CERN has expanded its OpenSearch estate across the organisation. The research centre now runs 139 clusters that store 1.4 petabytes of data.
The deployment spans 156 physical machines and supports observability, security monitoring, research search services, and newer machine learning work across the laboratory.
Sokratis Papadopoulos, OpenSearch Service Manager at CERN, outlined how the service evolved from a fragmented setup into a central platform used by multiple teams. Before 2016, users across CERN built their own Elasticsearch clusters for local projects. A central Elasticsearch service later emerged for the wider community. CERN then evaluated OpenDistro for Elasticsearch before moving to OpenSearch after the Elasticsearch project changed its licence.
The current platform sits inside one of the world's largest scientific computing environments. Activity linked to the Large Hadron Collider produces one petabyte of data per second before filtering. After filtering, around 10 gigabytes per second of events are stored and analysed.
That workload feeds into the Worldwide LHC Computing Grid, a global system that stores 1.5 exabytes of data and provides 1.4 million cores. It runs more than 2 million tasks a day, and transfer rates have exceeded 260 gigabytes per second.
Broad use
OpenSearch now supports a wide range of operational systems at CERN. Papadopoulos said observability is the main use case. Official logs are stored in OpenSearch through OpenTelemetry pipelines, including logs from deployed applications in OpenShift and Kubernetes environments, as well as logs used for data centre monitoring.
OpenSearch also plays a central role in monitoring the computing grid. It is used for file transfer logs, simulation jobs, and several monitoring systems. It also holds short-term and long-term accounting data, along with site network monitoring data.
One demanding use case involved displaying 20 years of aggregated data. Papadopoulos said InfluxDB could not handle that workload at CERN's scale, and OpenSearch replaced it for that task.
Use also extends to the major experiments connected to the Large Hadron Collider. Those teams store logs from control systems, software acquisition systems, and workload management systems in OpenSearch.
Security load
The security team is the platform's largest single user at CERN. Papadopoulos said it indexes 800 terabytes of data across many log types. That data supports deep packet inspection and analysis of traffic moving into and out of the CERN network. It also provides context when staff reconstruct events during security incident analysis.
The team is also preparing to test the Security Analytics plugin at CERN scale. The initial step will focus on Sigma rules already included in the plugin.
"We index 800 terabytes of data for them across all kinds of logs, assisting them to do deep packet inspection, analyzing anything that enters or leaves the CERN network, and providing context for reconstructing events during security incident analysis," said Sokratis Papadopoulos, OpenSearch Service Manager at CERN.
Search systems
CERN also relies on OpenSearch for public-facing and internal search services. Zenodo is one of the largest examples. The repository hosts 2 petabytes of raw data, has served 800 million downloads, and currently indexes 8 million records in OpenSearch.
INSPIRE is another major deployment. The scholarly information service for high-energy physics indexes 2 million records in OpenSearch and handles 6,000 requests per second. It has also processed 650,000 PDFs with the ingest-attachment plugin, according to Papadopoulos. The service uses the Analysis ICU plugin for text analysis and retrieval work.
Several other CERN search platforms also run on OpenSearch, including CDS for video, the Open Data repository, the CERN Document Server, and the CERN Library.
Another example comes from software development. CERN runs a large on-premise GitLab installation for code repositories. Papadopoulos said the GitLab team recently enabled advanced search with OpenSearch, improving query speed and system stability, with some searches dropping from minutes to milliseconds.
AI interest
Machine learning and AI projects are also starting to use the platform in new ways. Papadopoulos said users have mainly been experimenting with the built-in OpenSearch MCP server.
The Archie project uses OpenSearch as a tool for an agent rather than only as a dashboard for human operators. In that setup, staff can chat directly with monitoring data held in OpenSearch.
The ATLAS Search project indexes documentation sources in OpenSearch and builds a central knowledge base for the ATLAS experiment. Papadopoulos said the team runs hybrid searches and uses OpenSearch MCP as part of that work. Meanwhile, the ALICE experiment is building a new observability system on OpenSearch and storing detector control system logs and telemetry server logs there. He said that team is also exploring anomaly detection.
Platform changes
CERN is still changing how it runs the service underneath. Papadopoulos said the organisation uses OpenVox as a configuration system on AlmaLinux. It has also started a transition to Kubernetes through the OpenSearch Kubernetes Operator.
For storage, CERN uses Ceph-RBD volumes for cold data and a Ceph-based, S3-compatible backend for snapshots. Those choices reflect the need to run many clusters across a large internal estate rather than a single standard deployment.
The service also reflects a broader effort to standardise systems that had previously grown in a more localised way. That matters in a research environment where teams often build infrastructure around specific projects, experiments, or operational functions.
Open source role
CERN has also taken a more visible role in the OpenSearch project itself. Papadopoulos said the organisation joined the OpenSearch Software Foundation as an associate member. He said CERN wants to act as a reference point for non-profit organisations and others running OpenSearch in open-source environments.
He listed several technical contributions from CERN staff. In observability, he said CERN contributed metric support to the OpenSearch OpenTelemetry exporter. The organisation has also worked on Prometheus exporters and on Version 3 of the OpenSearch Kubernetes Operator. Papadopoulos highlighted node-label-based allocation awareness as one notable CERN contribution for high-availability deployments.
Those contributions show how CERN sees the software. OpenSearch is not just a back-end component there. It has become part of the operational fabric around scientific data, infrastructure monitoring, security operations, and access to research outputs.
That mix is unusual in scale and breadth. The same search and analytics platform now spans workloads from detector operations and computing grid accounting to digital libraries and security logs. In many organisations, those tasks would sit in separate systems managed by separate teams.
Papadopoulos also framed the software in the context of CERN's larger mission. The laboratory is known as the birthplace of the World Wide Web. It also operates one of the largest distributed computing estates in science. Against that backdrop, a common search and analytics layer has become part of how the institution handles both internal operations and external access to research information.
"OpenSearch plays an important role at CERN, supporting critical systems, and we are trying to capitalize on its full capabilities," said Papadopoulos.