{
    "componentChunkName": "component---src-templates-blog-post-js",
    "path": "/posts/scaling-data-analytics-at-sonos/",
    "result": {"data":{"sanityPost":{"id":"-a24f4f56-61a5-5bcf-886c-da75dfd0d052","slug":{"current":"scaling-data-analytics-at-sonos"},"title":"Scaling Data Analytics at Sonos","mainImage":{"altText":"Scaling Data Analytics at Sonos","asset":{"path":"images/znqtjj88/production/f2ccb0939c32c86b40c96fab0299ae0f4f4677bb-5433x3318.jpg","metadata":{"dimensions":{"width":5433,"height":3318,"aspectRatio":1.6374321880650995},"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAMABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAUDBAf/xAAfEAACAgIDAAMAAAAAAAAAAAABAgARAwQSEyEFUXH/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8AwPrcgEI9fkMIVsvFzX3LOr8xspqog4UBV17IdzP2gMceNXJssoomA3w6ms+MEuBXkIjOZ1NKxAhA/9k=","palette":{"dominant":{"background":"#3f3f3f"}}}}},"categories":[{"_id":"baa46497-c2bf-4eeb-bf51-bd08238af629","title":"Data Engineering"}],"publishedAt":"2026-09-18T17:38:00.000Z","noHeaderImage":null,"authors":[{"name":"Himanshu Ramchandani","_rawBio":[{"_key":"9ccfc21b9d4e","_type":"block","children":[{"_key":"1079fec50c1e","_type":"span","marks":[],"text":"Principal Data Engineer"}],"markDefs":[],"style":"normal"}]},{"name":"Abby O'Grady","_rawBio":[{"_key":"108bb5d09b20","_type":"block","children":[{"_key":"d0bdec6cef2c","_type":"span","marks":[],"text":"Senior Data Engineer"}],"markDefs":[],"style":"normal"}]}],"_rawBodyCopy":[{"_key":"b60c2a70b486","_type":"block","children":[{"_key":"00ea77d755da","_type":"span","marks":[],"text":"Rebuilding Sonos’ First Stop for Data Exploration"}],"markDefs":[],"style":"h2"},{"_key":"418e7cc90d05","_type":"block","children":[{"_key":"01fa3b459399","_type":"span","marks":[],"text":"Behind every seamless Sonos listening experience is a complex ecosystem of wireless speakers, mobile apps, cloud services, and third-party content providers that must work together flawlessly. Maintaining this reliability at scale requires a foundation that allows analysts and engineers to quickly search logs, explore Internet of Things (IoT) telemetry, and debug issues across millions of connected devices worldwide. This enables our engineering teams to catch and resolve issues before firmware updates reach users, and our customer care teams to resolve issues in the field more quickly. For more details on our data usage and privacy, you can visit "},{"_key":"e51b41d3e9d6","_type":"span","marks":["9e398bd674a7"],"text":"sonos.com/legal/privacy"},{"_key":"d0053ee35015","_type":"span","marks":[],"text":"."}],"markDefs":[{"_key":"9e398bd674a7","_type":"link","href":"https://www.sonos.com/en-us/legal/privacy"}],"style":"normal"},{"_key":"27ed6a005cd5","_type":"block","children":[{"_key":"cafdb1258b13","_type":"span","marks":[],"text":"At Sonos, data is the heart of how we understand our products and customer needs. Long before a feature reaches customers, it goes through multiple stages of internal validation, first with alpha builds tested by internal teams, then with our broader beta community. Engineers instrument new telemetry (player or app usage data) in collaboration with multiple Product and Data Teams. Then, new telemetry is shipped in a test build, which generates sample data from test environments to help engineers understand how a feature behaves in the real world."}],"markDefs":[],"style":"normal"},{"_key":"a199cf763ed2","_type":"block","children":[{"_key":"e6120450b52b","_type":"span","marks":[],"text":"For years, the Elasticsearch, Logstash, and Kibana (ELK) stack – a centralized logging and analytics platform – was the foundation of our real-time telemetry exploration at Sonos. It gave our engineers, data scientists, and customer care teams a fast and familiar way to search and visualize device telemetry across pre-production and production environments, and it was the right call for the volume of data we had at the time."}],"markDefs":[],"style":"normal"},{"_key":"561f45b369d0","_type":"block","children":[{"_key":"f2b9f45741af","_type":"span","marks":[],"text":"When Growth Outpaced Infrastructure"}],"markDefs":[],"style":"h3"},{"_key":"defc5fe23562","_type":"block","children":[{"_key":"f911d0cf008f","_type":"span","marks":[],"text":"As our data volume grew with our expanding customer base, the architecture we’d built around ELK became one of the most operationally expensive parts of our platform, both in terms of dollars, and engineering hours and effort. At our peak, we were ingesting approximately 6 TB of data per day in Elasticsearch, with that volume increasing roughly 10% year over year — a growth rate that made the cost and operational challenges of our existing stack increasingly difficult to absorb."}],"markDefs":[],"style":"normal"},{"_key":"94af6744275a","_type":"block","children":[{"_key":"de344551ca6d","_type":"span","marks":[],"text":"At the core of the scaling and efficiency problem was how our Logstash layer was built. Logstash is an open-source data processing pipeline that ingests, transforms, and ships data from various sources simultaneously. Logstash was deployed on Kubernetes (k8s) as one of our earliest k8s workloads, running across 78 pods spread across multiple pipelines, each responsible for a different data source and processing function. These pipelines shared infrastructure and operated as a tightly coupled pipeline, where a failure in one stage could create cascading pressure across others, and the root cause was rarely obvious from the surface. A system resource capacity alert on the consumer (Elasticsearch) side might actually originate from a backed-up pod in the processor (Logstash) layer. System logs from Kubernetes, while technically available, were not intuitive to parse in this context, and the system had grown complex enough that debugging required deep institutional knowledge that was not always available."}],"markDefs":[],"style":"normal"},{"_key":"3d11751c5b9f","_type":"block","children":[{"_key":"ab1b90b8c718","_type":"span","marks":[],"text":"When an incident hit, the first challenge was determining whether the issue was on the consumer side or the processor side; two separate systems that had to be debugged independently. Once the root cause was identified, resolving the issue often required DevOps involvement, as they provided us with platform support for Kubernetes. However, limited visibility into incoming data created a gap between infrastructure and data knowledge, leading to slower incident resolution."