Search Enhancement Features for Elasticsearch Clusters

Compared with open-source Elasticsearch, Elasticsearch clusters in CSS have many enhanced features. Table 1 lists these enhanced features and the corresponding cluster versions.

**Table 1** Search enhancement features for CSS Elasticsearch clusters
Enhanced Feature	Description	Cluster Version	Details
Vector search	Unstructured data, such as images, videos, and language corpora, is converted into vectors, which are searched based on similarity using either an exact or approximate nearest neighbors algorithm.	Elasticsearch 7.6.2, Elasticsearch 7.10.2	Configuring Vector Search for Elasticsearch Clusters
Storage-compute decoupling	Hot data that is frequently accessed is stored in high-performance storage media, while cold data that is infrequently accessed is migrated to low-cost storage media — Object Storage Service (OBS). This ensures real-time query performance for hot data while reducing long-term storage costs. Compared with cold/hot storage switchover, storage-compute decoupling is a better option for use cases that are not particularly demanding in terms of search performance, as cold data is stored in OBS, which cuts storage costs.	Elasticsearch 7.6.2, Elasticsearch 7.10.2	Configuring Decoupled Storage and Compute for an Elasticsearch Cluster
Flow Control 2.0	Protects clusters from overload through flow control policies, such as client request throttling, shard indexing backpressure, and traffic pattern analysis, ensuring proper resource allocation and risk prevention. NOTE: Elasticsearch 7.6.2 and Elasticsearch 7.10.2 clusters created after January 2023 support Flow Control 2.0 only, whereas those created before that support Flow Control 1.0 only.	Elasticsearch 7.6.2, Elasticsearch 7.10.2	Configuring Flow Control 2.0 for an Elasticsearch Cluster
Flow Control 1.0	Flow Control 1.0 controls traffic at the node level. You can configure blacklists and whitelists per node, the maximum concurrent HTTP connections allowed, the maximum HTTP connections allowed, the maximum heap memory used by specific request paths, and the maximum CPU usage. You can block access in one click, and collect statistics on IP addresses and URLs accessing the nodes. If flow control is enabled, requests will be blocked at the entry, which alleviates the cluster pressure in high-concurrency scenarios and reduces the likelihood of unavailability issues. NOTE: Elasticsearch 7.6.2 and Elasticsearch 7.10.2 clusters created after January 2023 support Flow Control 2.0 only, whereas those created before that support Flow Control 1.0 only.	Elasticsearch 7.6.2, Elasticsearch 7.10.2	Configuring Flow Control 1.0 for an Elasticsearch Cluster
Large query isolation	You can isolate query requests that consume a large amount of memory or take a long period of time. This way, you ensure service availability for other requests. If the heap memory usage of a node is too high, an interrupt control program will be triggered to terminate a large query based on the policies you configured. You can also configure a global query timeout duration. Long queries will be intercepted by an Elasticsearch-native cancel API.	Elasticsearch 7.6.2, Elasticsearch 7.10.2	Configuring Large Query Isolation for an Elasticsearch Cluster
Enhanced aggregation	Enhances aggregation performance in the face of large data volumes by leveraging vectorization and optimized clustering, enabling faster analytics and decision-making in complex situations.	Elasticsearch 7.10.2	Configuring Enhanced Aggregation for an Elasticsearch Cluster
Read/write splitting	Directs writes to the leader cluster and queries to the follower cluster. This separation of workloads enhances the stability, scalability, and high-concurrency processing capabilities of clusters.	Elasticsearch 7.6.2, Elasticsearch 7.10.2	Configuring Read/Write Splitting Between Two Elasticsearch Clusters
Switchover between hot and cold storage	Switching between hot and cold storage means to allocate data to nodes of different performance standards based on data temperature (that is, how often data is accessed). Typically, high-performance hardware (such as SSDs) is used to store hot data (real-time data) that is frequently accessed, while inexpensive hardware (such as HDDs) is used to store cold data (historical data) that is infrequently accessed. The goal is to achieve optimal storage costs and query performance. Compared with storage-compute decoupling, cold/hot storage switchover is a better option for use cases that are demanding in terms of search performance. Cold data is stored on local cold data nodes in the cluster. The storage capacity available depends on the number of cold data nodes and their disk capacity. The storage cost is higher than that of OBS.	This feature is supported as long as the cluster has cold data nodes.	Switching Between Hot and Cold Storage for an Elasticsearch Cluster
Index recycle bin	Similar to any other type of recycle bin, the index recycle bin temporarily stores deleted indexes so that users can restore them before they are finally removed from the recycle bin. This helps to prevent misdeletion of data and improve cluster data reliability.	Elasticsearch 7.10.2	Configuring an Index Recycle Bin for an Elasticsearch Cluster