OpenSearchCon Europe 2025

In this session, we'll share our experience managing over 1,000 OpenSearch clusters in a private cloud, focusing on technologies used for stable operations and cost reduction. The LINE Cloud team provides OpenSearch as a backend for various LINE services, aiming for automated operations with minimal user intervention. We'll detail our service architecture utilizing Kubernetes and OpenStack, focusing on stability, scalability, and automation.
Additionally, we intend to share our experience collaborating with the storage team to design lightweight storage solutions for OpenSearch. This solution and our architecture enable high performance while reducing maintenance costs. In a recent migration case, we achieved a 22% reduction in infrastructure costs for OpenSearch 'hot' nodes. Also, we'd like to share some of the issues we encountered under high load situations to share our experiences on the private cloud. This session will offer practical insights for engineers interested in operating OpenSearch in their own environment.

OpenSearch provides several tools for search and information retrieval, important in many stages of prompt processing. However, to be used in a varied range of industries and regulations such as healthcare, telco or finance, the solution must be proven to be secure, robust and highly available.

In this talk we will discuss how to build a secure conversational chat infra from the ground up to answer your prompts, using OpenSearch. We will explore how we can use existing features of OpenSearch to build the basis of this infra, e.g. vector search and RAG. We will discuss the latest technologies such as confidential computing and hardware acceleration to get the most out of the environment. We will also explore an OpenSearch VM operator that helps with the lifecycle of the cluster. It provides the features needed to scale, upgrade, specialize nodes in different roles according to the needs and manage security such as certificate rotation and user management.

Versioning OpenSearch indexes is critical for maintaining data integrity, ensuring seamless updates, and enabling rollback capabilities in modern CICD pipelines. This presentation explores how Terraform and Python can be combined to manage the versioning of OpenSearch indexes effectively. By leveraging Terraform’s infrastructure-as-code capabilities and Python’s scripting flexibility, teams can automate the lifecycle management of indexes, ensuring consistent reintegration and streamlined operations. Key benefits include enhanced automation, improved traceability, and reduced manual overhead.

Every OpenSearch workload behaves and evolves differently. Users strive to understand their production workload’s behavior by running performance tests. But this is often done with generic data and basic queries, which can inaccurately represent their use case. The best way to determine its behavior is by benchmarking with real-life data and customer queries. To do this, users will need to recreate their actual workload, which is difficult as there are many factors to consider. Although it seems daunting, recreating production workloads and their behaviors do not require scientific methodologies and formulas but rather techniques and intuition.

In this interactive session, we’ll use a feature in OpenSearch Benchmark to convert real customer data into a sharable custom workload that recreates patterns and behaviors seen in production environments. We’ll also show how that custom workload can be used to save time, discover optimizations, and lower costs.

After the session, attendees will have developed intuition on workload dynamics, gained practical skills they can apply to their own environments, and understand that recreating workload behavior is an art, not a science.

Join us for an in-depth exploration of tiered caching in OpenSearch, a powerful search and analytics engine. Caching plays a crucial role in optimizing performance for performance-intensive applications like OpenSearch. This session delves into the limitations of on-heap caching and introduces tiered caching, a multi-layered caching approach that balances performance and capacity. Learn how tiered caching leverages both on-heap and disk-based caches to store larger datasets efficiently without consuming excessive heap memory. Discover the workings of tiered caching, its benefits, and when to implement it. Uncover performance test results comparing tiered caching with the default on-heap cache, and get insights into future enhancements in tiered caching technology. Don't miss this opportunity to enhance your understanding of caching strategies in OpenSearch for improved query response times and application performance.

Performance testing OpenSearch clusters requires careful consideration of numerous variables and methodologies. While OpenSearch Benchmark (OSB) and its associated workloads provide powerful tools for cluster evaluation, many users struggle to implement effective testing strategies that yield meaningful, reproducible results.

In this comprehensive session, we'll dive more deeply into OSB best practices, moving beyond basic benchmarking to explore topics such as how to select and size appropriate workloads, handle common pitfalls and leverage more advanced features like custom workloads and gradual ramp-up to simulate realistic production scenarios. An understanding of critical aspects that are often overlooked such as warm-up periods, proper load generator sizing and techniques to analyze statistical significance will help you obtain actionable insights into how your OpenSearch cluster scales and performs under various operational conditions.