}],"markDefs":[],"style":"normal"},{"_key":"51f3848ce0ed","_type":"block","children":[{"_key":"36037d25ee92","_type":"span","marks":[],"text":"At the data volumes we were operating at when ELK was first deployed, running Elasticsearch without replicas was a reasonable cost decision, as the risk of index corruption didn’t justify the storage overhead. As our volume and reliance on the platform grew, that calculus inverted. When an index became corrupted or unhealthy, the data was simply gone, and the operational cost of that tradeoff compounded faster than we’d anticipated. Analysts & engineers would see gaps in their dashboards and analyses, and when backfilling was needed, reprocessing the data became a significant overhead. Over time, these incidents became a recurring pattern, and each one consumed roughly half a sprint's worth of on-call engineering time, along with teams not directly involved with data, like DevOps. DevOps involvement in data pipeline debugging was a symptom of a deeper architectural issue, not just a resourcing inefficiency."}],"markDefs":[],"style":"normal"},{"_key":"8d84a30a7ff7","_type":"block","children":[{"_key":"f012d512a822","_type":"span","marks":[],"text":"As these challenges compounded, it became clear that the combination of high-maintenance infrastructure, high operational cost, frequent incidents, and limited recovery options had pushed our ELK stack past the point where incremental fixes would be sufficient. We needed a new foundation."}],"markDefs":[],"style":"normal"},{"_key":"7d316d58460d","_type":"block","children":[{"_key":"52e4428cdc41","_type":"span","marks":[],"text":"Moving The Platform Closer to the Source"}],"markDefs":[],"style":"h3"},{"_key":"1f4010339497","_type":"block","children":[{"_key":"12e5157e34dd","_type":"span","marks":[],"text":"Our primary constraint was simple: we needed a platform that lived inside Amazon Web Services (AWS), where our source data already resided. "},{"_key":"a92975abc132","_type":"span","marks":["b8922eda1699"],"text":"AWS OpenSearch Service"},{"_key":"a76504e36844","_type":"span","marks":[],"text":" fit that constraint directly."}],"markDefs":[{"_key":"b8922eda1699","_type":"link","href":"https://aws.amazon.com/opensearch-service/"}],"style":"normal"},{"_key":"c84eec6ffb0d","_type":"block","children":[{"_key":"abe4f8b741bf","_type":"span","marks":[],"text":"Created by Amazon as a fork of Elasticsearch and Kibana, AWS OpenSearch Service offered a familiar interface for our engineers and analysts. OpenSearch Dashboards support Lucene Query Syntax for users familiar with Kibana, as well as "},{"_key":"bb6fa9a47dd4","_type":"span","marks":["6ea7d9a66e47"],"text":"Dashboards Query Language"},{"_key":"2bb60372cf35","_type":"span","marks":[],"text":" (DQL), offering simplified, autocomplete-assisted searching. We mitigated significantly the adoption risk across dozens of cross-functional users given the immediate familiarity of the tool."}],"markDefs":[{"_key":"6ea7d9a66e47","_type":"link","href":"https://docs.opensearch.org/latest/dashboards/dql/"}],"style":"normal"},{"_key":"fb65562c9b32","_type":"block","children":[{"_key":"a7ecf3f895a7","_type":"span","marks":[],"text":"Beyond familiarity, the AWS-native nature of the service addressed limitations our previous setup couldn't resolve. With our source data already living in AWS, we could now read directly from S3 using Lambda as our processor. In our previous setup, data had to travel across multiple AWS accounts to reach Logstash running on Kubernetes in a separate DevOps account, before being processed and shipped onward. That multi-hop journey added both cost and fragility. With AWS OpenSearch Service, Lambda reads directly from the source and ships to the OpenSearch domain in the same account."}],"markDefs":[],"style":"normal"},{"_key":"c8eed6449562","_type":"block","children":[{"_key":"2131f41472c7","_type":"span","marks":[],"text":"Using an AWS-native service meant we could easily manage the end-to-end pipeline via Infrastructure as Code (Terraform). Managing the pipeline infrastructure through Terraform also meant we could move faster, push fixes without DevOps dependencies, and control exactly what data we wanted to ingest and when. With Lambda as our processor, we gained the ability to enable or disable specific events without touching any underlying infrastructure, giving our team direct control over ingestion without major dependencies."}],"markDefs":[],"style":"normal"},{"_key":"f01a7d9e47d4","_type":"block","children":[{"_key":"c976ceac39e5","_type":"span","marks":[],"text":"Building the New Foundation"}],"markDefs":[],"style":"h3"},{"_key":"4f79342d0cdd","_type":"block","children":[{"_key":"45c2d63c2a1f","_type":"span","marks":[],"text":"We began with a proof of concept deployed directly through the AWS Console, working closely with AWS solutions architects to understand the right configuration for our scale, which instance types (virtual machine) to use, how to balance data across different storage tiers, and which ingestion approach made sense for each data source."}],"markDefs":[],"style":"normal"},{"_key":"ecd0a19ca217","_type":"block","children":[{"_key":"7fcad6650fa6","_type":"span","marks":[],"text":"One of the early decisions that shaped the architecture was how to handle processing of our incoming telemetry and logs. We initially considered OpenSearch Ingestion Service, but after evaluation, pivoted to using "},{"_key":"16d7bb7c2158","_type":"span","marks":["f3c6448b3219"],"text":"AWS Lambda"},{"_key":"9add4ad8d3f3","_type":"span","marks":[],"text":" and OpenSearch "},{"_key":"7c99f9cb89e8","_type":"span","marks":["9b4a099ca59a"],"text":"Ingest Processor"},{"_key":"cb33ab75b5b1","_type":"span","marks":[],"text":" pipelines, which provided more flexibility and better alignment with our existing processing logic."}],"markDefs":[{"_key":"f3c6448b3219","_type":"link","href":"https://aws.amazon.com/pm/lambda/"},{"_key":"9b4a099ca59a","_type":"link","href":"https://docs.opensearch.org/latest/ingest-pipelines/processors/index-processors/"}],"style":"normal"},{"_key":"71cf12e54b8f","_type":"block","children":[{"_key":"16964ea753e0","_type":"span","marks":[],"text":"The architecture eventually settled on a multi-source pipeline that directly ingests data from players, applications, and cloud services into OpenSearch. By using AWS Lambda to process and transmit data from Kinesis Data Streams (cloud services) and AWS S3 (player and app data), we were able to ship data straight to its destination. This approach avoided the creation of redundant copies by maintaining data at its origin."}],"markDefs":[],"style":"normal"},{"_key":"7ce465d478d2","_type":"block","children":[{"_key":"72668bfe647a","_type":"span","marks":[],"text":"Once we had confidence in the architecture, we moved to a phased rollout via Terraform. The MVP was rolled out with pre-release data, giving us a real environment to validate ingestion, search, and dashboard functionality before any users were impacted. Security compliance was built in from the start, with our Security team involved to ensure the deployment met Sonos standards and access to OpenSearch was secured within the Sonos VPN. We also worked with stakeholders to identify which dashboards and visualizations were highest-priority for migration, and leveraged a script to automate the transition."