Changes / Elastic Cloud / Elasticsearch 9.5.0 contains a query-correctness defect
Elastic Cloud: Major incident: Elasticsearch 9.5.0 contains a query-correctness defect
Summary
Elastic Cloud reported a major Elasticsearch 9.5.0 defect: boolean queries combining must, filter, or should with must_not on unindexed fields could return false positives and inflated counts. It lasted from 2026-08-05 22:59 UTC to 2026-08-12 08:59 UTC (6 days 10 h); Elasticsearch 9.5.1 fixed it, and customers running 9.5.0 were advised to upgrade.
Machine-written from the diff below (Sol; type: incident degradation). Check the diff before relying on it.
Major incidentLabel: degradation (model (Jev), 61%)Changed Detected Source: stspg.io (opens in new tab)
What changed
Before: not present
After: Elasticsearch 9.5.0 contains a query-correctness defect
Before: not present
After: major
Before: not present
After: resolved
Before: not present
After: 2026-08-05 22:59 UTC
Before: not present
After: 2026-08-12 08:59 UTC
Before: not present
After: Elasticsearch 9.5.0 contains a defect that can cause searches to return incorrect results for any index or data stream that disables indexing on a queried field . A query that excludes values using a must_not clause may fail to exclude them when the targeted field has doc values enabled but is not indexed for search. Affected searches can return documents that should have been excluded and report higher document counts than expected, and results may vary between runs of the same query.
No error is raised, so affected queries appear to succeed. Dashboards, alerting rules, and anything else built on these searches may report inaccurate values. Both the query DSL and ES|QL are affected.
Time series (TSDB) data streams are the most likely to be affected, because indexing is disabled by default for these fields. Columnar indices, currently in technical preview, are affected for the same reason. Any index or data stream that disables indexing on a queried field can be affected.
This affects Elasticsearch 9.5.0 on Elastic Cloud Hosted, Elastic Cloud Enterprise, and self-managed deployments, as well as Elasticsearch Serverless projects. Elasticsearch 9.4.x and earlier are not affected. There is no impact to cluster availability, connectivity, or data ingestion.
What you can do:
- If you have not yet upgraded to 9.5.0, we recommend deferring the upgrade until a fixed version is available.
- If you are already running 9.5.0, contact Elastic Support if you need help determining whether your searches are affected.
We have identified the root cause, a fix is in progress, and we are preparing a patch release. We will provide a further update by 10:00 UTC August 6.
Before: not present
After: Further investigation confirmed the impact of this issue was limited to boolean queries containing a must, filter, or should clause, along with a must_not clause on unindexed fields. Such queries can return false-positives returning documents that should have been excluded and report higher document counts than expected.
We have identified the root cause, a fix is in progress, and we are preparing a patch release. We will provide a further update by 10:00 UTC August 6.
Before: not present
After: A patch release containing the fix is in progress and it is expected to be available within the next week. Our recommendation to defer upgrading to 9.5.0 until 9.5.1 is available remains unchanged.
Before: not present
After: Elasticsearch 9.5.1 has been released and contains the fix for this issue. Customers running 9.5.0 should upgrade to 9.5.1. At this time we are considering this issue resolved and will be providing no further updates.
First version of this incident archived by Rewindex. View the live incident (opens in new tab).
History of this incident
| When (UTC) | Change | Kind |
|---|---|---|
| Major incident: Elasticsearch 9.5.0 contains a query-correctness defect (this change) Elastic Cloud reported a major Elasticsearch 9.5.0 defect: boolean queries combining must, filter, or should with must_not on unindexed fields could return false positives and inflated counts. It lasted from 2026-08-05 22:59 UTC to 2026-08-12 08:59 UTC (6 days 10 h); Elasticsearch 9.5.1 fixed it, and customers running 9.5.0 were advised to upgrade. | Major incident |
All Elastic Cloud changes → · Elastic Cloud profile · Markdown · JSON