How Norway's Welfare System Moved 400GB of Daily Logs to Managed OpenSearch without a Service Interruption

Why It Matters

The seamless switch demonstrates how public‑sector organizations can modernize observability without service interruption, while reducing infrastructure costs. It also highlights the strategic value of managed OpenSearch for enterprises facing licensing or scalability challenges.

Key Takeaways

• NAV cut logging cluster from 40 to 15 nodes
• Dual‑write approach avoided data transfer and downtime
• Loki failed due to high‑cardinality query limits
• Aiven added managed Data Prepper after migration
• OpenSearch licensing aligned with NAV’s open‑source policy

Pulse Analysis

NAV’s migration reflects a growing trend among large public‑sector bodies to bring critical observability tools in‑house while leveraging managed cloud services. The agency’s internal platform, NAIS, already emphasized open‑source compliance, making Elasticsearch’s license shift a catalyst for change. By partnering with Aiven, NAV secured a fully managed OpenSearch environment that met its scale—40 TB of storage and 400 GB of daily logs—without the overhead of self‑hosting, aligning with its product‑team model and reducing operational complexity.

The technical hallmark of the project was the dual‑write strategy, which re‑routed log shippers to feed both Elasticsearch and OpenSearch in parallel. This eliminated any cut‑over window, ensuring developers retained instant access to logs for incident response. As the new cluster accumulated sufficient history, the legacy system was decommissioned, resulting in a 62.5% reduction in node count and lower storage footprints. The move also forced NAV to tighten log‑generation practices, improving data governance without imposing restrictive role‑based controls on the new platform.

Beyond NAV, the case offers lessons for enterprises evaluating observability stacks. It underscores the importance of vendor collaboration—Aiven’s rapid addition of a managed Data Prepper service resolved a last‑minute compatibility issue just days before the holiday season. Moreover, the candid discussion of the failed Loki experiment provides rare insight into real‑world scalability limits, reinforcing that high‑cardinality queries remain a challenge for newer log solutions. As OpenSearch matures with its Long‑Term Support program, stories like NAV’s will shape confidence in open‑source alternatives to proprietary logging services.