Data Tool Guides

Databases

7 Best Elasticsearch ETL Tools for 2026

Compare 7 Elasticsearch ETL tools that can read from your indices, how each handles large exports and incremental sync, and why none can do CDC.

October 9, 2026

Last updated October 13, 2026

Summarize with AI:

TL;DR

Short answer: Elasticsearch has no change log, so no tool can do CDC from it. Every extraction is either a full re-read of the index or an incremental query on a timestamp field you maintain, and deleted documents never show up either way. Most connector platforms only offer the full re-read, which is why Elastic's own Logstash and the Spark connector stay in the running. Seven Elasticsearch ETL tools that genuinely read from it:

Airbyte: open-source Elasticsearch source that discovers every index, full refresh only, into any of 700+ connectors' destinations.
Fivetran: managed connector for self-hosted Elasticsearch and Elastic Cloud, in beta, billed on monthly active rows.
Hevo Data: no-code Elasticsearch source with incremental loading, cloud-only. Does not capture deletes.
Logstash: Elastic's own pipeline, whose elasticsearch input plugin queries an index on a schedule and writes anywhere Logstash outputs.
Elasticsearch for Apache Spark: Elastic's connector for reading indices into Spark DataFrames in parallel. The fastest route for very large indices.
Apache NiFi: open-source flow tool with processors that page through Elasticsearch query results.
Apache Airflow: an orchestrator with an Elasticsearch provider. It schedules the extraction code you write yourself.
One Elasticsearch constraint: ordinary from-and-size paging stops at 10,000 hits by default, and results shift as documents are indexed during the read. Large exports need a point-in-time with search_after, or a scroll, to page through a consistent snapshot of the index.

Elasticsearch ETL tools move documents out of Elasticsearch indices into a warehouse or lake where they can be joined to other data. Elasticsearch is built for search rather than export: documents are denormalised, any field can hold an array, mappings drift between indices, and there is no transaction log to replicate from. Which tool you pick decides how much of that you handle yourself.

Why move data out of Elasticsearch?

Elasticsearch is a distributed search and analytics engine that stores JSON documents in indices and serves them through a REST API. Teams use it for product search, log analytics and observability, and the data it holds, such as search queries, application events and logs, is often valuable in a warehouse too. Moving it out lets you join it to customer, order and product data, keep history longer than your index retention allows, and analyse it with SQL and BI tools that query Elasticsearch poorly or not at all.

How do the Elasticsearch ETL tools compare?

Tool	Sync model	Built for	Hosting	Pricing basis
Airbyte	Full refresh only	Small to medium indices, any destination	Cloud or self-hosted	Free self-hosted; Cloud volume-based; Pro and Flex capacity-based
Fivetran	Managed, beta connector	Teams wanting no upkeep	Cloud	Monthly active rows
Hevo Data	Incremental, no deletes	No-code teams	Cloud	Events
Logstash	Scheduled query, incremental if you filter on time	Elastic Stack teams	Self-hosted	Free
Elasticsearch for Apache Spark	Parallel batch reads, query filters	Very large indices	Your Spark cluster	Free; Spark compute
Apache NiFi	Paged queries in a flow	Visual flow builders	Self-hosted	Free
Apache Airflow	Whatever you code	Orchestrating custom jobs	Self-hosted or managed	Free, you run it

Which Elasticsearch ETL tools should you consider?

Three are connector platforms; the other four come from the Elastic and Apache ecosystems and need more engineering but handle large indices better.

1. Airbyte

Airbyte is an open-source data integration platform with 700+ connectors and a community of 25,000+ data engineers. Its Elasticsearch source discovers every index in the cluster and maps Elasticsearch field types, including the fact that any field can hold an array, into the destination. It supports full refresh only, so each sync re-reads the whole index: a good fit for small and medium indices or periodic snapshots, less so for very large, fast-growing ones.

What's unique about Airbyte?

Connectors are open source and editable, so you can add incremental reads on your own timestamp field, or build a custom source with the no-code Connector Builder or the Connector Development Kit. Self-hosting keeps Elasticsearch data inside your network, and Enterprise Flex keeps the data plane in your own environment while Airbyte runs the control plane.

2. Fivetran

Fivetran is a closed-source, managed ELT service with 700+ connectors. Its Elasticsearch connector, still in beta, supports self-hosted Elasticsearch and Elastic Cloud on versions 7.10 to 8.x, with basic or API-key authentication and an optional SSH tunnel, and it has a separate connector for OpenSearch. It bills on monthly active rows.

Here is a closer look at Airbyte vs Fivetran.

3. Hevo Data

Hevo Data is a no-code cloud ELT platform whose Elasticsearch source supports generic and AWS-hosted Elasticsearch from version 7 and loads indices into your warehouse, with an optional historical load followed by new data. Hevo's own documentation notes that it does not support deletes. It is cloud-only and billed on events.

