Daniel Dito — Solutions Engineer · Observability

Career History

DEPLOY

DELOITTE LLC · FEDERAL PRACTICE

Senior Solution Specialist

Embedded across multiple federal agencies over 7+ years — each engagement a distinct environment, stack, and mission team.

AUG 2018 → PRESENT

7+ YEARS

⌄

2024 DEPLOY Gave a healthcare client their first visibility into legacy HL7 SOAP protocols — Elastic Synthetics with Private Locations on Kubernetes, detecting failures before users hit them. OUTAGE IMPACT ↓FAILURES CAUGHT EARLY

2023–24 DEPLOY Designed and owned a production Observability platform from bare metal to running stack — RKE, custom Hitachi CSI driver, full ECK deployment. Gave 300+ agency engineers a single operational pane of glass. 30-40K EPS

2022–23 SCALE Scaled the federal Elasticsearch platform to 30+ nodes and 50TB+ — primary observability layer for 300+ engineers across a major agency. Faster queries meant faster incident resolution. QUERY PERF ↑

2022 INFO Unified logs and metrics across all cloud workloads under a single Elastic Agent Fleet deployment — eliminated fragmented tooling and gave the ops team one place to look. MTTD ↓

2021 MTTR Became primary incident-response SME for the agency — owned live RCA presentations to technical and leadership stakeholders during active outages. Consistent reduction in how long production stayed broken. MTTR ↓ · FEDERAL PLATFORM

2020–21 DEPLOY Enabled mission-critical app migration to cloud by pioneering containerized observability and dynamic storage classes at the client site — no disruption, no data loss, faster deployments after. DEPLOY TIME ↓

2019–20 INFO Kept 300+ engineers operational during an ELK migration by building a custom Kibana React plugin that bridged legacy dashboards — zero retraining required. Also shipped: Angular + TypeScript + D3.js + SAS NOC application for network operations.

2018–19 AUTOMATE Freed the team from manual patch cycles permanently — Ansible, PowerShell, and Bash automation across ~1,000 servers turned a 5-day process into 2 hours and near-eliminated human error in the process. 5d→2hERRORS NEAR-ZERO

Elastic Stack Kubernetes (RKE / ECK) Oracle Cloud Ansible Helm Docker React Angular TypeScript D3.js PowerShell Bash Prometheus Grafana

OPS

MARICOPA COUNTY SUPERIOR COURT · PHOENIX, AZ

Operations Lead, Court Administration

Led county-wide operations across 47 courts, 8 direct reports. Identified systemic inefficiency in juror summonsing, modeled it algebraically, and built a data-driven calculator to replace manual estimation — the first analytical tool of its kind at county scale.

MAR 2014 → JUL 2018

4 YEARS

Featured Project

When LLM access arrived, the question wasn't
"what can I ask it?" — it was "what can I make it run?"

SYSTEM ARCHITECTURE // ELASTIBOT v1

Elastibot

AUTONOMOUS ES ADMINISTRATION AGENT

PRIVATE · INTERNAL TOOL

CRITICAL PRODUCTION INCIDENT ✓ RESOLVED

symptom Cluster unresponsive — prod down

manual triage ~2 hrs. Elastibot was still new — not yet the first stop.

elastibot triage cluster_health → nodes_stats (heap 98%) → nodes_os_stats (swap active on 4 nodes)

root cause JVM heap swapping to disk — bootstrap.memory_lock not set

outcome < 4 min to diagnosis. ~2 hrs recovered. First-stop tool from that point forward.

When LLM API access arrived, the efficiency gain couldn't be ignored. The response wasn't a chatbot — it was an orchestrated agent. Issue comes in, an LLM triages and classifies it, generates a DAG execution plan, then runs it against a pseudo-MCP tool server of parameterized Elasticsearch APIs. Structured evidence out the other end: HTML summaries, indexed tables, CSV exports. Autonomous admin issue resolution, start to finish.

DAG EXECUTION PLANNER PSEUDO-MCP TOOL SERVER MODEL-AGNOSTIC GEMINI (CURRENT) NODE.JS ELASTICSEARCH APIS

›Provider-agnostic by design — built against an internal completions API that swaps models without touching the agent logic. Gemini today, whatever's best tomorrow.

›Domain depth is the prerequisite. A diagnostic agent for Elasticsearch only works if its builder knows Elasticsearch. The AI amplifies the expertise — it doesn't substitute for it.

A public, domain-agnostic analog is running below — type diagnose --demo to see the DAG planner in action. → github.com/drdito/elastibot

DEMO SURFACE // ELASTIBOT ANALOG v0.1 // CLIENT-SIDE EXECUTION ▸ try diagnose --demo

elastibot $

Interactive demo is offline — clone the repo to run locally: github.com/drdito/elastibot

  ─────────────────────────────────────────────────────────────
  ⚡ ELASTIBOT   Autonomous Elasticsearch Administration Harness

  ┌─ Phase 1 ─── Planning ──────────────────────────────────────────
  │  Priority: HIGH
  │  Hypothesis: Two of three data nodes have breached the 90%
  │              high-watermark threshold, causing replica shard
  │              allocation to fail and turning the cluster yellow.
  │
  │  Step 1  cluster_health    Assess overall cluster status
  │  Step 2  cat_allocation    Inspect per-node disk utilization
  │  Step 3  cat_indices       Survey all indices
  │  Step 4  cat_shards        Confirm unassigned shard reasons
  │  Step 5  ilm_summary       Review ILM rollover policy
  └──────────────────────────────────────────────────────────────────

  ┌─ Phase 2 ─── Executing ─────────────────────────────────────────
  ⚙  cluster_health  {"level":"cluster"}
  └  {"status":"yellow","unassigned_shards":12,"active_shards":245…}

  ⚙  cat_allocation
  └  [{"node":"data-node-1","disk.percent":"91"},{"node":"data-node-2"…}

  ⚙  cat_shards  {"state":"UNASSIGNED"}
  └  [{"index":"logs-app-2024.05.17","unassigned_details":"HIGH_DISK…}

  ┌─ Phase 3 ─── Analysis ──────────────────────────────────────────
  ## Summary
  The cluster is yellow due to replica allocation failures. data-node-1
  is at 91% disk — above the 90% high-watermark. 12 replica shards
  cannot be assigned. Data is intact; reads are operational.

  ## Risk Assessment
  HIGH — data-node-1 is at flood-stage threshold. Without intervention,
  all indices will become read-only within hours.

  ✔  Diagnosis complete.

Interactive demo requires JavaScript. Clone the repo to run locally: github.com/drdito/elastibot

Full source: github.com/drdito/elastibot

Field Notes

Long-form writing on observability engineering, AI agent architecture, and building technical systems in federal environments. The kind of writing that exists because most documentation stops at the happy path — and production never does.

→ VIEW ALL POSTS

MAY 2026

KUBERNETES · OBSERVABILITY

Before the First Log Line

The ticket said "Deploy ECK." I didn't touch Elasticsearch for three weeks. What getting observability into production actually requires — and why the T-shape matters more than the stack.

→

MAY 2026

AI / AGENTS

Narrow Tools, Deep Expertise

The limiting factor in AI agents isn't the model. It's whether you know enough to build the right tools. What building Elastibot taught me about composition and expertise.

→

02 /—— More field notes in progress.

Career History

Featured Project

Technical Arsenal

Access Credentials

Field Notes