What’s new in 8.15edit

Here are the highlights of what’s new and improved in Elasticsearch 8.15!

Stored fields are now compressed with ZStandard instead of LZ4/DEFLATEedit

Stored fields are now compressed by splitting documents into blocks, which are then compressed independently with ZStandard. index.codec: default (default) uses blocks of at most 14kB or 128 documents compressed with level 0, while index.codec: best_compression uses blocks of at most 240kB or 2048 documents compressed at level 3. On most datasets that we tested against, this yielded storage improvements in the order of 10%, slightly faster indexing and similar retrieval latencies.

#103374

New custom parser for ISO-8601 datetimesedit

This introduces a new custom parser for ISO-8601 datetimes, for the iso8601, strict_date_optional_time, and strict_date_optional_time_nanos built-in date formats. This provides a performance improvement over the default Java date-time parsing. Whilst it maintains much of the same behaviour, the new parser does not accept nonsensical date-time strings that have multiple fractional seconds fields or multiple timezone specifiers. If the new parser fails to parse a string, it will then use the previous parser to parse it. If a large proportion of the input data consists of these invalid strings, this may cause a small performance degradation. If you wish to force the use of the old parsers regardless, set the JVM property es.datetime.java_time_parsers=true on all ES nodes.

#106486

Preview: Support for the Connection Type, 'Domain, and ISP databases in the geoip processoredit

As a Technical Preview, the geoip processor can now use the commercial GeoIP2 Connection Type, GeoIP2 Domain, and GeoIP2 ISP databases from MaxMind.

#108683