Our Logging Stack Worked For Two Years. It Was Also Shipping Logs As Admin.
We turned a production OpenSearch stack into a reusable Ankra stack profile. The parameterisation exercise turned into an audit, and it found credentials that went nowhere, a security config that was never applied, and a retention policy pointed at every index in the cluster.