5. Core modules
server/ — the kernel
Responsibility: Entire node runtime not delegated to modules/x-pack.
Key packages:
bootstrap—Elasticsearch,BootstrapChecksnode—Node,NodeConstructioncluster—ClusterState, routing, allocation, coordinationaction— all transport actions (bulk, search, admin)index— shard, engine, translog, mapper, mergesearch— query DSL, aggregations,SearchServicerest— HTTP handler layertransport— inter-node RPCgateway— metadata persistenceindices—IndicesService, cluster-state listener
Depends on: libs/core, libs/x-content, Lucene, Log4j, Guice.
Depended on by: every module plugin at runtime (classpath).
Invariants: Cluster state updates only on master; shard writes primary-first; transport thread must not block on Lucene.
libs/ — shared foundations
| Lib | Purpose |
|---|---|
core | Base exceptions, collections, BytesReference, ref counting |
x-content | JSON/SMILE/CBOR parsing (XContentParser) |
cli | Command-line utilities for distribution tools |
entitlement | JDK 24+ sandbox policy enforcement for plugins |
native | JNI: zstd, vectorization hooks, process limits |
plugin-api | Stable plugin surface (new SPI direction) |
ssl-config | TLS context building shared with x-pack security |
modules/ — bundled plugins
| Module | Role |
|---|---|
transport-netty4 | Netty4Plugin — HTTP + transport implementations |
lang-painless | Default scripting language for aggs/runtime fields |
ingest-common | Built-in ingest processors (grok, date, set…) |
reindex | Reindex / update-by-query / delete-by-query actions |
repository-s3|gcs|azure | Snapshot repositories to cloud object stores |
analysis-common | Standard analyzers, token filters |
aggregations | Many agg implementations registered via SearchPlugin |
data-streams | Data stream metadata, rollover hooks |
mapper-extras | Additional field types (dense_vector extras, etc.) |
parent-join | join field type for parent/child |
rank-eval | Ranking evaluation API |
kibana | System index descriptors for Kibana |
Each module is a JAR with plugin-descriptor.properties and one or more Plugin implementations.
x-pack/plugin/ — licensed features (selected)
| Plugin | Role |
|---|---|
core | X-Pack foundation, license checking, unified setup |
security | Authn/z, TLS, role mappings, audit |
ml | Machine learning jobs, model deployment |
esql | ES|QL query language (ANTLR parser, columnar exec) |
sql | SQL translator to search DSL |
ccr | Cross-cluster replication |
ilm / slm | Index / snapshot lifecycle management |
watcher | Alerting on scheduled queries |
stateless | Object-store-backed shard engine (cloud architecture) |
autoscaling | Capacity signals for orchestrators |
async-search | Long-running search persistence |
Non-obvious: Even "basic" distributions load a subset of x-pack; license level gates features at runtime via LicenseService.
Important server subsystems (within server/)
action/ — transport action layer
ActionModule registers hundreds of TransportAction instances. Pattern: TransportFooAction extends TransportMasterNodeAction (cluster) or TransportBarAction extends TransportAction (data).
TransportAction.execute runs ActionFilter chain then doExecute on a configured Executor (thread pool).
index/mapper/ — document mapping
DocumentMapper, MappingLookup, field mappers (TextFieldMapper, KeywordFieldMapper, …). Parses JSON source into ParsedDocument with Lucene fields. Dynamic mapping triggers MappingUpdatedAction cluster task.
index/engine/ — per-shard storage engine
Engine interface; InternalEngine is default. Handles index/delete/get, refresh, flush, merge, translog retention. EngineFactory pluggable (used by x-pack stateless for IndexEngine/SearchEngine).
search/ — query execution
SearchModule registers queries, aggs, highlighters, suggesters. QueryPhase builds Lucene Weight, collects top docs. FetchPhase loads stored fields / source.
cluster/coordination/ — master election
Coordinator implements pre-voting, leader checks, publication. Replaces legacy Zen discovery. Persists voting configuration in cluster state.
gateway/ — metadata on disk
PersistedClusterStateService writes cluster metadata to disk (Lucid-format data under data/). GatewayService blocks indices until state recovered.
Dependency direction
Plugins never depend on each other directly at compile time; they interact only through registries and cluster state.