Read the source.

Detect auth spikes, top attacker IPs, and anomalies at millions of events per second.

Nginx, JSON, syslog, OTLP — ingest at line rate, query hot logs, drop cold to cheap storage.

Embed, index with HNSW, retrieve with hybrid BM25 + kNN — all on one box.

Classic inverted-index search with BM25, analyzers, highlighters, and query-time boosting.

Metrics + traces + logs as one queryable store. Prometheus scrape endpoint built in.

Retrieval by meaning with semantic_text — auto-embed on ingest, no separate vector DB.

Long-term memory for agents via the /_memory API — store, recall, forget, per-agent isolation.

Auto-chunk long docs; a doc competes on its best passage via max-sim scoring.

Nearest-neighbor similarity over dense_vector (HNSW), with filters.

Opt a dense_vector into int8_hnsw — smaller vectors, recall measured in the recipe.

Keyword + vector in one query — results neither BM25 nor kNN ranks first alone.

From raw logs to dashboards — error rates, p95 latency, top services via aggregations.

Statistical _ml detectors that flag spikes in metrics and logs.

A live _ml datafeed re-scores an index on a timer and stores anomaly records you poll.

Point your existing ES client at XERJ — same wire, change the URL.