V0.1 · 2026-04

Read the source.

Every key, every flag, every default in these docs comes out of the Rust crates under engine/crates/. If the docs and the code disagree, the code is right. File a bug; we'll reconcile the docs.

Playbooks

The top Elasticsearch use cases, written as complete recipes: a schema, an ingest command, a query, and the dashboard to visualize it.

01 SIEM · Security Analytics

Detect auth spikes, top attacker IPs, and anomalies at millions of events per second.

1M EVENTS · 74× FASTER · TERMS AGG 02 Log Analytics

Nginx, JSON, syslog, OTLP — ingest at line rate, query hot logs, drop cold to cheap storage.

LINE RATE · NO LOGSTASH · ZSTD 03 Vector · RAG

Embed, index with HNSW, retrieve with hybrid BM25 + kNN. 1B vectors on one box.

HNSW · SQ8 · HYBRID FUSION 04 Full-Text Search

Classic inverted-index search with BM25, analyzers, highlighters, and query-time boosting.

BM25 · STANDARD ANALYZER · QUERY DSL 05 Observability

Metrics + traces + logs as one queryable store. Prometheus scrape endpoint built in.

OTLP · TRACES · PROM METRICS

Start here

New to XERJ? Pick a path below. The quickstart is the fastest way to see something work; the install guide is for a real deployment.

START QuickstartFirst index, first query, first metrics scrape InstallDownload, system requirements, first boot Migrate from ESWhat swaps cleanly · what needs rewriting

REFERENCE CLIFour flags. That's it. Config TOML47 settings across 11 groups EnvironmentThree vars. Behaviour lives in TOML. Native REST APIPort 8080 · anything new goes here ES-compat APIPort 9200 · migration path

DATA MODEL Query types32 variants · one planner AggregationsExact buckets · t-digest percentiles AnalyzersStandard · whitespace · simple · english Vectors & HNSWm · ef_construction · ef_search · SQ8

ENGINE Ingest pipelinesTurbo, logs, syslog, OTLP — in-process Storage & WALWAL + immutable segments · three files per segment CompressionLZ4 · Zstd L3 · Zstd L19 · 9 encodings ClusteringEmbedded Raft · metadata replication · region split/merge MetricsPrometheus text · counters · histograms · gauges Auth & TLSAPI-key auth · PEM certs

OPERATIONS Running in productionSystemd · probes · log levels · scraping Backup & restoreHot rsync · S3 backup · per-index · clustered UpgradesPatch · minor · rolling cluster · format migration TroubleshootingSymptom → metric → log → config key

Source · engine/README.md · engine/xerj.default.toml · engine/crates/*