Accelerate Elasticsearch queries with the FalconSeek cloud-native kernel-Elasticsearch(ES)-阿里云帮助中心

Elasticsearch may encounter performance bottlenecks in scenarios such as complex aggregate queries, high-cardinality term queries, and vector search. The FalconSeek cloud-native kernel is based on the Havenask engine developed by Alibaba. It uses C++ columnar memory and a fully asynchronous framework to improve query performance while remaining compatible with the Elasticsearch ecosystem. This topic describes how to enable FalconSeek for default query acceleration, including instance creation, index-level configuration, and query execution strategy management.

Applicable scope

Before you enable FalconSeek, note the following:

Preview status — FalconSeek is currently in a limited, invitation-only free preview.
Version requirement — FalconSeek requires Elasticsearch 8.17.0 or 9.4.0.
New instances — When you purchase an instance of version 8.17.0 or 9.4.0, you can directly enable FalconSeek.
Existing instances — For an existing instance of version 8.17.0 or 9.4.0, log on to the console and open the instance Basic Information page. In the Engine Kernel section, click Configuration Change to enable or disable FalconSeek.

Create an instance and enable FalconSeek

To enable FalconSeek for an existing instance, see the Applicable scope section. To configure a new instance, complete the following steps:

On the instance purchase page, enable FalconSeek.
Elasticsearch Version: Select 8.17.0 or 9.4.0.
Advanced Enhanced Features: Select FalconSeek Cloud-Native Kernel.
Configure other parameters based on your business requirements, such as VPC and Cluster Specification, and then complete the payment process.
After the instance is created, run the following command in the Kibana console to verify that FalconSeek is enabled at the cluster level:

GET _cluster/settings?include_defaults&filter_path=defaults.havenask.engine.enabled

If the enabled field in the response is true, the feature is enabled, as shown in the following example:

{
  "defaults": {
    "havenask": {
      "engine": {
        "enabled": "true"
      }
    }
  }
}

Use FalconSeek in an index

After FalconSeek is enabled for an instance, it does not take effect on any index by default. You must use Index Settings to explicitly enable the FalconSeek engine for each index that you want to accelerate. You can run the commands in this section in the Kibana console.

Enable FalconSeek for a new index

When you create an index, add the "index.havenask.engine.enabled": true parameter to settings to enable FalconSeek:

PUT falcon_seek_test
{
  "settings": {
    "index.havenask.engine.enabled": true
  },
  "mappings": {
    "properties": {
      "foo": {
        "type": "keyword"
      }
    }
  }
}

Write data to the index:

POST falcon_seek_test/_bulk
{"index":{}}
{"foo":"hello"}
{"index":{}}
{"foo":"world"}
{"index":{}}
{"foo":"cpp"}
{"index":{}}
{"foo":"java"}

Query the data. By default, FalconSeek is used:

GET falcon_seek_test/_search
{
  "query": {
    "term":{
      "foo":{
        "value": "hello"
      }
    }
  },
  "sort": [
    {
      "_doc": {
        "order": "desc"
      }
    }
  ]
}

Enable FalconSeek for an existing index

In this scenario, the index already exists, and FalconSeek was not enabled when the index was created. The following example command only creates an index; it does not enable acceleration:

PUT my_existing_index
{
  "settings": {
    "number_of_shards": 5,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "foo": {
        "type": "keyword"
      }
    }
  }
}

Use the _settings API to update the index configuration and dynamically enable FalconSeek:
```
PUT my_existing_index/_settings
{
  "index.havenask.engine.enabled": true
}
```
To make FalconSeek take effect, first run POST /my_existing_index/_close to close the index, and then run POST /my_existing_index/_open to reopen it.

Manage query execution strategies

FalconSeek provides query execution strategies that let you control, at the index level or for an individual query, whether a request is processed by the FalconSeek engine or falls back to the Elasticsearch native engine. You can configure the strategy by using the index.havenask.engine.search.type parameter at the index level or the havenask_search_type parameter at the query level. The query-level parameter takes precedence.

Strategy	Description	Recommended scenario
`native` (default)	Queries are executed by the FalconSeek engine first, rather than the Elasticsearch native engine. If an unsupported syntax or feature is encountered, the request automatically falls back to the Elasticsearch native engine.	General production environments that require both performance and compatibility.
`es`	Queries are always executed by the Elasticsearch native engine.	When you need to compare performance or bypass unknown FalconSeek issues.
`native-direct`	Queries are always executed by the FalconSeek engine. If an unsupported syntax or feature is encountered, the system throws an exception and does not fall back.	Debugging.

Set the default query strategy at the index level

The following example configures all queries on my_index to use the Elasticsearch native engine by default:

PUT my_index/_settings
{
  "index.havenask.engine.search.type": "es"
}

Temporarily override the default strategy for a query

Assume that my_index uses the native strategy by default, but you want a specific query to be executed by the Elasticsearch native engine. Add the havenask_search_type parameter to the query request by using one of the following methods:

Method 1: As a URL parameter

GET my_index/_search?havenask_search_type=es
{
  "query": {
    "match_all": {}
  }
}

Method 2: As a request body parameter

GET my_index/_search
{
  "query": {
    "match_all": {}
  },
  "havenask_search_type": "es"
}

How it works

The FalconSeek cloud-native kernel replaces some of the underlying Lucene components in Elasticsearch with a deeply optimized C++ engine. When you send a query request, the request first reaches the FalconSeek plug-in layer. The plug-in layer determines whether the query can be efficiently processed by the FalconSeek engine:

Supported queries — The request is forwarded to the high-performance FalconSeek engine for execution.
Unsupported queries — Based on the strategy that you configure, the system automatically falls back to the Elasticsearch native engine to execute the query, or returns an exception.

FAQ

Q: Can I enable FalconSeek for an existing Elasticsearch instance?

A: It depends. For an instance of version 8.17.0 or 9.4.0, including an existing instance, open the instance Basic Information page. In the Engine Kernel section, click Configuration Change to enable FalconSeek. If your existing instance does not use either version, you cannot directly enable FalconSeek. Purchase a new instance of version 8.17.0 or 9.4.0, and use a tool such as Alibaba Cloud Data Transmission Service (DTS) or Logstash to migrate data to the new instance. For more information, see Migration method selection.

Q: What happens if I run a query that FalconSeek does not support?

A: It depends on your query execution strategy. With the default native strategy, the query automatically falls back to the Elasticsearch native engine. You still get correct results, but you cannot benefit from FalconSeek query acceleration. With the native-direct strategy, the system returns an error message.