187 lines
6.9 KiB
Plaintext
187 lines
6.9 KiB
Plaintext
[[release-highlights-7.3.0]]
|
|
== 7.3.0 release highlights
|
|
++++
|
|
<titleabbrev>7.3.0</titleabbrev>
|
|
++++
|
|
|
|
//NOTE: The notable-highlights tagged regions are re-used in the
|
|
//Installation and Upgrade Guide
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== Voting-only master nodes
|
|
|
|
A new {ref}/modules-node.html#voting-only-node[`node.voting-only`] role has been
|
|
introduced that allows nodes to participate in elections even though they are
|
|
not eligible to become the master.
|
|
The benefit is that these nodes still help with high availability while
|
|
requiring less CPU and heap than master nodes.
|
|
|
|
NOTE: The `node.voting-only` role is only available with the default
|
|
distribution of {es}.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== Reloading of search-time synonyms
|
|
|
|
A new {ref}/indices-reload-analyzers.html[Analyzer reload API] allows to reload
|
|
the definition of search-time analyzers and their associated resources. A common
|
|
use-case for this API is the reloading of search-time synonyms. In earlier
|
|
versions of Elasticsearch, users could force synonyms to be reloaded by closing
|
|
the index and then opening it again. With this new API, synonyms can be updated
|
|
without closing the index.
|
|
|
|
NOTE: The Analyzer reload API is only available with the default distribution
|
|
of {es}.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== New `flattened` field type
|
|
|
|
A new {ref}/flattened.html[`flattened`] field type has been added, which can index
|
|
arbitrary `json` objects into a single field. This helps avoid hitting issues
|
|
due to many fields in mappings, at the cost of more limited search
|
|
functionality.
|
|
|
|
NOTE: The `flattened` field type is only available with the
|
|
default distribution of {es}.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== Functions on vector fields
|
|
|
|
Painless now support computing the
|
|
{ref}/query-dsl-script-score-query.html#vector-functions[cosine similarity] and
|
|
the {ref}/query-dsl-script-score-query.html#vector-functions[dot product] of a
|
|
query vector and either values of a
|
|
{ref}/sparse-vector.html[`sparse_vector`] or
|
|
{ref}/dense-vector.html[`dense_vector`] field.
|
|
|
|
NOTE: These functions are only available with the default distribution of {es}.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== Prefix and wildcard support for intervals
|
|
|
|
{ref}/query-dsl-intervals-query.html[Intervals] now support querying by
|
|
{ref}/query-dsl-intervals-query.html#intervals-prefix[prefix] or
|
|
{ref}/query-dsl-intervals-query.html#intervals-wildcard[wildcard].
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== Rare terms aggregation
|
|
|
|
A new
|
|
{ref}/search-aggregations-bucket-rare-terms-aggregation.html[Rare Terms aggregation]
|
|
allows to find the least frequent values in a field. It is intended to replace
|
|
the `"order" : { "_count" : "asc" }` option of the
|
|
{ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregations].
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== Aliases are replicated via {ccr}
|
|
|
|
Read aliases are now replicated via {ref}/ccr-put-follow.html[{ccr}]. Note that
|
|
write aliases are still not replicated since they only make sense for indices that
|
|
are being written to while follower indices do not receive direct writes.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== SQL supports frozen indices
|
|
|
|
{es-sql} now supports querying {ref}/frozen-indices.html[frozen indices] via the
|
|
new {ref}/sql-index-frozen.html[`FROZEN`] keyword.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== Fixed memory leak when using templates in document-level security
|
|
|
|
{stack-ov}/document-level-security.html[Document-level security] was using an
|
|
unbounded cache for the set of visible documents. This could lead to a memory
|
|
leak when using a templated query as a role query. The cache has been fixed to
|
|
evict based on memory usage and has a limit of 50MB.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[float]
|
|
==== More memory-efficient aggregations on `keyword` fields
|
|
|
|
{ref}/search-aggregations-bucket-terms-aggregation.html[Terms aggregations]
|
|
generally need to build
|
|
{ref}/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-execution-hint[global ordinals]
|
|
in order to run. Unfortunately this operation became more memory-intensive in
|
|
6.0 due to the move to doc-value iterators in order to improve handling of
|
|
sparse fields. Memory pressure of global ordinals now goes back to a more
|
|
similar level as what you could have on pre-6.0 releases.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[discrete]
|
|
[[release-highlights-7.3.0-transforms]]
|
|
==== {dataframes-cap}: transform and pivot your streaming data
|
|
|
|
beta[] {stack-ov}/ml-dataframes.html[{dataframe-transforms-cap}] are a core new
|
|
feature in {es} that enable you to transform an existing index to a secondary,
|
|
summarized index. {dataframe-transforms-cap} enable you to pivot your data and
|
|
create entity-centric indices that can summarize the behavior of an entity. This
|
|
organizes the data into an analysis-friendly format.
|
|
|
|
{dataframe-transforms-cap} were originally available in 7.2. With 7.3 they can
|
|
now run either as a single batch transform or continuously incorporating new
|
|
data as it is ingested.
|
|
|
|
{dataframes-cap} enable new possibilities for {ml} analysis (such as
|
|
_outlier detection_), but they can also be useful for other types of
|
|
visualizations and custom types of analysis.
|
|
|
|
// end::notable-highlights[]
|
|
|
|
// tag::notable-highlights[]
|
|
[discrete]
|
|
[[release-highlights-7.3.0-outlier-detection]]
|
|
==== Discover your most unusual data using {oldetection}
|
|
|
|
The goal of {stack-ov}/dfa-outlier-detection.html[{oldetection}] is to find
|
|
the most unusual data points in an index. We analyse the numerical fields of
|
|
each data point (document in an index) and annotate them with how unusual they
|
|
are.
|
|
|
|
We use unsupervised {oldetection} which means there is no need to provide a
|
|
training data set to teach {oldetection} to recognize outliers. In practice,
|
|
this is achieved by using an ensemble of distance based and density based
|
|
techniques to identify those data points which are the most different from the
|
|
bulk of the data in the index. We assign to each analysed data point an
|
|
{olscore}, which captures how different the entity is from other entities in the
|
|
index.
|
|
|
|
In addition to new {oldetection} functionality, we are introducing the
|
|
{ref}/evaluate-dfanalytics.html[evaluate {dfanalytics} API], which enables you
|
|
to compute a range of performance metrics such
|
|
as confusion matrices, precision, recall, the
|
|
https://en.wikipedia.org/wiki/Receiver_operating_characteristic[receiver-operating characteristics (ROC) curve]
|
|
and the area under the ROC curve. If you are running {oldetection} on a source
|
|
index that has already been labeled to indicate which points are truly outliers
|
|
and which are normal, you can use the
|
|
evaluate {dfanalytics} API to assess the performance of the
|
|
{oldetection} analytics on your dataset.
|
|
|
|
// end::notable-highlights[]
|