| navigation_title | AI-powered features | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| applies_to |
|
||||||||||||
| products |
|
AI is a core part of the Elastic platform. It augments features and helps you analyze your data more effectively. This page lists the AI-powered capabilities and features available to you in each solution, and provides links to more detailed information about each of them.
To learn about enabling and disabling these features in your deployment, refer to .
For pricing information, refer to pricing.
- To use Elastic's AI-powered features, you need an appropriate subscription level or serverless feature tier. These vary by solution and feature. Refer to each feature's documentation to learn more.
- Most features require at least one working LLM connector. To learn about setting up large language model (LLM) connectors used by AI-powered features, refer to . Elastic Managed LLMs are available by default if your license supports it.
Elastic publishes tested model ratings and recommendations for chat and connector-based generative AI features including AI Assistant, {{agent-builder}}, and related workflows. Refer to:
- LLM performance matrix for {{observability}} and LLM performance matrix for {{elastic-sec}} summarize model performance for those solutions' AI-powered features.
- Recommended models for {{agent-builder}}: models that work well with {{agent-builder}}.
Other AI capabilities on this page—such as {{infer-cap}}, NLP and embedding models, and search ranking—use different model types and evaluation criteria. Refer to each feature's documentation for model choice; Elastic doesn't publish consolidated LLM performance matrices for every platform feature.
The following AI-powered features are available across the Elastic platform. These are core {{es}} capabilities that you can use regardless of your chosen solution or project type.
Elastic {{infer-cap}} enables you to use {{ml}} models to perform operations such as text embedding or reranking on your data.
To learn more, refer to:
- Elastic {{infer-cap}} Service (EIS): A managed service that runs {{infer}} without the need of deploying a model, or managing infrastructure and resources.
- Elastic Managed LLMs: Built-in LLMs vetted for GenAI product features across the platform.
- The {{infer}} API: This general-purpose API enables you to perform {{infer}} operations using EIS, your own models, or third-party services.
Natural Language Processing (NLP) enables you to analyze natural language data and make predictions. Elastic offers a range of built-in NLP models such as the Elastic-trained ELSER or Jina models. You can also deploy custom NLP models.
Vector search uses embeddings and similarity matching to find related data in {{es}}. {{ml-cap}} models convert text, images, and other content into vectors. Use cases include recommendations, duplicate detection, fraud and anomaly detection, image similarity, and semantic search.
For direct control over embeddings, field types, and queries, implement dense or sparse vector search with dense_vector and sparse_vector field types. Refer to Vector search in {{es}} for concepts, field types, and tutorials.
When you want a managed workflow for text—embedding generation, field mapping, and similarity retrieval, use the semantic search workflow. Start with the semantic_text field type for the simplest setup.
Hybrid search combines full-text search with vector search in one request so results can match both exact terms and meaning.
Semantic re-ranking involves using ML models to reorder search results based on semantic similarity to queries, using models hosted in {{es}} or using third-party inference endpoints.
Learning To Rank is an advanced feature that involves using trained ML models to build custom ranking functions for search. Best suited for use cases with substantial training data and requirements for highly customized relevance tuning.
Automatic Import uses an LLM to help you build a custom Elastic integration from a data sample when no prebuilt integration exists for your source. It applies across solutions that use {{agent}} and integrations, including {{observability}} and {{elastic-sec}}.
The {{es}} solution view (or project type in {{serverless-short}}) includes certain AI-powered features beyond the core {{es}} capabilities available on the Elastic platform.
Agent Builder enables you to create AI agents that can interact with your {{es}} data, run queries, and provide intelligent responses. It provides a complete framework for building conversational AI experiences on top of your search infrastructure.
helps you understand, analyze, and interact with your Elastic data throughout {{kib}}. It provides a chat interface where you can ask questions about the {{stack}} and your data, and provides contextual insights throughout {{kib}} that explain errors and messages and suggest remediation steps.
Playground enables you to use large language models (LLMs) to understand, explore, and analyze your {{es}} data using retrieval augmented generation (RAG), via a chat interface. Playground is also very useful for testing and debugging your {{es}} queries, using the retrievers syntax with the _search endpoint.
