Alight Solutions Achieves 55 Percent Cost Reduction Through Strategic Migration to Amazon OpenSearch Service

Alight Solutions, a prominent global provider of cloud-based human capital technology and integrated benefits administration, has completed a comprehensive migration of its massive logging infrastructure from a self-managed Elastic Stack to Amazon OpenSearch Service. This strategic transition addresses the mounting operational pressures of managing over 1 billion log records per day and has resulted in a 55 percent reduction in monthly infrastructure and licensing costs. By offloading the maintenance of its containerized microservices architecture to a managed service, Alight has reclaimed approximately 2,000 engineering hours per year—equivalent to one full-time employee—allowing the firm to pivot its focus from infrastructure upkeep to high-value innovation in the employee experience sector.

The migration marks a significant milestone for Alight, which serves hundreds of enterprise customers and millions of individual users worldwide. The company’s flagship platform, Alight Worklife, generates an immense volume of data, particularly during peak "Annual Enrollment" periods when log ingestion rates can surge to 100,000 records per second. For years, the company relied on a self-managed deployment of Elasticsearch, Logstash, and Kibana (the Elastic Stack), which had been in production since 2018. However, as the platform scaled and Elasticsearch 7.x approached its end-of-support life cycle, the technical debt and operational overhead became unsustainable.

The Operational Crisis of Legacy Infrastructure

Prior to the migration, Alight’s logging environment was a sprawling ecosystem of 15 Elasticsearch nodes supported by 168 terabytes of Amazon Elastic Block Store (EBS) storage. While the system was functional, it required an Elastic Platinum subscription to access necessary enterprise features. The financial burden was substantial, with monthly expenditures exceeding $100,000 across production and non-production environments.

Beyond the financial cost, the human cost was even more restrictive. The engineering team was trapped in a cycle of manual maintenance, including security vulnerability patching, cluster resizing, and index management. These tasks frequently bled into holidays and weekends, creating a high-stress environment for the operations staff. Furthermore, the legacy architecture suffered from technical bottlenecks. Specifically, Logstash—a tool used for data processing and ingestion—frequently experienced "backpressure" issues, where the volume of incoming logs overwhelmed the system’s capacity to process them. This instability led to two major "Priority 1" (P1) incidents over a two-year period, resulting in significant data gaps and hindering the company’s ability to troubleshoot application issues in real-time.

"The operational burden of maintaining our self-managed infrastructure consumed our entire operational budget," noted the Alight technical team. "We reached a point where we were paying for advanced features through our licensing, but we had zero capacity to actually implement or use them because we were too busy just keeping the lights on."

Strategic Evaluation and the Move to Managed Services

As the end-of-life deadline for Elasticsearch 7.x loomed, Alight leadership evaluated several paths forward. The primary contenders included upgrading to the latest version of the Elastic Stack, moving to a third-party managed logging provider, or transitioning to Amazon OpenSearch Service.

The decision to choose Amazon OpenSearch Service was driven by five critical factors: total cost of ownership (TCO), operational simplicity, scalability, security, and the strength of the existing partnership with Amazon Web Services (AWS). OpenSearch Service offered a managed environment that automatically detects and replaces failed nodes, handles software updates, and scales with simple API calls. Crucially, as an AWS-native service, it integrated seamlessly with Alight’s existing security protocols and identity management systems.

The evaluation also highlighted the financial advantages of the OpenSearch model. Unlike the Elastic Platinum subscription, which carried a fixed and heavy licensing fee, OpenSearch is based on an open-source fork of Elasticsearch, eliminating separate licensing costs. This allowed Alight to move to a "pay-as-you-go" model where costs are tied directly to compute and storage utilization rather than per-user or per-feature licenses.

Engineering the New Architecture

Working in collaboration with AWS Enterprise Support and Technical Account Managers (TAMs), Alight designed a cloud-native log aggregation architecture. The new system utilizes a cross-account model to separate log production from log analysis, enhancing both security and organizational clarity.

