- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Elastic
The leading unified cloud observability platform — metrics, traces, logs, real-user experience and security on ONE platform, with best-in-class correlation (one click: symptom → root cause). Powerful & easy — with an honest guide to the cost. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Five intel pages. One unified observability platform.
The complete Elastic platform — every linked card is a full intel page, from infrastructure metrics to the real user experience.
Elastic Security
The SIEM your engineers may already be running.
SIEM and endpoint security on the same engine that stores your logs — detection rules, MITRE ATT&CK coverage, entity analytics and an included endpoint agent, with no separate data copy to maintain. The distinctive commercial fact is deployment: it is the credible route when you need on-premises or air-gapped, which rules out most cloud-native SIEMs outright, and the free tier is genuinely usable so many teams start before they buy. Named a Visionary in the 2025 Gartner MQ for SIEM.
Elasticsearch
The search engine underneath everything else.
The distributed search and analytics engine the whole platform is built on, and increasingly a vector database for retrieval-augmented generation. It powers site and application search, log analytics and the two solutions below it. Open source again under AGPL since 2024. The reason it matters commercially: your engineering team may already run it, so the question is usually not whether to adopt Elastic but which tier and deployment to formalise.
Elastic Observability
Logs, metrics and traces on one store.
Full-stack observability — log analytics, infrastructure metrics, APM and distributed tracing, synthetics and real user monitoring — on the same Elasticsearch cluster as your search and security data. For teams already running the ELK stack for logs, this is the formalisation of what they have rather than a migration, and the cost model is resource-based rather than per-host, which changes the arithmetic against per-host competitors.
Elastic Defend
The endpoint agent that is also your log shipper.
Malware and ransomware prevention with EDR telemetry and response actions, delivered by the same Elastic Agent that ships your logs — so endpoint rollout is not a second project and there is no second agent to upgrade. It scored 100% malware protection in the AV-Comparatives 2026 Business Security Test. The honest scope: it is strongest as part of the Elastic platform rather than as a standalone EPP bought against CrowdStrike or SentinelOne on their own terms.
Elastic Enterprise Search
Search inside your own product, done properly.
Relevance tuning, semantic search and vector retrieval for your applications, websites, ecommerce and internal content — built on the same engine, so it is the same cluster and the same operational model as everything else Elastic sells you. This is the original commercial use of Elasticsearch and still the one that brings most teams to the platform in the first place.
Elastic Cloud
Elastic, without running the cluster.
The managed platform: Elastic Cloud Hosted across 60 regions with resource-based pricing and full control over the deployment, or Elastic Cloud Serverless with consumption pricing and nothing to size. Its real purpose is absorbing the operational work — shard strategy, capacity, upgrades — that makes self-managed cheaper on the licence and more expensive in engineer-days. That trade is the whole cost conversation.
Elastic AI Assistant
Platform & engineAcross Search, Observability and Security
AutoOps
Platform & engineCluster health and optimisation guidance
Elastic sells across 6 of the products TechBag carries in security. The SIEM & log management guide shows how the category splits and which part is yours. →
Why “unified observability, one click to root cause” is the whole story
Search, observability and security tools each keep their own copy of your data, so the same log is stored three times and queried three ways. Elastic bet on unifying observability on one platform with the best correlation UX— metrics, traces, logs, real-user experience and security unified on ONE platform, with best-in-class correlation (one click from symptom to root cause), from the observability leader doubled down on it.
One engine, three solutions
Search, Observability and Security are not three products with three data stores — they are three ways of querying one Elasticsearch cluster. A log your observability team ingested is the same document your security team writes a detection against. That is the architectural argument, and it is why the platform's economics differ from tools priced per host or per seat.
Deployment nobody else matches
Self-managed anywhere including fully air-gapped, Elastic Cloud Hosted across 60 regions with resource-based pricing, or Elastic Cloud Serverless with consumption pricing and no cluster to size. For a regulated Indian buyer whose mandate rules out SaaS, this is frequently the only credible modern SIEM on the shortlist.
Open source, and back again
Elastic moved Elasticsearch away from open source in 2021 and then moved back, adding AGPL as an option in 2024 — a reversal almost no vendor makes. Whatever you think of the round trip, the practical effect is that the engine is open source today, the free tier is genuinely capable, and adoption does not require procurement.
Bottom-up adoption is the norm
Elastic products usually arrive in an organisation because a developer installed one, not because a committee chose one. The commercial conversation is therefore rarely 'should we adopt Elastic' — it is 'we already run this, which tier do we actually need and who should operate it'. That is a different scoping exercise, and the one TechBag is most often asked for.