}],"markDefs":[],"style":"normal"},{"_key":"bee290484f6a","_type":"block","children":[{"_key":"44a84b463021","_type":"span","marks":[],"text":"For a few weeks, both platforms ran in parallel, giving users time to familiarize themselves with OpenSearch Dashboards before the older ELK stack was decommissioned. From the beginning, we took steps to ensure familiar usability, develop strong Infrastructure as Code, and migrate existing visualizations and API endpoints seamlessly, which ensured the transition was smooth enough that most users noticed very little disruption."}],"markDefs":[],"style":"normal"},{"_key":"62f60820c166","_type":"sonosImage","altText":"Figure 1 High-level architecture of the new system.","asset":{"_id":"image-05771cce9a23de05bb13b13150a924a92c009a94-3072x1479-jpg","_type":"sanity.imageAsset","_rev":"fsD9HtFkFKX3annIz3QYb4","_createdAt":"2026-09-22T18:19:47Z","_updatedAt":"2026-09-22T18:19:47Z","assetId":"05771cce9a23de05bb13b13150a924a92c009a94","extension":"jpg","metadata":{"_type":"sanity.imageMetadata","blurHash":"M4PZr%0Ko|^jx_-.D%RVnmti?]nhR6pJV=","dimensions":{"_type":"sanity.imageDimensions","aspectRatio":2.077079107505071,"height":1479,"width":3072},"hasAlpha":false,"isOpaque":true,"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAKABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAQBB//EAB8QAAEEAgIDAAAAAAAAAAAAAAEAAgMRBBIFMSEiYf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/xAAUEQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIRAxEAPwDtkMMzefyZHZszotBUFejfoKrxZJCxmhdI0k7Od4IVlDYmhaAV0gNNjpFoRB//2Q==","palette":{"_type":"sanity.imagePalette","darkMuted":{"_type":"sanity.imagePaletteSwatch","background":"#3f493e","foreground":"#fff","population":0.24,"title":"#fff"},"darkVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#14364e","foreground":"#fff","population":0.02,"title":"#fff"},"dominant":{"_type":"sanity.imagePaletteSwatch","background":"#ce641a","foreground":"#fff","population":0.42,"title":"#fff"},"lightMuted":{"_type":"sanity.imagePaletteSwatch","background":"#d4d1b8","foreground":"#000","population":0.04,"title":"#000"},"lightVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#b994e6","foreground":"#000","population":0.12,"title":"#fff"},"muted":{"_type":"sanity.imagePaletteSwatch","background":"#66a94d","foreground":"#fff","population":0.07,"title":"#fff"},"vibrant":{"_type":"sanity.imagePaletteSwatch","background":"#ce641a","foreground":"#fff","population":0.42,"title":"#fff"}}},"mimeType":"image/jpeg","originalFilename":"SDA-Fig-1.jpg","path":"images/znqtjj88/production/05771cce9a23de05bb13b13150a924a92c009a94-3072x1479.jpg","sha1hash":"05771cce9a23de05bb13b13150a924a92c009a94","size":405113,"uploadId":"dc9db7a0c5944913b131c1b3ec3468f99f2bbd7e","url":"https://cdn.sanity.io/images/znqtjj88/production/05771cce9a23de05bb13b13150a924a92c009a94-3072x1479.jpg","filename":"SDA-Fig-1.jpg","width":3072,"height":1479,"placeholderUrl":"https://cdn.sanity.io/images/znqtjj88/production/05771cce9a23de05bb13b13150a924a92c009a94-3072x1479.jpg?rect=1043,0,986,1479&w=%width%&h=%height%&q=80","id":"image-05771cce9a23de05bb13b13150a924a92c009a94-3072x1479-jpg","children":[],"parent":null},"caption":"Fig. 1: High-level architecture of the new system.","mediaOpacity":1},{"_key":"d723ec723aef","_type":"block","children":[{"_key":"ad58c8779808","_type":"span","marks":[],"text":"Handling Scaling Challenges: From Manual Tuning to Autonomous Management"}],"markDefs":[],"style":"h3"},{"_key":"bd60a589d21e","_type":"block","children":[{"_key":"ed1dcdc1a67d","_type":"span","marks":[],"text":"The ability to scale is especially important for our Product Data platforms - as we sell more products and add new telemetry, the amount of data we ingest is continuously growing. Another challenge that is perhaps unique to IoT data is the unpredictability and variability of individual events’ volume. Some events have a highly variable, high-frequency volume while others are more consistent or lower in volume. For instance, after a software release, we might see a 2-3x increase in volume for certain event types. It’s often hard to pinpoint the exact magnitude of these types of changes."}],"markDefs":[],"style":"normal"},{"_key":"5c581e920960","_type":"block","children":[{"_key":"13a61a89a188","_type":"span","marks":[],"text":"The 3 main components of data storage are "},{"_key":"0cc8eb7e4bd5","_type":"span","marks":["em"],"text":"indexes"},{"_key":"46abf5722cb8","_type":"span","marks":[],"text":", "},{"_key":"97ba9a282339","_type":"span","marks":["em"],"text":"shards"},{"_key":"99f56b377dfc","_type":"span","marks":[],"text":", and "},{"_key":"76dbe75eaf3b","_type":"span","marks":["em"],"text":"documents"},{"_key":"ca6d8ee036bb","_type":"span","marks":[],"text":". You can think of an index as a bookshelf, or a logical grouping of data. In Product Data's cluster, one event type is stored in one index. Each index contains shards, which can be thought of as books. Each shard has a limited capacity for data; if that shard becomes overwhelmed the book will burst at the seams. Finally, a "},{"_key":"8c5e1ca027d6","_type":"span","marks":["em"],"text":"document"},{"_key":"d71c82dceb79","_type":"span","marks":[],"text":" can be thought of as a single page in those books. It is the smallest unit of data; containing a singular data point."}],"markDefs":[],"style":"normal"},{"_key":"6d216619c988","_type":"block","children":[{"_key":"2dae5d95acbd","_type":"span","marks":[],"text":"Drawbacks of the ELK Index Management Approach"}],"markDefs":[],"style":"h4"},{"_key":"0a009b81b4ac","_type":"block","children":[{"_key":"616087971f47","_type":"span","marks":[],"text":"The difficult part about maintaining data in OpenSearch is that you need to be mindful of how many shards you provision in a single index. As mentioned earlier, individual events can vary greatly in data volume and it is hard to apply a one-size-fits-all method of assigning index size. We faced many challenges with our shard provisioning strategy within our ELK infrastructure. In the previous strategy, we created a new index each day for each individual event, ensuring every index only contained data from the current day. Furthermore, we used a configuration file that pre-defined the number of shards for each index based on the amount of data ingested per day; for example, a very high-volume event might have 25 shards, while a low-volume event might only have 1 shard."