Elastic offers two MCP server options for connecting agents to your {{es}} data. The Agent Builder MCP server is the recommended approach for {{es}} 9.2+ deployments and Serverless projects, offering full access to built-in and custom tools. For older {{es}} versions without Agent Builder, you can use the mcp-elasticsearch server which has a limited tool set.
stack: preview 9.2
elasticsearch: preview
Elastic 9.2+ deployments and Serverless projects provide an Agent Builder MCP server endpoint that exposes all built-in and custom tools you can use to power agentic workflows.
stack: deprecated 9.2
serverless: deprecated
If you're running earlier versions of {{es}} without Agent Builder, you can use elastic/mcp-server-elasticsearch. This MCP server enables connecting agents to your {{es}} data and allows you to interact with your {{es}} indices through natural language conversations, though with a more limited tool set compared to the Agent Builder MCP server.
{{observability}}'s AI-powered features all require an LLM connector. When you use one of these features, you can select any LLM connector that's configured in your environment. The connector you select for one feature does not affect which connector any other feature uses. For specific configuration instructions, refer to each feature's documentation. To find models that have been tested for {{observability}} use cases, refer to the LLM performance matrix for {{observability}}.
helps you understand, analyze, and interact with your Elastic data throughout {{kib}}. It provides a chat interface where you can ask questions about the {{stack}} and your data, and provides contextual insights throughout {{kib}} that explain errors and messages and suggest remediation steps.
Streams is an AI-assisted centralized UI within {{kib}} that streamlines common tasks like extracting fields, setting data retention, and routing data. Streams leverages AI in the following features:
% * Significant Events: Use AI to suggest queries based on your data that find important events in your stream.
- Grok processing: Use AI to generate grok patterns that extract meaningful fields from your data.
- Partitioning: Use AI to suggest logical groupings and child streams based on your data when using wired streams.
- Advanced settings: Use AI to generate a stream description and a feature identification that other AI features use when generating suggestions.
Automatic Import helps you ingest logs and events from sources that don’t have prebuilt Elastic integrations by generating a new integration from a sample of your data.
{{elastic-sec}}'s AI-powered features all require an LLM connector. When you use one of these features, you can select any LLM connector that's configured in your environment. The connector you select for one feature does not affect which connector any other feature uses. For specific configuration instructions, refer to each feature's documentation. To find models that have been tested for {{elastic-sec}} use cases, refer to the LLM performance matrix for {{elastic-sec}}.
Elastic AI Assistant for Security helps you with tasks such as alert investigation, incident response, and query generation throughout {{elastic-sec}}. It provides a chat interface where you can ask questions about the {{stack}} and your data, and provides contextual insights that explain errors and messages and suggest remediation steps.
Attack Discovery uses AI to triage your alerts and identify potential threats. Each "discovery" represents a potential attack and describes relationships among alerts to identify related users and hosts, map alerts to the MITRE ATT&CK matrix, and help identify threat actors.
Automatic Migration uses AI to help you migrate Splunk assets to {{elastic-sec}} by translating them into the necessary format and adding them to your {{elastic-sec}} environment. It supports the following asset types:
- Splunk rules
- Splunk dashboards
Automatic Import helps you ingest data from sources that do not have prebuilt Elastic integrations. It uses AI to parse a sample of the data you want to ingest, and creates a new integration specifically for that type of data.
Automatic troubleshooting uses AI to help you identify and resolve issues that could prevent {{elastic-defend}} from working as intended. It provides actionable insights into the following common problem areas:
- Policy responses: Detect warnings or failures in {{elastic-defend}}’s integration policies.
- Third-party antivirus (AV) software: Identify installed third-party antivirus (AV) products that might conflict with {{elastic-defend}}.
stack: ga 9.3
serverless: gaEntity summary, available in the entity details flyout, uses AI to generate a summary of a user's or host's security context. It aggregates information such as risk scores, asset criticality, vulnerabilities, and {{ml}} anomalies to provide a consolidated view of the entity's security posture. The summary helps you prioritize investigations and identify recommended next steps.
AI agent skills for Elastic provides official, open-source skill packages that help AI coding agents perform Elastic-specific tasks. Skills are built on the Agent Skills open standard, and include guidance for tasks like working with {{es}} APIs, {{kib}} workflows, and {{observability}} and {{elastic-sec}} use cases.