Elasticsearch 9.5.1: false-positive matches in certain boolean queries
Elasticsearch 9.5.2 has been released and contains the fix for this issue. Customers running 9.5.0 or 9.5.1 should upgrade to 9.5.2. At this time we are considering this issue resolved and will be providing no further updates.
The latest update from Elastic Cloud.
State
Resolved
Started
79 d ago
2026-08-14 09:22 UTC
Lasted
6 days
until 2026-08-20 17:09 UTC
Worst impact
Partial outage
Timeline
2 updatesIdentified
6 days 100%
Updates
Times in UTCAs posted by Elastic Cloud
Elasticsearch 9.5.2 has been released and contains the fix for this issue. Customers running 9.5.0 or 9.5.1 should upgrade to 9.5.2. At this time we are considering this issue resolved and will be providing no further updates.
Elasticsearch 9.5.1 contains a known issue where boolean queries containing a must, filter, or should clause using a multi-value terms query, alongside a must_not clause on fields with disabled indexing, can still return false-positive matches. While the patch in 9.5.1 (https://github.com/elastic/elasticsearch/pull/155936) resolved the bulk-scorer defect for term and range query paths; multi-value terms queries utilize a different Lucene query type that was not covered by that fix. Time Series Data Streams (TSDB) and columnar indices/data streams remain affected for this query pattern, as indexing is disabled by default on those fields. Affected terms queries may return false-positive matches (including documents that should have been excluded) and report higher document counts than expected. No error is raised, so queries will appear to complete successfully. What you can do: - If you have not yet upgraded to 9.5.*, we recommend deferring the upgrade until version 9.5.2 is available.
Elastic Cloud in the last 90 days
Full historyIncidents in 90 days
24
Days with an incident
90
Median duration
4 h 48 min
This incident
32× the median
Other Elastic Cloud incidents
All incidentsElastic Cloud·Elastic Support Portal is unavailable
The upstream provider has completed its fix, and access to the Elastic Support portal has been restored. Customers can authenticate to the support portal again. We are considering this issue resolved and will be providing no further updates. If you continue to have issues, please contact us.
Elastic Cloud·403 error when trying to access Autoops in newly created serverless projects
We resolved the issue affecting AutoOps at 12:30 UTC. Elastic Cloud Hosted and Elastic Cloud Serverless: Customers who created a new account in the AWS us-east-1 region since approximately 00:30 UTC on October 22, 2026 were unable to access AutoOps and may have seen an error (HTTP 403) when opening it.
Elastic Cloud·Elastic Cloud scaling issues in Azure
Engineers have mitigated an issue affecting the ability to scale existing Elastic Cloud Hosted deployments and Serverless projects in Azure. Scaling is working as expected.
Elastic Cloud·Degraded availability for some Elastic Cloud Hosted and Serverless deployments in GCP europe-west2 (London)
The infrastructure incident at our cloud provider affecting availability zone europe-west2-b in the GCP europe-west2 (London) region has been resolved. Engineering has completed recovery of infrastructure running in the affected availability zone. Elastic Cloud Hosted: Customers whose plan changes or other operations failed during the incident are advised to retry them from the Elastic Cloud console. Some deployments may still be unavailable or degraded, and may need additional recovery steps that our Support team will work through case by case. If your deployment is still unhealthy, please contact Support.
Elastic Cloud·Delayed or Unavailable project operation in GCP us-central1
The upstream cloud storage issue affecting some Elastic Cloud Serverless projects in the GCP us-central1 region has been resolved. Project operations have returned to normal, and we are no longer seeing affected projects in a red health state.
Follow Elastic Cloud
Your coding agent knows when Elastic Cloud is down, and tells you when a failure is theirs, not yours. You can also get Elastic Cloud incidents in a feed reader or in Slack.
Install the outages.live MCP server, so that when something breaks you can tell if the cause is a provider we depend on and not my code. It reads the official status pages of cloud, AI, payment and developer providers and gives you their incidents as MCP tools.
Add it as a remote MCP server named "outages" at https://outages.cc/mcp (Streamable HTTP, no authentication), with your CLI command or your MCP config file.
Then:
1. Make sure it connects and shows the tools get_provider, list_feed and send_feedback.
2. Call get_provider with "elastic" and tell me if Elastic Cloud has a problem right now.
3. From now on, when a call to a third-party service fails or becomes slow, call get_provider for that service before you change my code.Paste this into any coding agent. It adds the server with its own MCP setup.
https://outages.cc/feed.xml?providers=elastic/feed subscribe https://outages.cc/feed.xml?providers=elasticFAQ
Go from tracking outages to fixing production issues with Polylane.
Try Polylane