OpenSearchCon India 2026

Kubernetes platforms generate massive volumes of logs from microservices, infrastructure, and platform services. At scale, OpenSearch observability pipelines often struggle with shard explosion, indexing bottlenecks, JVM pressure, and slow queries.

This session presents a practical architecture for operating an OpenSearch observability platform handling 100M+ logs per day from Kubernetes environments. We will walk through the end-to-end pipeline—from log collection to ingestion and indexing—and share performance engineering techniques used to maintain cluster stability under heavy workloads.

Topics include shard and index design, JVM and thread-pool tuning, optimizing indexing throughput, and using lifecycle policies and hot-warm architectures to scale efficiently. Attendees will gain actionable strategies for building resilient OpenSearch observability platforms for cloud-native systems.

Large Language Model agents frequently rely on retrieval systems to make decisions, yet most pipelines still depend on a naive top-k retrieval strategy. In agentic workflows this can lead to a dangerous failure mode: agents confidently acting on low-relevance results, amplifying hallucinations through iterative tool use.

This session presents a practical framework for implementing search-confidence guardrails using OpenSearch. Instead of treating retrieval scores as opaque signals, we demonstrate how to convert heterogeneous ranking outputs into a normalized trust metric that agents can reason about.

We will explore techniques such as score normalization, Reciprocal Rank Fusion (RRF), and hybrid retrieval (BM25 + vector search) to build a deterministic confidence layer on top of OpenSearch queries. Using this signal, agents can dynamically decide whether to answer, re-query, or request clarification, preventing cascading hallucinations.

The talk includes a reference architecture for agent-search interaction, evaluation workflows using the OpenSearch comparison tooling.

This session is about the recent productivity study we ran in our open source lab (OSL). I’ll walk through the end-to-end architecture: extracting device telemetry, transforming it into task sessions, and running association rule mining on top of OpenSearch to compute support and confidence for goal-relevant activity patterns. The entire setup runs locally, therefore no risk of activity data theft.

ActivityWatch is cross platform open-source time tracker that collects telemetry on how we spend time on devices. It comes with watchers that can do all the data collection from AFK to browser windows. In our setup, ActivityWatch runs on each device, and OpenSearch is self-hosted on our lab’s local LAN (I'm academic), and then we ingest logs into it every 10 seconds using API-based ingestion. While ActivityWatch runs, users tag their intended task (e.g., #learn, #java). We align tags with telemetry windows, sessionize events into transactions (items[]=apps/domains, duration), and mine rules with support/confidence/lift per tag. If the current window drifts from the active tag with high confidence for a short period, we send a nudge reminding they are distracted from the original goal.

Ever wondered what really happens after you hit “Search”? This talk takes you on a fast, funny, and surprisingly eye‑opening journey through the secret life of a query inside OpenSearch. We’ll follow it as it squeezes through analyzers, hops across shards, meets vectors, dodges caches, and races toward the perfect answer, all in milliseconds. Along the way, you’ll discover why some queries feel instant, why others take a coffee break, and how tiny architectural choices can totally change the search experience. Whether you're new to OpenSearch or a seasoned engineer, you’ll walk away with a delightful mental model of how search really works and how to make it faster, smarter, and a whole lot more magical.

Modern ecommerce search systems must do more than return results. They must understand customer intent, retrieve relevant products, and do all of this within extremely tight latency budgets. Even small delays can impact user experience and conversion.

In this talk, I will walk through the architecture of a product discovery system designed to deliver relevant product suggestions in under 200 milliseconds using OpenSearch and Lucene. The session will explore how search infrastructure can power real time product discovery across high traffic ecommerce platforms.

We will cover how queries are processed, how candidate products are retrieved efficiently, and how filtering and ranking strategies help surface high quality and buyable items. The talk will also discuss practical techniques for managing latency budgets, optimizing search queries, and designing indexes that balance speed and relevance.

Attendees will gain practical insights into building fast and scalable product discovery systems and learn how OpenSearch and Lucene can be used to power low latency search experiences in modern ecommerce applications.

Piped Processing Language (PPL) has quietly become one of OpenSearch's most powerful tools for observability data transformation.
OpenSearch 3.5 added various powerful functions that unlock advanced use cases: join , Lookup, mvcombine, mvzip, mvfind, and mvmap for multivalue field operations, addtotals for instant summary tables, and streamstats for cumulative statistical calculations as events are processed. This session showcases these capabilities through real-world observability scenarios — correlating multivalue log fields across microservices, building running error rate dashboards with streamstats, and performing lightweight anomaly detection using just PPL with no ML model required. We'll also demonstrate cross-signal analysis by combining PPL log queries with Prometheus
metric data using the new Discover experience for Prometheus data sources shipped in 3.5. Attendees will leave with ready-to-use PPL patterns for incident investigation that are more intuitive than equivalent SQL approaches.

Enterprise search is evolving from keyword-based retrieval into intelligent, context-aware systems powered by generative AI. While many RAG examples focus on simple vector lookups, building a production-grade, multi-modal RAG platform requires more—especially at enterprise scale.

