OpenSearchCon India 2026

Modern observability tools mostly index log lines, metrics, and traces as isolated events. But production incidents rarely happen because of a single event. They happen because of patterns of behavior across services.

In this session, I’ll explore a different approach: indexing system execution paths instead of raw logs.

Rather than storing individual log lines, request traces are converted into behavioral documents that represent how a request actually moved through the system. This makes it possible to search for things like unusual request flows, repeated failure paths, or rare service interactions.

We’ll walk through:
=> Transforming distributed traces into searchable execution paths
=> Designing an index structure for behavioral search
=> Querying for patterns like repeated timeout paths or rare service flows
=> How OpenSearch scoring can highlight abnormal request behavior

A small demo will simulate a microservice environment and show how OpenSearch can surface failure patterns by searching system behavior instead of individual log lines.