}],"markDefs":[],"style":"normal"},{"_key":"e783bfc68ce0","_type":"block","children":[{"_key":"dd54612d429c","_type":"span","marks":[],"text":"The drawbacks of this approach were centered on the inefficiency and brittleness of shard management. Spikes in event volume often led to under-provisioning, causing indexes to become overwhelmed, which in severe cases, led to entire cluster outages. In order to prevent these outages, we needed to delete the unhealthy indexes, which led to unwanted data loss. As a result, critical data points needed for debugging, analysis and product development were missing from the platform. This system was also inflexible to changes, requiring engineers to open a pull request and wait until the next day for a new index to be created before shard adjustments could take effect. Conversely, over-provisioning occurred when volume dropped, leading to wasted shards in a system with hard capacity limits."}],"markDefs":[],"style":"normal"},{"_key":"11dac5a5c57b","_type":"block","children":[{"_key":"32511d0e9cac","_type":"span","marks":[],"text":"Together, these challenges led to on-call engineers needing to constantly monitor the ELK cluster, checking for ‘unhealthy’ indexes, deleting any that risked being under-provisioned, and making updates to the shard configurations. It also led to important data being permanently unavailable for debugging and analysis in ELK, making it difficult for stakeholders to rely on the tool."}],"markDefs":[],"style":"normal"},{"_key":"31addaffcd82","_type":"block","children":[{"_key":"5c864978c620","_type":"span","marks":[],"text":"The Autonomous Solution"}],"markDefs":[],"style":"h4"},{"_key":"161649c34429","_type":"block","children":[{"_key":"1fd8e230cd99","_type":"span","marks":[],"text":"To address these challenges in OpenSearch, we leveraged "},{"_key":"4aa5bff565f4","_type":"span","marks":["strong"],"text":"Index State Management Policies"},{"_key":"d88cdd403369","_type":"span","marks":[],"text":", which make it possible to dynamically manage index settings and lifecycles. The system operates by maintaining a single "},{"_key":"cd16fcd9db01","_type":"span","marks":["em"],"text":"write index"},{"_key":"f29d22adc911","_type":"span","marks":[],"text":" per event type, initially provisioned with one shard. Once that index reaches the recommended 50 GB limit, it is automatically rolled over to a new write index while both remain queryable under the same alias. Furthermore, any index older than two weeks is moved to the lower-cost ultrawarm storage tier to optimize costs, and eventually deleted once it reaches four weeks of age."}],"markDefs":[],"style":"normal"},{"_key":"3bcb7bad4075","_type":"block","children":[{"_key":"ab3b40ae2fbc","_type":"span","marks":[],"text":"The benefits of this new strategy include the elimination of over-provisioning or under-provisioning, as every index is provisioned with a single shard that never exceeds the recommended amount of data. Furthermore, the process is completely autonomous, requiring no manual intervention or updating of configurations. This shift also delivers cost and storage efficiency, as older data is moved to lower-cost storage tiers and eventually deleted after four weeks, preventing the buildup of unnecessary data."}],"markDefs":[],"style":"normal"},{"_key":"b6a59141c14d","_type":"block","children":[{"_key":"3a9db556a31e","_type":"span","marks":[],"text":"By moving towards a more autonomous strategy that allows for auto-scaling across indexes, we no longer need to manually intervene to ensure cluster health and storage optimization of our OpenSearch cluster, and data loss is no longer a concern. Ultimately, this shift means on-call engineers are now completely relieved from the burden of manual index maintenance, allowing them to focus on higher-value platform improvements."}],"markDefs":[],"style":"normal"},{"_key":"90ec4a5bd050","_type":"sonosImage","altText":"Figure 2 Current OpenSearch Index State Management Policy","asset":{"_id":"image-41c1ba586e136c5325993f2577d90923424c913a-3072x2619-jpg","_type":"sanity.imageAsset","_rev":"DUvTSWcXlZsYBNyxAoFtLf","_createdAt":"2026-09-22T18:19:47Z","_updatedAt":"2026-09-22T18:19:47Z","assetId":"41c1ba586e136c5325993f2577d90923424c913a","extension":"jpg","metadata":{"_type":"sanity.imageMetadata","blurHash":"e3Ps#Ct7%M_3_3?bt7j[RjWB-;t7WBWBM{%MM{oft7xu~qayIUj[IU","dimensions":{"_type":"sanity.imageDimensions","aspectRatio":1.172966781214204,"height":2619,"width":3072},"hasAlpha":false,"isOpaque":true,"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAARABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAMBB//EAB8QAAICAgIDAQAAAAAAAAAAAAABAhEDEiExEyJBUf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/xAAUEQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIRAxEAPwDv0t/L6NUG8yTpJks0Mjzpxi6/bKuOanUlfzgCsb1W3YEbUeewBoQAAAAf/9k=","palette":{"_type":"sanity.imagePalette","darkMuted":{"_type":"sanity.imagePaletteSwatch","background":"#666666","foreground":"#fff","population":0.68,"title":"#fff"},"darkVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#424242","foreground":"#fff","population":0,"title":"#fff"},"dominant":{"_type":"sanity.imagePaletteSwatch","background":"#666666","foreground":"#fff","population":0.68,"title":"#fff"},"lightMuted":{"_type":"sanity.imagePaletteSwatch","background":"#bcbcbc","foreground":"#000","population":0.64,"title":"#fff"},"lightVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#bcbcbc","foreground":"#000","population":0,"title":"#fff"},"muted":{"_type":"sanity.imagePaletteSwatch","background":"#7c7c7c","foreground":"#fff","population":0.19,"title":"#fff"},"vibrant":{"_type":"sanity.imagePaletteSwatch","background":"#7f7f7f","foreground":"#fff","population":0,"title":"#fff"}}},"mimeType":"image/jpeg","originalFilename":"SDA-Fig-2.jpg","path":"images/znqtjj88/production/41c1ba586e136c5325993f2577d90923424c913a-3072x2619.jpg","sha1hash":"41c1ba586e136c5325993f2577d90923424c913a","size":638019,"uploadId":"5e3d88bc9df37ead89e3d460c0014ae91d947b1c","url":"https://cdn.sanity.io/images/znqtjj88/production/41c1ba586e136c5325993f2577d90923424c913a-3072x2619.jpg","filename":"SDA-Fig-2.jpg","width":3072,"height":2619,"placeholderUrl":"https://cdn.sanity.io/images/znqtjj88/production/41c1ba586e136c5325993f2577d90923424c913a-3072x2619.jpg?rect=663,0,1746,2619&w=%width%&h=%height%&q=80","id":"image-41c1ba586e136c5325993f2577d90923424c913a-3072x2619-jpg","children":[],"parent":null},"caption":"Fig. 2: Current OpenSearch Index State Management (ISM) Policy implementation – Indexes before and after a rollover action.","mediaOpacity":1},{"_key":"e8bfa166813a","_type":"block","children":[{"_key":"a62984c299c5","_type":"span","marks":[],"text":"How We Achieved 60%+ Cost Reduction"}],"markDefs":[],"style":"h3"},{"_key":"ea976ab1a4f7","_type":"block","children":[{"_key":"ebae4373e9d9","_type":"span","marks":[],"text":"Reducing operational cost was one of the primary drivers behind this migration, but getting there required more than just swapping one platform for another. It took a combination of architectural changes, smarter data management, and close collaboration with the teams who depended on the platform every day. The savings came from three areas: replacing our shipping layer (Logstash), smarter data ingestion, and moving to a managed infrastructure."