Boost Elasticsearch Query Performance with FalconSeek - Elasticsearch

FalconSeek is a cloud-native query acceleration kernel built on Alibaba's proprietary Havenask engine. It replaces select Lucene components with a C++ columnar-memory, fully asynchronous execution layer — significantly speeding up complex aggregations, high-cardinality term queries, and vector searches, while remaining fully compatible with the Elasticsearch ecosystem.

Important

FalconSeek is in invitational preview and is free to use during this phase. To join the whitelist, contact technical support.

Limitations

FalconSeek has the following hard requirements. Verify these before purchasing an instance.

Constraint	Detail
Version	Requires Elasticsearch 8.17.0. You cannot upgrade or downgrade after instance creation.
Instance type	Supported only on newly purchased Enhanced Edition (Vector Search) instances. Existing instances cannot be migrated.

How it works

When a query request arrives, it first reaches the FalconSeek plugin layer. The plugin evaluates whether the query can run on the FalconSeek engine:

Supported queries are forwarded to the high-performance FalconSeek engine.
Unsupported queries are handled according to your configured query execution policy — either falling back to the native Elasticsearch engine or returning an error.

This design delivers performance gains without sacrificing compatibility and stability.

Create an instance and enable FalconSeek

FalconSeek can only be enabled at instance creation time.

Go to the Elasticsearch purchase page and configure the following:

Field	Required value
Cluster Type	Vector Enhanced Edition
Instance Type	8.17.0 (Recommended For Vector Scenarios)
Advanced Enhanced Features	FalconSeek Cloud-native Kernel

Configure the remaining parameters — such as VPC and Cluster Specification — and complete the payment.
After the instance is created, run the following command in the Kibana console to verify that FalconSeek is enabled at the cluster level:
```
GET _cluster/settings?include_defaults&filter_path=defaults.havenask.engine.enabled
```
If enabled is true in the response, FalconSeek is active.
```
{
  "defaults": {
    "havenask": {
      "engine": {
        "enabled": "true"
      }
    }
  }
}
```

Enable FalconSeek for an index

Enabling FalconSeek on an instance does not automatically accelerate existing indexes. Explicitly enable it for each index you want to accelerate.

New index

Set "index.havenask.engine.enabled": true in the index settings at creation time.

PUT falcon_seek_test
{
  "settings": {
    "index.havenask.engine.enabled": true    // Enable FalconSeek
  },
  "mappings": {
    "properties": {
      "foo": {
        "type": "keyword"
      }
    }
  }
}

After the index is created, write data and query it — FalconSeek is used by default.

POST falcon_seek_test/_bulk
{"index":{}}
{"foo":"hello"}
{"index":{}}
{"foo":"world"}
{"index":{}}
{"foo":"cpp"}
{"index":{}}
{"foo":"java"}

GET falcon_seek_test/_search
{
  "query": {
    "term": {
      "foo": {
        "value": "hello"
      }
    }
  },
  "sort": [
    {
      "_doc": {
        "order": "desc"
      }
    }
  ]
}

Existing index

Create the index without acceleration:

PUT my_existing_index
{
  "settings": {
    "number_of_shards": 5,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "foo": {
        "type": "keyword"
      }
    }
  }
}

Enable FalconSeek using the _settings API:

PUT my_existing_index/_settings
{
  "index.havenask.engine.enabled": true
}

Close and reopen the index for the setting to take effect:

POST /my_existing_index/_close
POST /my_existing_index/_open

Manage query execution policies

FalconSeek gives you precise control over which engine processes each query. Set a default policy at the index level, then override it per query as needed.

Use index.havenask.engine.search.type for the index-level policy and havenask_search_type for query-level overrides. The query-level parameter takes precedence.

