Thanks! Glad you enjoyed it. The main thing that narrowed it down was thinking about the request path from the app server to Elasticsearch. That pointed us at

Thanks! Glad you enjoyed it. The main thing that narrowed it down was thinking about the request path from the app server to Elasticsearch. That pointed us at the load balancers (we tried a request directly from app -> Elasticsearch in production to verify they were the problem). You're right that HAProxy wasn't the first place we looked once we were there, though. If I remember right, we started by diffing `sysctl` output to see if Ubuntu had tweaked something between versions.