Whether you're a DevOps engineer, database administrator, or performance analyst, this talk will equip you with the tools and methodologies needed to unlock the full potential of your OpenSearch deployment.

The standard way for creating APIs is to first define the API contract, use that to generate classes and write your application around it. But what happens when the application is already in place and is actively being used by millions around the world and does not have an API contract?

We faced this issue when we set out to find a single source of truth for OpenSearch APIs. Finding none and realizing that we need to create one, we set out on a journey to create asuch specification.

This talk will deal with:
* Experience with Jest client and frustration with freeform request bodies as a customer
* The stages of development including ideation, PoC, RFC, choosing the technologies, gaining consensus and implementation
* setting up the project and integration framework (while ensuring frugality and complete coverage)
* Opening up the project to community contribution after initial implementation
* Adoption by the clients team
* Switch from Smithy to OpenAPI based on community discussion
and the FUTURE!

This session will provide an overview of key advancements in OpenSearch Dashboards delivered in 2024, including the launch of the next-generation OpenSearch UI. Highlights include multiple data source integration, OpenSearch Workspaces for tailored collaboration, and an enhanced Discover experience featuring natural language query capabilities. These updates have streamlined workflows, improved user experience, and expanded data visualization options.

Looking ahead, the session will outline the roadmap for OpenSearch Dashboards, focusing on enhancing user workflows, improving integration across observability modules, and simplifying data management. Attendees will gain insights into the platform’s direction and how it aims to address common challenges, including fragmented workflows, feature silos, and configuration complexities, to deliver a more unified and efficient analytics experience.

One of the really cool aspects of OpenSearch is its ability to serve as a monitoring tool for itself. Let's have a look at how to piece together a monitoring solution for OpenSearch using components from the OpenSearch ecosystem such as Data Prepper and OpenSearch alerting. We will focus on security aspects like authentication and authorization.

Any software dealing with confidential data needs to have a security solution providing authentication and authorization. And any such security solution should have proper monitoring. OpenSearch is no exception in this regard.

In this presentation, we will look how to use components like Audit Logs, Data Prepper and OpenSearch Alerting to create a small, but effective security monitoring solution.

This will give us two benefits at once:

- A security monitoring solution
- Insights into the workings of components like Alerting, etc. by looking at a real world example

Many OS users, especially those new to Lucene-based search engines, struggle with sharding best practices. This often results in inefficient shard sizes, leading to performance issues and resource waste. Our talk introduces a novel approach: Dynamic Sharding Strategy.

We'll explore how this strategy adaptively determines the optimal primary shard count for indices, particularly beneficial for time-series data with fluctuating ingestion rates. By analyzing past ingestion rates, cluster resources, and workload patterns, our method predicts and applies suitable shard counts for each index rollover.

We'll discuss
* Common sharding pitfalls and their impact
* The idea behind our dynamic sharding approach
* Implementation as a Python script integrated with OpenSearch
* Real-world case studies and performance improvements
* Potential for native integration into OpenSearch's Index State Management

This talk aims to empower OpenSearch users with a practical solution for maintaining optimal cluster performance, reducing storage skewness, and minimizing manual interventions in shard management. Join us to learn how dynamic sharding can revolutionize your OpenSearch cluster efficiency

This talk will explore how OpenSearch can be leveraged to build a centralized and multi-tenant log analysis platform that provides logging-as-a-service to several Kubernetes enterprise environments.

We’ll address solutions for critical topics like cluster and tenant separation strategies, Kubernetes integration, automation, capacity management and monitoring best practices. Additionally, we’ll present our approach to non-technical challenges such as handling diverse tenant requirements, effective customer support and different areas of tenant collaboration.

Throughout the talk, there will be a strong emphasis on standardization as the primary solution component to achieve heterogeneity within the different configuration domains (retention policies, RBAC, etc.), while simultaneously maintaining the flexibility to be able adapt to customers' needs.

Drawing experience from a recent real-world implementation, this session will provide attendees with actionable insights and our lessons learned to overcome technical and operational challenges in building multi-tenant logging platforms using OpenSearch.