The ingestion path was modernized to eliminate the vulnerabilities of the old Logstash setup. Alight implemented Amazon OpenSearch Ingestion (OSIS) and integrated it with AWS FireLens and Fluent Bit. For applications running on Amazon Elastic Container Service (ECS), logs are now captured via a FireLens sidecar and routed through OSIS pipelines. To prevent a recurrence of the P1 incidents caused by ingestion backpressure, Alight integrated Amazon Elastic File System (EFS) to provide persistent filesystem buffering for the Fluent Bit sidecar. This ensures that even during massive traffic spikes, logs are buffered securely on disk until the ingestion pipeline is ready to process them, virtually eliminating the risk of data loss.

The production cluster configuration was optimized for high-performance and cost-efficiency, utilizing AWS’s specialized instance types:

• Data Nodes: 18 im4gn.2xlarge.search instances, leveraging AWS Graviton2 processors for superior price-performance.
• Storage Tiers: A "Hot" tier providing 25 TB of high-speed storage and an "UltraWarm" tier providing 180 TB for aged data.
• Total Data Capacity: Support for over 100 TB of data including replicas, managing a logical data footprint of 80 TB.

Security was another pillar of the new design. User access is now governed through AWS IAM Identity Center, synchronized with Alight’s enterprise identity provider via SCIM (System for Cross-domain Identity Management). This allows engineers to use the same single sign-on (SSO) credentials for OpenSearch Dashboards that they use for the AWS Management Console, applying fine-grained access control to ensure that developers only see logs relevant to their specific applications.

A Seven-Month Migration Chronology

The transition began in February 2025 and was completed by August 2025. Alight adopted a phased approach to minimize risk to its flagship services.

1. Pilot Phase (February – March): The team built Terraform modules to automate the deployment of OpenSearch domains and OSIS pipelines. Two smaller, non-critical applications were migrated first to validate the architecture and refine the ingestion logic.
2. Parallel Running (April – June): For the flagship Alight Worklife application, the team implemented a "dual-write" strategy. Logs were sent to both the legacy Elasticsearch cluster and the new OpenSearch service simultaneously. This allowed for real-time performance comparisons and ensured that the new dashboards met the needs of the development teams.
3. Historical Data Transfer (July): Prior to the final cutover, Alight migrated the most recent 30 days of live data from the old system to the new one. Older logs were archived in Amazon S3, where they could be re-indexed into OpenSearch on demand if needed for long-term audits.
4. Final Cutover and Decommissioning (August): Once the performance of OpenSearch was proven to meet or exceed the legacy system, the final applications were switched over, and the process of decommissioning the expensive self-managed EC2 instances began.

Quantifiable Success and Future Implications

The results of the migration have exceeded Alight’s initial projections. The most immediate impact was the 55 percent reduction in monthly costs, a figure expected to rise to 65 percent once the final legacy clusters are fully decommissioned. This saving is particularly impressive given that Alight is now managing more applications on the new platform than it did on the old one.

Operationally, the "onboarding" time for new applications has plummeted. Previously, creating new indices and configuring the legacy stack took between 80 and 120 hours of manual labor per application. Using the new Terraform-based automation, this process now takes just 4 to 8 hours.

"The ability to reconfigure, resize, and upgrade OpenSearch domains with a few clicks and zero downtime is a game changer," said Mark Larson, Enterprise Architect at Alight. "Effective application logging is critical for analyzing system behaviors and performance tuning. Amazon OpenSearch Service provides us with that capability at scale, very cost-effectively."

The removal of the 2,000-hour annual maintenance burden has opened the door for "Phase 2" of Alight’s observability strategy. With the infrastructure now managed by AWS, Alight’s engineers are beginning to implement advanced features that were previously out of reach, such as:

• Anomaly Detection: Using machine learning to automatically identify unusual patterns in log data that could indicate a security threat or a pending system failure.
• AI-Powered Analytics: Leveraging OpenSearch’s integration with generative AI to allow developers to query log data using natural language.
• Enhanced Monitoring: Developing real-time alerts for business-level metrics, such as benefit enrollment success rates, rather than just technical system health.

In the broader context of the tech industry, Alight’s move mirrors a growing trend among enterprise-scale companies to move away from self-managed open-source tools toward managed cloud services. As data volumes continue to explode, the "undifferentiated heavy lifting" of server maintenance is increasingly seen as a liability rather than a core competency. For Alight Solutions, the migration was not just a technical upgrade; it was a financial and operational realignment that positions the company to better serve the millions of employees who depend on its platform for their healthcare and benefits needs.