OpenSearchCon Europe 2026

In large-scale OpenSearch clusters, uneven workload distribution creates performance bottlenecks that traditional shard allocation strategies can't address. We present a groundbreaking approach to cluster optimisation through heat-aware operations, transforming how OpenSearch handles resource utilisation and workload distribution.

Our solution introduces a smart heat detection system that monitors cluster health across multiple dimensions - CPU, memory, I/O, and query patterns. By analysing both node and shard-level metrics using statistical methods, we can identify and classify various patterns of resource imbalance.

Key innovations include:
🔹 Multi-dimensional heat scoring for precise hotspot detection
🔹 Pattern recognition for automated root cause analysis
🔹 Intelligent rebalancing recommendations
🔹 Predictive scaling suggestions

Through real-world examples, we'll demonstrate how this system:
- Reduces query latency
- Optimises resource utilisation across clusters
- Prevents cascading performance issues
- Enables proactive capacity planning

Join us to explore how heat-aware operations are setting new standards for OpenSearch cluster performance and reliability.

This talk shares a hands-on journey of building and operating a large-scale OpenSearch platform in a strictly on-premises, VM-based environment. What started as an urgent Splunk replacement evolved into a Managed Detection and Response (MDR) logging platform for high ingestion rates (~40GB to 1.2TB/day per customer). 

The session focuses on real operational challenges and experiences: sizing and sharding decisions, gaps in official documentation, and the realities of owning OpenSearch end-to-end. Initially using Terraform to deploy and manual bootstrapping.

The talk includes a migration failure story from our biggest cluster, caused by accidental double ingestion, bad sizing and snapshot-induced OOMs.

At the end we have automated deployments, bootstrapping, ISM, snapshots, tiering, SSO-based access control, searchable-snapshots(on-prem S3) and automation. Due to limitations in ISM we built a custom lifecycle automation script via an operator-like pipeline and an opensearchcli binary.

Attendees gain a realistic view of running OpenSearch at scale on-prem, including lessons learned the hard way.

Agents and AI systems require answers that are reliable, precise and fast. In enterprise and organizational environments, these answers also must be secure. In fact, vector databases and search engines provide rapid access to knowledge. But a key challenge remains: how to correctly apply the permission models of underlying content sources within hybrid and semantic search workflows?

This presentation outlines how organizational knowledge can be securely integrated into OpenSearch. We will walk through how permissions need to be modeled, how authentication can be applied, and how these constraints propagate through the search and retrieval pipeline. In addition, we will show how prompt and query preprocessing can improve reliability and precision, particularly for agentic and AI‑driven use cases.

It’s safe to say Unconference is now an OpenSearchCon tradition. Each time the community gets together for this event, we learn from one another in an engaging environment with interesting talks and open discussions.

Make plans to join us again and come ready to pitch your favorite speaking topic! This is an opportunity for the community to come together and kick off OpenSearchCon Europe with an action-packed morning of sharing and discovery. With no pre-planned talks, what you want to hear about will be determined by you and your fellow conference-goers.

Attendees/Speakers
This is a first-come, first-served event; the room holds up to 75 individuals and anyone registered for OpenSearchCon is welcome to attend until the room is full. We advise you to show up a little early to make sure you get your spot.

Each speaker has 15 minutes to do with as they see fit! Want to talk for 10 minutes and have 5 minutes of questions? Great! Have a lot to say and want to talk for the whole 15? That works too! Are you a maintainer and want to hold a lightning round of questions with the audience? Fantastic! You get the picture. Just be mindful of your 15 minutes!

Voting
- At 13:30, each attendee will receive a card and three gold-star stickers. Those who would like to give a talk will write their title and brief description on the card, put their name on the back, and post them to the board for voting.
- At 13:45, you’ll have 15 minutes to walk the board and place a gold star on one of the talks you would like to hear. One rule: please do not vote for yourself.
- At 14:00, our host, Kris Freedain, and a lucky volunteer will collect and sort the cards, then select the day’s talks from the cards receiving the most votes while ensuring the widest arrangement of topics are covered.

Presentations
At 14:15, we will return the cards to the wall in the order each talk will be given. Be ready to talk and participate! This year, we have time saved for additional presentations from 15:50-16:30 during Unconference - Part 2.

