doc number, so read the stored id and join back to your beans.
Elastic
@elasticOct 16
We're building search into a Java music library with plain Lucene, one step at a time. Next up is analysis: what happens to your text before it reaches the index. An analyzer cuts it into tokens, lowercases them and folds the accents away. Step 1: add lucene-analysis-common for ASCIIFoldingFilter. Pin the same version as lucene-core
2
3
6
1,596
more replies
Step 3: filter and exclude. Wrap the text query as MUST. Add a FILTER on genre = Club: 62 → 26 hits. Add a MUST_NOT on keys 4A or 4B: 26 → 23. FILTER and MUST_NOT narrow the results without touching the score. Gotcha: a query with only MUST_NOT matches nothing. When users exclude without typing, add a MatchAllDocsQuery as MUST.
1
393
Step 4: ask Lucene why a track ranked where it did. searcher.explain(query, doc) breaks the BM25 score down per term: boost × idf × tf. On a track with "bob" in both title and album, the title clause adds 10.77 and the album clause 4.08. So yes, the title counts for more. Next: facets, counting what users can click. Code for the series, built by @dadoonet github.com/dadoonet/lucene-s…
1
290
Most “share chat” links are a secret URL to a frozen copy. Anyone with the link can read it, and nobody can continue it. Shared Agent Builder conversations are live and use the Kibana privileges you already have. No bearer link.
2
2
1
8
1,438
Why share an Agent Builder conversation instead of a summary? elastic.co/search-labs/blog/…

Agent Builder conversation sharing for incident handoffs

Agent Builder conversation sharing is live, not a read-only link. Hand over the full history, keep questioning the same agent, grant no new access.

elastic.co
1
375
Stop moving Grafana dashboards by hand Elastic’s tools make dashboard migration a whole lot easier: elastic.co/observability-lab…
1
4
1,294
We're building search into a Java music library with plain Lucene, one step at a time. Next up is analysis: what happens to your text before it reaches the index. An analyzer cuts it into tokens, lowercases them and folds the accents away. Step 1: add lucene-analysis-common for ASCIIFoldingFilter. Pin the same version as lucene-core
Elastic
@elasticOct 14
Your beans are mapped. Now, who owns the index? Step 1: wrap Directory + IndexWriter in a small class dedicated to your bean. ByteBuffersDirectory for in-memory, FSDirectory to persist
3
1
10
2,935
Step 2: build the analyzer chain. StandardTokenizer splits the text. LowerCaseFilter lowercases it. ASCIIFoldingFilter turns "François" into "francois". No stemming, so artist names stay intact. No stop words, so "Around The World" stays searchable. Use the same analyzer at index time and query time, or your query terms won't match.
1
1
3
493
Step 3: the index holds terms, not text. After commit, each term points to the documents that contain it. Look up artist:bob and you get docs 1, 2 and 3. It works like the index at the back of a book: jump to the term, skip the scan. Next: type "Bob" and build the query a real search engine runs. Code for the series, built by @dadoonet github.com/dadoonet/lucene-s…
2
392
📣 Attention #DevRel friends! @elastic are hiring Senior Developer Advocates in NYC, US and Sao Paulo, Brazil. Job specs 👇 . jobs.elastic.co/jobs/marketi… jobs.elastic.co/jobs/marketi… If you are based in these locations and have a background in #DevRel or software engineering, apply!
4
6
596
Same 1.25 GiB load, twice. 1 run alerted, 1 didn't.
1
2
10
1,219
Full walkthrough with the ES|QL queries, alert rules, and a companion notebook that rebuilds the whole lab: go.es.io/4yVMeTm

Kubernetes node pressure alerts with Elastic anomaly detection

Catch Kubernetes node pressure 7 minutes before the kubelet evicts your pods. The per-node job, the rules that cover its blind spot, and the triage path.

elastic.co
1
388
Your beans are mapped. Now, who owns the index? Step 1: wrap Directory + IndexWriter in a small class dedicated to your bean. ByteBuffersDirectory for in-memory, FSDirectory to persist
Elastic
@elasticOct 12
Get any Java bean ready for Lucene in 3 steps You have a Track bean. You need search. Step 1: embed Apache Lucene in-process. One dependency, no native code, no server to run. Elasticsearch does this for you on top of Lucene. Here's what it looks like by hand 👇
One dependency, no native code

ALT One dependency, no native code

3
3
1
14
3,085
more replies
Step 3: edit one row, not the whole index updateDocument deletes by term, then adds, in one call. Key it on the id StringField from part 1. It's never analyzed, so the term matches exactly.
1
2
416
Step 4: close the writer first, then the directory Order matters If request threads share the index, put every mutation behind the same lock. Rule of thumb: upsert or delete for single-row edits, full rebuild for bulk changes. Next: what happens to a token before it reaches the index. Code for the series, built by @dadoonet github.com/dadoonet/lucene-s…
315
In an agentic trace with 20 LLM calls, you can see which span is using the most tokens and read the prompt that caused it. Both live in Elastic APM, so there's no second tool to run.

LLM tracing in Elastic APM: prompts, responses, and token counts in the span view

Article · @elastic
4
2
1
12
1,808
Load more