Link to ES|QL query performance guide

deploy-manage/monitor/autoops.md

@@ -75,4 +75,4 @@ In this section, you'll find the following information:
 * [Regions](/deploy-manage/monitor/autoops/ec-autoops-regions.md) where AutoOps is available.
 * Which [views](/deploy-manage/monitor/autoops/views.md) AutoOps offers to gain insight into your deployment.
 * What AutoOps [events](/deploy-manage/monitor/autoops/ec-autoops-events.md) are and how you can configure [event settings](/deploy-manage/monitor/autoops/ec-autoops-event-settings.md) and [notifications](/deploy-manage/monitor/autoops/ec-autoops-notifications-settings.md).
-* [Frequently asked questions](/deploy-manage/monitor/autoops/ec-autoops-faq.md) about AutoOps.
+* [Frequently asked questions](/deploy-manage/monitor/autoops/ec-autoops-faq.md) about AutoOps.

deploy-manage/monitor/logging-configuration/query-logs.md

@@ -358,3 +358,4 @@
 
 - [Query activity](/deploy-manage/monitor/query-activity.md)
 - [Tune for search speed](/deploy-manage/production-guidance/optimize-performance/search-speed.md)
+- [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md)

deploy-manage/monitor/logging-configuration/slow-logs.md

@@ -263,4 +263,4 @@
 
 ## Learn more [_learn_more]
 
-To learn about other ways to optimize your search and indexing requests, refer to [tune for search speed](/deploy-manage/production-guidance/optimize-performance/search-speed.md) and [tune for indexing speed](/deploy-manage/production-guidance/optimize-performance/indexing-speed.md).
+To learn about other ways to optimize your search and indexing requests, refer to [tune for search speed](/deploy-manage/production-guidance/optimize-performance/search-speed.md) and [tune for indexing speed](/deploy-manage/production-guidance/optimize-performance/indexing-speed.md). For {{esql}}-specific guidance, refer to [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md).

deploy-manage/monitor/query-activity.md

@@ -131,3 +131,4 @@ To change this threshold:
 - [](/deploy-manage/monitor/logging-configuration/query-logs.md)
 - [](/deploy-manage/monitor/logging-configuration/slow-logs.md)
 - [](/deploy-manage/production-guidance/optimize-performance/search-speed.md)
+- [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md)

deploy-manage/production-guidance/optimize-performance.md

@@ -23,6 +23,9 @@
 * [General recommendations](general-recommendations.md)
 * [Tune for indexing speed](optimize-performance/indexing-speed.md)
 * [Tune for search speed](optimize-performance/search-speed.md)
+
+  For additional guidance specific to {{esql}} queries, refer to [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md).
+
 * [Tune approximate kNN search](optimize-performance/approximate-knn-search.md)
 * [Tune for disk usage](optimize-performance/disk-usage.md)
 * [Size your shards](optimize-performance/size-shards.md)

deploy-manage/production-guidance/optimize-performance/search-speed.md

@@ -365,6 +365,10 @@
 So what is the right number of replicas? If you have a cluster that has `num_nodes` nodes, `num_primaries` primary shards *in total* and if you want to be able to cope with `max_failures` node failures at once at most, then the right number of replicas for you is `max(max_failures, ceil(num_nodes / num_primaries) - 1)`.
 
 
+## Optimize {{esql}} queries [_optimize_esql_queries]
+
+For {{esql}}-specific performance guidance, including common anti-patterns and techniques for reducing scan size, refer to [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md).
+
 ## Tune your queries with the Search Profiler [_tune_your_queries_with_the_search_profiler]
 
 The [Profile API](elasticsearch://reference/elasticsearch/rest-apis/search-profile.md) provides detailed information about how each component of your queries and aggregations impacts the time it takes to process the request.

explore-analyze/discover/try-esql.md

@@ -19,9 +19,13 @@ Elasticsearch Query Language ({{esql}}) helps you explore and analyze your {{pro
 - You must have data in {{product.elasticsearch}}.
   The examples on this page use the {{product.kibana}} sample web logs to explore data and create visualizations. You can install sample data by following [Add sample data](../index.md#gs-get-data-into-kibana).
 
-::::{tip}
-For the complete {{esql}} documentation, including all supported commands, functions, and operators, refer to the [{{esql}} reference](elasticsearch://reference/query-languages/esql/esql-syntax-reference.md). For a more detailed overview of {{esql}} in {{product.kibana}}, refer to [Use {{esql}} in Kibana](../query-filter/languages/esql-kibana.md).
-::::
+## Resources
+
+This tutorial covers the basics of querying data with {{esql}} in Discover. For more information, refer to:
+
+* [{{esql}} reference](elasticsearch://reference/query-languages/esql/esql-syntax-reference.md): Complete list of commands, functions, and operators
+* [Use {{esql}} in Kibana](../query-filter/languages/esql-kibana.md): Detailed overview of {{esql}} features in {{product.kibana}}
+* [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md): Techniques for writing fast queries
 