Running it well is real work
The honest counterweight to a capable free tier: operating Elasticsearch at scale — shard strategy, index lifecycle, capacity, upgrades — is genuine engineering effort that teams underestimate. Elastic Cloud exists precisely to absorb that. The right comparison is rarely licence-versus-licence; it is licence plus your engineers' time versus a managed bill.
Start with Infrastructure Monitoring (the core) — then add APM, Logs, Cloud Security and Digital Experience, all correlated on one platform. (And manage the cost — TechBag’s key value.)
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Gartner MQ for SIEM 2025
Named a Visionary — not a Leader. We say which.
AV-Comparatives 2026
100% malware protection, Business Security Test
NYSE: ESTC
$1.739B revenue, FY ended 30 April 2026
Open source again
AGPL added back for Elasticsearch and Kibana, 2024
60 regions
Elastic Cloud Hosted footprint
Air-gapped capable
Self-managed deployment with no cloud dependency
Founder still building
Shay Banon returned to CTO in 2022
one engine
Search · Observability · Security
The company in six figures
See the platform, hear the pitch
Elastic Security Solutions Overview
The security platform, explained by Elastic.
Elastic Security: an agentic security operations platform
Where the security product is heading.
Elastic Security: End to End Incident Response
Detection through to response, end to end.
Where Elastic sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Elastic Across Its Platform
Each dot is an Elastic solution: competitive position vs category momentum.
SIEM + endpoint — on-prem or air-gapped capable.
The Unification × Breadth Map
Deployment flexibility and cost control vs the field — and where the Leaders still go deeper.
One engine for search, observability and security — and the deployment flexibility nobody else matches.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Elastic?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is the most pressing thing you need to solve?
2. What does your deployment have to look like?
3. Who will be using it day to day?
What is the ELK stack?
Elasticsearch, Logstash and Kibana — what each does, and why so many teams are already running it without a contract.
Read →Free tier vs paid — what you actually get
The free tier is genuinely capable, so the question is which features above it you need. The most important thing to understand before buying.
Read →Elastic Security as a SIEM
Detection rules, MITRE coverage and an included endpoint agent — on the store your logs are already in.
Read →Self-managed, Cloud or Serverless?
Three deployment models with genuinely different economics — including the air-gapped option most SIEMs cannot offer.
Read →Observability on the same cluster
Why logs, metrics and traces on one store changes the arithmetic against per-host pricing.
Read →Elastic vs Splunk vs OpenSearch
The honest matrix — deployment flexibility and cost against Splunk's depth and the AWS fork.
Read →The acronym decoder
Every term on these pages, in one place- Elasticsearch
- The distributed search and analytics engine at the centre of everything Elastic sells — and increasingly a vector database for AI retrieval.
- The ELK stack
- Elasticsearch, Logstash (ingest) and Kibana (visualisation) — the combination a great many teams run for log analytics, often before any commercial relationship.
- Kibana
- The visualisation and management interface — dashboards, search, and the console for Security and Observability.
- Beats / Elastic Agent
- The lightweight shippers that send data in. Elastic Agent is the single unified one, and it doubles as the endpoint security agent.
- AGPL
- The open-source licence Elastic added back for Elasticsearch and Kibana in 2024, after moving away from open source in 2021.
- OpenSearch
- The fork AWS created in 2021 when Elasticsearch left open source — Apache 2.0 licensed and still developed separately.
- Self-managed
- You run the cluster on your own infrastructure, including fully air-gapped. Satisfies data residency by definition.
- Elastic Cloud Hosted
- Elastic runs the cluster for you across 60 regions, priced on the resources you provision rather than per host or per seat.
- Serverless
- Fully managed with no cluster to size, billed on consumption — ingest per GB plus storage per GB per month.
- Subscription tiers
- Standard, Gold, Platinum and Enterprise — the feature and support levels layered on top of whichever deployment you choose.
- Shard strategy
- How you split indices across nodes. Getting it wrong is the single most common cause of a badly performing Elasticsearch cluster.
- Index lifecycle management
- The policy that rolls data from hot to warm to cold to frozen storage as it ages — the main lever on self-managed cost.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Find out what you already run
Elastic arrives bottom-up. Before anything else, find the clusters your engineering teams have already stood up — the commercial question is almost always about formalising something that exists, not adopting something new.
Decide the deployment model first
Self-managed, Cloud Hosted or Serverless have genuinely different economics and different residency answers. This decision constrains everything after it, so make it before comparing feature tiers.
