OpenSearchCon Europe 2026

Single Instruction, Multiple Data (SIMD) is a key feature of modern CPUs, allowing a single instruction to process multiple data elements in parallel. For large-scale vector search workloads, fast dot-product computation is crucial for low-latency, high-throughput semantic search.

In this talk, we’ll share our experience accelerating Lucene’s vector search using native SIMD on ARM CPUs (AWS Graviton 2/3). We’ll first discuss challenges with Java's native access improvements (Project Panama) for vectorization, and why we switched to native SIMD implementations for better performance. Through architecture-specific optimizations, we reduced vector search latency on ARM-based systems by 60%.

Next, we’ll dive into the complexities of working with multiple CPU families, each with different SIMD instructions and optimizations. We’ll also share our progress on making this optimization available to all Lucene users, carefully iterating with Lucene developers to address concerns about linking native code to Lucene’s core.

Finally, we’ll highlight our efforts to make this SIMD optimization an opt-in feature and its potential impact on OpenSearch deployments on ARM at scale.

The biggest barrier to entering the cybersecurity field isn't talent; it's the cost of tools. Proprietary SIEMs (Security Information and Event Management) are expensive, leaving students with "theory" but no "practice." As a community leader who has mentored over 10,000 aspiring engineers, I realized we needed a better way.

This session explores how we used OpenSearch to build a scalable, open-source Security Operations Center (SOC) for education. We will step through the architecture of a "Training Lab" where students can ingest real attack logs, visualize threats, and practice threat hunting—all without a corporate budget.

We will discuss:

The "Free Tier" Architecture: How to deploy a multi-tenant OpenSearch cluster on Kubernetes that scales to thousands of student workloads cost-effectively.

Gamification: Using OpenSearch Dashboards to build "Capture The Flag" (CTF) scoreboards that track student progress in real-time.

The Talent Pipeline: How this open-source approach creates a generation of engineers who are "OpenSearch Native" from day one.

GDPR. HIPAA. CCPA. Red tape? Not anymore. We’ll showcase how we transformed OpenSearch into a privacy-aware analytics engine using tokenization, dynamic data masking, and a custom plugin that auto-redacts PII before indexing. Ever seen a dashboard where every number is differentially private? You will. We’ll also debate the ethics of search in a post-Roe world and open-source our “privacy score” audit tool.

Warning: This talk may ruin your faith in anonymized data… but we’ll fix it.

As European search applications scale, they face a unique challenge: maintaining high-concurrency relevance across multi-lingual datasets. When an index grows to 25GB+, standard Lucene merge policies often lead to "Segment Fragmentation," causing significant latency spikes in k-NN search. This session moves beyond basic vector implementation to perform "surgery" on the underlying Lucene engine. We explore how to tune index merge policies and custom analyzers specifically for multi-lingual shards, ensuring that 60+ concurrent streams remain performant. Attendees will learn how to optimize the physical storage of vector data to reduce I/O overhead and maintain sub-second relevance without bloating hardware costs.

Cost-effective data tiering in OpenSearch has traditionally meant moving older indices to warm storage that is optimized for density rather than mutability. In practice, this comes with no write support and intrusive migration workflows that rely on forced segment merges, serial processing, and heavy CPU and IO usage—frequently impacting production workloads and operational stability.

In this talk, we introduce Writable Warm, a new tiering architecture designed for remote-storage-backed clusters that removes the read-only constraint while simplifying operations. Instead of heavyweight migrations, Writable Warm relies on fast shard relocation, block-level data access, and lazy recovery to support sustained writes and reads on warm data.

We will walk through the core design decisions behind block-level fetching, replica-aware recovery, and concurrent seamless migrations, and explain how eliminating forced merges improves stability and predictability at scale. Attendees will learn how this approach enables faster tier transitions, better resource utilization, and meaningful cost reductions—without changing application behavior or operational workflows.

OpenSearch 3 was the first version released under the OpenSearch and Linux Foundations aegis and represented the evolution of the technology into a true open source project.  

Now we have a new challenge, delivering the best search solution in a market place that is rapidly changing. In this talk I will share the recently published roadmap for OpenSearch for 2026 and go into how this roadmap will support bringing a brand new community into the OpenSearch fold, that of data scientists and AI engineers.

This new community is characterized by "wants to use search but that doesn’t want to spend a lot of time on search". They think that hybrid search with complex rerankers like cross encoders is the first place to start, not the last place, and we need to make them feel welcome!

You will learn about how we're "compressing complexity" in OpenSearch so that the extremely powerful capabilities of the engine are easily accessible to any developer.  Leaving this talk you'll understand the direction, and most importantly, how you can get involved in driving this evolution of OpenSearch.

Every infrastructure outage tells the same story: a YAML mistake years in the making, hiding in plain sight until production burns. Teams patch symptoms, not causes because today's tools treat manifests as dumb text.

This talk reveals how OpenSearch becomes your infrastructure's immune system: a semantic search engine that understands Kubernetes YAML intent, not syntax. We transform manifests into queryable configuration graphs, parsing what matters-resource quotas, RBAC permissions, network policies, dependency chains rather than line counts.

Attendees will learn how OpenSearch can be used as a preventive debugging tool for infrastructure, enabling teams to detect configuration risks earlier and reason about changes with greater confidence.

In the world of cloud-native observability, the "Golden Signal" is only as valuable as the pipeline that carries it. To build a truly vendor-neutral, scalable observability stack, look to Fluent Bit for high-performance telemetry routing and OpenSearch for robust search and analytics. This session dives into why these two projects form the "Power Couple" of the open-source ecosystem. One excels at being a lightweight, sub-millisecond processor at the edge, the other providing the distributed backend required to make sense of that data.

What we will cover:

- The "Why" Behind the Pairing: An exploration of how Fluent Bit’s low-resource footprint perfectly complements OpenSearch’s high-performance indexing.
- Streamlined Integration: Practical demonstrations of configuring the Fluent Bit OpenSearch output plugin.
- Zero to Dashboard: A walkthrough of the developer workflow—from containerized deployment using Podman to visualizing live telemetry in OpenSearch Dashboards.

Attendees will walk away with an understanding of the advantages to this couple and access to a free online hands-on workshop: https://o11y-workshops.gitlab.io/workshop-fluentbit