OpenSearchCon India 2026

When a search cluster slows down, the first question is: what's running right now? Until recently, OpenSearch had no answer. Top N Queries shows what was slow after the fact, but by then the root cause may have disappeared.

In this talk, I'll walk through Live Queries, a feature I built for the Query Insights plugin that gives operators real-time visibility into every in-flight and recently completed search request across the cluster.

I'll cover:
- Why "what's running now?" was unanswerable and how operators struggled with manual correlation of node stats and thread dumps
- The end-to-end architecture: REST handler → transport fan-out → TaskGroup collection → LiveQueryRecord assembly with per-shard task details (CPU, memory, running time)
- The lock-free Finished Queries Cache: ConcurrentLinkedDeque with CAS-based lazy activation achieving zero hot-path overhead
- Correlating live and finished queries via nodeId:taskId keys linked to Top N records
- Evolution from OpenSearch 3.0 (inflight API) through 3.1 (cancellation tracking) to 3.3 (WLM group filtering)
- Live demo and future roadmap: comprehensive latency breakdown (RFC #20693) and OpenTelemetry integration