OpenSearchCon India 2026

We migrated ~1,500 OpenSearch nodes across 7 clusters in 5 regions from Intel to AWS Graviton 4, upgrading from OpenSearch 2.13 to 3.4 and JVM 17 to 21 along the way. We saw 2x indexing throughput and ~30% cost savings. We want to share the benchmarking data, compare migration strategies (inline upgrade, snapshot-restore, and why CCS didn't work), and push more teams toward Graviton.

A practical guide to evaluating and executing a Graviton migration at scale — covering instance type benchmarking (i4i/i4g/i7i/i8g), migration strategy trade-offs (inline upgrade is fast but risky, snapshot-restore is safe but needs parallel infrastructure, CCS doesn't work across major versions), production validation steps, and the real performance and cost numbers from 1,500 nodes in production.

Large-scale Graviton migration data for OpenSearch is scarce. By sharing production numbers from 7 clusters across 5 regions — including what didn't work — we want to de-risk Graviton adoption for the community. The 2x throughput and 30% cost reduction we're seeing should motivate more teams to make the move, and our migration playbook gives them a concrete path to follow.

Large-scale ingestion can significantly impact OpenSearch cluster stability, query latency, and operational efficiency. Traditional bulk APIs and Spark/Hadoop connectors rely on online indexing, where clusters must handle indexing and queries simultaneously—creating resource contention and long ingestion windows.

This session introduces an Offline Batch Ingestion framework that builds OpenSearch-compatible Lucene segments outside the cluster using distributed Spark executors. The system leverages OpenSearch’s native indexing engine and snapshot/restore APIs to deploy indexes atomically with zero production impact.

We’ll cover the architecture (distributed indexing, shard merge, snapshot generation), technical implementation using OpenSearch Engine APIs, production learnings, scalability characteristics, and future extensions such as vector indexing. This approach decouples indexing compute from serving clusters, enabling faster ingestion, safer reindexing, and improved operational resilience.

Search performance directly impacts user experience and system resilience. OpenSearch Query Insights provides unprecedented visibility into query execution with minimal performance overhead.

This presentation explores Query Insights capabilities and demonstrates how to identify performance bottlenecks, diagnose issues in real-time, and optimize your cluster. Through live demos, you'll see how to pinpoint the top queries consuming resources, understand query patterns for structural improvements, and leverage dashboards for data-driven optimization. Whether you're managing a small cluster or large-scale search platform, you'll gain the visibility needed to keep OpenSearch running at peak efficiency.

Key Features to Demo:
- Real-time query monitoring and live execution tracking
- Resource consumption rankings (CPU, memory, latency)
- Advanced query grouping and pattern detection
- Interactive Query Insights Dashboard with filtering and drill-down
- Query metadata and node/shard-level insights
- Historical query analysis and trend tracking
- Performance metrics export and integration capabilities

Vector search in OpenSearch offers a rich set of configuration options, but choosing the right combination of engine, algorithm, quantization, and storage tier can be daunting — especially as your workload grows or shifts from semantic search to agentic AI. This session covers both workload types at small, medium, and high scale. You'll learn how to apply the cost-recall-latency curve to choose between Faiss and Lucene, HNSW and IVF, and the right quantization technique for your budget and recall requirements. You'll explore tiered storage from in-memory to disk-based and memory-optimized, and production tuning techniques including bulk indexing strategies, GPU-accelerated builds, and automated parameter optimization. You'll leave with best practices to apply whether you're running thousands of vectors on a single node or billions across a fleet.

Security isn't just about firewalls and alerts, it’s about curiosity, context, and catching the weird stuff before it gets weird. But let’s be real: most teams don’t have the budget (or patience) for a million-dollar SIEM.

In this talk, I’ll walk you through how we turned OpenSearch into a scrappy, surprisingly powerful threat-hunting platform. Using native tools, open-source plugins, and a healthy dose of creativity, we built real-time alerting and investigation flows without blowing up costs. We'll cover:

• Designing log schemas that highlight anomalies.
• Building threat-detection pipelines using ingest processors and OpenSearch Dashboards.
• Real-life incident where OpenSearch helped us catch something our cloud provider missed.

If you’ve ever felt like security tools are either overkill or underwhelming, this session is for you. You’ll walk away with practical patterns and open-source recipes for turning OpenSearch into your security command center — no license key required.

Most teams have a dirty secret: they're running Elasticsearch versions they can't afford to upgrade and can't afford to stay on. The migration feels impossible due to data loss risk, query regression, extended downtime, and no rollback. So they wait. And wait. This talk ends the waiting. We walk through the OpenSearch Migration Assistant end-to-end: a fully open-source toolkit that handles metadata migration, historical backfill via Reindex-from-Snapshot, and live traffic capture + replay so your users never feel the move. We'll cover all three migration scenarios, the trickiest mapping transformation pitfalls (dense_vector → knn_vector, anyone?), and live comparative response diffing before the final cutover. Migrate smarter, not harder.

Enterprise search is evolving from keyword-based retrieval into intelligent, context-aware systems powered by generative AI. While many RAG examples focus on simple vector lookups, building a production-grade, multi-modal RAG platform requires more—especially at enterprise scale.

This talk presents a reference architecture for agent-assisted, multi-modal RAG systems with OpenSearch as the core retrieval and indexing layer. OpenSearch combines lexical relevance, vector similarity, and metadata filtering across text, images, audio, and video, while preserving deterministic control over retrieval in AI-driven workflows.

