Introductions for new features and breaking changes of Elasticsearch, Logstash, Kibana and Beats version 5.0 releases. Information based on 5.0.0-alpha4 releases and subject to change before the general availability.
node • Painless scripting • Text/keyword to replace strings • Completion suggester v2 • Settings validation • Safety in production • Percolate query • Deleted Index Tombstones 3 • Indexed scripts/templates • Dots in Field Names • Cluster Allocation Explain API • Rollover/Shrink Index API • Delete by Query and more!
been replaced by the text field for full text analyzed content, and the keyword field for not-analyzed exact string values • The string field to be deprecated in 6.0 • Default string mappings: 5 { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }
as though they were an object • The following two documents are treated as thought they were the same: 7 PUT my_index/my_type/1 { "aaa.bbb.ccc": "some_val", "aaa.ddd": "other_val" } PUT my_index/my_type/2 { "aaa": { "bbb": { "ccc": "some_val" }, "ddd": "other_val" } }
new index when the existing index is considered to be too large or too old • Settings, mappings, and aliases can be specified other than using index templates 8 PUT /logs-0001 { "aliases": { "logs_write": {} }} POST logs_write/_rollover { "conditions": { "max_age": "7d", "max_docs": 1000 }, "settings": { "index.number_of_shards": 2 }}
new index with fewer primary shards • The requested number of primary shards in the target index must be a factor of the number of shards in the source index (e.g. 8 primary shards into 4, 2 or 1; 15 primary shards into 5, 3 or 1) 9 POST my_source_index/_shrink/my_target_index { "settings": { "index.number_of_replicas": 1, "index.number_of_shards": 1, "index.codec": "best_compression" }, "aliases": { "my_search_indices": {} } }
replaced by the Delete By Query API • Performs a deletion on every document that match a query 10 POST twitter/_delete_by_query { "query": { "match": { "message": "some message" } } }
cache is no longer loaded to memory by default • Aggregation does not work in analyzed fields • “fielddata” must be set “true” explicitly when using 11 PUT my_index { "mappings": { "_default_" :{ "properties": { “my_text_field” : { "type": "text", "index": "analyzed", "fielddata": true } } } } }
through Kibana up to 1 GB • Tips - Date/time field must look like “2016-07-12T03:47:19.744Z” or “2016-07-12” - Single title and at least 10 data lines are required - No extra spaces between columns - Save in UTF-8 14