talk-data.com talk-data.com

Event

Elastic Filebeat and Agent & Zalando and their Elasticsearch Battle History

2025-11-12 – 2025-11-12 Meetup Visit website ↗

Activities tracked

2

Meet us for talks at Zalando on November 12, 2025!

Doors open at 18.00 with pizza, refreshments, and networking to follow. We wrap up at 20.30.

Please make sure you sign up with your full name.

📅Date and Time: Wednesday, November 12, from 6:00-8:30 PM

📍Location: Zalando Office BHW Berlin Hedwig-Wachenheimstraße 7 (BHW) The main entrance is on the west-side of the building (towards Uber Arena). Participants should register at the Helpdesk, and will be picked up from there.

📝 Agenda:

  • 18:00 - Doors Open Please have your real name in your profile description because the security team will check if you're registered when you arrive.
  • 18:30 - Talk #1 - The Performance Paradox: When Slower Code Doesn't Slow You Down Anderson Queiroz - Senior Software Engineer at Elastic Abstract: We added on-the-fly gzip decompression to Elastic Filebeat and the Elastic Agent—our log collection tools—to enable the ingestion of gzip archives and rotated logs. A performance drop was expected, so we benchmarked the feature only to find that the performance didn't drop at all. This talk is the story of our hunt for a non-existent bottleneck and how a holistic view of application performance uncovered the surprising truth about where the real costs lie.
  • 19:00 - Talk #2 We Hacked Ourselves So You Don't Have To: An Elasticsearch Battle Story Maryna Kryvko, Senior Software Engineer at Zalando Ivan Potapov, Research Engineer at Zalando Abstract: This talk examines the October 2024 Zalando outage, which resulted in severe revenue impact. The incident was triggered by an automated security scan that uncovered an unprotected GraphQL endpoint. This led to an unexpected amplification of requests, causing computationally expensive queries against the service in front of the search indices and ultimately overloading the Elasticsearch clusters. The prolonged impact highlighted difficulties in pinpointing the root cause of high load in Elasticsearch, and proved that even though a perfect storm is by definition a rare occurrence, it still should never be discarded. Sometimes, when you hear the hoofbeats, they are zebras after all.
  • 19:30 - Pizza, drinks and networking
  • 20:30 - Wrap up

Invite your friends and join our meetup. Special thanks to our hosts Zalando.

Want to speak at our next meetup? Submit your talk on this link and we will get in touch with you as soon as possible.

Sessions & talks

Showing 1–2 of 2 · Newest first

Search within this event →

We Hacked Ourselves So You Don't Have To: An Elasticsearch Battle Story

2025-11-12
talk
Maryna Kryvko (Zalando) , Ivan Potapov (Zalando)
elasticsearch

This talk examines the October 2024 Zalando outage, which resulted in severe revenue impact. The incident was triggered by an automated security scan that uncovered an unprotected GraphQL endpoint. This led to an unexpected amplification of requests, causing computationally expensive queries against the service in front of the search indices and ultimately overloading the Elasticsearch clusters. The prolonged impact highlighted difficulties in pinpointing the root cause of high load in Elasticsearch, and proved that even though a perfect storm is by definition a rare occurrence, it still should never be discarded. Sometimes, when you hear the hoofbeats, they are zebras after all.

The Performance Paradox: When Slower Code Doesn't Slow You Down

2025-11-12
talk
Anderson Queiroz (Elastic)
ELK

Abstract: We added on-the-fly gzip decompression to Elastic Filebeat and the Elastic Agent—our log collection tools—to enable the ingestion of gzip archives and rotated logs. A performance drop was expected, so we benchmarked the feature only to find that the performance didn't drop at all. This talk is the story of our hunt for a non-existent bottleneck and how a holistic view of application performance uncovered the surprising truth about where the real costs lie.