OpenSearchCon India 2026

Large Language Model agents frequently rely on retrieval systems to make decisions, yet most pipelines still depend on a naive top-k retrieval strategy. In agentic workflows this can lead to a dangerous failure mode: agents confidently acting on low-relevance results, amplifying hallucinations through iterative tool use.

This session presents a practical framework for implementing search-confidence guardrails using OpenSearch. Instead of treating retrieval scores as opaque signals, we demonstrate how to convert heterogeneous ranking outputs into a normalized trust metric that agents can reason about.

We will explore techniques such as score normalization, Reciprocal Rank Fusion (RRF), and hybrid retrieval (BM25 + vector search) to build a deterministic confidence layer on top of OpenSearch queries. Using this signal, agents can dynamically decide whether to answer, re-query, or request clarification, preventing cascading hallucinations.

The talk includes a reference architecture for agent-search interaction, evaluation workflows using the OpenSearch comparison tooling.

When a search cluster slows down, the first question is: what's running right now? Until recently, OpenSearch had no answer. Top N Queries shows what was slow after the fact, but by then the root cause may have disappeared.

In this talk, I'll walk through Live Queries, a feature I built for the Query Insights plugin that gives operators real-time visibility into every in-flight and recently completed search request across the cluster.

I'll cover:
- Why "what's running now?" was unanswerable and how operators struggled with manual correlation of node stats and thread dumps
- The end-to-end architecture: REST handler → transport fan-out → TaskGroup collection → LiveQueryRecord assembly with per-shard task details (CPU, memory, running time)
- The lock-free Finished Queries Cache: ConcurrentLinkedDeque with CAS-based lazy activation achieving zero hot-path overhead
- Correlating live and finished queries via nodeId:taskId keys linked to Top N records
- Evolution from OpenSearch 3.0 (inflight API) through 3.1 (cancellation tracking) to 3.3 (WLM group filtering)
- Live demo and future roadmap: comprehensive latency breakdown (RFC #20693) and OpenTelemetry integration

Running OpenSearch in production at scale is very different from what tutorials or books show. When you manage many clusters, you start seeing issues you didn’t know existed, like shard and disk imbalance, uneven traffic distribution, and unstable cluster states. These problems can degrade search performance and even cause incidents.

In this session, we will share real challenges we faced while operating large OpenSearch clusters and the practical solutions we used to stabilize them. We will explore how shard distribution can silently create problems, why some nodes end up using much more disk than others, and how clusters behave under heavy indexing and query load.

This talk focuses on the operational side of running OpenSearch in production. We’ll discuss strategies for better shard allocation, preventing disk imbalance, controlling indexing pressure, and keeping clusters stable under load.

Attendees will leave with practical techniques they can apply to run OpenSearch clusters reliably at large scale and improve stability and performance in real-world environments.

AI agents are moving from demos to production, but observability hasn't kept up. When an agent takes a wrong path, hallucinates mid-task, or silently degrades, how do you investigate? Traditional APM treats agent execution as a black box. We need purpose-built, OpenTelemetry-native observability for agentic AI.

We introduce the Agent Traces and Agent Health for OpenSearch: a native UI for exploring agent execution traces. OTel SDKs with GenAI semantic conventions (gen_ai.* attributes) instrument your agents, Data Prepper ingests the spans, and Agent Traces show you hierarchical trace views, detail agent maps, and aggregate metrics like token usage and latency percentiles - all queryable via PPL.

We demonstrate root-cause investigation: expanding execution trees to inspect each LLM call and tool invocation, querying spans to answer "which tool call caused the agent to diverge?" We then go deeper with Agent Health's golden path comparison that evaluates trajectories against expected behavior. Whether you're building agents for customer support, code generation, or data pipelines, you'll leave with a practical playbook for agent observability.