}],"markDefs":[],"style":"normal"},{"_key":"c449a4ef9a96","_type":"block","children":[{"_key":"ebae4373e9d9","_type":"span","marks":[],"text":"The single biggest driver of savings was replacing our Kubernetes-hosted processor layer with AWS Lambda. In our previous setup, Logstash ran across 78 pods in a separate DevOps account, and every byte of data traveling between accounts carried a cross-account networking cost on top of the infrastructure cost of running and maintaining those pods. Lambda eliminated that entirely. It reads directly from the source, ships to the OpenSearch domain, and costs a fraction of what Kubernetes infrastructure requires to run and maintain."}],"markDefs":[],"style":"normal"},{"_key":"dac472bcda4d","_type":"block","children":[{"_key":"69a1bea43b61","_type":"span","marks":[],"text":"Furthermore, we re-evaluated the necessity of the data that we were ingesting. Rather than ingesting everything by default, we took a more deliberate approach. We started by conducting a survey across our user base to understand what data people actually need and how they use it. The patterns were clear:"}],"markDefs":[],"style":"normal"},{"_key":"90f8a0381317","_type":"block","children":[{"_key":"5d1cd590d30d","_type":"span","marks":["strong"],"text":"Pre-release data is the highest priority: "},{"_key":"5e7fb120abd4","_type":"span","marks":[],"text":"Most engineers only need access to the latest alpha or beta builds to validate changes and debug issues."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"7165e52a1b80","_type":"block","children":[{"_key":"b0a57fa8dc4e","_type":"span","marks":["strong"],"text":"Recent data over historical data: "},{"_key":"c12d91194cf3","_type":"span","marks":[],"text":"In cases where production data is needed, users typically query only a short window, seven to fourteen days, since longer-term trend analysis happens in other tools."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"2b0d8090d5f5","_type":"block","children":[{"_key":"d6ff025d03a6","_type":"span","marks":["strong"],"text":"Production data on demand:"},{"_key":"bb9caaba3aa1","_type":"span","marks":[],"text":" Enabling specific production data streams required nothing more than a configuration change to our allow list, keeping the process lightweight and fully within our team's control."}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"1f0ba9f3a594","_type":"block","children":[{"_key":"cc739f7a6e2f","_type":"span","marks":[],"text":"This gave us the confidence to make alpha and beta data the default, with production data available on request. The result was a significantly smaller data footprint (up to 99% reduction in volume for the majority of telemetry events) without any meaningful loss in utility for our users."}],"markDefs":[],"style":"normal"},{"_key":"79cc15d49e3b","_type":"block","children":[{"_key":"22f56418bd0b","_type":"span","marks":[],"text":"The final major lever toward achieving significant cost reductions was moving to a fully AWS-managed OpenSearch domain. This meant we no longer needed to provision, monitor, or scale EC2 instances manually. Cluster scaling, node replacement, and storage management are handled by the service itself, which freed our team from the operational overhead that had previously consumed roughly 1 week of engineering time per incident (with twelve or more incidents a year). That engineering time is now spent building and improving the platform rather than keeping it alive."}],"markDefs":[],"style":"normal"},{"_key":"0a4587da252a","_type":"block","children":[{"_key":"3cc0bc437c5b","_type":"span","marks":[],"text":"Together, these changes delivered a cost reduction of over 60% compared to our previous ELK stack."}],"markDefs":[],"style":"normal"},{"_key":"b3fd8c41b58b","_type":"sonosImage","altText":"Figure 3 ELK vs OpenSearch Infrastructure","asset":{"_id":"image-4e345ccd33ec84e8aade2f1f0546518eb82b0cb4-3072x2301-jpg","_type":"sanity.imageAsset","_rev":"5xmuNeLaPuWXR7Zt8TjTcQ","_createdAt":"2026-09-22T18:19:47Z","_updatedAt":"2026-09-22T18:19:47Z","assetId":"4e345ccd33ec84e8aade2f1f0546518eb82b0cb4","extension":"jpg","metadata":{"_type":"sanity.imageMetadata","blurHash":"V7PjGc%Ms:tQ~qt7ofofWBxu-;ofWBf6M{?bayjukBae","dimensions":{"_type":"sanity.imageDimensions","aspectRatio":1.3350717079530638,"height":2301,"width":3072},"hasAlpha":false,"isOpaque":true,"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAPABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAIBAwf/xAAdEAEAAwEAAgMAAAAAAAAAAAABAAIDEQQSIVFx/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhEDEQA/AN420ueRUIebZCvFPyW3xba+y/EbbNsHAefcBsVcqrCTQ5UIQP/Z","palette":{"_type":"sanity.imagePalette","darkMuted":{"_type":"sanity.imagePaletteSwatch","background":"#545454","foreground":"#fff","population":0.61,"title":"#fff"},"darkVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#285c3e","foreground":"#fff","population":0,"title":"#fff"},"dominant":{"_type":"sanity.imagePaletteSwatch","background":"#545454","foreground":"#fff","population":0.61,"title":"#fff"},"lightMuted":{"_type":"sanity.imagePaletteSwatch","background":"#a1cab4","foreground":"#000","population":0.01,"title":"#fff"},"lightVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#9cd4b4","foreground":"#000","population":0,"title":"#fff"},"muted":{"_type":"sanity.imagePaletteSwatch","background":"#6c8c74","foreground":"#fff","population":0,"title":"#fff"},"vibrant":{"_type":"sanity.imagePaletteSwatch","background":"#4db178","foreground":"#fff","population":0,"title":"#fff"}}},"mimeType":"image/jpeg","originalFilename":"SDA-Figure-1.jpg","path":"images/znqtjj88/production/4e345ccd33ec84e8aade2f1f0546518eb82b0cb4-3072x2301.jpg","sha1hash":"4e345ccd33ec84e8aade2f1f0546518eb82b0cb4","size":781508,"uploadId":"7b7b145ef94aae2e0891c6629ab1e6b84fb3c97b","url":"https://cdn.sanity.io/images/znqtjj88/production/4e345ccd33ec84e8aade2f1f0546518eb82b0cb4-3072x2301.jpg","filename":"SDA-Figure-1.jpg","width":3072,"height":2301,"placeholderUrl":"https://cdn.sanity.io/images/znqtjj88/production/4e345ccd33ec84e8aade2f1f0546518eb82b0cb4-3072x2301.jpg?rect=769,0,1534,2301&w=%width%&h=%height%&q=80","id":"image-4e345ccd33ec84e8aade2f1f0546518eb82b0cb4-3072x2301-jpg","children":[],"parent":null},"caption":"Fig. 3: ELK vs OpenSearch Infrastructure","mediaOpacity":1},{"_key":"c9bed4df60c9","_type":"block","children":[{"_key":"28833a333b46","_type":"span","marks":[],"text":"Knowing What's Happening: Observability at Every Layer"}],"markDefs":[],"style":"h3"},{"_key":"22b153bd55e4","_type":"block","children":[{"_key":"837f737c4452","_type":"span","marks":[],"text":"One of the hardest parts of operating our ELK stack was not knowing where to look when something went wrong. With OpenSearch, we rebuilt observability with a simple goal: any issue should be detectable, diagnosable, and resolvable by the on-call engineer without cross-team dependencies."