OpenSearch, re-architected for object storage economics and elastic compute.
SearchLake is built on the OpenSearch codebase, with the internals redesigned for large-scale security data, long-term retention, and elastic infrastructure.
100% OpenSearch & Elasticsearch API Compatible
Built by enhancing the OpenSearch codebase while redesigning its underlying architecture. SearchLake preserves OpenSearch and Elasticsearch API compatibility, allowing existing applications, integrations, dashboards, and workflows to move without being rewritten.
SearchLake separates compute from storage, allowing each to scale independently. Historical data can remain economically in object storage, while stateless query compute scales with actual workload rather than retained data volume.
Scale storage without adding compute nodes
Add query capacity only when demand requires it
Deploy ephemeral compute for investigations or peak workloads
Shut compute down when it is no longer needed
The result is a fundamentally different cost curve for large-scale retention.
Interactive Performance Directly on Object Storage
SearchLake combines a purpose-built query engine with an ultra-compressed storage format designed specifically for object-storage retrieval characteristics. The engine minimizes data movement and retrieves only the data required to execute each query, rather than treating object storage like a slower local disk.
The underlying format is approximately 40% smaller than gzip-compressed JSON, remains fully lossless, and can be converted back into either JSON or Lucene indexes.
The result: interactive investigation performance without requiring the full retained dataset to live on expensive local SSD.
Native Multi-Level Multi-Tenancy
Designed for security platforms and SaaS environments that need isolation and resource management across customers, organizations, and workloads.