MOUNTAIN VIEW, Calif. & AMSTERDAM, The Netherlands--(BUSINESS WIRE)--Elastic N.V. (NYSE: ESTC), creators of Elasticsearch, today announced the release of Elastic Stack 7.5.0, the latest version of the all-in-one datastore, search engine, and analytics platform.
Along with the introduction of Kibana Lens, a fast and intuitive way to craft visualizations, this release offers significant enhancements to Elastic’s Observability, Security, and Enterprise Search solutions.
Introducing Kibana Lens: An entirely new data visualization experience
Kibana is, and has always been, the best way to visualize data stored in Elasticsearch and to navigate the Elastic Stack. With 7.5, Elastic is introducing Kibana Lens — an entirely new way to craft visualizations. Lens is designed to work the way users think, letting users rapidly go from raw data to meaningful visualization without needing any previous technical experience or knowledge of Elasticsearch. It starts with a new drag-and-drop experience, along with the ability to easily switch between chart types and different index patterns. As the user adds fields to the chart, Lens provides smart suggestions to show other views of the data. Combined with the speed of Elasticsearch, Lens makes it faster and easier than ever to visualize, explore, and understand data.
More information about Lens and the other Kibana features in 7.5 is available on Elastic’s blog.
Index time enrichment in Elasticsearch gets even richer
Way back in Elasticsearch 5.0, Elastic first introduced the Ingest Pipeline — a way to process and enrich documents at indexing time. By building this directly into Elasticsearch, configuration via API is simple, scaling out is easy, and performance is quite fast. Over the years, Elastic has seen wide adoption of this feature and now relies on it for processing and enrichment in nearly all of its modules — the many data sources that Elastic natively supports. Whether it's parsing a log line with grok or dissect or adding location data to an IP address, ingest pipelines are increasingly the workhorse doing the ingest-time processing in the Elastic Stack. With the 7.5 release, Elastic is delivering one of the most requested features: lookup-based enrichment. The new Enrich processor provides an efficient way to query an Elasticsearch index and add the results to a document at indexing time. This allows users to do things like identify web services or vendors based on known IP addresses, add postal codes based on user coordinates, or look up host information ingested from a configuration management database and add the relevant metadata to a document right at indexing time.
More about the enrich processor and all the new Elasticsearch features in 7.5 can be found in Elastic’s Elasticsearch blog post.
The Elastic Stack also hosts Elastic’s solutions: tailored applications for common use cases. With the 7.5 release, Elastic has also introduced improvements to its Observability, Security, and Enterprise Search solutions.
Elastic Enterprise Search
Elastic Enterprise Search aims to connect people and teams to the content that matters most to them. For organizations with a significant Microsoft product footprint, Elastic Enterprise Search now provides one-click integrations with SharePoint Online, Office 365, and OneDrive, making it easier than ever to unify and search across content platforms. To top it off, Enterprise Search also includes a brand new ServiceNow connector, allowing users to centralize all business operation information in one place. With these new sources now available alongside the ones already included — Salesforce, Google Drive, Atlassian JIRA, Confluence, Dropbox, and more — teams can now focus on the task at hand.
Elastic Enterprise Search is now being versioned and released with the Elastic Stack, which makes this the 7.5.0 release, and it remains in beta for the time being. More details about what’s new are available in Elastic’s Enterprise Search blog post.
Elastic Observability
Elastic believes that to truly understand your applications and infrastructure, you need to be able to see, or observe, each layer. Elastic Observability brings together the Elastic Logs, Metrics, APM, and Uptime products to give a more complete and comprehensive view across an organization. Version 7.5 of the Elastic Stack brings a significant expansion of the Elastic Metrics story and adds several key integrations between APM, logging, and security data for organizations adopting observability initiatives.
Elastic’s metrics story has gained steam in recent releases with the addition of Metrics Explorer, a purpose-built user interface for real-time metrics analytics. Elastic has also made it easier to get started with metrics using turnkey data integrations for the most important infrastructure and service metrics, including Kubernetes, Prometheus, and Amazon Web Services (AWS). In 7.5, Elastic builds on that momentum by introducing turnkey monitoring of Microsoft Azure metrics and logs as part of Elastic’s partnership with Microsoft. Finally, Elastic has also added initial support for viewing endpoint security data directly in the Elastic Metrics and Logs apps. These advances help Elastic Stack users set up monitoring of critical services more quickly and enable them to combine metrics with important events, such as audit logs from endpoint devices, more efficiently.
To learn more, read Elastic’s Observability blog post.
Elastic Security
It is an exciting time for folks using the Elastic Stack to protect their organizations. Since the last release, Elastic has joined forces with Endgame, a leading endpoint security company, and announced the end of per-endpoint pricing for the EPP/EDR space. Unlimited endpoints are now included with Elastic’s Enterprise subscriptions, so users no longer need to choose which machines deserve protection. For servers, if you’re already collecting security and operational data, why not protect them at the same time? And it isn’t just about servers; the security events from all of your infrastructure, including desktops and laptops, should be available to security analysts. Version 7.5 of Elastic SIEM now includes endpoint security data and alerts directly in the SIEM app.
The 7.5 release of Elastic SIEM also continues the push to detect threats using machine learning, from identifying unusual patterns in DNS activity that could indicate DNS tunneling or command and control behavior, to unusual logins over RDP or using the runas command, and more. The SIEM app itself is expanding to include a number of new visualizations and widgets that make threat hunting easier, from interactive visualizations of host activity to a new TLS view that surfaces unusual certificates and simplifies hunting based on TLS fingerprints, such as JA3 hash.
To learn more about Elastic’s vision around Elastic SIEM and Elastic Endpoint Security, watch the launch announcement here, or check out Elastic’s Security blog post for the details about what’s new in 7.5.
Learn more
Read the individual product blogs for the details on everything added in 7.5:
The Elastic Stack
Elasticsearch 7.5.0 released
Kibana 7.5.0 released
Beats 7.5.0 released
Logstash 7.5.0 released
Solutions:
Elastic Enterprise Search 7.5.0 released
Elastic Observability 7.5.0 released
Elastic Security 7.5.0 released
About Elastic
Elastic is a search company. As the creators of the Elastic Stack (Elasticsearch, Kibana, Beats, and Logstash), Elastic builds self-managed and SaaS offerings that make data usable in real time and at scale for use cases like application search, site search, enterprise search, logging, APM, metrics, security, business analytics, and many more.
Elastic and associated marks are trademarks or registered trademarks of Elastic N.V. and its subsidiaries. All other company and product names may be trademarks of their respective owners.