}],"markDefs":[],"style":"normal"},{"_key":"73f343e7d8c4","_type":"block","children":[{"_key":"be5f6cf0f559","_type":"span","marks":[],"text":"Today our observability covers two layers, "},{"_key":"dc130440d130","_type":"span","marks":["em"],"text":"pipeline health "},{"_key":"1503a88023ca","_type":"span","marks":[],"text":"and"},{"_key":"fc9d38a7b127","_type":"span","marks":["em"],"text":" domain health"},{"_key":"a2035aa91e5a","_type":"span","marks":["strong"],"text":","},{"_key":"c7c6bb5b2878","_type":"span","marks":[],"text":" both surfaced through a centralized"},{"_key":"5ce4e7cd6861","_type":"span","marks":["strong"],"text":" "},{"_key":"f9ad9dd10264","_type":"span","marks":["em"],"text":"AWS CloudWatch"},{"_key":"c09778955608","_type":"span","marks":[],"text":" dashboard that also feeds our alerting layer."}],"markDefs":[],"style":"normal"},{"_key":"bdb5244fa3da","_type":"block","children":[{"_key":"0487ae028a9f","_type":"span","marks":[],"text":"Pipeline health tracks how data flows from source to OpenSearch. For each pipeline we monitor Lambda invocation counts, execution duration, success and failure rates, as well as error logs that surface ingestion failures, template mismatches, or shard issues."}],"markDefs":[],"style":"normal"},{"_key":"d2b296ae842b","_type":"block","children":[{"_key":"f7b03ca81aea","_type":"span","marks":[],"text":"When ingestion stalls or error rates cross a threshold, the on-call engineer is paged through PagerDuty. Relevant error logs and metrics are surfaced within the dashboard. Most issues are diagnosable and resolvable directly from the observability dashboard without escalation."}],"markDefs":[],"style":"normal"},{"_key":"c186843644c4","_type":"sonosImage","altText":"Figure 4 A 6-month look back on pipeline metrics for player data processing","asset":{"_id":"image-f7b0feb92a183e18dd63acaafbb9aaabc5436ff6-3072x1479-jpg","_type":"sanity.imageAsset","_rev":"fsD9HtFkFKX3annIz3QZLM","_createdAt":"2026-09-22T18:19:49Z","_updatedAt":"2026-09-22T18:19:49Z","assetId":"f7b0feb92a183e18dd63acaafbb9aaabc5436ff6","extension":"jpg","metadata":{"_type":"sanity.imageMetadata","blurHash":"M8SijYxHWA-;xu?bInjZfjj[~pX7WVWVR*","dimensions":{"_type":"sanity.imageDimensions","aspectRatio":2.077079107505071,"height":1479,"width":3072},"hasAlpha":false,"isOpaque":true,"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAKABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAMECP/EAB4QAAICAgIDAAAAAAAAAAAAAAABAgMRQQQhEhMx/8QAFQEBAQAAAAAAAAAAAAAAAAAAAAH/xAAUEQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIRAxEAPwDpvNisn28KWyysntGjYwgI8a33V+S+ZaBWKSXSAR//2Q==","palette":{"_type":"sanity.imagePalette","darkMuted":{"_type":"sanity.imagePaletteSwatch","background":"#548154","foreground":"#fff","population":0.01,"title":"#fff"},"darkVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#1f6520","foreground":"#fff","population":0,"title":"#fff"},"dominant":{"_type":"sanity.imagePaletteSwatch","background":"#2d912f","foreground":"#fff","population":0.42,"title":"#fff"},"lightMuted":{"_type":"sanity.imagePaletteSwatch","background":"#a8ccd0","foreground":"#000","population":0.22,"title":"#fff"},"lightVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#a6c9e0","foreground":"#000","population":0.16,"title":"#fff"},"muted":{"_type":"sanity.imagePaletteSwatch","background":"#778e9e","foreground":"#fff","population":0.11,"title":"#fff"},"vibrant":{"_type":"sanity.imagePaletteSwatch","background":"#2d912f","foreground":"#fff","population":0.42,"title":"#fff"}}},"mimeType":"image/jpeg","originalFilename":"SDA-Fig-4.jpg","path":"images/znqtjj88/production/f7b0feb92a183e18dd63acaafbb9aaabc5436ff6-3072x1479.jpg","sha1hash":"f7b0feb92a183e18dd63acaafbb9aaabc5436ff6","size":823056,"uploadId":"426a149aa1e2205dbe5a7028d13808eb2556a888","url":"https://cdn.sanity.io/images/znqtjj88/production/f7b0feb92a183e18dd63acaafbb9aaabc5436ff6-3072x1479.jpg","filename":"SDA-Fig-4.jpg","width":3072,"height":1479,"placeholderUrl":"https://cdn.sanity.io/images/znqtjj88/production/f7b0feb92a183e18dd63acaafbb9aaabc5436ff6-3072x1479.jpg?rect=1043,0,986,1479&w=%width%&h=%height%&q=80","id":"image-f7b0feb92a183e18dd63acaafbb9aaabc5436ff6-3072x1479-jpg","children":[],"parent":null},"caption":"Fig. 4: A 6-month look back on pipeline metrics for player data processing","mediaOpacity":1},{"_key":"a26624adad71","_type":"block","children":[{"_key":"fb61ef57259f","_type":"span","marks":[],"text":"Domain health gives us a real-time view of the OpenSearch cluster itself. We track:"}],"markDefs":[],"style":"normal"},{"_key":"4c38eef630c0","_type":"block","children":[{"_key":"49c9972b6db4","_type":"span","marks":[],"text":"Cluster status, active and unassigned shard counts"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"a7bed311c60b","_type":"block","children":[{"_key":"63f27fe33e48","_type":"span","marks":[],"text":"CPU utilization, free disk storage and searchable document counts"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"7a9d93551602","_type":"block","children":[{"_key":"008d2adf35f5","_type":"span","marks":[],"text":"Successful response codes across search and index requests"}],"level":1,"listItem":"bullet","markDefs":[],"style":"normal"},{"_key":"d67bcfd19f92","_type":"block","children":[{"_key":"417ecdb9d21d","_type":"span","marks":[],"text":"In addition, AWS OpenSearch exposes over 85 out-of-the-box "},{"_key":"18f9633f3b9d","_type":"span","marks":["f6e656b1b01b"],"text":"cluster metrics"},{"_key":"e7b6e9fb6d1d","_type":"span","marks":[],"text":" covering everything from indexing latency to UltraWarm node performance, giving us deep visibility at every layer of the stack."