OpenSearch Mastery (Senior → Principal)

Operate

• Start from workload type: product search, log analytics, security analytics, or mixed.
• Treat mappings, analyzers, shards, retention, and cluster topology as architectural decisions.
• Separate relevance needs from ingest-heavy observability defaults.
• Optimize for predictable operations and recoverability, not demo queries.

Default Standards

• Important fields should have explicit mappings.
• Shard count is an operational budget.
• Relevance changes must be evaluated, not guessed.
• Retention and ILM/ISM must match business value.
• Search clusters and logging clusters should not be treated as identical by default.

References

• Mappings and analyzers: references/mappings-and-analyzers.md
• Query DSL, filters, and scoring: references/query-dsl-filters-and-scoring.md
• Shards, topology, and cluster layout: references/shards-topology-and-cluster-layout.md
• Ingestion, pipelines, and retention: references/ingestion-pipelines-and-retention.md
• Search relevance and analytics tradeoffs: references/search-relevance-and-analytics-tradeoffs.md
• Security, tenancy, and governance: references/security-tenancy-and-governance.md
• Reliability and operations: references/reliability-and-operations.md
• Incident runbooks: references/incident-runbooks.md