Elastic
The company behind Elasticsearch — one engine under Search, Observability and Security, deployable self-managed (including air-gapped), on Elastic Cloud or Serverless, and open source again under AGPL. This hub is your complete intel file, with an honest guide to the cost of running it.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Four intel pages. One engine underneath.
The complete Elastic platform — every linked card is a full intel page, from the search engine itself to the SIEM and the managed cloud it all runs on.
Elastic Security
The SIEM your engineers may already be running.
SIEM plus an included endpoint agent on the engine holding your logs, deployable on-prem or air-gapped; a 2025 Gartner SIEM Visionary.
Elasticsearch
The search engine underneath everything else.
The search and analytics engine under the whole platform, and a vector database for RAG; open source again under AGPL since 2024.
Elastic Observability
Logs, metrics and traces on one store.
Logs, metrics, APM, tracing, synthetics and RUM on the cluster that holds your search and security data, priced by resource.
Elastic Cloud
Elastic, without running the cluster.
Hosted in 50+ regions with resource-based pricing and full control, or Serverless with consumption pricing and nothing to size.
Elastic AI Assistant
Platform & engineAcross Search, Observability and Security
AutoOps
Platform & engineCluster health and optimisation guidance
Elastic sells across 2 of the products TechBag carries in security. The Security guide shows how the category splits and which part is yours. →
Also sold in DevOps (2 products).
Why “one engine, one copy of the data” is the whole story
Search, observability and security tools each keep their own copy of your data, so the same log is stored three times and queried three ways. Elastic bet on one engine and one copy of the data— search, observability and security as three ways of querying the same Elasticsearch cluster, deployable wherever your mandate allows, and it has built the whole portfolio around that.
One engine, three solutions
Search, Observability and Security are three ways of querying one Elasticsearch cluster, not three data stores. That single copy is why the economics beat per-host tools.
Deployment nobody else matches
Self-managed including air-gapped, Cloud Hosted across 50+ regions, or Serverless. For a regulated Indian buyer barred from SaaS, often the only credible modern SIEM.
Open source, and back again
Elastic left open source in 2021 and returned in 2024 by adding AGPL. The upshot: the engine is open source today, the free tier is capable, and adoption needs no procurement.
Bottom-up adoption is the norm
Elastic usually arrives because a developer installed it. So the question is rarely whether to adopt it, but which tier you need and who runs it; TechBag scopes exactly that.
Running it well is real work
Operating Elasticsearch at scale (shards, lifecycle, capacity, upgrades) is real engineering work that Elastic Cloud absorbs. Weigh licence plus staff time against a managed bill.
Start with the cluster you already run — then decide deployment and tier before adding Observability or Security on the same data. (And price the operations — TechBag’s key value.)
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Gartner MQ for SIEM 2025
Named a Visionary — not a Leader. We say which.
AV-Comparatives 2026
100% malware protection, Business Security Test
NYSE: ESTC
$1.739B revenue, FY ended 30 April 2026
Open source again
AGPL added back for Elasticsearch and Kibana, 2024
50+ regions
Elastic Cloud Hosted footprint
Air-gapped capable
Self-managed deployment with no cloud dependency
Founder still building
Shay Banon returned to CTO in 2022
one engine
Search · Observability · Security
The company in six figures
See the platform, hear the pitch
Elastic Security Solutions Overview
The security platform, explained by Elastic.
Elastic Security: an agentic security operations platform
Where the security product is heading.
Elastic Security: End to End Incident Response
Detection through to response, end to end.
Where Elastic sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Elastic Across Its Platform
Each dot is an Elastic solution: competitive position vs category momentum.
SIEM + endpoint — on-prem or air-gapped capable.
Capability × Flexibility Map
Elastic against the search, observability and SIEM vendors it meets most — how deep each goes vs how freely and cheaply it deploys.
One engine for search, observability and security — and the deployment flexibility nobody else matches.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Elastic?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is the most pressing thing you need to solve?
2. What does your deployment have to look like?
3. Who will be using it day to day?
What is the ELK stack?
Elasticsearch, Logstash and Kibana — what each does, and why so many teams are already running it without a contract.
Read →Free tier vs paid — what you actually get
The free tier is capable, so the real question is which paid features you need. Understand this before buying.
Read →Elastic Security as a SIEM
Detection rules, MITRE coverage and an included endpoint agent — on the store your logs are already in.
Read →Self-managed, Cloud or Serverless?
Three deployment models with genuinely different economics — including the air-gapped option most SIEMs cannot offer.
Read →Observability on the same cluster
Why logs, metrics and traces on one store changes the arithmetic against per-host pricing.
Read →Elastic vs Splunk vs OpenSearch
The honest matrix — deployment flexibility and cost against Splunk's depth and the AWS fork.
Read →The acronym decoder
Every term on these pages, in one place- Elasticsearch
- The distributed search and analytics engine behind everything Elastic sells, now also a vector store for AI.
- The ELK stack
- Elasticsearch, Logstash and Kibana: the log-analytics combo many teams run before any commercial deal.