It’s safe to say Unconference is now an OpenSearchCon tradition. Each time the community gets together for this event, we learn from one another in an engaging environment with interesting talks and open discussions.

Make plans to join us again and come ready to pitch your favorite speaking topic! This is an opportunity for the community to come together and kick off OpenSearchCon Europe with an action-packed afternoon of sharing and discovery. With no pre-planned talks, what you want to hear about will be determined by you and your fellow conference-goers.

Attendees/Speakers
This is a first-come, first-served event; the room holds up to 75 individuals and anyone registered for OpenSearchCon is welcome to attend until the room is full. We advise you to show up a little early to make sure you get your spot.

Each speaker has 15 minutes to do with as they see fit! Want to talk for 10 minutes and have 5 minutes of questions? Great! Have a lot to say and want to talk for the whole 15? That works too! Are you a maintainer and want to hold a lightning round of questions with the audience? Fantastic! You get the picture. Just be mindful of your 15 minutes!

Please note: This block of time will be reserved for additional presentations and discussion time. The unconference session begins at 13:30.

Alert fatigue is rarely caused by missing data. Logs, metrics, traces, and alerts are usually available, but during incidents they remain fragmented. Engineers still correlate signals manually, under pressure, relying on experience rather than shared context.

This talk describes an AIOps approach where observability data becomes the basis for operational decisions. OpenSearch is used as the central platform to collect, query, and correlate logs, metrics, and traces, providing a consistent data model and query layer across systems. By leveraging MCP capabilities, agentic AI, and tools, automation plays a central role in closing the loop from GitOps to delivery, monitoring, and problem resolution.

From this foundation, OpenSearch can be integrated with complementary tools to extend its capabilities. KeepHQ can consume data from OpenSearch to design alerting and response workflows and connect ticketing systems and external tools. HolmesGPT can operate on data retrieved from OpenSearch to assist with incident analysis and root cause investigation.

The focus is on what happens after detection: reducing noise, correlating signals, and supporting engineers during incident response.

Single Instruction, Multiple Data (SIMD) is a key feature of modern CPUs, allowing a single instruction to process multiple data elements in parallel. For large-scale vector search workloads, fast dot-product computation is crucial for low-latency, high-throughput semantic search.

In this talk, we’ll share our experience accelerating Lucene’s vector search using native SIMD on ARM CPUs (AWS Graviton 2/3). We’ll first discuss challenges with Java's native access improvements (Project Panama) for vectorization, and why we switched to native SIMD implementations for better performance. Through architecture-specific optimizations, we reduced vector search latency on ARM-based systems by 60%.

Next, we’ll dive into the complexities of working with multiple CPU families, each with different SIMD instructions and optimizations. We’ll also share our progress on making this optimization available to all Lucene users, carefully iterating with Lucene developers to address concerns about linking native code to Lucene’s core.

Finally, we’ll highlight our efforts to make this SIMD optimization an opt-in feature and its potential impact on OpenSearch deployments on ARM at scale.

The biggest barrier to entering the cybersecurity field isn't talent; it's the cost of tools. Proprietary SIEMs (Security Information and Event Management) are expensive, leaving students with "theory" but no "practice." As a community leader who has mentored over 10,000 aspiring engineers, I realized we needed a better way.

This session explores how we used OpenSearch to build a scalable, open-source Security Operations Center (SOC) for education. We will step through the architecture of a "Training Lab" where students can ingest real attack logs, visualize threats, and practice threat hunting—all without a corporate budget.

We will discuss:

The "Free Tier" Architecture: How to deploy a multi-tenant OpenSearch cluster on Kubernetes that scales to thousands of student workloads cost-effectively.

Gamification: Using OpenSearch Dashboards to build "Capture The Flag" (CTF) scoreboards that track student progress in real-time.

The Talent Pipeline: How this open-source approach creates a generation of engineers who are "OpenSearch Native" from day one.

GDPR. HIPAA. CCPA. Red tape? Not anymore. We’ll showcase how we transformed OpenSearch into a privacy-aware analytics engine using tokenization, dynamic data masking, and a custom plugin that auto-redacts PII before indexing. Ever seen a dashboard where every number is differentially private? You will. We’ll also debate the ethics of search in a post-Roe world and open-source our “privacy score” audit tool.