4. Logstash

Logstash is usually described as an ingestion tool, but its elasticsearch input plugin reads too: it runs a query against an index on a cron schedule, pages through the results, and sends documents to any Logstash output, such as S3, a file, Kafka or a database. It is free and familiar to Elastic Stack teams, and it handles incremental reads if you filter the query on a timestamp field. You own the pipeline configuration, the state between runs and the load into the warehouse.

5. Elasticsearch for Apache Spark

Elasticsearch for Apache Hadoop, Elastic's open-source connector library, lets Spark read indices as DataFrames, reading shards in parallel and pushing query filters down to Elasticsearch. That makes it the fastest route for very large indices, and a natural fit if you already run Spark, Databricks or EMR. You write the job, including incremental logic and the write to your warehouse or lake.

6. Apache NiFi

Apache NiFi is an open-source, visual data flow tool with processors that query Elasticsearch and page through the results, then route documents through transformation to almost any destination. It suits teams who prefer building flows on a canvas to writing code and already run NiFi for other sources. Operating NiFi itself is the main cost.

7. Apache Airflow

Apache Airflow is an open-source orchestrator, not an ETL tool. Its Elasticsearch provider gives you hooks to query a cluster from Python, but you write the paging, incremental logic and loading yourself. Its real role is scheduling one of the tools above, or a Spark job, alongside the rest of your pipelines.

Here is a closer look at Airbyte vs Airflow.

How do you read a large Elasticsearch index reliably?

Whatever tool you use, it pages through the index in one of three ways, and the difference matters once an index passes a few thousand documents:

From and size: simple offset paging, capped at 10,000 hits by default and inconsistent if documents are indexed during the read. Fine for small exports only.
Scroll API: keeps a search context open and returns batches from a frozen view of the index. It works for large exports, but Elastic now recommends against it for deep pagination because open contexts hold resources on the cluster.
Point in time with search_after: Elastic's recommended approach. A point in time freezes a consistent view, and search_after pages through it by sort values. It is the safest way to export a large, active index.

For ongoing sync, add a timestamp field such as updated_at to your documents when you index them, and filter each run on it. Without one, every sync is a full re-read. Deleted documents never appear in either approach, so mark deletes with a flag rather than removing documents if the warehouse needs to know.

How do you start syncing Elasticsearch data with Airbyte?

Step 1: Set up Elasticsearch as a source

Create an Elasticsearch user or API key with read access to the indices you want. In Airbyte, open Sources, choose New source and select Elasticsearch, then enter the cluster endpoint and credentials, or an SSH tunnel if the cluster is not directly reachable, and run the connection test. Airbyte discovers every index as a stream.

Step 2: Set up a destination

Choose where the data lands: a cloud warehouse such as Snowflake, BigQuery or Redshift, a data lake, a database or cloud storage.

Step 3: Configure the connection

Select the indices to sync and use full refresh with overwrite so each run replaces the previous copy. Set the frequency by index size, since every run re-reads the whole index.

The process is the same in Airbyte Open Source, which you can deploy yourself, and in Airbyte Cloud, which you can try free for 14 days.

Which Elasticsearch ETL tool should you choose?

Size decides most of it. For small and medium indices that should sit next to your other sources, a connector platform is quickest: Airbyte self-hosted or in Cloud, Fivetran if you want it managed and its beta status suits you, or Hevo for no-code incremental loads. For very large indices, use Elasticsearch for Apache Spark, or Logstash if your team already runs the Elastic Stack, and schedule either with Airflow. Whatever you choose, add an updated_at field and soft deletes at indexing time; no tool can recover changes Elasticsearch does not record.

For tools that cover more than Elasticsearch, see our guide to the top data integration tools.

Move Elasticsearch data with Airbyte

Sync Elasticsearch indices into Snowflake, BigQuery, Databricks or any Airbyte destination, alongside the rest of your sources, self-hosted or in Airbyte Cloud.

Try Airbyte Cloud free for 14 days or talk to our team.

Frequently Asked Questions (FAQs)

1. Does Elasticsearch support change data capture?

No. Elasticsearch has no change log that external tools can read, so there is no log-based CDC. Incremental extraction relies on a timestamp field you maintain, and deleted documents are not visible to any tool unless you mark them with a flag instead of removing them.

2. Should you use the scroll API or point in time?

For new exports, use a point in time with search_after, which Elastic recommends for deep pagination. The scroll API still works but holds search contexts open on the cluster, and from-and-size paging stops at 10,000 hits by default.

3. How do you move Elasticsearch data to Snowflake or BigQuery?

Use an ETL tool with an Elasticsearch source and a Snowflake or BigQuery destination, such as Airbyte, Fivetran or Hevo. For very large indices, read them with Elasticsearch for Apache Spark into files in cloud storage, then bulk load those into the warehouse.

4. Can Logstash export data out of Elasticsearch?

Yes. Its elasticsearch input plugin runs a query against an index, optionally on a schedule, and sends the documents to any Logstash output, such as S3, files, Kafka or a database. You manage the configuration and any incremental filtering yourself.

7 Best Elasticsearch ETL Tools for 2026

Related posts