 
 ## Get started with {{esql}} in Discover [tutorial-try-esql]

explore-analyze/query-filter/languages/esql-kibana.md

@@ -401,3 +401,4 @@ The first time a query references an unmapped field, the editor shows a warning
 - [{{esql}} visualizations](/explore-analyze/visualize/esorql.md): Create and edit {{esql}}-based visualizations in dashboards.
 - [Dashboard controls](/explore-analyze/dashboards/add-controls.md): Add {{esql}}-powered controls to dashboards.
 - {applies_to}`stack: ga 9.4` {applies_to}`serverless: ga` [Custom Vega visualizations](/explore-analyze/visualize/custom-visualizations-with-vega.md#vega-esql-queries): Use {{esql}} queries as a data source in Vega and Vega-Lite visualizations.
+- [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md): Techniques for writing fast queries and identifying slow ones.

explore-analyze/visualize/esorql.md

@@ -41,7 +41,7 @@
 2. Choose **ES|QL** under **Visualizations**. An ES|QL editor appears and lets you configure your query and its associated visualization. The **Suggestions** panel can help you find alternative ways to configure the visualization.
 
    ::::{tip}
-   Check the [ES|QL reference](elasticsearch://reference/query-languages/esql.md) to get familiar with the syntax and optimize your query.
+   Check the [ES|QL reference](elasticsearch://reference/query-languages/esql.md) to get familiar with the syntax and [optimize your query](elasticsearch://reference/query-languages/esql/esql-query-performance.md).
    ::::
 
 3. When editing your query or its configuration, run the query to update the preview of the visualization.

solutions/search/esql-for-search.md

@@ -197,6 +197,7 @@
 ### Tutorials and how-to guides [esql-for-search-tutorials]
 
 - [Search and filter with {{esql}}](elasticsearch://reference/query-languages/esql/esql-search-tutorial.md): Hands-on tutorial for getting started with search tools in {{esql}}, with concrete examples of the functionalities described in this page
+- [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md): Techniques for writing fast queries, including using full-text search functions instead of `LIKE` or `RLIKE`
 
 ### Technical reference [esql-for-search-reference]
 

solutions/security/esql-for-security.md

@@ -22,4 +22,5 @@
 - [Generate and understand {{esql}} queries](/solutions/security/ai/generate-customize-learn-about-esorql-queries.md) using the AI Assistant
 - [Investigate events in Timeline](/solutions/security/investigate/timeline.md#esql-in-timeline) using {{esql}}
 - [Create detection rules](/solutions/security/detect-and-alert/esql.md) using {{esql}}
-- [Convert Splunk SPL rules to {{esql}}](/solutions/security/get-started/automatic-migration.md) with Automatic Migration
+- [Convert Splunk SPL rules to {{esql}}](/solutions/security/get-started/automatic-migration.md) with Automatic Migration
+- [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md) to write faster queries for threat hunting and detection rules

solutions/security/investigate/timeline.md

@@ -284,3 +284,5 @@
 To get started using {{esql}}, read the tutorial for [using {{esql}} in {{kib}}](/explore-analyze/query-filter/languages/esql-kibana.md). Much of the functionality available in {{kib}} is also available in Timeline.
 
 To find examples of using {{esql}} for threat hunting, check out [our blog](https://www.elastic.co/blog/introduction-to-esql-new-query-language-flexible-iterative-analytics).
+
+For tips on writing faster {{esql}} queries, refer to [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md).

troubleshoot/elasticsearch/circuit-breaker-errors.md

@@ -111,6 +111,10 @@ If you’ve triggered the fielddata circuit breaker and can’t disable fielddat
 POST _cache/clear?fielddata=true
 ```
 
+**Optimize expensive queries**
+
+Both [Query DSL](../../explore-analyze/query-filter/languages/querydsl.md) and {{esql}} queries can trigger circuit breaker errors when they consume large amounts of memory. For {{esql}}, high-cardinality `STATS BY` groupings are a common cause. Refer to [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md) for techniques to reduce memory usage.
+
 ## Memory evaluation
 
 Circuit breakers may either directly evaluate memory usage estimates or indirectly limit operations that are likely to cause excessive memory consumption. For example, the `script` circuit breaker checks memory indirectly by rate-limiting Painless/Mustache script compilations. However, even with circuit breakers in place, nodes can still encounter out-of-memory (OOM) conditions. This can occur, for example, because:

troubleshoot/elasticsearch/high-jvm-memory-pressure.md

@@ -193,6 +193,10 @@
 }
 ```
 
+::::{tip}
+For {{esql}}-specific guidance on writing efficient queries, refer to [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md).
+::::
+
 #### Prevent mapping explosion [reduce-jvm-memory-pressure-setup-mapping]
 
 Defining too many fields or nesting fields too deeply can lead to [mapping explosions](/troubleshoot/elasticsearch/mapping-explosion.md) that use large amounts of memory. To prevent mapping explosions, use the [mapping limit settings](elasticsearch://reference/elasticsearch/index-settings/mapping-limit.md) to limit the number of field mappings.

troubleshoot/elasticsearch/troubleshooting-searches.md

@@ -243,3 +243,5 @@
 ```
 
 Refer to [Advanced tuning: finding and fixing slow Elasticsearch queries](https://www.elastic.co/blog/advanced-tuning-finding-and-fixing-slow-elasticsearch-queries) for more information.
+
+For {{esql}}-specific slow query diagnosis and prevention, refer to [Optimize {{esql}} query performance](elasticsearch://reference/query-languages/esql/esql-query-performance.md).