Most Elasticsearch books on sale were written for 8.x, and you can still learn from them on Elasticsearch 9. The chapter scripts of Elasticsearch in Action, the best Elasticsearch book for most readers, gave the same results on 9 as on 8 wherever we could run them, apart from one parameter in chapter 6. What changed sits at the edges: vector search, the semantic search queries and a few deprecated parameters that 9.0 finally removed.
Seven books made this list: five for Elasticsearch and Kibana, one for OpenSearch and one on search relevance that works across engines. We pulled editions and prices from Amazon’s catalog and read each publisher’s contents page and companion repository. Then, in October 2026, we replayed 810 requests from three of the books’ code against Elasticsearch 8.19.23 and 9.5.5 and OpenSearch 2.19.6 and 3.9.0 in Docker.
Choose a Book by What You Run
Match the book to the job, because no single title covers the query language, the whole Elastic Stack and vector search well:
- Learning Elasticsearch itself: Elasticsearch in Action, 2nd Edition
- Running the stack on 9.x: Practical Elastic Stack
- Recipes for Elastic Agent, Kibana and Logstash: Elastic Stack 8.x Cookbook
- Dashboards only: Kibana 8.x, A Quick Start Guide
- OpenSearch clusters: The Definitive Guide to OpenSearch
- Vector and semantic search on Elastic: Vector Search for Practitioners with Elastic
- Relevance, ranking and RAG: AI-Powered Search
Most readers need two: Elasticsearch in Action for the query and mapping model, plus whichever of the others matches the stack you actually deploy. Of the seven, only Practical Elastic Stack ships Elasticsearch 9 code. Packt has a Getting Started with Elastic Stack 9.x on preorder for February 2027, so if you would rather wait for a second 9.x book, that is the one to watch.
Check What Elasticsearch 9 Changed
The licensing story moved under these books since they were printed. Elastic added AGPL as a third license option next to ELv2 and SSPL in August 2024. A month later, AWS handed OpenSearch to the Linux Foundation’s new OpenSearch Software Foundation. Neither change touches a single API call you will type. The 9.0 breaking changes do, so we ran the calls that matter for each book on both major versions:
| Topic | Request tested | Elasticsearch 8.19 | Elasticsearch 9.5 | OpenSearch 3.9 |
|---|---|---|---|---|
| Mapping, documents, term and compound queries | Elasticsearch in Action chapter scripts (685 requests) | 494 succeed | The same 494 succeed | Not tested |
| Closing an index | _close?wait_for_active_shards=index-setting | Works, deprecation warning | 400 error | Not tested |
| kNN search in early 8.x tutorials (none of the seven books) | POST /books/_knn_search | Works | Error, endpoint removed in 9.0 | Error, endpoint never existed |
| kNN search, current style | knn in _search | Works | Works | Uses its own knn query |
| Vectors in get/search responses | GET /books/_doc/1 | Vector in _source | Vector left out | Not tested |
| ELSER semantic search | text_expansion query | Refused on Basic (403 license) | Parses, with deprecation warning | Not available |
| Sparse vector search | sparse_vector query | Works | Works | Not tested |
| OpenSearch vectors | knn_vector with the nmslib engine | Not available | Not available | Refused for new indices |
The first row is the useful one, with limits you should know. Every request that succeeded on 8.19 also succeeded on 9.5, and only one request changed status: a chapter 6 close call that went from 404 to 400. Of the 191 that failed, 56 query two sample data sets the book loads separately, covid and books. That left chapter 10 (full-text queries) and chapter 13 (aggregations) unexercised: 0 of 37 and 1 of 41 requests succeeded, and the one chapter 13 success was a bulk load that returned 200 while Elasticsearch rejected every document in it. We can’t vouch for those two chapters on 9.x.
Another 67 came from our harness, which reset indices between chapter files but not cluster settings, so action.auto_create_index: false from chapter 5 carried into later chapters. It refused 29 writes outright, 36 later requests found no index because a write that failed should have created it (for tv_sales, the bulk load above), and chapter 9’s search.allow_expensive_queries: false blocked 2 percolator queries in chapter 12. If you run the scripts in order in one Kibana session, send PUT _cluster/settings with {"persistent":{"action.auto_create_index":null}} after chapter 5, and the same body with "transient":{"search.allow_expensive_queries":null} after chapter 9, to put both settings back to their defaults.
