OpenSearchCon India 2026

We migrated ~1,500 OpenSearch nodes across 7 clusters in 5 regions from Intel to AWS Graviton 4, upgrading from OpenSearch 2.13 to 3.4 and JVM 17 to 21 along the way. We saw 2x indexing throughput and ~30% cost savings. We want to share the benchmarking data, compare migration strategies (inline upgrade, snapshot-restore, and why CCS didn't work), and push more teams toward Graviton.

A practical guide to evaluating and executing a Graviton migration at scale — covering instance type benchmarking (i4i/i4g/i7i/i8g), migration strategy trade-offs (inline upgrade is fast but risky, snapshot-restore is safe but needs parallel infrastructure, CCS doesn't work across major versions), production validation steps, and the real performance and cost numbers from 1,500 nodes in production.

Large-scale Graviton migration data for OpenSearch is scarce. By sharing production numbers from 7 clusters across 5 regions — including what didn't work — we want to de-risk Graviton adoption for the community. The 2x throughput and 30% cost reduction we're seeing should motivate more teams to make the move, and our migration playbook gives them a concrete path to follow.

Large-scale ingestion can significantly impact OpenSearch cluster stability, query latency, and operational efficiency. Traditional bulk APIs and Spark/Hadoop connectors rely on online indexing, where clusters must handle indexing and queries simultaneously—creating resource contention and long ingestion windows.

This session introduces an Offline Batch Ingestion framework that builds OpenSearch-compatible Lucene segments outside the cluster using distributed Spark executors. The system leverages OpenSearch’s native indexing engine and snapshot/restore APIs to deploy indexes atomically with zero production impact.

We’ll cover the architecture (distributed indexing, shard merge, snapshot generation), technical implementation using OpenSearch Engine APIs, production learnings, scalability characteristics, and future extensions such as vector indexing. This approach decouples indexing compute from serving clusters, enabling faster ingestion, safer reindexing, and improved operational resilience.

Search performance directly impacts user experience and system resilience. OpenSearch Query Insights provides unprecedented visibility into query execution with minimal performance overhead.

This presentation explores Query Insights capabilities and demonstrates how to identify performance bottlenecks, diagnose issues in real-time, and optimize your cluster. Through live demos, you'll see how to pinpoint the top queries consuming resources, understand query patterns for structural improvements, and leverage dashboards for data-driven optimization. Whether you're managing a small cluster or large-scale search platform, you'll gain the visibility needed to keep OpenSearch running at peak efficiency.

Key Features to Demo:
- Real-time query monitoring and live execution tracking
- Resource consumption rankings (CPU, memory, latency)
- Advanced query grouping and pattern detection
- Interactive Query Insights Dashboard with filtering and drill-down
- Query metadata and node/shard-level insights
- Historical query analysis and trend tracking
- Performance metrics export and integration capabilities

Vector search in OpenSearch offers a rich set of configuration options, but choosing the right combination of engine, algorithm, quantization, and storage tier can be daunting — especially as your workload grows or shifts from semantic search to agentic AI. This session covers both workload types at small, medium, and high scale. You'll learn how to apply the cost-recall-latency curve to choose between Faiss and Lucene, HNSW and IVF, and the right quantization technique for your budget and recall requirements. You'll explore tiered storage from in-memory to disk-based and memory-optimized, and production tuning techniques including bulk indexing strategies, GPU-accelerated builds, and automated parameter optimization. You'll leave with best practices to apply whether you're running thousands of vectors on a single node or billions across a fleet.

Security isn't just about firewalls and alerts, it’s about curiosity, context, and catching the weird stuff before it gets weird. But let’s be real: most teams don’t have the budget (or patience) for a million-dollar SIEM.

In this talk, I’ll walk you through how we turned OpenSearch into a scrappy, surprisingly powerful threat-hunting platform. Using native tools, open-source plugins, and a healthy dose of creativity, we built real-time alerting and investigation flows without blowing up costs. We'll cover:

• Designing log schemas that highlight anomalies.
• Building threat-detection pipelines using ingest processors and OpenSearch Dashboards.
• Real-life incident where OpenSearch helped us catch something our cloud provider missed.

If you’ve ever felt like security tools are either overkill or underwhelming, this session is for you. You’ll walk away with practical patterns and open-source recipes for turning OpenSearch into your security command center — no license key required.

Most teams have a dirty secret: they're running Elasticsearch versions they can't afford to upgrade and can't afford to stay on. The migration feels impossible due to data loss risk, query regression, extended downtime, and no rollback. So they wait. And wait. This talk ends the waiting. We walk through the OpenSearch Migration Assistant end-to-end: a fully open-source toolkit that handles metadata migration, historical backfill via Reindex-from-Snapshot, and live traffic capture + replay so your users never feel the move. We'll cover all three migration scenarios, the trickiest mapping transformation pitfalls (dense_vector → knn_vector, anyone?), and live comparative response diffing before the final cutover. Migrate smarter, not harder.

Enterprise search is evolving from keyword-based retrieval into intelligent, context-aware systems powered by generative AI. While many RAG examples focus on simple vector lookups, building a production-grade, multi-modal RAG platform requires more—especially at enterprise scale.

This talk presents a reference architecture for agent-assisted, multi-modal RAG systems with OpenSearch as the core retrieval and indexing layer. OpenSearch combines lexical relevance, vector similarity, and metadata filtering across text, images, audio, and video, while preserving deterministic control over retrieval in AI-driven workflows.

The session covers ingestion pipelines, chunking strategies, hybrid and multi-vector indexing, and retrieval orchestration, and explains how OpenSearch acts as the retrieval intelligence boundary between probabilistic agent reasoning and enterprise data. Key production trade-offs around relevance tuning, multi-tenant isolation, performance scaling, and cost control are also discussed, providing practical guidance for building reliable, enterprise-ready AI search platforms.

This OpenSearchCon talk covers setting up and enabling agents for private environments, from initial configuration to solving common challenges. We faced numerous issues connecting OpenSearch Agents to our private LLM. Through trial and error, we succeeded by setting certificates in the JDK keystore, enabling private MCPs, and more. We identified gaps in OpenSearch and addressed them via pull requests, including creating a blueprint for Ollama and adding an option to disable certificate validation for LLM connectors.

In this session, we'll share our journey, discuss use cases, and provide a live demo using the latest OpenSearch features, including the brand new Agentic UI. You'll leave with practical insights to configure and optimize OpenSearch Agents for private LLMs, solutions to common integration issues, and the knowledge to deploy customized, fully private search experiences.