}],"markDefs":[{"_key":"f6e656b1b01b","_type":"link","href":"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.html"}],"style":"normal"},{"_key":"3889ee686b9e","_type":"sonosImage","altText":"Figure 5 A 6-month look back on our OpenSearch Domain metrics","asset":{"_id":"image-a9eef5888a5ae7cfe6b7b6f4b47ba19ede109938-3072x1479-jpg","_type":"sanity.imageAsset","_rev":"fsD9HtFkFKX3annIz3QZZF","_createdAt":"2026-09-22T18:19:49Z","_updatedAt":"2026-09-22T18:19:49Z","assetId":"a9eef5888a5ae7cfe6b7b6f4b47ba19ede109938","extension":"jpg","metadata":{"_type":"sanity.imageMetadata","blurHash":"M8Ss87xrogx]t7?cWYRiWAbH~DkDRjf9WB","dimensions":{"_type":"sanity.imageDimensions","aspectRatio":2.077079107505071,"height":1479,"width":3072},"hasAlpha":false,"isOpaque":true,"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAKABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMCBAj/xAAdEAACAgIDAQAAAAAAAAAAAAAAAQIRAxMhIjFR/8QAFAEBAAAAAAAAAAAAAAAAAAAAAf/EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oADAMBAAIRAxEAPwDTryThsfaVPhEtsnJqn5dlql8ClfgCF43Jx5bAYgEv/9k=","palette":{"_type":"sanity.imagePalette","darkMuted":{"_type":"sanity.imagePaletteSwatch","background":"#6a7971","foreground":"#fff","population":0.05,"title":"#fff"},"darkVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#30743c","foreground":"#fff","population":0.09,"title":"#fff"},"dominant":{"_type":"sanity.imagePaletteSwatch","background":"#56a187","foreground":"#fff","population":0.22,"title":"#fff"},"lightMuted":{"_type":"sanity.imagePaletteSwatch","background":"#a8cfce","foreground":"#000","population":0.12,"title":"#fff"},"lightVibrant":{"_type":"sanity.imagePaletteSwatch","background":"#e49c8c","foreground":"#000","population":0.01,"title":"#fff"},"muted":{"_type":"sanity.imagePaletteSwatch","background":"#56a187","foreground":"#fff","population":0.22,"title":"#fff"},"vibrant":{"_type":"sanity.imagePaletteSwatch","background":"#34af87","foreground":"#fff","population":0.03,"title":"#fff"}}},"mimeType":"image/jpeg","originalFilename":"SDA-Fig-5.jpg","path":"images/znqtjj88/production/a9eef5888a5ae7cfe6b7b6f4b47ba19ede109938-3072x1479.jpg","sha1hash":"a9eef5888a5ae7cfe6b7b6f4b47ba19ede109938","size":823915,"uploadId":"8e8591381c26be9720596a4baaa13ba852f5cebf","url":"https://cdn.sanity.io/images/znqtjj88/production/a9eef5888a5ae7cfe6b7b6f4b47ba19ede109938-3072x1479.jpg","filename":"SDA-Fig-5.jpg","width":3072,"height":1479,"placeholderUrl":"https://cdn.sanity.io/images/znqtjj88/production/a9eef5888a5ae7cfe6b7b6f4b47ba19ede109938-3072x1479.jpg?rect=1043,0,986,1479&w=%width%&h=%height%&q=80","id":"image-a9eef5888a5ae7cfe6b7b6f4b47ba19ede109938-3072x1479-jpg","children":[],"parent":null},"caption":"Fig. 5: A 6-month look back on our OpenSearch Domain metrics","mediaOpacity":1},{"_key":"9276a368295d","_type":"block","children":[{"_key":"a943b21b61a3","_type":"span","marks":[],"text":"The shift from reactive to proactive is perhaps the most meaningful operational change. Rather than waiting for a pipeline to stall or an index to become unhealthy, we now catch issues early and address them before they impact data availability."}],"markDefs":[],"style":"normal"},{"_key":"bde7bfdd1bdf","_type":"block","children":[{"_key":"b20e54d4031c","_type":"span","marks":[],"text":"Beyond the Migration"}],"markDefs":[],"style":"h3"},{"_key":"402d7e293498","_type":"block","children":[{"_key":"321963cc99d9","_type":"span","marks":[],"text":"Impact and Results"}],"markDefs":[],"style":"h4"},{"_key":"c3d82a7fb42e","_type":"block","children":[{"_key":"a4dbf3e8a296","_type":"span","marks":[],"text":"The migration to OpenSearch delivered more than just cost savings – it provided a platform our teams can actually rely on. Dozens of users access OpenSearch every day, running queries and searches across over 5 billion records, with use cases ranging from early-stage QA to customer-facing issue resolution."}],"markDefs":[],"style":"normal"},{"_key":"158e9afa01d5","_type":"block","children":[{"_key":"ee5b45153ee4","_type":"span","marks":[],"text":"The most immediate change was operational. Data loss, which had been an accepted cost of clusters running without replicas, is no longer a concern. Pipeline congestion, once a recurring source of incidents, has been wholly eliminated by the combination of Lambda-based ingestion and automated index management ("},{"_key":"ca918068012f","_type":"span","marks":["a0295afb4c5d"],"text":"ISM"},{"_key":"e2f23b72205c","_type":"span","marks":[],"text":"). Time-to-resolution for ingestion-related incidents has been reduced from hours to minutes. Since the transition, the platform has maintained exceptional stability, recording zero significant service disruptions or cluster downtime. Across engineering, data science, and product teams, OpenSearch has become the go-to tool for the debugging and validation for player, app and cloud telemetry. The feedback has been simple and consistent: it just works."}],"markDefs":[{"_key":"a0295afb4c5d","_type":"link","href":"https://docs.opensearch.org/latest/im-plugin/ism/index/"}],"style":"normal"},{"_key":"011ccbc1979d","_type":"block","children":[{"_key":"ea0da3ffd5c2","_type":"span","marks":[],"text":"Customer Care teams, who depend on real-time API access to query usage logs for customers to understand and diagnose system issues during support calls, made the transition without disruption. OpenSearch is central to the customer experience: without fast, reliable access to player and controller telemetry, resolving these issues would not be possible. Furthermore, OpenSearch’s near-real-time visualization capability is our foundation for quick troubleshooting, such as detecting music service partner outages. No other data exploration tool at Sonos offers the flexibility and speed that OpenSearch does in terms of visualization and search for our usage data. The importance of a stable and efficient platform cannot be overstated - diagnosing issues is faster and more intuitive than anything we had before."}],"markDefs":[],"style":"normal"},{"_key":"e07f917132a9","_type":"block","children":[{"_key":"bfd323ad16b5","_type":"span","marks":[],"text":"What We Would Do Differently"}],"markDefs":[],"style":"h4"},{"_key":"ac377b6e2b43","_type":"block","children":[{"_key":"7cc4580a76b7","_type":"span","marks":[],"text":"In hindsight, we held onto our ELK implementation past the point where incremental fixes were viable. The signals were there — recurring incidents, growing operational overhead, cross-team dependencies — but the switching cost of a full migration felt high enough that we kept patching. The lesson: establish clearer criteria upfront for when an architecture has been outgrown, so the migration decision is data-driven rather than crisis-driven."}],"markDefs":[],"style":"normal"},{"_key":"bb37174f180c","_type":"block","children":[{"_key":"47bdc4144b92","_type":"span","marks":[],"text":"The most important technical lesson for us is to build observability into the proof of concept, not as an afterthought once the system is live. Having visibility into pipeline health, ingestion rates, and cluster metrics from the earliest stages of testing would have helped us catch configuration issues earlier and given us more confidence going into production."