The rest are the book’s own scaffolding: 20 cleanup DELETEs for indices that did not exist yet, 7 requests against indices the scripts never create, 5 prefix and fuzzy queries chapter 9 blocks on purpose, and errors the chapters show deliberately or that need synonym files and snapshot paths set up outside Dev Tools. Two were inline # comments our parser did not strip. We saw the same version-to-version pattern in the Elastic Stack 8.x Cookbook’s 76 Dev Tools snippets and in chapter 4 of the OpenSearch book, where all 49 requests succeeded on both OpenSearch 2.19.6 and 3.9.0.
_knn_search is gone in Elasticsearch 9
Early 8.x releases shipped kNN search as a separate technical preview endpoint, and some tutorials from that time used it, although none of the seven books here does. The breaking changes list its removal in 9.0. In our lab the same request that returned a hit on 8.19 came back from 9.5.5 as an error body instead of search results.
Move the same knn object into a normal search request. The field names and parameters do not change, and this form ran on both 8.19 and 9.5 in our lab:
POST /books/_search
{
"knn": {
"field": "title_vector",
"query_vector": [0.1, 0.2, 0.3],
"k": 1,
"num_candidates": 10
},
"_source": ["title"]
}OpenSearch 3.9 also answered _knn_search with an error, because it never had that endpoint. Its k-NN plugin uses a knn query inside query instead, which is what the OpenSearch book teaches.
The ‘index-setting’ value for parameter ‘wait_for_active_shards’ is not supported anymore
This is the one break we found in Elasticsearch in Action. Chapter 6 uses the parameter twice: once to close the cars index with POST cars/_close?wait_for_active_shards=index-setting, and once on a multi-index close of cars1,*mov*,students*. In the scripted run the single-index call returned 404 on 8.19, because the carried-over auto_create_index setting had stopped cars from being created, so we repeated it by hand on a clean node. There, 8.19 closed the index but sent a warning header saying the value “will become unsupported in version 9”. Version 9.5 refuses both calls:
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"The 'index-setting' value for parameter 'wait_for_active_shards' is the default behaviour and this configuration value is not supported anymore. Please remove 'wait_for_active_shards=index-setting'."}],"type":"illegal_argument_exception","reason":"The 'index-setting' value for parameter 'wait_for_active_shards' is the default behaviour and this configuration value is not supported anymore. Please remove 'wait_for_active_shards=index-setting'."},"status":400}Drop the parameter, as the message says. POST cars/_close closes the index on 9.5 with the same behavior the book describes, because the value was already the default. The multi-index call has a second problem: 8.19 rejected it with “Wildcard expressions or all indices are not allowed”, so name the indices instead of using wildcards.
Vectors missing from _source on Elasticsearch 9
This one raises no error, so it is easy to miss. Since 9.2, Elasticsearch leaves vector values out of _source in get and search responses on new indices. We indexed the same document on both versions. 8.19 returned the dense vector and the sparse tokens, while 9.5 dropped the dense_vector field entirely and returned an empty object where the sparse_vector tokens had been:
{"title":"Elasticsearch in Action","ml":{}}Any vector chapter that prints a document to show you its embedding will look broken when you run it on 9.x. Ask for the vectors explicitly with "_source": {"exclude_vectors": false} in the search body, as the dense_vector reference describes, and they come back as stored float32 values, so 0.1 shows up as 0.099999994.
text_expansion is deprecated. Use sparse_vector instead.
