OpenSearchCon Europe 2026

In large-scale OpenSearch clusters, uneven workload distribution creates performance bottlenecks that traditional shard allocation strategies can't address. We present a groundbreaking approach to cluster optimisation through heat-aware operations, transforming how OpenSearch handles resource utilisation and workload distribution.

Our solution introduces a smart heat detection system that monitors cluster health across multiple dimensions - CPU, memory, I/O, and query patterns. By analysing both node and shard-level metrics using statistical methods, we can identify and classify various patterns of resource imbalance.

Key innovations include:
🔹 Multi-dimensional heat scoring for precise hotspot detection
🔹 Pattern recognition for automated root cause analysis
🔹 Intelligent rebalancing recommendations
🔹 Predictive scaling suggestions

Through real-world examples, we'll demonstrate how this system:
- Reduces query latency
- Optimises resource utilisation across clusters
- Prevents cascading performance issues
- Enables proactive capacity planning

Join us to explore how heat-aware operations are setting new standards for OpenSearch cluster performance and reliability.

This talk shares a hands-on journey of building and operating a large-scale OpenSearch platform in a strictly on-premises, VM-based environment. What started as an urgent Splunk replacement evolved into a Managed Detection and Response (MDR) logging platform for high ingestion rates (~40GB to 1.2TB/day per customer). 

The session focuses on real operational challenges and experiences: sizing and sharding decisions, gaps in official documentation, and the realities of owning OpenSearch end-to-end. Initially using Terraform to deploy and manual bootstrapping.

The talk includes a migration failure story from our biggest cluster, caused by accidental double ingestion, bad sizing and snapshot-induced OOMs.

At the end we have automated deployments, bootstrapping, ISM, snapshots, tiering, SSO-based access control, searchable-snapshots(on-prem S3) and automation. Due to limitations in ISM we built a custom lifecycle automation script via an operator-like pipeline and an opensearchcli binary.

Attendees gain a realistic view of running OpenSearch at scale on-prem, including lessons learned the hard way.

Agents and AI systems require answers that are reliable, precise and fast. In enterprise and organizational environments, these answers also must be secure. In fact, vector databases and search engines provide rapid access to knowledge. But a key challenge remains: how to correctly apply the permission models of underlying content sources within hybrid and semantic search workflows?

This presentation outlines how organizational knowledge can be securely integrated into OpenSearch. We will walk through how permissions need to be modeled, how authentication can be applied, and how these constraints propagate through the search and retrieval pipeline. In addition, we will show how prompt and query preprocessing can improve reliability and precision, particularly for agentic and AI‑driven use cases.

It’s safe to say Unconference is now an OpenSearchCon tradition. Each time the community gets together for this event, we learn from one another in an engaging environment with interesting talks and open discussions.

Make plans to join us again and come ready to pitch your favorite speaking topic! This is an opportunity for the community to come together and kick off OpenSearchCon Europe with an action-packed morning of sharing and discovery. With no pre-planned talks, what you want to hear about will be determined by you and your fellow conference-goers.

Attendees/Speakers
This is a first-come, first-served event; the room holds up to 75 individuals and anyone registered for OpenSearchCon is welcome to attend until the room is full. We advise you to show up a little early to make sure you get your spot.

Each speaker has 15 minutes to do with as they see fit! Want to talk for 10 minutes and have 5 minutes of questions? Great! Have a lot to say and want to talk for the whole 15? That works too! Are you a maintainer and want to hold a lightning round of questions with the audience? Fantastic! You get the picture. Just be mindful of your 15 minutes!

Voting
- At 13:30, each attendee will receive a card and three gold-star stickers. Those who would like to give a talk will write their title and brief description on the card, put their name on the back, and post them to the board for voting.
- At 13:45, you’ll have 15 minutes to walk the board and place a gold star on one of the talks you would like to hear. One rule: please do not vote for yourself.
- At 14:00, our host, Kris Freedain, and a lucky volunteer will collect and sort the cards, then select the day’s talks from the cards receiving the most votes while ensuring the widest arrangement of topics are covered.

Presentations
At 14:15, we will return the cards to the wall in the order each talk will be given. Be ready to talk and participate! This year, we have time saved for additional presentations from 15:50-16:30 during Unconference - Part 2.

It’s safe to say Unconference is now an OpenSearchCon tradition. Each time the community gets together for this event, we learn from one another in an engaging environment with interesting talks and open discussions.

Make plans to join us again and come ready to pitch your favorite speaking topic! This is an opportunity for the community to come together and kick off OpenSearchCon Europe with an action-packed afternoon of sharing and discovery. With no pre-planned talks, what you want to hear about will be determined by you and your fellow conference-goers.

Attendees/Speakers
This is a first-come, first-served event; the room holds up to 75 individuals and anyone registered for OpenSearchCon is welcome to attend until the room is full. We advise you to show up a little early to make sure you get your spot.

Each speaker has 15 minutes to do with as they see fit! Want to talk for 10 minutes and have 5 minutes of questions? Great! Have a lot to say and want to talk for the whole 15? That works too! Are you a maintainer and want to hold a lightning round of questions with the audience? Fantastic! You get the picture. Just be mindful of your 15 minutes!

Please note: This block of time will be reserved for additional presentations and discussion time. The unconference session begins at 13:30.

Alert fatigue is rarely caused by missing data. Logs, metrics, traces, and alerts are usually available, but during incidents they remain fragmented. Engineers still correlate signals manually, under pressure, relying on experience rather than shared context.

This talk describes an AIOps approach where observability data becomes the basis for operational decisions. OpenSearch is used as the central platform to collect, query, and correlate logs, metrics, and traces, providing a consistent data model and query layer across systems. By leveraging MCP capabilities, agentic AI, and tools, automation plays a central role in closing the loop from GitOps to delivery, monitoring, and problem resolution.

From this foundation, OpenSearch can be integrated with complementary tools to extend its capabilities. KeepHQ can consume data from OpenSearch to design alerting and response workflows and connect ticketing systems and external tools. HolmesGPT can operate on data retrieved from OpenSearch to assist with incident analysis and root cause investigation.

The focus is on what happens after detection: reducing noise, correlating signals, and supporting engineers during incident response.