OpenSearchCon Europe 2026

Single Instruction, Multiple Data (SIMD) is a key feature of modern CPUs, allowing a single instruction to process multiple data elements in parallel. For large-scale vector search workloads, fast dot-product computation is crucial for low-latency, high-throughput semantic search.

In this talk, we’ll share our experience accelerating Lucene’s vector search using native SIMD on ARM CPUs (AWS Graviton 2/3). We’ll first discuss challenges with Java's native access improvements (Project Panama) for vectorization, and why we switched to native SIMD implementations for better performance. Through architecture-specific optimizations, we reduced vector search latency on ARM-based systems by 60%.

Next, we’ll dive into the complexities of working with multiple CPU families, each with different SIMD instructions and optimizations. We’ll also share our progress on making this optimization available to all Lucene users, carefully iterating with Lucene developers to address concerns about linking native code to Lucene’s core.

Finally, we’ll highlight our efforts to make this SIMD optimization an opt-in feature and its potential impact on OpenSearch deployments on ARM at scale.

Search systems are hitting a wall. Static sharding causes hotspots, slow queries, and costly overprovisioning. But what if your search infrastructure could evolve in real time - splitting, scaling, and optimizing itself on the fly?

We present a cutting-edge dynamic shard topology in OpenSearch that redefines how scalability and search efficiency coexist. Inspired by distributed systems principles and real-world cloud constraints, this architecture uses a root-child shard model with mutually exclusive hash ranges to enable conflict-free, high-throughput ingestion and ultra-fast targeted search.

But we didn’t stop there. We embedded a playoff-style lookup algorithm - a smarter alternative to brute-force fan-out—ensuring queries scale logarithmically, not linearly.

The result?
🔹 True infinite horizontal scalability without reindexing.
🔹 Near-zero latency lookups, even during shard splits.
🔹 Elastic, self-healing architecture balancing cost, performance, and reliability.

This isn't a prototype. It's cloud-native and production-ready. If you're building systems at scale - or aiming to - this session will change how you think about search.

GDPR. HIPAA. CCPA. Red tape? Not anymore. We’ll showcase how we transformed OpenSearch into a privacy-aware analytics engine using tokenization, dynamic data masking, and a custom plugin that auto-redacts PII before indexing. Ever seen a dashboard where every number is differentially private? You will. We’ll also debate the ethics of search in a post-Roe world and open-source our “privacy score” audit tool.

Warning: This talk may ruin your faith in anonymized data… but we’ll fix it.

The current index authorization model in OpenSearch has a few quirks and weaknesses; these will be mostly noticeable when working in OpenSearch Dashboards or similar applications with users which have only limited access to indices. Thus, if you do not take care and forget to flip certain switches, you will encounter quite a few "Forbidden" errors in OpenSearch Dashboards.
Over the past year, we have been working on a new index authorization concept for OpenSearch. The goal is a more logical and intuitive authorization model that provides a smoother and more predictable user experience.

This new approach is expected to be introduced as an optional feature in an upcoming OpenSearch release and is planned to become the default in OpenSearch 4.

In this talk, we will explain the new authorization concept, highlight its advantages, and provide practical guidance for cluster administrators on how to roll it out safely without causing service interruptions.

Join us to explore the latest performance improvements in OpenSearch, highlighting the integration of Lucene’s bulk collection API and enhancements to the gRPC Search API. This session will dive into how bulk collection optimizes aggregation execution, delivering measurable gains across analytical workloads by batching operations and reducing computational overhead. We will also cover the expanded features of the gRPC Search API in OpenSearch 3.4, which now supports new query types, improved bulk requests, and multiple document formats. To make these concepts clear and practical, we will showcase live demos illustrating performance boosts in aggregation workloads and expanded query handling through gRPC. Attendees will gain a clear understanding of how these advancements significantly enhance efficiency and broaden query capabilities in real‑world use cases. Key takeaways include understanding Lucene’s bulk collection benefits, learning about new gRPC query types, and discovering improvements in bulk request handling and document format support.

As European search applications scale, they face a unique challenge: maintaining high-concurrency relevance across multi-lingual datasets. When an index grows to 25GB+, standard Lucene merge policies often lead to "Segment Fragmentation," causing significant latency spikes in k-NN search. This session moves beyond basic vector implementation to perform "surgery" on the underlying Lucene engine. We explore how to tune index merge policies and custom analyzers specifically for multi-lingual shards, ensuring that 60+ concurrent streams remain performant. Attendees will learn how to optimize the physical storage of vector data to reduce I/O overhead and maintain sub-second relevance without bloating hardware costs.

Open source powers most of today’s technology, yet many people still judge a project only by visible activity. The problem is that activity does not always reflect real health. A project can look busy while struggling behind the scenes. It can also look quiet while staying stable and strong.

This talk explores the gap between what we see on the surface and what a community is actually experiencing. It draws from my work as a contributor and member of the Linux Foundation’s CHAOSS project, where researchers and maintainers built shared ways to study open-source health in a practical and human way.