- Kibana
- The visualisation and management interface — dashboards, search, and the console for Security and Observability.
- Beats / Elastic Agent
- Lightweight data shippers; Elastic Agent is the unified one and also serves as the endpoint security agent.
- AGPL
- The open-source licence Elastic added back for Elasticsearch and Kibana in 2024, after leaving in 2021.
- OpenSearch
- The fork AWS created in 2021 when Elasticsearch left open source — Apache 2.0 licensed and still developed separately.
- Self-managed
- You run the cluster on your own infrastructure, including fully air-gapped. Satisfies data residency by definition.
- Elastic Cloud Hosted
- Elastic runs the cluster across 50+ regions, priced on provisioned resources, not per host or seat.
- Serverless
- Fully managed, no cluster to size; billed per GB ingested and retained, or compute units for Search.
- Subscription tiers
- Standard, Gold, Platinum and Enterprise: feature and support levels on top of any deployment.
- Shard strategy
- How indices are split across nodes; getting it wrong is the commonest cause of a slow cluster.
- Index lifecycle management
- The policy that rolls data from hot to warm to cold to frozen storage as it ages — the main lever on self-managed cost.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Find out what you already run
Find the clusters engineers have already stood up. The deal is usually about formalising what exists, not adopting something new.
Decide the deployment model first
Self-managed, Cloud Hosted and Serverless differ in economics and residency. Settle this first, since it constrains the tier choice.
Work out which tier you actually need
The free tier is capable. Map the specific features you need above it — and be honest about which are wants. This is where most of the negotiable money is.
Price your engineers' time honestly
Self-managed licences look cheap until you count shards, capacity and upgrades. Compare licence plus operations with a managed bill.
Plan index lifecycle before you ingest
Hot, warm, cold and frozen tiers drive cost at scale. Set the policy first; retrofitting a cluster holding a year of data hurts.
Get it quoted in INR with GST
Elastic bills in USD. TechBag scopes the tier and deployment, and quotes locally with GST-compliant invoicing and support.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Elastic Security | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need | Platinum or Enterprise for SIEM/endpoint |
| Elasticsearch | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based | Free under AGPL; paid tiers add support |
| Elastic Observability | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption | Hosted: resources; Serverless: ingest |
Free and open source under AGPL, with paid tiers above it — the cost that surprises is your engineers’ time, not the licence. TechBag scopes the tier you actually need AND prices your engineers’ time honestly (Elastic bills USD; GST added).
Five pitfalls that cost buyers quarters
Assuming free means free forever
The capable free tier hides that features you later need, such as authentication integrations, alerting depth or machine-learning jobs, sit in paid tiers. Map required features before go-live.
Underestimating what running it costs
Self-managed clusters need shard strategy, capacity planning, upgrades and lifecycle work. A licence-versus-managed-bill comparison that ignores your own engineers’ time is not a fair one.
Not setting index lifecycle up front
Hot, warm, cold and frozen tiers are the main storage-cost lever, and far easier to set before a cluster holds a year of data. Most large-deployment cost problems start here.
Confusing Elasticsearch with OpenSearch
AWS forked Elasticsearch in 2021 as OpenSearch; docs, clients and features now differ. Confirm which one your team deployed before buying support for the other.
Reading Visionary as Leader
Elastic Security is a Visionary in the 2025 Gartner MQ for SIEM, not a Leader, which says something about execution at enterprise scale. Read material that blurs this twice.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: vector search for AI retrieval compounds fastest — and it runs on the same Elasticsearch engine you already have.
Vector search and RAG
AI retrieval on Elasticsearch is the fastest-moving part of Elastic’s portfolio, a new and substantial use case.
What it means for you
Elasticsearch as the retrieval layer for AI apps: the same engine, a big new use case.
The return to open source
Adding AGPL back in 2024 reversed the 2021 relicensing.
What it means for you
Whatever the motivation, it changes how freely teams can adopt and redistribute the engine.
Agentic security operations
Elastic is building Security around AI-assisted investigation and response rather than ever more rules.
What it means for you
Elastic is steering Security toward AI-assisted investigation and response, like the SIEM market.
Serverless deployment
Serverless consumption pricing, with no cluster to size, targets the strongest argument against self-managing.
What it means for you
No cluster to size directly answers the operational-burden objection to self-managing.
Air-gapped demand in regulated India
RBI, SEBI and IRDAI expectations are sharpening, and more Indian buyers cannot use a cloud-only SIEM.
What it means for you
As RBI, SEBI and IRDAI tighten, more Indian buyers need SIEMs that can run air-gapped.
One store, three solutions
As data volumes grow, querying one copy three ways beats three products each holding their own.
What it means for you
As data grows, one copy queried three ways beats three products each keeping their own.
Questions buyers ask about Elastic
Ready to shortlist Elastic?
Open any of the four intel pages for the deep dive, or let a TechBag advisor build the case with you — deployment and tier scoping, an honest count of the operations cost, comparisons, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.