Choose a policy

Policy	Behavior	Use when
`native` (default)	Routes queries to FalconSeek; automatically falls back to the native Elasticsearch engine if a query uses unsupported syntax or feature	Running production workloads that need both performance and broad query compatibility
`es`	Forces all queries to the native Elasticsearch engine	Benchmarking FalconSeek performance or isolating a suspected FalconSeek issue
`native-direct`	Forces all queries to FalconSeek; throws an exception on unsupported syntax or feature instead of falling back	Debugging FalconSeek behavior

Set the default policy at the index level

The following example forces all queries on my_index to the native Elasticsearch engine:

PUT my_index/_settings
{
  "index.havenask.engine.search.type": "es"
}

Override the policy for a single query

If my_index uses the native policy by default, force a specific query to the native Elasticsearch engine using either method:

As a URL parameter:

GET my_index/_search?havenask_search_type=es
{
  "query": {
    "match_all": {}
  }
}

As a request body parameter:

GET my_index/_search
{
  "query": {
    "match_all": {}
  },
  "havenask_search_type": "es"
}

Accelerate vector searches

FalconSeek adds a new C++-based vector index (havenask_native) on top of the original ES index schema, built on Alibaba's internal search infrastructure — the same engine behind search and recommendation on Taobao and Tmall, and Pailitao (search by image). Use it to power AI applications such as semantic search and image similarity search.

All examples in this section use the havenask_native index type on a dense_vector field, combined with index.havenask.engine.enabled: true.

Create a vector index with FalconSeek enabled. Define a dense_vector field and set its index_options.type to havenask_native:

PUT vector_index
{
  "settings": {
    "index.havenask.engine.enabled": true
  },
  "mappings": {
    "properties": {
      "image_vector": {
        "type": "dense_vector",
        "dims": 128,
        "index_options": {
          "type": "havenask_native"
        }
      },
      "title": {
        "type": "keyword"
      }
    }
  }
}

Write vector data using the bulk API. The value of each vector field is an array of floating-point numbers with length equal to dims:

POST vector_index/_bulk
{"index":{"_id":"1"}}
{"image_vector":[0.12, -0.05, 0.08, 0.24, -0.17, 0.31, 0.02, -0.19, 0.11, 0.28,
    -0.03, 0.15, 0.22, -0.11, 0.09, 0.33, -0.07, 0.14, 0.26, -0.21,
    0.18, 0.29, -0.13, 0.06, 0.35, -0.08, 0.16, 0.23, -0.15, 0.12,
    0.27, -0.22, 0.19, 0.32, -0.14, 0.07, 0.25, -0.18, 0.13, 0.30,
    -0.09, 0.17, 0.24, -0.16, 0.10, 0.34, -0.10, 0.20, 0.31, -0.23,
    0.15, 0.28, -0.12, 0.11, 0.26, -0.19, 0.14, 0.29, -0.17, 0.08,
    0.22, -0.20, 0.16, 0.27, -0.15, 0.09, 0.25, -0.21, 0.18, 0.30,
    -0.13, 0.07, 0.24, -0.22, 0.19, 0.32, -0.16, 0.10, 0.26, -0.18,
    0.12, 0.28, -0.14, 0.06, 0.23, -0.19, 0.15, 0.29, -0.11, 0.05,
    0.21, -0.17, 0.13, 0.27, -0.10, 0.04, 0.20, -0.15, 0.11, 0.25,
    -0.09, 0.03, 0.19, -0.13, 0.10, 0.24, -0.08, 0.02, 0.18, -0.12,
    0.09, 0.23, -0.07, 0.01, 0.17, -0.11, 0.08, 0.22, 0.05, -0.06,
    0.09, 0.23, -0.07, 0.01, 0.17, -0.11, 0.08, 0.22],"title":"Image One"}
{"index":{"_id":"2"}}
{"image_vector":[0.12, -0.05, 0.08, 0.24, -0.17, 0.31, 0.02, -0.19, 0.11, 0.28,
    -0.03, 0.15, 0.22, -0.11, 0.09, 0.33, -0.07, 0.14, 0.26, -0.21,
    0.18, 0.29, -0.13, 0.06, 0.35, -0.08, 0.16, 0.23, -0.15, 0.12,
    0.27, -0.22, 0.19, 0.32, -0.14, 0.07, 0.25, -0.18, 0.13, 0.30,
    -0.09, 0.17, 0.24, -0.16, 0.10, 0.34, -0.10, 0.20, 0.31, -0.23,
    0.15, 0.28, -0.12, 0.11, 0.26, -0.19, 0.14, 0.29, -0.17, 0.08,
    0.22, -0.20, 0.16, 0.27, -0.15, 0.09, 0.25, -0.21, 0.18, 0.30,
    -0.13, 0.07, 0.24, -0.22, 0.19, 0.32, -0.16, 0.10, 0.26, -0.18,
    0.12, 0.28, -0.14, 0.06, 0.23, -0.19, 0.15, 0.29, -0.11, 0.05,
    0.21, -0.17, 0.13, 0.27, -0.10, 0.04, 0.20, -0.15, 0.11, 0.25,
    -0.09, 0.03, 0.19, -0.13, 0.10, 0.24, -0.08, 0.02, 0.18, -0.12,
    0.09, 0.23, -0.07, 0.01, 0.17, -0.11, 0.08, 0.22, 0.05, -0.06,
    0.09, 0.23, -0.07, 0.01, 0.17, -0.11, 0.08, 0.22],"title":"Image Two"}

