Elasticsearch minors live six months —
except the last one, which lives for years.

Elasticsearch has one of the more counter-intuitive lifecycles in infrastructure software, and the search traffic proves people are confused by it: Elasticsearch 9.1, 9.2 and 9.3 are all already end of life — each lived about six months — while 8.19, released the same day as 9.1, is supported until July 15, 2027. An older major outliving three newer minors is not a mistake in the data. It is Elastic’s policy working exactly as written, and if you do not know the rule, you will pick the wrong version to be on.

The rule: two newest minors, plus the last one

Elastic’s published support policy maintains “the most recent two Minor Releases of the then-current Major Release, and the final Minor Release of the previous Major Release.” Two consequences follow, and they pull in opposite directions.

For a normal minor, that means about six months. Elastic ships a 9.x minor roughly every three months; the moment two newer ones exist, yours is out. Measured across the recent line: 9.0 lived 191 days, 9.1 189, 9.2 194, 9.3 182. If your upgrade cadence is annual, you will spend half of every year unsupported on 9.x by construction.

For the final minor of a major, it means years. A major release is maintained for “the longer of: 1) 30 months from its general availability or 2) 18 months from the GA of the next Major Release” — and that clock is carried by the last minor. 8.19 is 8.x’s final minor, so it inherits the whole 8.x tail: end of support July 15, 2027. Its predecessor 8.18, released three months earlier, died in October 2025 like any other minor. Same major, three months apart, twenty-one months of difference in support.

Every version’s date

Read the 9.1 and 8.19 rows together: same release date, seventeen months of difference in end of life. That is the entire policy in two lines.

Elasticsearch 7 is dead — and it is in the KEV catalog

Elasticsearch 7 — whose final minor, 7.17, carried the line’s long tail — reached end of support on January 15, 2026. Seven months later it still runs a great many clusters, because 7.x was the version a generation of deployments were built on and the 7-to-8 upgrade touched security defaults, mappings and client libraries all at once. Those clusters now receive nothing.

That matters more for Elasticsearch than for most software, because Elasticsearch appears in CISA’s Known Exploited Vulnerabilities catalog — the list of flaws with confirmed real-world exploitation. It is the KEV factor that lifts Elasticsearch’s product score to 80 for 7.x. An exposed, unpatched search cluster is a well-documented breach vector, not a hypothetical one, and 7.x is now permanently unpatched.

Which line to be on

If you are on 9.0–9.3: you are out of support — move to the current minor (9.5). And decide, honestly, whether your team can upgrade Elasticsearch twice a year, because that is what staying on 9.x supported means.

If you are on 8.x and cannot take the major upgrade yet: get to 8.19. It is genuinely supported until July 15, 2027, and within 8.x the move is a minor upgrade. It buys eleven months of runway from today to plan the 9.x jump properly — the longest window in the whole table short of the newest 9.x.

If you are on 7.x: you have been unpatched since January on a KEV-listed product. The upgrade to 8.19 is a major-version project (security defaults on by default, deprecated mappings), but 8.19’s July 2027 window makes it a stable place to land while you plan for 9. Commercial extended support for end-of-life Elasticsearch exists in the extended-support market; tell us your situation via the form on this page and we will reply with matched options, free and independent.

Every Elasticsearch release, its dates and its EOL Risk Score are on the Elasticsearch lifecycle page; the rest of the stack — Kibana, Logstash, Beats — is on the Elastic vendor page.

Frequently Asked Questions