Modules

Modules are plugins built by the project, packaged inside the default distribution, and always loaded. They live under modules/. Practically, modules are plugins whose maintainers chose "always on" instead of "install on demand".

Module catalog

Module	Purpose
aggregations	Sandboxed advanced aggregations (e.g. geohex_grid)
analysis-common	Default analyzers and filters (snowball, stop, stemmer, etc.)
apm	OpenTelemetry tracing + metrics export
data-streams	Data stream rollover and DLM (Data Lifecycle Management)
dot-prefix-validation	Blocks creation of indices starting with . outside system contexts
health-shards-availability	Health indicator for unavailable shards
ingest-attachment	Tika-based content extraction in pipelines
ingest-common	The core ingest processor catalog (set, grok, etc.)
ingest-geoip	MaxMind-based GeoIP enrichment
ingest-otel	OTLP-compatible normalizers
kibana	Kibana-specific helpers and system indices
lang-expression	Lucene Expression script engine
lang-mustache	Mustache templating for stored search templates
lang-painless	The Painless scripting language
legacy-geo	Legacy geo-shape readers for old indices
mapper-extras	Extra field types (token_count, scaled_float, rank_feature, ...)
parent-join	join field type for parent / child relationships
percolator	Stored-query "percolate" matching
rank-eval	Search relevance evaluation API
reindex	_reindex, _update_by_query, _delete_by_query
reindex-management	Async reindex orchestration
repository-azure	Azure Blob Storage snapshot repository
repository-gcs	Google Cloud Storage snapshot repository
repository-s3	S3 snapshot repository
repository-url	Read-only HTTP/HTTPS snapshot repository
rest-root	The GET / endpoint that returns version info
runtime-fields-common	Painless contexts for runtime fields
streams	Streams APIs
systemd	systemd integration for distro packages
transport-netty4	Default Netty4-based HTTP and transport
user-agent	User-agent string parsing for ingest

A handful of modules deserve their own pages because they are themselves substantial subsystems. The most important are noted below; otherwise, treat each module as a small plugin whose code lives at modules/<name>/.

Notable modules

lang-painless

The default scripting language for Elasticsearch. Painless is a Java-like sandboxed language with a deterministic compilation model — scripts compile to JVM bytecode at execution time, with strict allow-listed type access enforced by the language whitelist files (modules/lang-painless/src/main/resources/...). It replaces Groovy, JavaScript, Python, and the other ill-fated past attempts.

Painless contexts are pluggable: each subsystem (search, mappings, runtime fields, ingest, ML) registers a "context" that defines which inputs and outputs scripts in that location can use.

transport-netty4

The actual implementation of the transport and HTTP layers. Other implementations are theoretically possible via NetworkPlugin but transport-netty4 is the only production option.

reindex

_reindex (copy across indices), _update_by_query, and _delete_by_query all live here. They run as cancellable, throttled tasks that page through documents using a scroll or PIT and apply a per-document operation.

ingest-geoip / ingest-attachment / ingest-otel

The most complex ingest processors are split into their own modules to keep their large dependency trees out of the core distribution surface. ingest-geoip manages a MaxMind database lifecycle (auto-update via geoip-enterprise-downloader for licensed users); ingest-attachment ships an Apache Tika fork; ingest-otel understands OpenTelemetry's data model.

mapper-extras

Less-common field types: token_count (number of tokens after analysis), scaled_float (long stored, divided by a scale at read time), rank_feature / rank_features (single-value or sparse rank inputs), search_as_you_type, match_only_text. Useful to know about because the choice between these and the basic types is performance-sensitive.

data-streams

Data streams are the project's preferred shape for time-series data: a rolling sequence of hidden indices behind a single write target. This module owns rollover triggers, DLM (Data Lifecycle Management) — the simpler, data-stream-native cousin of ILM — and the data stream metadata customs.

apm

The OpenTelemetry shipper. Wires the Tracer SPI to OTLP and exposes per-class metrics through MeterRegistry. Configured under tracing.apm.*.

Pattern: how modules differ from external plugins

• Always loaded — no bin/elasticsearch-plugin install.
• Source lives in this repo; built and tested in CI alongside the server.
• Same Plugin base class; same capability interfaces.
• Cannot be removed without rebuilding the distribution.

For optional / customer-installed plugins see Plugins. For the licensed feature set see X-Pack.