Warning: This talk may ruin your faith in anonymized data… but we’ll fix it.

As European search applications scale, they face a unique challenge: maintaining high-concurrency relevance across multi-lingual datasets. When an index grows to 25GB+, standard Lucene merge policies often lead to "Segment Fragmentation," causing significant latency spikes in k-NN search. This session moves beyond basic vector implementation to perform "surgery" on the underlying Lucene engine. We explore how to tune index merge policies and custom analyzers specifically for multi-lingual shards, ensuring that 60+ concurrent streams remain performant. Attendees will learn how to optimize the physical storage of vector data to reduce I/O overhead and maintain sub-second relevance without bloating hardware costs.

Cost-effective data tiering in OpenSearch has traditionally meant moving older indices to warm storage that is optimized for density rather than mutability. In practice, this comes with no write support and intrusive migration workflows that rely on forced segment merges, serial processing, and heavy CPU and IO usage—frequently impacting production workloads and operational stability.

In this talk, we introduce Writable Warm, a new tiering architecture designed for remote-storage-backed clusters that removes the read-only constraint while simplifying operations. Instead of heavyweight migrations, Writable Warm relies on fast shard relocation, block-level data access, and lazy recovery to support sustained writes and reads on warm data.

We will walk through the core design decisions behind block-level fetching, replica-aware recovery, and concurrent seamless migrations, and explain how eliminating forced merges improves stability and predictability at scale. Attendees will learn how this approach enables faster tier transitions, better resource utilization, and meaningful cost reductions—without changing application behavior or operational workflows.

OpenSearch 3 was the first version released under the OpenSearch and Linux Foundations aegis and represented the evolution of the technology into a true open source project.  

Now we have a new challenge, delivering the best search solution in a market place that is rapidly changing. In this talk I will share the recently published roadmap for OpenSearch for 2026 and go into how this roadmap will support bringing a brand new community into the OpenSearch fold, that of data scientists and AI engineers.

This new community is characterized by "wants to use search but that doesn’t want to spend a lot of time on search". They think that hybrid search with complex rerankers like cross encoders is the first place to start, not the last place, and we need to make them feel welcome!

You will learn about how we're "compressing complexity" in OpenSearch so that the extremely powerful capabilities of the engine are easily accessible to any developer.  Leaving this talk you'll understand the direction, and most importantly, how you can get involved in driving this evolution of OpenSearch.

Every infrastructure outage tells the same story: a YAML mistake years in the making, hiding in plain sight until production burns. Teams patch symptoms, not causes because today's tools treat manifests as dumb text.

This talk reveals how OpenSearch becomes your infrastructure's immune system: a semantic search engine that understands Kubernetes YAML intent, not syntax. We transform manifests into queryable configuration graphs, parsing what matters-resource quotas, RBAC permissions, network policies, dependency chains rather than line counts.

Attendees will learn how OpenSearch can be used as a preventive debugging tool for infrastructure, enabling teams to detect configuration risks earlier and reason about changes with greater confidence.

In the world of cloud-native observability, the "Golden Signal" is only as valuable as the pipeline that carries it. To build a truly vendor-neutral, scalable observability stack, look to Fluent Bit for high-performance telemetry routing and OpenSearch for robust search and analytics. This session dives into why these two projects form the "Power Couple" of the open-source ecosystem. One excels at being a lightweight, sub-millisecond processor at the edge, the other providing the distributed backend required to make sense of that data.

What we will cover:

- The "Why" Behind the Pairing: An exploration of how Fluent Bit’s low-resource footprint perfectly complements OpenSearch’s high-performance indexing.
- Streamlined Integration: Practical demonstrations of configuring the Fluent Bit OpenSearch output plugin.
- Zero to Dashboard: A walkthrough of the developer workflow—from containerized deployment using Podman to visualizing live telemetry in OpenSearch Dashboards.

Attendees will walk away with an understanding of the advantages to this couple and access to a free online hands-on workshop: https://o11y-workshops.gitlab.io/workshop-fluentbit