Elasticsearch is a distributed search and analytics engine that also serves as a data store and vector database. It indexes structured, unstructured, and vector data and makes newly indexed documents searchable in near real time, which makes it usable as the retrieval layer behind retrieval-augmented generation (RAG) and agentic search.
You work with it through REST APIs: data is added as JSON documents, timestamped data such as logs and metrics goes into data streams backed by auto-generated indices, and queries are sent as JSON. Language clients exist for common programming languages, and Kibana provides a developer console and the Discover view for querying and visualizing indexed data.
It is the foundation of the Elastic Stack, and it runs either as a managed deployment on Elastic Cloud or self-managed. For local development and testing, a start-local script starts Elasticsearch and Kibana together in Docker.
Features
- Full-text search: relevance-ranked text queries over indexed documents
- Vector search: stores embeddings and runs vector and hybrid search for RAG pipelines
- Document indexing: JSON documents added individually or in bulk as newline-delimited JSON (NDJSON) through the _bulk API
- Data streams: timestamped data such as logs and metrics written to data streams with auto-generated backing indices
- Observability data: logs, metrics, application performance monitoring (APM), and security logs
- REST and client access: any HTTP client or the official language clients, authenticated with basic auth or API keys
- Kibana integration: a developer console for running requests and Discover for exploring and visualizing data
