- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Elastic
The company behind Elasticsearch — one engine under Search, Observability and Security, deployable self-managed (including air-gapped), on Elastic Cloud or Serverless, and open source again under AGPL. This hub is your complete intel file, with an honest guide to the cost of running it.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Four intel pages. One engine underneath.
The complete Elastic platform — every linked card is a full intel page, from the search engine itself to the SIEM and the managed cloud it all runs on.
Elastic Security
The SIEM your engineers may already be running.
SIEM plus an included endpoint agent on the engine holding your logs, deployable on-prem or air-gapped; a 2025 Gartner SIEM Visionary.
Elasticsearch
The search engine underneath everything else.
The search and analytics engine under the whole platform, and a vector database for RAG; open source again under AGPL since 2024.
Elastic Observability
Logs, metrics and traces on one store.
Logs, metrics, APM, tracing, synthetics and RUM on the cluster that holds your search and security data, priced by resource.
Elastic Cloud
Elastic, without running the cluster.
Hosted in 50+ regions with resource-based pricing and full control, or Serverless with consumption pricing and nothing to size.
Elastic AI Assistant
Platform & engineAcross Search, Observability and Security
AutoOps
Platform & engineCluster health and optimisation guidance
Elastic sells across 2 of the products TechBag carries in security. The Security guide shows how the category splits and which part is yours. →
Also sold in DevOps (2 products).
Why “one engine, one copy of the data” is the whole story
Search, observability and security tools each keep their own copy of your data, so the same log is stored three times and queried three ways. Elastic bet on one engine and one copy of the data— search, observability and security as three ways of querying the same Elasticsearch cluster, deployable wherever your mandate allows, and it has built the whole portfolio around that.
One engine, three solutions
Search, Observability and Security are not three products with three data stores — they are three ways of querying one Elasticsearch cluster. A log your observability team ingested is the same document your security team writes a detection against. That is the architectural argument, and it is why the platform's economics differ from tools priced per host or per seat.
Deployment nobody else matches
Self-managed anywhere including fully air-gapped, Elastic Cloud Hosted across 50+ regions with resource-based pricing, or Elastic Cloud Serverless with consumption pricing and no cluster to size. For a regulated Indian buyer whose mandate rules out SaaS, this is frequently the only credible modern SIEM on the shortlist.
Open source, and back again
Elastic moved Elasticsearch away from open source in 2021 and then moved back, adding AGPL as an option in 2024 — a reversal almost no vendor makes. Whatever you think of the round trip, the practical effect is that the engine is open source today, the free tier is genuinely capable, and adoption does not require procurement.
Bottom-up adoption is the norm
Elastic products usually arrive in an organisation because a developer installed one, not because a committee chose one. The commercial conversation is therefore rarely 'should we adopt Elastic' — it is 'we already run this, which tier do we actually need and who should operate it'. That is a different scoping exercise, and the one TechBag is most often asked for.
Running it well is real work
The honest counterweight to a capable free tier: operating Elasticsearch at scale — shard strategy, index lifecycle, capacity, upgrades — is genuine engineering effort that teams underestimate. Elastic Cloud exists precisely to absorb that. The right comparison is rarely licence-versus-licence; it is licence plus your engineers' time versus a managed bill.
Start with the cluster you already run — then decide deployment and tier before adding Observability or Security on the same data. (And price the operations — TechBag’s key value.)
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Gartner MQ for SIEM 2025
Named a Visionary — not a Leader. We say which.
AV-Comparatives 2026
100% malware protection, Business Security Test
NYSE: ESTC
$1.739B revenue, FY ended 30 April 2026
Open source again
AGPL added back for Elasticsearch and Kibana, 2024
50+ regions
Elastic Cloud Hosted footprint
Air-gapped capable
Self-managed deployment with no cloud dependency
Founder still building
Shay Banon returned to CTO in 2022
one engine
Search · Observability · Security
The company in six figures
See the platform, hear the pitch
Elastic Security Solutions Overview
The security platform, explained by Elastic.
Elastic Security: an agentic security operations platform
Where the security product is heading.
Elastic Security: End to End Incident Response
Detection through to response, end to end.
Where Elastic sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Elastic Across Its Platform
Each dot is an Elastic solution: competitive position vs category momentum.
SIEM + endpoint — on-prem or air-gapped capable.
Capability × Flexibility Map
Elastic against the search, observability and SIEM vendors it meets most — how deep each goes vs how freely and cheaply it deploys.
One engine for search, observability and security — and the deployment flexibility nobody else matches.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Elastic?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is the most pressing thing you need to solve?
2. What does your deployment have to look like?
3. Who will be using it day to day?
What is the ELK stack?
Elasticsearch, Logstash and Kibana — what each does, and why so many teams are already running it without a contract.
Read →Free tier vs paid — what you actually get
The free tier is genuinely capable, so the question is which features above it you need. The most important thing to understand before buying.
Read →Elastic Security as a SIEM
Detection rules, MITRE coverage and an included endpoint agent — on the store your logs are already in.
Read →Self-managed, Cloud or Serverless?
Three deployment models with genuinely different economics — including the air-gapped option most SIEMs cannot offer.
Read →Observability on the same cluster
Why logs, metrics and traces on one store changes the arithmetic against per-host pricing.
Read →Elastic vs Splunk vs OpenSearch
The honest matrix — deployment flexibility and cost against Splunk's depth and the AWS fork.
Read →The acronym decoder
Every term on these pages, in one place- Elasticsearch
- The distributed search and analytics engine at the centre of everything Elastic sells — and increasingly a vector database for AI retrieval.
- The ELK stack
- Elasticsearch, Logstash (ingest) and Kibana (visualisation) — the combination a great many teams run for log analytics, often before any commercial relationship.
