OpenSearchCon Europe 2026

OpenSearch's ML Commons plugin enables deploying embedding models directly on your cluster—yet many developers still rely on external services. This session demonstrates building a complete RAG system using OpenSearch as both vector store and ML inference engine.

We'll cover deploying sentence-transformer models via ML Commons, processing PDFs, generating embeddings within OpenSearch, configuring knn_vector indices, and implementing semantic search. The highlight: voice search using local Whisper (STT) model creating a fully self-contained system.

What I hope to achieve: Share practical patterns for leveraging OpenSearch's ML capabilities and gather community feedback.

What attendees gain: Step-by-step knowledge to deploy ML models on OpenSearch, build RAG pipelines, and integrate local voice processing—reproducible techniques they can apply immediately.

How this helps the ecosystem: Showcases OpenSearch's native ML features, reducing dependency on external services. Demonstrates OpenSearch as a complete AI platform, not just a search engine.

Target audience: Developers building RAG applications, OpenSearch operators exploring ML capabilities.

This talk shares a hands-on journey of building and operating a large-scale OpenSearch platform in a strictly on-premises, VM-based environment. What started as an urgent Splunk replacement evolved into a Managed Detection and Response (MDR) logging platform for high ingestion rates (~40GB to 1.2TB/day per customer). 

The session focuses on real operational challenges and experiences: sizing and sharding decisions, gaps in official documentation, and the realities of owning OpenSearch end-to-end. Initially using Terraform to deploy and manual bootstrapping.

The talk includes a migration failure story from our biggest cluster, caused by accidental double ingestion, bad sizing and snapshot-induced OOMs.

At the end we have automated deployments, bootstrapping, ISM, snapshots, tiering, SSO-based access control, searchable-snapshots(on-prem S3) and automation. Due to limitations in ISM we built a custom lifecycle automation script via an operator-like pipeline and an opensearchcli binary.

Attendees gain a realistic view of running OpenSearch at scale on-prem, including lessons learned the hard way.

As OpenSearch clusters grow beyond 10–20 nodes, centralized monitoring becomes a bottleneck: single points of failure, API overload, and higher latency. Traditional approaches don’t scale.

This session presents a production-ready distributed monitoring architecture using Apache NiFi and MiNiFi. MiNiFi agents on each node collect local metrics via a custom NodeStatsProcessor (CPU, heap, JVM, I/O, thread pools), while central NiFi collectors aggregate and deduplicate cluster-wide metrics using a custom ClusterStatsProcessor and forward them to OpenSearch.

Results include linear scalability, sub-millisecond node metrics, HA, and minimal overhead. Key insights: separating local vs cluster-wide collection, deployment patterns (bare metal, VMs, containers), HA strategies with multiple NiFi collectors, and lessons from production clusters of 10–50+ nodes processing millions of metrics daily with 99.9% reliability.

Ideal for OpenSearch operators managing 10+ nodes, platform engineers building observability pipelines, and anyone hitting centralized monitoring limits. Walk away with a distributed architecture you can implement immediately.

Running OpenSearch in Kubernetes sounds simple — until you try to do it at scale, with high availability, zero downtime, and evolving workloads. In this talk, we draw on years of production experience operating OpenSearch clusters for SAP Cloud Logging service. We aim to share the key lessons learned and design patterns from building our Kubernetes operator.

We’ll dive into how we approached seamless upgrades, built tailored monitoring, and improved performance when interacting with OpenSearch APIs. Even if we adapt solutions to fit internal needs, the lessons learned are valuable for the broader OpenSearch and Kubernetes community.

In the second half, we turn our focus to the open-source OpenSearch Kubernetes Operator. We’ll explore its current state, the challenges the community is addressing and efforts to improve its reliability. We’ll also discuss how this open-source offering enables organizations to seamlessly scale and manage OpenSearch clusters on Kubernetes, and highlight opportunities for collaboration within the project.

The current index authorization model in OpenSearch has a few quirks and weaknesses; these will be mostly noticeable when working in OpenSearch Dashboards or similar applications with users which have only limited access to indices. Thus, if you do not take care and forget to flip certain switches, you will encounter quite a few "Forbidden" errors in OpenSearch Dashboards.
Over the past year, we have been working on a new index authorization concept for OpenSearch. The goal is a more logical and intuitive authorization model that provides a smoother and more predictable user experience.

This new approach is expected to be introduced as an optional feature in an upcoming OpenSearch release and is planned to become the default in OpenSearch 4.

In this talk, we will explain the new authorization concept, highlight its advantages, and provide practical guidance for cluster administrators on how to roll it out safely without causing service interruptions.

Cost-effective data tiering in OpenSearch has traditionally meant moving older indices to warm storage that is optimized for density rather than mutability. In practice, this comes with no write support and intrusive migration workflows that rely on forced segment merges, serial processing, and heavy CPU and IO usage—frequently impacting production workloads and operational stability.

In this talk, we introduce Writable Warm, a new tiering architecture designed for remote-storage-backed clusters that removes the read-only constraint while simplifying operations. Instead of heavyweight migrations, Writable Warm relies on fast shard relocation, block-level data access, and lazy recovery to support sustained writes and reads on warm data.

We will walk through the core design decisions behind block-level fetching, replica-aware recovery, and concurrent seamless migrations, and explain how eliminating forced merges improves stability and predictability at scale. Attendees will learn how this approach enables faster tier transitions, better resource utilization, and meaningful cost reductions—without changing application behavior or operational workflows.

The Norwegian Labor and Welfare Administration (NAV) manages 1/3 of Norway’s state budget. Supporting their "product-first" paradigm for 20,000 employees required a shift from legacy monoliths to a centralized, self-service observability stack. NAV partnered with Aiven to migrate their logging infrastructure to a managed OpenSearch environment. Aiven has been a strategic partner of NAV by hosting some of NAV’s most critical data services for many years. As a founding member of the OpenSearch Foundation with active maintainers, Aiven provided a unique advantage in helping NAV adopt OpenSearch for their application logging.
This technical deep-dive covers:
* Migration Architecture: High-throughput logging from on-premise to a managed service with zero-downtime
* Scalability & Performance: Shard rebalancing, customized scaling, and automated snapshots
* Data Pipeline: 60TB of log data, and OpenTelemetry traces with Data Prepper
* Operational Stability: Self-healing nodes and alert integrations with Slack.
We will cover usage scenarios of OpenSearch dashboards and take a close look at how Aiven delivers and operates OpenSearch as a managed service at Nav’s scale.

Every infrastructure outage tells the same story: a YAML mistake years in the making, hiding in plain sight until production burns. Teams patch symptoms, not causes because today's tools treat manifests as dumb text.

This talk reveals how OpenSearch becomes your infrastructure's immune system: a semantic search engine that understands Kubernetes YAML intent, not syntax. We transform manifests into queryable configuration graphs, parsing what matters-resource quotas, RBAC permissions, network policies, dependency chains rather than line counts.

Attendees will learn how OpenSearch can be used as a preventive debugging tool for infrastructure, enabling teams to detect configuration risks earlier and reason about changes with greater confidence.