This talk presents a reference architecture for agent-assisted, multi-modal RAG systems with OpenSearch as the core retrieval and indexing layer. OpenSearch combines lexical relevance, vector similarity, and metadata filtering across text, images, audio, and video, while preserving deterministic control over retrieval in AI-driven workflows.

The session covers ingestion pipelines, chunking strategies, hybrid and multi-vector indexing, and retrieval orchestration, and explains how OpenSearch acts as the retrieval intelligence boundary between probabilistic agent reasoning and enterprise data. Key production trade-offs around relevance tuning, multi-tenant isolation, performance scaling, and cost control are also discussed, providing practical guidance for building reliable, enterprise-ready AI search platforms.

Debugging production incidents in distributed systems often means manually searching through thousands of log lines to understand what went wrong. During high-impact outages, engineers must quickly correlate signals across services, identify error patterns, and reconstruct the sequence of events.

In this talk, we explore how AI investigation agents can assist engineers by using OpenSearch as the investigation backbone for incident analysis. Instead of simply retrieving logs, an agent can iteratively query OpenSearch, identify dominant error patterns, correlate events across services, and build a timeline of failures before producing a concise root-cause explanation.

We will demonstrate a lightweight investigation agent diagnosing a simulated microservices failure using logs stored in OpenSearch. Attendees will see how engineers can ask questions like “Why did the ingestion service fail?” and watch the agent autonomously investigate and explain the incident.

Participants will leave with a practical architecture for building AI-assisted debugging workflows on top of OpenSearch.

As data volumes and AI-driven workloads grow, operating large-scale search and observability platforms comes with rising infrastructure costs and energy consumption. GreenOps, an approach that combines operational efficiency, cost management, and environmental responsibility, is emerging as a practical way for engineering teams to run cloud systems more sustainably.

This session explores how GreenOps principles apply when operating OpenSearch for search and observability workloads. We will examine strategies to optimise cluster sizing, storage, and indexing patterns to reduce unnecessary compute usage while maintaining performance and reliability. The talk will also cover ways teams can use observability data to identify inefficient workloads, control infrastructure costs, and reduce the overall carbon footprint of their systems.

Attendees will gain practical insights into running more efficient OpenSearch deployments while aligning operational decisions with broader sustainability and cost-optimization goals.

Search engines are widely used but rarely understood at a deeper level. What actually happens between the moment a user submits a query and the results appear on the screen?
This session provides a technical deep dive into the OpenSearch query execution pipeline, exploring how user queries are processed, distributed, and ranked across a cluster. The talk begins with how text is analyzed and indexed using Lucene, including tokenization, analyzers, and inverted indexes. It then walks through how queries are parsed, executed across shards, and scored using relevance algorithms such as BM25.
Participants will also learn how OpenSearch coordinates distributed search, merges shard results, and optimizes performance through caching and query planning. Finally, we will examine debugging tools and profiling techniques that help developers understand and tune search relevance and performance.
By the end of the session, attendees will have a deeper understanding of the internals of OpenSearch and how those internals influence search quality and system performance.

Your users search for “comfortable shoes for standing all day” and get shoe polish. 30% of searches return zero results even when products exist. This is keyword hell, costing you customers daily.

This session reveals how we transformed Adobe Commerce search using OpenSearch’s vector search capabilities. Learn the complete technical journey, including text embeddings, k-NN similarity, and hybrid search that combines keyword precision with semantic understanding.

We’ll cover the architecture, including vector indexing with FAISS and Lucene, ingest pipelines for automatic embedding generation, and query-time optimization.

Honest challenges included computational costs, embedding model selection through sentence-transformers comparisons, dimension tradeoffs between 384 and 768, cold start problems, and explainability to stakeholders.

You’ll get actionable knowledge such as exact OpenSearch configurations, PPL queries for semantic search, hybrid scoring strategies, open-source model recommendations, and cost optimization for Indian startups, with $30 per month infrastructure compared to $200 or more for managed vector databases.

Building billion-scale vector indexes on OpenSearch has traditionally meant days of CPU-intensive processing. OpenSearch 3.0 changes this with GPU-accelerated index building using CAGRA and auto-optimize for automated hyperparameter tuning.

This session shares hands-on lessons building billion-scale vector indexes on OpenSearch 3.0. We cover the end-to-end journey: selecting embedding models, choosing between HNSW and IVF algorithms, leveraging GPU-accelerated builds for up to 9x faster indexing, and using auto-optimize to balance recall, latency, and cost without manual tuning of ef_construction and M parameters.

We dive into production realities including quantization strategies (scalar, product, binary) to reduce memory footprint, disk-optimized vector search for cost-sensitive workloads, and hybrid search combining vector similarity with BM25 keyword matching. We cover operational patterns for zero-downtime index rebuilds and monitoring vector search performance.

Attendees leave with a decision framework for vector index configuration, benchmarks across deployment sizes, and guidance on when GPU acceleration pays off versus CPU-only approaches.