- Kibana
- The visualisation and management interface — dashboards, search, and the console for Security and Observability.
- Beats / Elastic Agent
- The lightweight shippers that send data in. Elastic Agent is the single unified one, and it doubles as the endpoint security agent.
- AGPL
- The open-source licence Elastic added back for Elasticsearch and Kibana in 2024, after moving away from open source in 2021.
- OpenSearch
- The fork AWS created in 2021 when Elasticsearch left open source — Apache 2.0 licensed and still developed separately.
- Self-managed
- You run the cluster on your own infrastructure, including fully air-gapped. Satisfies data residency by definition.
- Elastic Cloud Hosted
- Elastic runs the cluster for you across 50+ regions, priced on the resources you provision rather than per host or per seat.
- Serverless
- Fully managed with no cluster to size, billed on usage — per GB ingested and retained for Observability and Security, compute units for Search.
- Subscription tiers
- Standard, Gold, Platinum and Enterprise — the feature and support levels layered on top of whichever deployment you choose.
- Shard strategy
- How you split indices across nodes. Getting it wrong is the single most common cause of a badly performing Elasticsearch cluster.
- Index lifecycle management
- The policy that rolls data from hot to warm to cold to frozen storage as it ages — the main lever on self-managed cost.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Find out what you already run
Elastic arrives bottom-up. Before anything else, find the clusters your engineering teams have already stood up — the commercial question is almost always about formalising something that exists, not adopting something new.
Decide the deployment model first
Self-managed, Cloud Hosted or Serverless have genuinely different economics and different residency answers. This decision constrains everything after it, so make it before comparing feature tiers.
Work out which tier you actually need
The free tier is capable. Map the specific features you need above it — and be honest about which are wants. This is where most of the negotiable money is.
Price your engineers' time honestly
Self-managed licences look cheap until you count shard strategy, capacity planning and upgrades. The real comparison is licence plus operations against a managed bill.
Plan index lifecycle before you ingest
Hot, warm, cold and frozen tiers are the main cost lever on any large deployment. Set the policy first; retrofitting it to a cluster already holding a year of data is painful.
Get it quoted in INR with GST
Elastic bills in USD. TechBag scopes the tier and deployment, and quotes locally with GST-compliant invoicing and support.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Elastic Security | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need |
| Elasticsearch | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based |
| Elastic Observability | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption |
Free and open source under AGPL, with paid tiers above it — the cost that surprises is your engineers’ time, not the licence. TechBag scopes the tier you actually need AND prices your engineers’ time honestly (Elastic bills USD; GST added).
Five pitfalls that cost buyers quarters
Assuming free means free forever
The free tier is genuinely capable, which is exactly why teams get surprised: the feature you eventually need — a specific authentication integration, alerting depth, certain machine-learning jobs — sits in a paid tier, and by then the cluster is production-critical. Map the features you need up front.
Underestimating what running it costs
A self-managed cluster is engineering work: shard strategy, capacity planning, version upgrades, index lifecycle. Teams routinely compare a self-managed licence against a managed competitor's bill and forget to price their own people. That is not a fair comparison.
Not setting index lifecycle up front
Hot, warm, cold and frozen tiers are the main lever on storage cost, and they are far easier to configure before the cluster holds a year of data than after. Most cost problems on large deployments trace back to this.
Confusing Elasticsearch with OpenSearch
AWS forked Elasticsearch in 2021 as OpenSearch, and the two have diverged since. Documentation, clients and features are not interchangeable — check which one your team actually deployed before you buy support for the other.
Reading Visionary as Leader
Elastic Security was named a Visionary in the 2025 Gartner MQ for SIEM, not a Leader. That is a real distinction about execution at enterprise scale, and any vendor material that blurs it is worth reading twice.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: vector search for AI retrieval compounds fastest — and it runs on the same Elasticsearch engine you already have.
Vector search and RAG
Elasticsearch as the retrieval layer for AI applications is the fastest-moving part of the portfolio — the same engine, a new and substantial use case.
What it means for you
Elasticsearch as the retrieval layer for AI applications is the fastest-moving part of the portfolio — the same engine, a new and substantial use case.
The return to open source
Adding AGPL back in 2024 reversed the 2021 relicensing.
What it means for you
Whatever the motivation, it changes how freely teams can adopt and redistribute the engine.
Agentic security operations
Elastic is positioning Security around AI-assisted investigation and response rather than more rules — the same direction as the rest of the SIEM market.
What it means for you
Elastic is positioning Security around AI-assisted investigation and response rather than more rules — the same direction as the rest of the SIEM market.
Serverless deployment
Consumption pricing with no cluster to size directly targets the operational-burden objection that has always been the strongest argument against self-managing.
What it means for you
Consumption pricing with no cluster to size directly targets the operational-burden objection that has always been the strongest argument against self-managing.
Air-gapped demand in regulated India
As RBI, SEBI and IRDAI expectations sharpen, the number of Indian buyers who cannot use a cloud-only SIEM is rising — and the list of modern SIEMs that can deploy air-gapped is short.
What it means for you
As RBI, SEBI and IRDAI expectations sharpen, the number of Indian buyers who cannot use a cloud-only SIEM is rising — and the list of modern SIEMs that can deploy air-gapped is short.
One store, three solutions
The architectural argument gets stronger as data volumes grow: keeping one copy queried three ways beats three products each holding their own.
What it means for you
The architectural argument gets stronger as data volumes grow: keeping one copy queried three ways beats three products each holding their own.
Questions buyers ask about Elastic
Ready to shortlist Elastic?
Open any of the four intel pages for the deep dive, or let a TechBag advisor build the case with you — deployment and tier scoping, an honest count of the operations cost, comparisons, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.