X-Pack

X-Pack is the umbrella for the project's commercial features. Code lives under x-pack/plugin/. All X-Pack code is licensed under the Elastic License 2.0 only (no SSPL / AGPL options). It ships with the default distribution but most features require an active license to enable.

X-Pack is enormous — about 9,760 production Java files. This page is the index. Use the dedicated feature pages for the high-traffic ones.

Catalog (selected)

Plugin	Purpose	Page
analytics	Commercial aggregations: top_metrics, t_test, weighted_avg, geoline, ...	(see Aggregations)
apm-data	APM ingest pipelines and templates	—
async-search	Submit / poll / get long-running searches	—
autoscaling	Cluster auto-scaling decision engine	—
blob-cache	Disk cache for searchable snapshots / stateless	(see Stateless)
ccr	Cross-cluster replication	(see CCS / CCR)
core	Shared X-Pack types (license, persistent tasks, ...)	—
deprecation	Deprecation log + API	—
diskbbq	Disk-backed BBQ vector codec	(see Vector search)
dlm-frozen-transition	Stateless DLM transitions	(see ILM/SLM)
downsample	Time-series downsampling	—
enrich	Enrich processor + lookup index	—
ent-search	Search applications, query rules, behavioral analytics	—
eql	Event Query Language	—
esql	Elasticsearch Query Language	ESQL
esql-core	Shared types between SQL and ESQL	—
esql-datasource-*	Pluggable ESQL data sources (Parquet, S3, Iceberg, CSV, ...)	—
fleet	Fleet management API	—
frozen-indices	Frozen-tier optimizations	—
geoip-enterprise-downloader	MaxMind enterprise feed	—
graph	Graph API (relationships from search hits)	—
identity-provider	Built-in OIDC IdP	(see Security)
ilm	Index Lifecycle Management	ILM/SLM
inference	LLM provider integration	Inference
kql	Kibana Query Language parser	—
logsdb	Logs-DB index mode	—
logstash	Logstash pipeline metadata	—
mapper-aggregate-metric	aggregate_metric_double field type	—
mapper-constant-keyword	constant_keyword field type	—
mapper-counted-keyword	counted_keyword field type	—
mapper-unsigned-long	unsigned_long field type	—
mapper-version	version field type for semver	—
migrate	Index migration helpers	—
ml	Machine learning	ML
ml-package-loader	Trained-model bootstrap (ELSER, e5, ...)	(see ML)
monitoring	Stack Monitoring (legacy)	—
old-lucene-versions	Read indices from very old Lucene majors	—
otel-data	OpenTelemetry data integration	—
profiling	Continuous profiling backend	—
prometheus	Prometheus metrics exposition	—
ql	Shared query-language utilities (used by SQL + EQL + ESQL)	—
rank-rrf	Reciprocal Rank Fusion retriever	(see Search)
rank-vectors	Vector rerank retriever	—
redact	Ingest processor for PII redaction	—
repositories-metering-api	Per-repository usage metering	—
rollup	Time-series rollup jobs (legacy)	—
search-business-rules	Query rules for business overrides	—
searchable-snapshots	Read indices directly from snapshot blobs	Stateless
secure-settings	Operator-only secure settings	—
security	AuthN/AuthZ, audit, FIPS, TLS	Security
shutdown	Coordinated node shutdown	—
slm	Snapshot Lifecycle Management	ILM/SLM
snapshot-based-recoveries	Recover replicas from snapshots	(see Stateless)
snapshot-repo-test-kit	Repository self-test API	—
spatial	Spatial aggregations and field types	—
sql	SQL query frontend	—
stack	Stack management metadata	—
stateless, stateless-*	Stateless topology	Stateless
text-structure	Text structure inference (_text_structure/find_structure)	—
transform	Continuous data-pivot jobs	—
vector-tile	Mapbox vector tile API	—
voting-only-node	Voting-only master role	—
watcher	Scheduled queries + alerting	—
wildcard	wildcard field type for high-cardinality keyword search	—
write-load-forecaster	Adaptive write load forecasting	—

How X-Pack plugins differ from server modules

• License: Elastic License 2.0 only, not the tri-license.
• Common base: x-pack/plugin/core/ provides shared types (XPackPlugin, XPackLicenseState, persistent task framework, telemetry of usage features).
• License gating: most features check XPackLicenseState at runtime and degrade or refuse when the license tier is insufficient.
• Catalog awareness: ES|QL and security plugins inspect EnabledFeatures on every action.

Project structure

Each X-Pack plugin is its own Gradle subproject under x-pack/plugin/<name>/. They share most of the structure of a normal plugin (Plugin subclass, descriptor, build.gradle) but:

• Headers are the X-Pack-only license.
• Tests usually run as internalClusterTest, javaRestTest, yamlRestTest, plus the x-pack-specific qa/ projects under x-pack/plugin/<name>/qa/.
• Many plugins depend on x-pack-core for shared types.

Where to add a new X-Pack feature

Create x-pack/plugin/<name>/, register it in x-pack/plugin/build.gradle (it is auto-included via subproject scan), depend on x-pack-core, and follow the same plugin patterns. License-check via XPackLicenseState.