The Cookbook and Vector Search for Practitioners both query ELSER through the text_expansion query. Elastic has marked it deprecated since 8.15, so this is not an 8.x versus 9.x split: on 9.5 it still parses and the response carries this warning header, and 8.15 through 8.19 flag it too. Vector Search for Practitioners also uses the ELSER v1 model ID, .elser_model_1, and Elastic’s ELSER page says v1 “is and will remain in technical preview” while v2 is GA, with no backward compatibility between them. Use sparse_vector with an ELSER v2 deployment, and note that ELSER needs a paid subscription or the trial license. On a free Basic license, our 8.19 node refused the query with “current license is non-compliant for [inference]” before any deprecation check ran.
nmslib engine is deprecated and cannot be used for new index creation
OpenSearch 3.0 stopped accepting the nmslib k-NN engine for new indices, and tutorials written for 2.x sometimes use it. OpenSearch 3.9.0 rejected our mapping:
Failed to parse mapping [_doc]: nmslib engine is deprecated in OpenSearch and cannot be used for new index creation in OpenSearch from 3.0.0.Switch the engine to faiss or lucene. The Definitive Guide to OpenSearch already uses faiss, which is part of why its listings run unchanged on 3.9.
How We Picked and Tested
We started from publisher catalogs, not best-seller rankings. Amazon’s results for “elasticsearch” include many short self-published books from 2025 and 2026 with no publisher behind them. We kept print editions from Manning, Packt and BPB, checked each against its publisher page and code repository, and dropped anything older than the 8.x line unless it teaches concepts that still hold.
For the three books with runnable Dev Tools scripts, we replayed every request against a fresh single-node cluster on each of these versions, using the official Docker images with security left on:
- Elasticsearch 8.19.23, the last 8.x line
- Elasticsearch 9.5.5, the current release when we tested
- OpenSearch 2.19.6, the maintained 2.x line
- OpenSearch 3.9.0, what the
latesttag pulled when we tested
We compared the status codes on both sides and read every failure, so you can tell a data set the book loads separately from a real break. The others we judged from their repositories: which image tags they pin and which APIs they call. We did not work through every chapter, so coverage claims come from contents pages and code.
Compare the Seven Books
The “Written for” column comes from each book’s code repository, not from its title:
| Book | Publisher, year | Pages | Written for | Best for | Price band, October 2026 |
|---|---|---|---|---|---|
| Elasticsearch in Action, 2nd Ed. | Manning, 2023 | 592 | Elasticsearch 8.1 to 8.6 | Queries, mappings, aggregations | $40 to $50 |
| Practical Elastic Stack | BPB, 2026 | 434 | 9.2 and 9.3; 8.x in chapters 4 and 9 | Running the full stack | $35 to $45 |
| Elastic Stack 8.x Cookbook | Packt, 2024 | 688 | Elastic Stack 8.12 | Agent, Kibana, Logstash recipes | $50 to $60 |
| Kibana 8.x, A Quick Start Guide | Packt, 2024 | 198 | Kibana 8 | Dashboards and Lens | $30 to $40 |
| The Definitive Guide to OpenSearch | Packt, 2025 | 386 | OpenSearch 2.12 and later | OpenSearch clusters | $40 to $50 |
| Vector Search for Practitioners with Elastic | Packt, 2023 | 240 | Elasticsearch 8.11 | Vectors and ELSER | $30 to $40 |
| AI-Powered Search | Manning, 2024 | 520 | Solr by default, OpenSearch adapter | Relevance and RAG | $55 to $65 |
1. Elasticsearch in Action, Second Edition
Madhusudhan Konda’s September 2023 Manning book is the one to learn Elasticsearch from. Its 15 chapters go from architecture and mapping through document APIs, text analysis, term-level and full-text queries, compound and advanced queries, aggregations, administration and performance, with appendices on installation and ingest pipelines. Shay Banon, who created Elasticsearch, wrote the foreword.
Its companion repository holds a Dev Tools script per chapter, which is what we replayed. Of its 685 requests, the same 494 succeeded on 8.19 and 9.5, and the chapter 6 wait_for_active_shards parameter was the only change we found you need to make. Our run could not exercise the full-text and aggregation chapters, because of data sets we did not load and cluster settings our harness carried over, so treat those as unverified on 9.x. The Docker files pin 8.6.2 and the README turns security off to keep the examples simple, so keep it on for anything past a laptop lab.