Run a kNN search. Use the knn clause with field, query_vector, k (number of results), and num_candidates (candidate pool size):

GET vector_index/_search
{
  "knn": {
    "field": "image_vector",
    "query_vector": [0.12, -0.05, 0.08, 0.24, -0.17, 0.31, 0.02, -0.19, 0.11, 0.28,
    -0.03, 0.15, 0.22, -0.11, 0.09, 0.33, -0.07, 0.14, 0.26, -0.21,
    0.18, 0.29, -0.13, 0.06, 0.35, -0.08, 0.16, 0.23, -0.15, 0.12,
    0.27, -0.22, 0.19, 0.32, -0.14, 0.07, 0.25, -0.18, 0.13, 0.30,
    -0.09, 0.17, 0.24, -0.16, 0.10, 0.34, -0.10, 0.20, 0.31, -0.23,
    0.15, 0.28, -0.12, 0.11, 0.26, -0.19, 0.14, 0.29, -0.17, 0.08,
    0.22, -0.20, 0.16, 0.27, -0.15, 0.09, 0.25, -0.21, 0.18, 0.30,
    -0.13, 0.07, 0.24, -0.22, 0.19, 0.32, -0.16, 0.10, 0.26, -0.18,
    0.12, 0.28, -0.14, 0.06, 0.23, -0.19, 0.15, 0.29, -0.11, 0.05,
    0.21, -0.17, 0.13, 0.27, -0.10, 0.04, 0.20, -0.15, 0.11, 0.25,
    -0.09, 0.03, 0.19, -0.13, 0.10, 0.24, -0.08, 0.02, 0.18, -0.12,
    0.09, 0.23, -0.07, 0.01, 0.17, -0.11, 0.08, 0.22, 0.05, -0.06,
    0.09, 0.23, -0.07, 0.01, 0.17, -0.11, -0.08, -0.22],
    "k": 10,
    "num_candidates": 100
  },
  "fields": ["title"]
}

For full vector index configuration options, see the FalconSeek Vector Index User Guide.

FAQ

Can I enable FalconSeek on an existing Elasticsearch instance?

No. FalconSeek is supported only on newly purchased instances. To use FalconSeek with an existing workload, create a new Enhanced Edition (Vector Search) instance running 8.17.0, then migrate your data using Alibaba Cloud Data Transmission Service (DTS) or Logstash.

What happens when FalconSeek encounters an unsupported query?

It depends on your query execution policy. With the default native policy, the query automatically falls back to the native Elasticsearch engine — you get the correct result, but without FalconSeek acceleration. With native-direct, the system returns an error message.

Elasticsearch:Accelerate Elasticsearch queries with the FalconSeek cloud-native kernel