The session explains two core ideas. Sustainability covers contributor experience, documentation, onboarding, clarity, and the ability to move forward without burnout. Survivability covers risk, key person dependence, governance strength, and the ability to handle sudden change.

Attendees will learn how to ask better questions, spot early signals, avoid misreading data, and support communities with a clearer understanding of what health truly looks like. This talk is designed for community managers, contributors, OSPO teams, and anyone who works inside open source every day.

Cost-effective data tiering in OpenSearch has traditionally meant moving older indices to warm storage that is optimized for density rather than mutability. In practice, this comes with no write support and intrusive migration workflows that rely on forced segment merges, serial processing, and heavy CPU and IO usage—frequently impacting production workloads and operational stability.

In this talk, we introduce Writable Warm, a new tiering architecture designed for remote-storage-backed clusters that removes the read-only constraint while simplifying operations. Instead of heavyweight migrations, Writable Warm relies on fast shard relocation, block-level data access, and lazy recovery to support sustained writes and reads on warm data.

We will walk through the core design decisions behind block-level fetching, replica-aware recovery, and concurrent seamless migrations, and explain how eliminating forced merges improves stability and predictability at scale. Attendees will learn how this approach enables faster tier transitions, better resource utilization, and meaningful cost reductions—without changing application behavior or operational workflows.

The Norwegian Labor and Welfare Administration (NAV) manages 1/3 of Norway’s state budget. Supporting their "product-first" paradigm for 20,000 employees required a shift from legacy monoliths to a centralized, self-service observability stack. NAV partnered with Aiven to migrate their logging infrastructure to a managed OpenSearch environment. Aiven has been a strategic partner of NAV by hosting some of NAV’s most critical data services for many years. As a founding member of the OpenSearch Foundation with active maintainers, Aiven provided a unique advantage in helping NAV adopt OpenSearch for their application logging.
This technical deep-dive covers:
* Migration Architecture: High-throughput logging from on-premise to a managed service with zero-downtime
* Scalability & Performance: Shard rebalancing, customized scaling, and automated snapshots
* Data Pipeline: 60TB of log data, and OpenTelemetry traces with Data Prepper
* Operational Stability: Self-healing nodes and alert integrations with Slack.
We will cover usage scenarios of OpenSearch dashboards and take a close look at how Aiven delivers and operates OpenSearch as a managed service at Nav’s scale.

Most production monitoring follows the same path: metrics fire an alert, engineers search logs for context, and human reasoning becomes the bottleneck. A global p95 alert triggers, and 10–15 minutes later someone realizes the issue is limited to ap-south-1. Metrics and logs are tightly coupled through manual toil.

This session proposes a simple shift: logs detect first.

Structured JSON logs become system signals. These are indexed into purpose-built OpenSearch indexes, where sliding-window aggregation queries continuously evaluate system state. Queries like “p95 latency by region over 5 minutes” yield precise outcomes such as “REGION_OUTAGE: ap-south-1” instead of noisy global alerts.

Through a live demo, we show how explicit log schemas, index mappings, and Query DSL enable context-rich, machine-driven evaluation without dashboards or ad hoc searches. OpenSearch evaluates signals; actions remain external and decoupled.

The result is reduced human toil, a clearer system state, and a practical pattern that complements existing monitoring stacks without overpromising scale.

Every infrastructure outage tells the same story: a YAML mistake years in the making, hiding in plain sight until production burns. Teams patch symptoms, not causes because today's tools treat manifests as dumb text.

This talk reveals how OpenSearch becomes your infrastructure's immune system: a semantic search engine that understands Kubernetes YAML intent, not syntax. We transform manifests into queryable configuration graphs, parsing what matters-resource quotas, RBAC permissions, network policies, dependency chains rather than line counts.

Attendees will learn how OpenSearch can be used as a preventive debugging tool for infrastructure, enabling teams to detect configuration risks earlier and reason about changes with greater confidence.

In the world of cloud-native observability, the "Golden Signal" is only as valuable as the pipeline that carries it. To build a truly vendor-neutral, scalable observability stack, look to Fluent Bit for high-performance telemetry routing and OpenSearch for robust search and analytics. This session dives into why these two projects form the "Power Couple" of the open-source ecosystem. One excels at being a lightweight, sub-millisecond processor at the edge, the other providing the distributed backend required to make sense of that data.

What we will cover:

- The "Why" Behind the Pairing: An exploration of how Fluent Bit’s low-resource footprint perfectly complements OpenSearch’s high-performance indexing.
- Streamlined Integration: Practical demonstrations of configuring the Fluent Bit OpenSearch output plugin.
- Zero to Dashboard: A walkthrough of the developer workflow—from containerized deployment using Podman to visualizing live telemetry in OpenSearch Dashboards.

Attendees will walk away with an understanding of the advantages to this couple and access to a free online hands-on workshop: https://o11y-workshops.gitlab.io/workshop-fluentbit