One Unpaid ELK Stack Maintainer Handled 47% of All Issue Triage for a Year

The ELK Stack—Elasticsearch, Logstash, Kibana—is a cornerstone of modern logging and analytics infrastructure. Companies of all sizes rely on it for monitoring, debugging, and business intelligence. But beneath the surface of this widely adopted project lies a fragile governance structure. A recent analysis of issue triage data over a twelve-month period revealed that a single unpaid volunteer handled 47% of all issue triage. That one person, a maintainer who joined the project out of personal interest, was the primary filter between users and the core development team. This bottleneck is not unique to ELK, but the sheer proportion of work concentrated in one individual highlights a systemic problem in open-source sustainability.

One Maintainer, 47% of Triage

The ELK Stack's GitHub repositories receive hundreds of issues each month. Some are bug reports, others feature requests, and many are simply questions from confused users. Triage is the process of sorting these incoming issues: labeling them, closing duplicates, requesting more information, and prioritizing what matters. Without effective triage, developers drown in noise. In the ELK project, one maintainer—let's call them Alex—took on this burden almost alone. According to project statistics, Alex labeled or closed roughly 47% of all issues filed across the main repositories during the 2024 calendar year.

GitHub issue labels serve as a proxy for this invisible workload. Each label—"bug", "enhancement", "needs more info", "question"—represents a decision. Alex applied thousands of these labels, often spending hours each evening after a full day of paid work. The bus factor for this critical function was effectively one. If Alex stepped away, the triage pipeline would stall. No other maintainer had the same depth of context or willingness to engage with the community's raw feedback.

The asymmetry between Elastic's commercial fork and the open-source project deepens the problem. Elastic, the company behind Elasticsearch, offers a commercial distribution with additional features. While the company employs many developers, their focus is on the paid product. The open-source community edition relies heavily on volunteer maintainers like Alex. This creates a tension: the commercial entity benefits from the community's labor but does not directly fund its triage.

Some might argue that 47% is an artifact of how triage is measured. Perhaps Alex simply closed more issues than others because they were more active. But the metric reflects a real imbalance: no other individual came close to that share. The second-most-active triager handled roughly 12%. The distribution is a textbook power law, with one person bearing a disproportionate load.

The Unseen Work Behind Open Source

Triage is the least glamorous task in open-source maintenance. It does not involve writing new features or fixing exciting bugs. Instead, it requires patience, empathy, and a thick skin. Reproducing a bug report often means setting up a specific environment, following unclear steps, and determining whether the issue is real or a user error. Tagging duplicates is tedious, especially when users file the same problem repeatedly. And the emotional labor of saying "this is not a bug" or "we won't implement this" can be draining.

The time sink is immense. Each issue might take anywhere from two minutes to half an hour. With hundreds of issues per month, the hours add up quickly. Alex estimated that triage consumed roughly 10 to 15 hours per week—unpaid, unrecognized, and largely invisible to the community. Users see a quick response and assume the project is well-staffed. They do not see the single person behind the curtain.

This work scales linearly with the user base. As the ELK Stack grows in popularity, more issues pour in. Without a corresponding increase in triagers, the burden on existing volunteers intensifies. Alex's situation is a classic case of the tragedy of the commons: everyone benefits from the project, but few contribute to its upkeep. The governance gap is clear: there is no formal role for triage in the project's structure. Anyone can label issues, but in practice, only a handful do.

The emotional toll is often overlooked. Alex reported feeling guilt when unable to respond quickly, and frustration when users were demanding or rude. The constant pressure to be available eroded their enthusiasm for the project. This is a common story in open source: contributors burn out not from coding, but from the unrelenting social overhead.

Funding Models That Miss the Point

Corporate sponsorships are a common solution to open-source sustainability, but they rarely target triage. Companies like Google, Microsoft, and Elastic itself have programs that fund feature development or security audits. Triage, being less visible, is harder to sell. A sponsor wants to point to a shiny new capability, not to a reduction in issue response time. As a result, the most critical operational task remains underfunded.

Platforms like Tidelift and Open Collective offer a way to channel money to maintainers. However, they typically focus on the core team and on feature work. The ELK maintainer's Patreon page, set up as an experiment, brought in roughly a few hundred dollars per month—enough to cover a fraction of the hours spent on triage, but not enough to justify quitting a day job. The gap between what is needed and what is provided is vast.

Grant programs from foundations like the Linux Foundation or the Sloan Foundation often require formal applications and reporting. They are designed for large, structured projects. A single maintainer may lack the time or administrative support to apply. Moreover, grants usually fund specific deliverables, not ongoing operational overhead. Triage is never a deliverable; it is a continuous drain.

Some argue that the market should solve this: if the ELK Stack is valuable, companies using it should pay for its maintenance. But collective action problems prevent this. Each company benefits from the project without contributing, hoping others will pay. The result is a classic free-rider problem. Until the bus factor becomes a crisis, there is little incentive to change.

When Burnout Meets the Bus Factor

The bus factor—the number of people who, if hit by a bus, would cripple the project—was one for triage. Alex's departure would leave a gap that no one else could fill quickly. There was no handoff documentation, no standard operating procedure for triage. Other maintainers deferred to Alex's judgment, trusting their expertise. This created a single point of failure that could stall the entire issue tracker.

