Elastic

Where developers learn, build, and share. Your source for hands-on demos, cheat sheets, explainers and more.

[Elastic @elastic]

When people say “hybrid search,” they usually mean keyword + semantic.

But what about semantic + geospatial?

If I search for “a quiet café to work from,” understanding what I mean is only half the job. I also need it to be nearby.

[Elastic Security Labs @elasticseclabs]

Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

You can still focus on detection coverage today.

Security Labs writeup (coverage + guidance): https://t.co/aBB6g7gCZ5

Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.

• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root

The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.

We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.

The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.

(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)

Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.

Guidance + every rule link below.

[Elastic @elastic]

Step 4: ask Lucene why a track ranked where it did.

searcher.explain(query, doc) breaks the BM25 score down per term: boost × idf × tf.

On a track with "bob" in both title and album, the title clause adds 10.77 and the album clause 4.08. So yes, the title counts for more.

Next: facets, counting what users can click.

Code for the series, built by @dadoonet https://t.co/cQhuxn4wi6

[Elastic @elastic]

Building search into a Java music library with plain Lucene, one step at a time.

The tracks are indexed. Now we query them.

Should "Bob" in a title count for more than "Bob" in an album?

Step 1: start with no criteria. Open an IndexSearcher and fetch the first 10 hits. Each hit carries a Lucene doc number, so read the stored id and join back to your beans.

[Elastic @elastic]

We're building search into a Java music library with plain Lucene, one step at a time.

Next up is analysis: what happens to your text before it reaches the index. An analyzer cuts it into tokens, lowercases them and folds the accents away.

Step 1: add lucene-analysis-common for ASCIIFoldingFilter. Pin the same version as lucene-core

[Elastic @elastic]

Step 3: filter and exclude.

Wrap the text query as MUST. Add a FILTER on genre = Club: 62 → 26 hits. Add a MUST_NOT on keys 4A or 4B: 26 → 23.

FILTER and MUST_NOT narrow the results without touching the score.

Gotcha: a query with only MUST_NOT matches nothing. When users exclude without typing, add a MatchAllDocsQuery as MUST.

[Elastic @elastic]

Why share an Agent Builder conversation instead of a summary? https://t.co/ldpYqrqFfi

[Elastic @elastic]

Most “share chat” links are a secret URL to a frozen copy.

Anyone with the link can read it, and nobody can continue it.

Shared Agent Builder conversations are live and use the Kibana privileges you already have.

No bearer link.

[Elastic @elastic]

Stop moving Grafana dashboards by hand

Elastic’s tools make dashboard migration a whole lot easier: https://t.co/olK20EAunj

[Elastic @elastic]

Step 3: the index holds terms, not text.

After commit, each term points to the documents that contain it. Look up artist:bob and you get docs 1, 2 and 3.

It works like the index at the back of a book: jump to the term, skip the scan.

Next: type "Bob" and build the query a real search engine runs.

Code for the series, built by @dadoonet https://t.co/cQhuxn4wi6

[Elastic @elastic]

We're building search into a Java music library with plain Lucene, one step at a time.

Next up is analysis: what happens to your text before it reaches the index. An analyzer cuts it into tokens, lowercases them and folds the accents away.

Step 1: add lucene-analysis-common for ASCIIFoldingFilter. Pin the same version as lucene-core

[Elastic @elastic]

Your beans are mapped. Now, who owns the index?

Step 1: wrap Directory + IndexWriter in a small class dedicated to your bean.

ByteBuffersDirectory for in-memory, FSDirectory to persist

[Elastic @elastic]

Step 2: build the analyzer chain.

StandardTokenizer splits the text. LowerCaseFilter lowercases it. ASCIIFoldingFilter turns "François" into "francois".

No stemming, so artist names stay intact. No stop words, so "Around The World" stays searchable.

Use the same analyzer at index time and query time, or your query terms won't match.

[Carly Richmond @CarlyLRichmond]

📣 Attention #DevRel friends!

@elastic are hiring Senior Developer Advocates in NYC, US and Sao Paulo, Brazil. Job specs 👇 .

https://t.co/KDoiQlItjo

https://t.co/6PekdmjYMO

If you are based in these locations and have a background in #DevRel or software engineering, apply!

[Elastic @elastic]

Full walkthrough with the ES|QL queries, alert rules, and a companion notebook that rebuilds the whole lab: https://t.co/dlA67FLRof

[Elastic @elastic]

Same 1.25 GiB load, twice. 1 run alerted, 1 didn't.

[Elastic @elastic]

Step 4: close the writer first, then the directory

Order matters

If request threads share the index, put every mutation behind the same lock.

Rule of thumb: upsert or delete for single-row edits, full rebuild for bulk changes.

Next: what happens to a token before it reaches the index.

Code for the series, built by @dadoonet https://t.co/cQhuxn4wi6

[Elastic @elastic]

Your beans are mapped. Now, who owns the index?

Step 1: wrap Directory + IndexWriter in a small class dedicated to your bean.

ByteBuffersDirectory for in-memory, FSDirectory to persist

[Elastic @elastic]

Get any Java bean ready for Lucene in 3 steps

You have a Track bean. You need search.

Step 1: embed Apache Lucene in-process. One dependency, no native code, no server to run.

Elasticsearch does this for you on top of Lucene. Here's what it looks like by hand 👇

[Elastic @elastic]

Step 3: edit one row, not the whole index

updateDocument deletes by term, then adds, in one call.

Key it on the id StringField from part 1. It's never analyzed, so the term matches exactly.

[Elastic @elastic]

In an agentic trace with 20 LLM calls, you can see which span is using the most tokens and read the prompt that caused it.

Both live in Elastic APM, so there's no second tool to run. https://t.co/QwIeEgDaAi