}],"markDefs":[],"style":"normal"},{"_key":"32abd663efe8","_type":"block","children":[{"_key":"42fec2620866","_type":"span","marks":[],"text":"We would also invest earlier in a dedicated development environment with representative sampling data for load testing. Testing against production-like volumes has the potential to surface edge cases that smaller test datasets do not capture."}],"markDefs":[],"style":"normal"},{"_key":"3cad6175635b","_type":"block","children":[{"_key":"f2af17cdcc72","_type":"span","marks":[],"text":"Finally, our stakeholder review took place only after we released a working test version — bringing external stakeholders in earlier would have surfaced feedback sooner and reduced the number of issues discovered after the test release. A structured pre-launch review with a subset of power users, ahead of full rollout to end-users, is something we would make a formal part of any future migration."}],"markDefs":[],"style":"normal"},{"_key":"8ed90212187b","_type":"block","children":[{"_key":"1ebc9467ce94","_type":"span","marks":[],"text":"What Comes Next"}],"markDefs":[],"style":"h4"},{"_key":"d0f96ecab679","_type":"block","children":[{"_key":"4a78a76c62b1","_type":"span","marks":[],"text":"The platform continues to evolve as we strive for optimal cost and performance efficiency. We are evaluating "},{"_key":"f868b4244868","_type":"span","marks":["bec610b69628"],"text":"Reserved Instances"},{"_key":"870ecbbfc2b0","_type":"span","marks":[],"text":" to further reduce compute costs as usage patterns stabilize, and we are exploring dynamic cluster sizing to better align infrastructure with actual demand. The architecture has also found a second life – the Customer Care Development team at Sonos independently adopted our architecture and deployment framework as the foundation for their own OpenSearch implementation, a testament to the value of designing for reusability from the start. Being deeply integrated within the AWS ecosystem gives us a strong foundation to build on, and "},{"_key":"5217ac1ebe30","_type":"span","marks":["d2869cd3d58e"],"text":"Amazon OpenSearch Serverless"},{"_key":"1f76b351f59d","_type":"span","marks":[],"text":" is one area we are keeping a close eye on and open to exploring as the platform continues to mature."}],"markDefs":[{"_key":"bec610b69628","_type":"link","href":"https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ri.html"},{"_key":"d2869cd3d58e","_type":"link","href":"https://aws.amazon.com/opensearch-service/features/serverless/"}],"style":"normal"}]},"allCategoryMatchedPost":{"nodes":[{"id":"-b563eca1-33f5-5613-ab9b-edcb04190456","slug":{"current":"better-data-better-products-building-confidence-into-the-data-behind-every-sonos-experience"},"title":"Better Data, Better Products: Building Confidence into the Data Behind Every Sonos Experience","mainImage":{"altText":"Better Data, Better Products: Building Confidence into the Data Behind Every Sonos Experience","asset":{"path":"images/znqtjj88/production/e6c38316865378f860bfc383ee38b5db521da18b-5433x3318.jpg","metadata":{"dimensions":{"width":5433,"height":3318,"aspectRatio":1.6374321880650995},"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAMABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMFBAf/xAAgEAACAQQBBQAAAAAAAAAAAAAAAQIDBBESMRMhUVKR/8QAFwEAAwEAAAAAAAAAAAAAAAAAAQIDBf/EABYRAQEBAAAAAAAAAAAAAAAAAAABEf/aAAwDAQACEQMRAD8A7btH2X0YnkiVLaDq1HtPu88lCx26LzJyx5NqXVbGsBcJNrkBgf/Z","palette":{"dominant":{"background":"#d4ccfc"}}}}},"categories":[{"_id":"baa46497-c2bf-4eeb-bf51-bd08238af629","title":"Data Engineering"}],"publishedAt":"2026-03-28T02:50:00.000Z"},{"id":"-eeea6166-14a4-53cb-9403-2a9176d634ea","slug":{"current":"reproducing-on-device-data-accurately-for-private-by-design-voice-control"},"title":"Reproducing On-Device Data Accurately for Private-by-Design Voice Control","mainImage":{"altText":null,"asset":{"path":"images/znqtjj88/production/87105e334cbb0c83b019c207e1c4d5481f6c8a40-3622x2212.jpg","metadata":{"dimensions":{"width":3622,"height":2212,"aspectRatio":1.6374321880650995},"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAMABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAQCAwf/xAAfEAADAQACAQUAAAAAAAAAAAABAgMAETEFBBNBUWH/xAAVAQEBAAAAAAAAAAAAAAAAAAABBf/EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhEDEQA/AMhfx9lgtQA6t8L3l6RpMA0RlB+xnU8l6hI+2pULxx1k6WpQAUdmH6dcSleNNgOesZD/2Q==","palette":{"dominant":{"background":"#14345c"}}}}},"categories":[{"_id":"2a760cee-ab0b-432c-866e-eae71039e09d","title":"Machine Learning"},{"_id":"baa46497-c2bf-4eeb-bf51-bd08238af629","title":"Data Engineering"}],"publishedAt":"2023-04-26T13:40:20.236Z"},{"id":"-c884edc1-7150-5759-b861-66f02c77f631","slug":{"current":"feature-generating-framework"},"title":"Feature Generating Framework","mainImage":{"altText":null,"asset":{"path":"images/znqtjj88/production/e73a4aebf336efa83f9c8b09a17ffae5a1583e7b-3622x2212.jpg","metadata":{"dimensions":{"width":3622,"height":2212,"aspectRatio":1.6374321880650995},"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAMABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAUEBgf/xAAeEAACAgIDAQEAAAAAAAAAAAABAgARAwQFEiExYf/EABcBAAMBAAAAAAAAAAAAAAAAAAECAwX/xAAWEQEBAQAAAAAAAAAAAAAAAAAAEQH/2gAMAwEAAhEDEQA/ANbAtbBFGLeT5NNNetHuflyIm9mCAWPPyLeRytsZgctGZsxBYOO2GbUxtme3b2ETjKyqAPBUIsB//9k=","palette":{"dominant":{"background":"#bccca4"}}}}},"categories":[{"_id":"20b9cbd8-4962-471c-8b5f-6b396cf95c26","title":"Analytics"},{"_id":"baa46497-c2bf-4eeb-bf51-bd08238af629","title":"Data Engineering"}],"publishedAt":"2022-06-02T17:28:00.000Z"},{"id":"-2d5a4a71-3f16-5bfa-82ba-f920a95180be","slug":{"current":"automating-data-engineering-and-data-discovery"},"title":"Automating Data Engineering and Data Discovery at Sonos","mainImage":{"altText":null,"asset":{"path":"images/znqtjj88/production/532a11b7c8d43f9da74045a11e738af2d7f15860-3622x2212.jpg","metadata":{"dimensions":{"width":3622,"height":2212,"aspectRatio":1.6374321880650995},"lqip":"data:image/jpeg;base64,/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAMABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMFBAb/xAAjEAABBAIBAwUAAAAAAAAAAAABAgMEEQASBQYTISIxMkFR/8QAFwEAAwEAAAAAAAAAAAAAAAAAAQMEBv/EABkRAAMBAQEAAAAAAAAAAAAAAAECEQADof/aAAwDAQACEQMRAD8A6OIhUnWK01s6tQpQ9xlbqHhUcLGZGwdddHqN/A/lZIgTX4DxdjK1XVXWLcfdff7jy1LUVWSTebZk6HoIYo91MNyz4+jhmzkXC7I2KUg6geBWGOVqAcRv/9k=","palette":{"dominant":{"background":"#9c7cf4"}}}}},"categories":[{"_id":"baa46497-c2bf-4eeb-bf51-bd08238af629","title":"Data Engineering"}],"publishedAt":"2021-06-29T15:36:00.000Z"}]}},"pageContext":{"id":"-a24f4f56-61a5-5bcf-886c-da75dfd0d052","categories":["Data Engineering"]}},
    "staticQueryHashes": ["4145174575"],
    "manifestId": "177bed40-3d7e-4268-834f-f15a7c806a06-2026-09-21T17:34:51.000Z"}