Pass on it if you need vector search or ES|QL, because its chapter scripts contain no vector or ES|QL examples. It sold for $40 to $50 when we checked in October 2026. Check the current price on Amazon.
2. Practical Elastic Stack
Piotr Ziental’s BPB book, printed in September 2026, is the newest Elastic title from an established publisher that we found, and the only book here whose code targets Elasticsearch 9. Its 11 chapters cover installation, Logstash pipelines, Kibana analysis, Beats, security monitoring, Fleet and Elastic Agent, application monitoring, scaling, machine learning and observability.
The repository shows a split you should know about before buying. The chapter 1 and 2 Compose files run Elasticsearch 9.2.3 and 9.3.2 with Kibana, Logstash and Filebeat 9.2.3, but the chapter 4 Filebeat sample pins 8.17.0 and the chapter 9 cluster, Helm chart and Kubernetes manifests still pin 8.15.0. Ziental has spent twelve years on the stack, much of it in telecom and SRE work, and the book reads like an operator’s notes rather than a reference.
Skip it if you want depth on the query DSL, since it spends its pages on running the stack. Bump the chapter 4 and chapter 9 image tags to your 9.x release before you follow those chapters. It was $35 to $45 when we checked. Check the current price on Amazon.
3. Elastic Stack 8.x Cookbook
Huage Chen and Yazid Akadiri’s June 2024 Packt cookbook has more than 80 recipes. Its 13 chapters cover ingestion, search applications, timestamped data, transforms, Kibana visualization, alerting and anomaly detection, advanced data analysis, vector search with generative AI, Elastic Observability, access control, operations and monitoring. Its repository targets Elastic Stack 8.12, with Python, Terraform, Kubernetes, Okta and Ollama examples.
All 76 Dev Tools snippets behaved the same on 8.19 and 9.5, but only 34 succeeded on our self-managed nodes. Most of the rest query indices that earlier recipes fill through Elastic Agent integrations or sample data. Nine more are the Search Applications calls in chapters 3 and 9, which returned 403 with “Current license is non-compliant for search application” on the free Basic license. The book assumes Elastic Cloud or a trial license for those.
Choose it when you run the whole stack and want a recipe per task. If you only search your own application’s data, much of it goes unused, and the chapter 9 ELSER queries should move to the sparse_vector query described above. It was $50 to $60 when we checked. Check the current price on Amazon.
4. Kibana 8.x, A Quick Start Guide to Data Analysis
Krishna Shah’s February 2024 book is the only Kibana 8 book from a major publisher that we found, which is why it’s here for readers who want a Kibana book specifically. It covers installing Kibana, data views and spaces, Discover, Lens visualizations, dashboards, sharing and exporting reports, and the aggregations that sit behind each chart.
It is written for data analysts as much as engineers, and at 198 pages you can finish it in a weekend if you follow along in your own Kibana. Packt’s repository has a README and no code, so there was nothing for us to replay. The screenshots show Kibana 8 menus, so expect some navigation paths to differ on a 9.x Kibana.
Engineers who already know Elasticsearch can skip it, since the Cookbook’s Kibana chapters cover the same ground at a higher level. It was $30 to $40 when we checked. Check the current price on Amazon.
5. The Definitive Guide to OpenSearch
Jon Handler, Soujanya Konka and Prashant Agrawal, all AWS solutions architects, wrote this September 2025 Packt book. Its 14 chapters cover installation, deploying on AWS, indexing, querying and aggregations, OpenSearch Dashboards, plugins, generative AI, migrating to OpenSearch, security, monitoring with backup and recovery, and scaling. Grant Ingersoll wrote the foreword.
The repository‘s Compose file pulls opensearchproject/opensearch:latest, with comments written for 2.12. When we tested, that tag pulled 3.9.0, so readers get a 3.x cluster whether they meant to or not. It holds up: all 49 chapter 4 requests ran on both 2.19.6 and 3.9.0, and its vector examples use the faiss engine, which 3.x still accepts. Set OPENSEARCH_INITIAL_ADMIN_PASSWORD before you start it, because the demo security setup has required one since 2.12.