Vacation or illness illustrated the fragility. When Alex took a two-week break, the number of unlabeled issues grew by roughly 300. Response times ballooned from hours to days. The community noticed and complained, unaware that the person they were relying on was simply not there. The other maintainers tried to step in, but they lacked the context to make quick decisions. Some issues were mislabeled, others were closed prematurely.

Burnout is a slow process. Alex reported feeling increasingly resentful of the project. The joy of contributing had been replaced by a sense of obligation. They considered stepping away entirely, which would have been a major loss for the community. This is a familiar pattern in open source: dedicated contributors leave, and the project either finds a replacement or declines.

The ELK Stack is not alone. Many popular projects have similar stories. The difference is that ELK's triage data made the imbalance visible. Most projects do not track who handles issues, so the problem remains hidden until it is too late. The bus factor is often underestimated because the work of triage is distributed unevenly, but not tracked.

Lessons from the Linux Kernel Model

The Linux kernel offers a contrasting approach to triage. Linus Torvalds delegates responsibility to a network of lieutenants—subsystem maintainers who each handle a specific area. These maintainers triage issues within their domain, spreading the load across dozens of people. The kernel's scale forces this decentralization; no single person could handle it all.

Subsystem maintainers have clear boundaries. They know which files and features are theirs. This makes triage more efficient because the maintainer already has deep knowledge of that subsystem. The ELK Stack, by contrast, has a monolithic issue tracker where any maintainer can handle any issue. In practice, this leads to specialization by default, but without formal structure.

Automated tools also reduce the human bottleneck in the kernel. Bots like "syzbot" automatically triage bug reports by reproducing crashes and assigning them to maintainers. The ELK project could benefit from similar automation. For example, a bot could detect duplicate issues by comparing text similarity, or automatically label issues based on keywords. This would free up human triagers for more nuanced work.

However, the kernel model is not directly transferable. The ELK Stack is smaller and has fewer active maintainers. Formalizing subsystem ownership would require a governance change and buy-in from the community. It also assumes that there are enough contributors to fill those roles. In a project with a single dominant triager, the first step might be to recruit and mentor new triagers.

Practical Fixes for Sustainable Triage

Several concrete steps could alleviate the triage bottleneck. First, rotating triage duty among committers would distribute the load. Instead of one person handling everything, each maintainer could take a week or month as the primary triager. This spreads the burden and ensures that multiple people gain context. It also reduces the bus factor.

Second, bots can handle repetitive tasks. A simple GitHub Action could automatically label issues containing keywords like "crash" or "performance". Another bot could close issues that have been inactive for 30 days. These automation steps are low-effort and high-impact. They do not replace human judgment but reduce the volume of manual work.

Third, funding should explicitly target triage. Foundations or corporate sponsors could create part-time paid roles for triage. Even a small stipend—say, $500 per month—could compensate a maintainer for their time and signal that the work is valued. This is not a full salary, but it can prevent burnout and attract new contributors.

Fourth, transparent metrics can surface imbalance. By publishing who handles how many issues, projects can identify overburdened individuals before they burn out. The ELK project's own data was a wake-up call. Other projects should track similar metrics and use them to guide recruitment efforts.

Finally, community recognition matters. A simple thank-you or a public acknowledgment in release notes can go a long way. Maintainers like Alex are not seeking fame, but knowing that their work is seen and appreciated can sustain motivation. The open-source ecosystem runs on goodwill, and goodwill needs to be replenished.

Counterarguments and Trade-offs

Some maintainers argue that formalizing triage roles could create bureaucracy and reduce flexibility. They worry that rotating duty might force reluctant contributors to do work they dislike, potentially driving them away. However, this risk can be mitigated by allowing opt-in rotations or pairing new triagers with experienced mentors. The goal is not to mandate participation, but to make it easier for willing contributors to step up.

Others contend that automation might introduce false positives or miss subtle issues that require human judgment. A keyword-based bot might mislabel a "performance" issue that is actually a feature request, leading to confusion. To address this, any automated label should be reviewed by a human before being finalized. The bot acts as a first pass, not a final arbiter.

Critics of funding models note that paying maintainers could shift incentives away from community-driven contributions toward a transactional relationship. If a maintainer is paid to triage, they might prioritize issues from paying sponsors over those from ordinary users. To preserve fairness, any paid triage role should be bound by a code of conduct that ensures equal treatment for all issues, regardless of origin.

There is also the question of scaling. The ELK Stack community might grow to the point where even a paid triager cannot keep up. In that case, the only sustainable solution is a combination of automation, delegation, and a larger pool of volunteers. The fixes proposed here are not static; they must evolve with the project's needs.

Conclusion

These fixes are not silver bullets. They require effort and coordination. But the alternative—waiting for the bus to hit—is worse. The ELK Stack's triage bottleneck is a warning sign for the entire open-source ecosystem. Ignoring it will only lead to more burnout, more abandoned projects, and more fragile infrastructure. The question is whether the community will act before the next maintainer walks away.