Work out which tier you actually need
The free tier is capable. Map the specific features you need above it — and be honest about which are wants. This is where most of the negotiable money is.
Price your engineers' time honestly
Self-managed licences look cheap until you count shard strategy, capacity planning and upgrades. The real comparison is licence plus operations against a managed bill.
Plan index lifecycle before you ingest
Hot, warm, cold and frozen tiers are the main cost lever on any large deployment. Set the policy first; retrofitting it to a cluster already holding a year of data is painful.
Get it quoted in INR with GST
Elastic bills in USD. TechBag scopes the tier and deployment, and quotes locally with GST-compliant invoicing and support.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Elastic Security | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need | Subscription tier on top of your deployment; Platinum and Enterprise carry the SIEM and endpoint features most buyers need |
| Elasticsearch | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based | Free and open source under AGPL; paid tiers add features and support. Elastic Cloud is resource-based |
| Elastic Observability | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption | Same tiering; Cloud Hosted priced on provisioned resources, Serverless on ingest and storage consumption |
Free and open source under AGPL, with paid tiers above it — the cost that surprises is your engineers’ time, not the licence. The compounds across modules. TechBag scopes the tier you actually need AND prices your engineers’ time honestly (Elastic bills USD; GST added).
Five pitfalls that cost buyers quarters
Assuming free means free forever
The free tier is genuinely capable, which is exactly why teams get surprised: the feature you eventually need — a specific authentication integration, alerting depth, certain machine-learning jobs — sits in a paid tier, and by then the cluster is production-critical. Map the features you need up front.
Underestimating what running it costs
A self-managed cluster is engineering work: shard strategy, capacity planning, version upgrades, index lifecycle. Teams routinely compare a self-managed licence against a managed competitor's bill and forget to price their own people. That is not a fair comparison.
Not setting index lifecycle up front
Hot, warm, cold and frozen tiers are the main lever on storage cost, and they are far easier to configure before the cluster holds a year of data than after. Most cost problems on large deployments trace back to this.
Confusing Elasticsearch with OpenSearch
AWS forked Elasticsearch in 2021 as OpenSearch, and the two have diverged since. Documentation, clients and features are not interchangeable — check which one your team actually deployed before you buy support for the other.
Reading Visionary as Leader
Elastic Security was named a Visionary in the 2025 Gartner MQ for SIEM, not a Leader. That is a real distinction about execution at enterprise scale, and any vendor material that blurs it is worth reading twice.
The evaluation kit
The flagship intel page carries an 8-question vendor checklist and an automation-savings calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: vector search for AI retrieval compounds fastest — and it runs on the same Elasticsearch engine you already have.
Vector search and RAG
Elasticsearch as the retrieval layer for AI applications is the fastest-moving part of the portfolio — the same engine, a new and substantial use case.
What it means for you
Elasticsearch as the retrieval layer for AI applications is the fastest-moving part of the portfolio — the same engine, a new and substantial use case.
The return to open source
Adding AGPL back in 2024 reversed the 2021 relicensing.
What it means for you
Whatever the motivation, it changes how freely teams can adopt and redistribute the engine.
Agentic security operations
Elastic is positioning Security around AI-assisted investigation and response rather than more rules — the same direction as the rest of the SIEM market.
What it means for you
Elastic is positioning Security around AI-assisted investigation and response rather than more rules — the same direction as the rest of the SIEM market.
Serverless deployment
Consumption pricing with no cluster to size directly targets the operational-burden objection that has always been the strongest argument against self-managing.
What it means for you
Consumption pricing with no cluster to size directly targets the operational-burden objection that has always been the strongest argument against self-managing.
Air-gapped demand in regulated India
As RBI, SEBI and IRDAI expectations sharpen, the number of Indian buyers who cannot use a cloud-only SIEM is rising — and the list of modern SIEMs that can deploy air-gapped is short.
What it means for you
As RBI, SEBI and IRDAI expectations sharpen, the number of Indian buyers who cannot use a cloud-only SIEM is rising — and the list of modern SIEMs that can deploy air-gapped is short.
One store, three solutions
The architectural argument gets stronger as data volumes grow: keeping one copy queried three ways beats three products each holding their own.
What it means for you
The architectural argument gets stronger as data volumes grow: keeping one copy queried three ways beats three products each holding their own.
Questions buyers ask about Elastic
Ready to shortlist Elastic?
Open any of the five intel pages for the deep dive, or let a TechBag advisor build the case with you — module scoping, realistic cost estimation and active COST MANAGEMENT, honest comparisons, deployment, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.