One-off — Hybrid Search

One-off: Hybrid Search

Presenter: Specialist (DSR)

Date: TBD

SLB × Elastic Workshop Program

Overview

Explore hybrid search — BM25 plus vector similarity — in Elasticsearch.

Where this applies

These labs run on Observability Serverless — a fully managed project so you can practice without cluster operations.

The same capabilities you explore here — ES|QL, Streams, AI Assistant, Agent Builder, Workflows, and SLOs — are available on Elastic Cloud Hosted (ECH) and self-managed deployments.

Serverless mainly saves operational toil (sizing, ILM, Fleet, upgrades). Your observability skills transfer directly.

Session topics

  • Combining lexical and semantic search
  • Hybrid search in Elasticsearch
  • Relevance tuning for observability and log search

Why these features?

Hybrid searchKeyword precision plus semantic recall
ES|QLOne query language for logs, metrics, and traces
AI AssistantNatural language over your live telemetry

Use → to see why each feature matters for SLB.

Why Hybrid search?

Keyword precision plus semantic recall

Without it

Exact-match search misses reworded errors; vector-only search misses ticket IDs and hostnames.

With Hybrid search

Combine BM25 keyword scoring with semantic similarity — find "connection reset" and paraphrased variants together.

  • Better log and runbook search during incidents
  • Tune relevance for SLB-specific vocabulary
  • AI Assistant can leverage hybrid retrieval patterns
Keyword
+ semantic
Ranked hits

Why ES|QL?

One query language for logs, metrics, and traces

Without it

Different syntax per signal — PromQL for metrics, LogQL for logs, trace UI only — context switching slows incidents.

With ES|QL

ES|QL pipes data through filters, stats, and joins across observability datasets in Logs Explorer and Dev Tools.

  • Faster investigations with reusable query patterns
  • Same syntax in Logs Explorer on Serverless, ECH, and self-managed
  • AI Assistant can draft and explain ES|QL for your team
FROM logs-*
STATS / WHERE
Answer

Why AI Assistant?

Natural language over your live telemetry

Without it

Every investigator rebuilds the same ES|QL, scrolls dashboards, and writes runbook prose from scratch.

With AI Assistant

Ask questions in plain language — get ES|QL, summaries, and correlated logs/traces grounded in your project data.

  • Onboard new engineers without memorizing query syntax
  • Explain spikes and error patterns during live incidents
  • Draft queries you can save, share, and reuse
Question
AI Assistant
Evidence

Hands-on lab

Your lab uses Elastic Observability Serverless for a zero-ops learning environment.

The steps and features are the same on ECH and on-prem — follow the assignment panel when Kibana opens.

Instruqt track: slb-one-offs

Resources

  • Registration: events.elastic.co/slbworkshops
  • Repo: github.com/poulsbopete/slb-workshops
  • Use ← → arrow keys to navigate slides