OpenSearchCon Europe 2026

Most production monitoring follows the same path: metrics fire an alert, engineers search logs for context, and human reasoning becomes the bottleneck. A global p95 alert triggers, and 10–15 minutes later someone realizes the issue is limited to ap-south-1. Metrics and logs are tightly coupled through manual toil.

This session proposes a simple shift: logs detect first.

Structured JSON logs become system signals. These are indexed into purpose-built OpenSearch indexes, where sliding-window aggregation queries continuously evaluate system state. Queries like “p95 latency by region over 5 minutes” yield precise outcomes such as “REGION_OUTAGE: ap-south-1” instead of noisy global alerts.

Through a live demo, we show how explicit log schemas, index mappings, and Query DSL enable context-rich, machine-driven evaluation without dashboards or ad hoc searches. OpenSearch evaluates signals; actions remain external and decoupled.

The result is reduced human toil, a clearer system state, and a practical pattern that complements existing monitoring stacks without overpromising scale.