Elastic Filebeat and Agent & Zalando and their Elasticsearch Battle History

Meet us for talks at Zalando on November 12, 2025!

Doors open at 18.00 with pizza, refreshments, and networking to follow. We wrap up at 20.30.

Please make sure you sign up with your full name.

📅Date and Time:
Wednesday, November 12, from 6:00-8:30 PM

📍Location:
Zalando Office BHW
Berlin Hedwig-Wachenheimstraße 7 (BHW)
The main entrance is on the west-side of the building (towards Uber Arena). Participants should register at the Helpdesk, and will be picked up from there.

📝 Agenda:

• 18:00 - Doors Open
  Please have your real name in your profile description because the security team will check if you're registered when you arrive.
• 18:30 - Talk #1 - The Performance Paradox: When Slower Code Doesn't Slow You Down
  Anderson Queiroz - Senior Software Engineer at Elastic
  Abstract: We added on-the-fly gzip decompression to Elastic Filebeat and the Elastic Agent—our log collection tools—to enable the ingestion of gzip archives and rotated logs. A performance drop was expected, so we benchmarked the feature only to find that the performance didn't drop at all. This talk is the story of our hunt for a non-existent bottleneck and how a holistic view of application performance uncovered the surprising truth about where the real costs lie.
• 19:00 - Talk #2 We Hacked Ourselves So You Don't Have To: An Elasticsearch Battle Story
  Maryna Kryvko, Senior Software Engineer at Zalando
  Ivan Potapov, Research Engineer at Zalando
  Abstract: This talk examines the October 2024 Zalando outage, which resulted in severe revenue impact. The incident was triggered by an automated security scan that uncovered an unprotected GraphQL endpoint. This led to an unexpected amplification of requests, causing computationally expensive queries against the service in front of the search indices and ultimately overloading the Elasticsearch clusters. The prolonged impact highlighted difficulties in pinpointing the root cause of high load in Elasticsearch, and proved that even though a perfect storm is by definition a rare occurrence, it still should never be discarded. Sometimes, when you hear the hoofbeats, they are zebras after all.
• 19:30 - Pizza, drinks and networking
• 20:30 - Wrap up

Invite your friends and join our meetup. Special thanks to our hosts Zalando.

Want to speak at our next meetup? Submit your talk on this link and we will get in touch with you as soon as possible.