The session covers ingestion pipelines, chunking strategies, hybrid and multi-vector indexing, and retrieval orchestration, and explains how OpenSearch acts as the retrieval intelligence boundary between probabilistic agent reasoning and enterprise data. Key production trade-offs around relevance tuning, multi-tenant isolation, performance scaling, and cost control are also discussed, providing practical guidance for building reliable, enterprise-ready AI search platforms.

This OpenSearchCon talk covers setting up and enabling agents for private environments, from initial configuration to solving common challenges. We faced numerous issues connecting OpenSearch Agents to our private LLM. Through trial and error, we succeeded by setting certificates in the JDK keystore, enabling private MCPs, and more. We identified gaps in OpenSearch and addressed them via pull requests, including creating a blueprint for Ollama and adding an option to disable certificate validation for LLM connectors.

In this session, we'll share our journey, discuss use cases, and provide a live demo using the latest OpenSearch features, including the brand new Agentic UI. You'll leave with practical insights to configure and optimize OpenSearch Agents for private LLMs, solutions to common integration issues, and the knowledge to deploy customized, fully private search experiences.

OpenSearch Dashboards plugins are often used to add individual features, but how far can the plugin model go? In this talk we share how we took the dashboards-observability plugin skeleton and evolved it into a full observability platform supporting tracing, RUM, profiling, synthetics, model observability, alerting, AI-powered RCA, and pipeline monitors — all within a single plugin.

We’ll walk through the architectural patterns behind this evolution, including domain-based state management, lazy-loaded modules, custom clients, and config-driven feature toggling. We’ll also discuss integrating rich visualizations such as trace timelines, dependency graphs, and flamegraphs into the Dashboards plugin shell, extending the query grammar for syntax highlighting, and organizing server routes with a middleware layer to proxy multiple backends.

Attendees will leave with practical patterns for building complex applications on OpenSearch Dashboards and a deeper understanding of how the plugin architecture can evolve from simple extensions into an extensible application platform for full solutions.

Your users search for “comfortable shoes for standing all day” and get shoe polish. 30% of searches return zero results even when products exist. This is keyword hell, costing you customers daily.

This session reveals how we transformed Adobe Commerce search using OpenSearch’s vector search capabilities. Learn the complete technical journey, including text embeddings, k-NN similarity, and hybrid search that combines keyword precision with semantic understanding.

We’ll cover the architecture, including vector indexing with FAISS and Lucene, ingest pipelines for automatic embedding generation, and query-time optimization.

Honest challenges included computational costs, embedding model selection through sentence-transformers comparisons, dimension tradeoffs between 384 and 768, cold start problems, and explainability to stakeholders.

You’ll get actionable knowledge such as exact OpenSearch configurations, PPL queries for semantic search, hybrid scoring strategies, open-source model recommendations, and cost optimization for Indian startups, with $30 per month infrastructure compared to $200 or more for managed vector databases.

Modern AI assistants and knowledge systems rely heavily on high-quality retrieval to provide accurate and contextual responses. While large language models generate answers, it is the underlying search infrastructure that retrieves relevant information and grounds AI outputs in real data.
In this session, we explore how modern AI applications use search infrastructure as the backbone of their intelligence layer. We will examine the architectural patterns that combine OpenSearch with embeddings, vector search, and hybrid retrieval to power knowledge assistants, enterprise search systems, and AI copilots.
The talk will walk through the evolution of search infrastructurfrom traditional keyword-based search to semantic retrieval and retrieval-augmented generation (RAG). We will discuss key design considerations such as document chunking strategies, embedding pipelines, hybrid ranking approaches, and relevance tuning required to build reliable AI systems.

Attendees will also learn how it enables scalable retrieval pipelines that support real-time indexing, vector similarity search, and metadata filtering—capabilities that are essential for powering AI-driven knowledge systems at scale.

Modern Kubernetes platforms generate massive volumes of logs, yet most teams still rely on keyword searches and dashboards to debug production issues. This slows down incident response and hides valuable operational knowledge inside unstructured data.

In this talk, we’ll demonstrate how to build an AI-assisted observability pipeline using Fluent Bit, OpenSearch, and Retrieval-Augmented Generation (RAG) to transform raw logs into queryable, contextual insights. We’ll walk through a cloud-native architecture that streams logs from Kubernetes workloads, enriches and indexes them in OpenSearch, and uses RAG to answer operational questions in real time.

Attendees will see how this approach helps SREs and platform teams reduce MTTR, improve root-cause analysis, and move from reactive troubleshooting to proactive observability—using open-source, CNCF-aligned tooling.

Modern AI agents generate massive operational telemetry: prompts, tool executions, policy decisions, and execution outcomes. Without strong indexing and analytics, debugging and governing these systems becomes extremely difficult.

This talk presents a practical architecture for operating autonomous systems at scale using OpenSearch as the observability and decision-intelligence backbone.

We explore an AgentOps architecture where OpenSearch indexes agent traces, policy decisions, incident telemetry, and execution evidence to enable real-time debugging, safety enforcement, and auditability.

Topics covered include building searchable “decision traces” for AI agents, designing observability pipelines for autonomous systems, using OpenSearch for policy audits and incident forensics, and scaling analytics for multi-agent operations.

Attendees will learn concrete patterns for using search and analytics infrastructure to make AI-driven systems observable, debuggable, and governable in production.