Skip it if you run Elastic’s Elasticsearch, because the two have diverged far enough that an OpenSearch book teaches the wrong plugins and dashboards. One chapter is about deploying on AWS, and the authors’ examples lean that way. It was $40 to $50 when we checked. Check the current price on Amazon.
6. Vector Search for Practitioners with Elastic
Bahaaldine Azarmi and Jeff Vestal of Elastic wrote this November 2023 Packt book on using vector search beyond the search box, in observability and security as well as search. It covers moving from keyword to vector search, managing embedding models with Hugging Face and Eland, ELSER, and applied examples such as phishing detection. Its repository lists Elasticsearch 8.11 or later.
This is the book most affected by 9.x. Its chapter 9 code queries ELSER v1 through text_expansion, so on 9.5 you will swap in ELSER v2 and the sparse_vector query, and any example that prints a document will show the vectors missing until you add exclude_vectors: false. The concepts transfer cleanly; the request bodies need the edits in the section above.
Pass on it if you don’t have a trial or paid license, because the ELSER chapters will not run on Basic. It was $30 to $40 when we checked. Check the current price on Amazon.
7. AI-Powered Search
Trey Grainger, Doug Turnbull and Max Irwin’s December 2024 Manning book is about making search results good rather than making a cluster run. You learn user signals, personalization, learning to rank, click models, semantic knowledge graphs, dense and sparse vectors, hybrid search and retrieval-augmented generation. Turnbull also co-wrote Relevant Search, Manning’s 2016 book on tuning relevance in Solr and Elasticsearch.
The code runs in Jupyter notebooks with PySpark against Apache Solr by default, with swappable adapters for OpenSearch, Weaviate and Vespa. There is no Elasticsearch adapter, so you’ll translate the queries yourself, which is easier after the first book on this list. The ideas are engine-neutral, and they are the part that ages slowest.
Leave it until you have a working cluster and a relevance problem to solve, because it teaches nothing about operations. It was $55 to $65 when we checked. Check the current price on Amazon.
Skip These Older Elasticsearch Books
Amazon still lists all of these. Each was written for a release line that the current server has left behind:
| Book | Publisher, year | Why we passed |
|---|---|---|
| Elasticsearch 8.x Cookbook, 5th Ed. | Packt, 2022 | Its repository still pins Elasticsearch 7.12.1 in the Docker, Java and plugin code |
| Getting Started with Elastic Stack 8.0 | Packt, 2022 | Written for 8.0; a 9.x title with the same name is on preorder for February 2027 |
| Elasticsearch: The Definitive Guide | O’Reilly, 2015 | Written in 2015, before Elasticsearch 5 |
| Elasticsearch in Action, 1st Ed. | Manning, 2015 | Replaced by the second edition above |
| Learning Elastic Stack 7.0 | Packt, 2019 | Written for 7.0, before security on by default |
| Advanced Elasticsearch 7.0 | Packt, 2019 | Written for 7.0, the same era |
| Relevant Search | Manning, 2016 | Co-author Doug Turnbull’s AI-Powered Search covers the same ground plus vectors and LLMs |
The 2022 cookbook is the one to watch for, because its title says 8.x. Its recipes still explain mappings and queries well, but the code was never moved past 7.12.1, so you would rewrite every client example.
Buy Them in This Order
For most readers the order is Elasticsearch in Action first, then one stack book, then a specialist book only if your work needs it. These pairings cover the common cases:
- Developers adding search to an app: Elasticsearch in Action, then AI-Powered Search
- Operators running logging or observability: Practical Elastic Stack, then the Cookbook
- Analysts building dashboards: the Kibana quick start guide
- Teams on OpenSearch or Amazon OpenSearch Service: The Definitive Guide to OpenSearch
- Semantic search on Elastic with a paid or trial license: Vector Search for Practitioners
Read any of them against a real cluster. Our guides to installing the ELK stack on Ubuntu, Elasticsearch and Kibana on Rocky Linux and OpenSearch on Ubuntu give you one in an afternoon. When a single node stops being enough, building a multi-node Elasticsearch cluster and shipping Kubernetes logs into it are the next steps the stack books assume you’ve taken.