Ever wondered what really happens after you hit “Search”? This talk takes you on a fast, funny, and surprisingly eye‑opening journey through the secret life of a query inside OpenSearch. We’ll follow it as it squeezes through analyzers, hops across shards, meets vectors, dodges caches, and races toward the perfect answer, all in milliseconds. Along the way, you’ll discover why some queries feel instant, why others take a coffee break, and how tiny architectural choices can totally change the search experience. Whether you're new to OpenSearch or a seasoned engineer, you’ll walk away with a delightful mental model of how search really works and how to make it faster, smarter, and a whole lot more magical.

Modern ecommerce search systems must do more than return results. They must understand customer intent, retrieve relevant products, and do all of this within extremely tight latency budgets. Even small delays can impact user experience and conversion.

In this talk, I will walk through the architecture of a product discovery system designed to deliver relevant product suggestions in under 200 milliseconds using OpenSearch and Lucene. The session will explore how search infrastructure can power real time product discovery across high traffic ecommerce platforms.

We will cover how queries are processed, how candidate products are retrieved efficiently, and how filtering and ranking strategies help surface high quality and buyable items. The talk will also discuss practical techniques for managing latency budgets, optimizing search queries, and designing indexes that balance speed and relevance.

Attendees will gain practical insights into building fast and scalable product discovery systems and learn how OpenSearch and Lucene can be used to power low latency search experiences in modern ecommerce applications.

Piped Processing Language (PPL) has quietly become one of OpenSearch's most powerful tools for observability data transformation.
OpenSearch 3.5 added various powerful functions that unlock advanced use cases: join , Lookup, mvcombine, mvzip, mvfind, and mvmap for multivalue field operations, addtotals for instant summary tables, and streamstats for cumulative statistical calculations as events are processed. This session showcases these capabilities through real-world observability scenarios — correlating multivalue log fields across microservices, building running error rate dashboards with streamstats, and performing lightweight anomaly detection using just PPL with no ML model required. We'll also demonstrate cross-signal analysis by combining PPL log queries with Prometheus
metric data using the new Discover experience for Prometheus data sources shipped in 3.5. Attendees will leave with ready-to-use PPL patterns for incident investigation that are more intuitive than equivalent SQL approaches.

As data volumes and AI-driven workloads grow, operating large-scale search and observability platforms comes with rising infrastructure costs and energy consumption. GreenOps, an approach that combines operational efficiency, cost management, and environmental responsibility, is emerging as a practical way for engineering teams to run cloud systems more sustainably.

This session explores how GreenOps principles apply when operating OpenSearch for search and observability workloads. We will examine strategies to optimise cluster sizing, storage, and indexing patterns to reduce unnecessary compute usage while maintaining performance and reliability. The talk will also cover ways teams can use observability data to identify inefficient workloads, control infrastructure costs, and reduce the overall carbon footprint of their systems.

Attendees will gain practical insights into running more efficient OpenSearch deployments while aligning operational decisions with broader sustainability and cost-optimization goals.

Agentic AI systems are moving from experiments to production—but most teams lack visibility into how agents
think, coordinate, and evolve. This session explores using OpenSearch as the cognitive backbone for modern agent
frameworks like Strands and LangGraph, positioning it as: a long-term memory store, reasoning trace index, multi-
agent coordination layer, and observability platform.

Through a live architecture walkthrough, we'll build a multi-agent system where every planning step, tool
invocation, state transition, and outcome is indexed in OpenSearch. We'll demonstrate how to debug hallucinations
using reasoning traces, replay agent decisions across sessions, analyze performance with hybrid search, detect
behavioral drift, and coordinate multiple agents through search-backed state.

Attendees will gain practical architectural patterns for running stateful, observable, production-grade AI agents
using OpenSearch as core infrastructure—beyond basic retrieval.

Key Takeaways:
• Design stateful agent memory architectures
• Implement agent observability pipelines
• Use OpenSearch for reasoning trace analysis
• Coordinate multi-agent systems via indexed state