OpenSearchCon Europe 2025

There are lots of statistics we can calculate for search relevance: NDCG, precision, MAP, …. OpenSearch 3.0 calculates and displays them for you.

But metrics don’t tell the whole story. In particular, NDCG can’t give you the qualitative analysis that one algorithm is great for author names, and a different one is good for shapes and sizes. For that, you need eyeballing, that is, human intuition and judgment.

That’s why we’ve built tools to help you dig deeper into your search results. The Search Comparison tool in OpenSearch 2.11 is just the starting point – in 3.0, it lets you define search configurations and test sets of multiple queries and determine which queries’ results have changed the most… and then zoom in to the individual cases. You can integrate data on judgments and query frequency from User Behavior Insights for deeper analysis.

In this talk, we’ll discuss how traditional statistical metrics are complemented by eyeballing, how the new tools in OpenSearch 3.0 support disciplined eyeballing, and how you can use them to improve the quality of your search results.

In this technical session, I'll demonstrate practical implementations of OpenSearch Security Analytics powered by community-driven detection rules. Through hands-on examples, you'll learn:

1. Configuring Security Analytics dashboards for threat detection
2. Building and sharing custom detection rules that benefit the community
3. Testing and validating community-contributed security rules
4. Contributing your validated rules back to OpenSearch

The demonstrations will cover security rule syntax, detection logic, and dashboard configuration. You'll learn both the technical implementation and the collaborative workflow for sharing security rules with the community. We'll explore how shared security patterns strengthen the entire OpenSearch ecosystem, turning individual security insights into community-wide protection.

Target Audience: Security practitioners and OpenSearch operators with basic security monitoring knowledge.

Search engines guide users from their initial goals to the information that fulfills those goals. The retrieved items are deemed relevant when they align with the user's intent. Ensuring relevant results involves having the data in the catalog, analyzing it accurately, representing it through text and vectors, ranking it appropriately, and performing other actions.
In this session, discover how auction houses utilize vector search, powered by Amazon OpenSearch Service, to find similar items within their extensive database, enhancing the customer experience and preventing issues with counterfeit artworks, and see how it assists users in obtaining the most relevant results.
This session also uncovers some peculiarities in getting embeddings with AWS Bedrock and AWS SageMaker serverless inference for the abovementioned goals.

Dive deep into OpenSearch workload management and optimize your cluster's performance and resource allocation. This talk is suitable for both seasoned users and newcomers to OpenSearch.

We'll cover workload management fundamentals, exploring core concepts and principles specific to OpenSearch environments. You'll discover the benefits through real-world scenarios. We'll also guide you through implementation strategies, offering best practices and helping you avoid common pitfalls.

Gain insights into the various resource types supported by OpenSearch's workload management feature, enabling informed allocation decisions. We'll update you on current capabilities and provide a glimpse into the exciting future roadmap of this feature.

By attending, you'll gain actionable insights for immediate application, learn to address common OpenSearch challenges. This talk is ideal for OpenSearch administrators, DevOps professionals with large-scale search and analytics, IT decision-makers, and open-source enthusiasts.

Join us to master WLM in OpenSearch. Enhance your skills, optimize your clusters, and become part of the vibrant OpenSearch community driving innovation in search technology.

Edge computing has gained significant importance since it handles data close to its source, enabling real-time processing and low-latency analytics. This presentation will provide ideas on how OpenSearch can be adapted for edge environments, focusing on practical strategies to address challenges such as resource constraints, data synchronization, and intermittent/low network connectivity and also insights from real-world use cases, discuss best practices for lightweight deployments, and showcase innovative techniques to optimize OpenSearch for edge scenarios like IoT, smart cities, and industrial automation

I would like to initiate collaborative discussions and engage attendees about real world challenges, potential solutions and innovation to OpenSearch in this regard and offline-first functionalities. I’ll present technical and operational challenges of using OpenSearch in edge environments and also actionable strategies to overcome these challenges, such as optimizing resource utilization, managing connectivity issues, and ensuring data consistency. This broadens OpenSearch's applicability across industries like IoT, manufacturing, retail, and healthcare

I'm breaking down key insights from our latest RFC that's shaping the future of core OpenSearch performance.
https://github.com/opensearch-project/OpenSearch/issues/16841

It touch on core fundemental issues that are essential to master to take the OpenSearch Core performance codebase to the next level.
In particular it surveys real live examples from OpenSearch and shows us patterns that are common in Operating systems Kernels and State of the art databases for reliable low latency high throughput performance.
The talk also provides background on core fundemental concepts for data plane engineering such as "Dynamic Memory Allocation", GC, GC tunning, Circular buffers, CPU branching, JIT, JMH profiling.

Geared towards developers looking to contribute to a new or existing OpenSearch or OpenSearch Dashboards plugin, this talk will explore the testing practices of the OpenSearch project in depth. We'll delve into the functional test repository and Cypress standards used for testing Dashboards plugins, providing insights into setting up robust and maintainable test suites. On the backend side, we'll cover unit, integration, and backward compatibility (BWC) testing strategies for OpenSearch plugins, ensuring stability and seamless upgrades. We'll also discuss the use of yamlRestTest for validating REST APIs and remote cluster testing to ensure seamless interoperability during development and release cycles. Finally, we'll examine the TestClusters framework from OpenSearch Core, showcasing how it simplifies testing in distributed environments. Whether you're a seasoned contributor or new to the ecosystem, this talk will equip you with the knowledge to implement effective testing in your plugins and contribute with confidence.

Imagine this: your systems are humming along smoothly when, without warning, an unseen adversary slips through the cracks. A small vulnerability leads to a large-scale security breach. Could it have been prevented? Absolutely—with the right tools and strategy.

In this session, I’ll embark on an interactive journey into how OpenSearch becomes the vigilant guardian of your infrastructure. Starting with real-world scenarios, we'll explore how to harness OpenSearch’s powerful features to detect anomalies, correlate logs, and respond to threats in real-time.

You’ll see how simple queries can expose hidden patterns, dashboards can visualize attack vectors, and machine learning models can predict threats before they occur. But it’s not just about the tools—we’ll dive into best practices for deploying OpenSearch in complex environments and ensuring it scales with your security needs.

Join me to learn how OpenSearch transforms security operations, turning chaos into clarity and ensuring you stay one step ahead of cyber threats.

This talk will dive deep into building a multi-region, highly scalable enterprise-grade logging platform on OpenSearch. The platform can scale to handle over 100 terabytes of log ingestion per day and store over a petabyte of log data. The speaker will discuss the key challenges encountered when building a logging solution at this scale, and share the solutions leveraging open-source components like OpenTelemetry agents for log ingestion and Data Prepper for aggregation, distillation, enrichment, and buffering. Attendees will learn best practices for constructing a comprehensive, resilient logging infrastructure on top of the OpenSearch ecosystem.