Elastic (@elastic) / X

Elastic

10.4K posts

Elastic

@elastic

Where developers learn, build, and share. Your source for hands-on demos, cheat sheets, explainers and more.

Global

Joined October 2009

Elastic
@elastic
19h
300+ Claude audit events now land in Elastic Security. Elastic's Anthropic integration pulls from Claude's Compliance API. Everything maps to ECS. Sign-ins, SSO changes, role updates, API key lifecycle, MCP server connections, data exports. Searchable the moment they land.
00:00
1.3K
Elastic
@elastic
19h
Blog and integration docs:
Monitor Claude activity in Elastic Security
From elastic.co
490
Elastic reposted
Elastic Security Labs
@elasticseclabs
Jun 8
Your SOC tools don't talk to your dev tools. Your detection engineers write rules in one place and investigate in another. Live on June 17, we're demoing autonomous investigation workflows and security operations running inside Claude, Cursor, and Copilot. One week to go.
00:00
1.2K
Elastic reposted
Elastic Security Labs
@elasticseclabs
Jun 15
Attackers are using AI to cut attack timelines to minutes. @andythevariable , @jamesspi and @DanielMiessler get into what that means for your SOC, live on June 17.
Andrew Pease
@andythevariable
Jun 13
On June 17, I'm going live with @jamesspi and @DanielMiessler to cover the Obsidian and Axios supply chain attacks, and how AI agents can speed response. Humans don't leave the loop; they're moved to the top of it. 10am PT / 1pm ET @elasticseclabs elastic.co/lp/agentic-ai-…
00:00
1.8K
Elastic
@elastic
Jun 12
3 types of mappings in Elasticsearch Dynamic: Elasticsearch detects field types as documents arrive. Explicit: you define every field upfront. Recommended for production. Runtime: schema-on-read, no reindexing needed. Each trades setup speed for indexing control.
666K
Elastic
@elastic
Jun 12
Learn more:
elastic.co
Mapping | Elastic Docs
Mapping is the process of defining how a document and the fields it contains are stored and indexed. Each document is a collection of fields, which each...
1K
Elastic
@elastic
Jun 11
Stop building dummy data to test Elasticsearch. Kibana ships three production-quality sample datasets. One click to install, dashboards included: - Sample eCommerce orders: customer transactions, product categories, revenue by region - Sample flight data: airline routes, ticket
00:00
2.3K
Elastic
@elastic
Jun 11
Sample data:
elastic.co
Sample data | Elastic Docs
Using sample data is a great way to start exploring the system and learn your way around. There are a few ways to easily ingest sample data into Elasticsearch...
734
Elastic
@elastic
Jun 10
🧵 Your PromQL doesn't have to be rewritten to move to Elastic Observability. 9.4 added native Prometheus support. Ship metrics straight to ES, run your existing PromQL in Kibana. Same queries. Same dashboards. rate(http_requests_total{job="api"}[5m]) That runs in Kibana now.
1.6K
Elastic
@elastic
Jun 10
When you want one language across logs, metrics, and traces, ES|QL's TS command is the direct equivalent. TS metrics-* | STATS SUM(RATE(http_requests_total, 5m)) BY job, TBUCKET(5m) RATE(metric, 5m) maps to PromQL's rate(metric[5m]). TS groups by time series first and handles
30x faster than Prometheus: How we rebuilt Elasticsearch as a leading columnar metrics datastore -...
From elastic.co
700
Elastic
@elastic
Jun 9
Learn how to cut Elasticsearch log storage by up to 76% with LogsDB: 1. Create a LogsDB index with "index.mode": "logsdb" 2. Reindex your logs into both a standard and LogsDB index 3. Force merge both indices with _forcemerge?max_num_segments=1 4. Measure the difference with the
8M
Elastic
@elastic
Jun 9
Already on Elasticsearch 9.2+? Any logs-* data stream uses LogsDB by default. Run GET /.ds-logs-*/_settings?filter_path=*.settings.index.mode to verify.
2.5K
Elastic
@elastic
Jun 9
Follow along in the full tutorial:
How to cut Elasticsearch log storage costs with LogsDB — Elastic Observability Labs
From elastic.co
1.5K
Elastic
@elastic
Jun 8
🧵 p95 latency tile in Kibana. 5 million events. Takes 296ms exact. Add one line to the ES|QL pipeline: SET approximation=true; Same query. 110ms. Every result comes with a confidence interval. Drop the interval (SET approximation={"confidence_level": null}) and it runs in
1.8K
Elastic
@elastic
Jun 8
ES|QL 9.4 approximate mode samples and extrapolates instead of scanning everything. Accuracy depends on data shape, not row count. Full benchmark on 5M events in Serverless:
1.3K
Elastic
@elastic
Jun 8
Good fit for the speculative query patterns LLM agents generate: fast, approximate, cheap. Won't approximate DISTINCT_COUNT, MIN, or MAX yet. No support for TS, JOIN, or FORK pipelines. Falls back to exact. Gist: go.es.io/4fbZdcH Blog: go.es.io/4nUElst
single_query_compare.py
From gist.github.com
1K
Elastic
@elastic
Jun 5
🧵 Autocomplete has to be faster than regular search. That's the whole point. If your latency is high, users stop seeing suggestions before they finish typing. The approach you pick determines whether you hit that bar in production. Here are 4 ways to build autocomplete in
2.8K
Elastic
@elastic
Jun 5
Replying to @elastic
TL;DR: - 4 approaches: search-as-you-type, query time, completion suggester, index time - match_bool_prefix is the underused middle ground for query time - Empty prefix queries can bring down a cluster — always set a minimum character threshold - Completion suggester is for
890
Elastic
@elastic
Jun 5
Full breakdown with code samples in the blog:
Elasticsearch autocomplete: search as you type, query time & more - Elasticsearch Labs
From elastic.co
685