Dependencies

The third-party libraries Elasticsearch ships, with notes on the ones developers most often touch.

Major direct dependencies

Library	Used by	Notes
Apache Lucene	The whole index/search stack	Tracked aggressively; usually a tagged release plus project-specific patches
Netty 4	modules/transport-netty4	HTTP and transport
Log4j 2	logging	Reduced to a small surface; the project also has libs/logging decoupled from log4j
Jackson	libs/x-content	Wrapped behind XContent; never call directly
Apache HTTP Components	repositories, inference clients, REST client
Bouncy Castle (FIPS variant)	TLS in FIPS mode
AWS SDK	modules/repository-s3	S3-compatible storage
Azure SDK	modules/repository-azure	Azure Blob Storage
Google Cloud SDK	modules/repository-gcs	GCS
Apache Tika	modules/ingest-attachment	Document content extraction
MaxMind DB Reader	modules/ingest-geoip	GeoIP lookups
Apache Commons (lang3, codec, math3)	misc	Sparingly
JNA	libs/native	OS-level helpers
ANTLR 4	modules/lang-painless, x-pack/plugin/esql	Parser generators
PyTorch (via JNI)	x-pack/plugin/ml	Trained model inference
t-digest	libs/tdigest	Forked into the repo
Uber H3	libs/h3	Forked into the repo

Build dependencies

Library	Purpose
Gradle (wrapper)	The build itself
Spotless	Java formatter
forbidden-apis	Block deprecated / unsafe JDK APIs
Develocity	Build cache + scan
Avast docker-compose plugin	Test fixtures

Dependency hygiene

• Adding a new dependency requires opening a PR with :thirdPartyAudit clean — every transitive dependency must be allow-listed in build-tools-internal/.../third-party-audit-allowlist.txt.
• Licenses must be vetted (no GPL except where dual-licensed).
• Always check whether the same functionality already exists in libs/ before pulling in a new library.

Vendored / forked libraries

Some libraries are forked into libs/ to avoid version-skew issues:

• t-digest (libs/tdigest)
• H3 (libs/h3)
• dissect (libs/dissect) — pattern parser
• grok (libs/grok) — Java implementation of Logstash's grok

When upstream releases happen, the project rebases its patches and re-imports.

Lucene

Lucene is the deepest dependency. Elasticsearch tracks Lucene closely and contributes back regularly (see Search Labs Lucene blog). Notable touch points:

• Custom Codecs in server/src/main/java/org/elasticsearch/index/codec/ (vector codecs, postings tweaks).
• Custom Directorys for searchable snapshots and stateless.
• Lucene's geo and analysis libraries are used directly by mappers and analyzers.

Vector API and FFI

The build's --add-modules=jdk.incubator.vector flag enables Java's incubator Vector API, used by libs/simdvec. The Foreign Function & Memory API (libs/native, libs/parquet-rs) needs --enable-native-access flags configured per module.

How to inspect

• ./gradlew dependencies — full classpath with versions.
• ./gradlew dependencyInsight --dependency <name> — why a particular dependency is on the classpath.
• gradle/build.versions.toml — the version catalog applied to most subprojects.