- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Elastic Cloud
Elastic, without running the cluster — Elastic Cloud is the managed platform: Hosted across 60 regions on resource-based pricing, or Serverless on consumption with nothing to size.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — answered by deployment
Self-managed
Stored AND processed by you
Runs on your own infrastructure, including fully air-gapped. Both questions answered by definition — the data never leaves.
Elastic Cloud
60 regions — confirm both
If you choose managed, confirm storage AND processing location for your region in writing, as you would with any SaaS.
This is the reason Elastic reaches shortlists the cloud-only SIEMs cannot. Where a mandate rules out SaaS, self-managed sidesteps the storage-versus-processing question entirely — unlike a cloud SIEM that may store in your region while processing elsewhere. See the SIEM guide for which other products can do this.
Quick answer
The Microsoft platform family
This page covers Elastic Cloud — the SIEM. The other pillars:
Quick facts
30-second orientation- Product
- Elastic Cloud — the managed Elastic Stack
- What it is
- The same software, with the operations moved to Elastic
- Vendor
- Elastic N.V. — CEO Ash Kulkarni
- Runs on
- AWS · Azure · Google Cloud
- India regions
- Mumbai (AWS) · Central India (Azure) · Mumbai (GCP)
- Priced on
- Consumption — compute and storage actually used
- Tiers
- Standard · Gold · Platinum · Enterprise
- Serverless
- Usage-based; no nodes to provision
- Data residency
- Yours to choose — Indian regions available
- Data processing
- Elastic's managed control plane in your chosen region
- The honest limit
- No air gap — that requires the self-managed path
- Free tier
- Elasticsearch is AGPL open source; self-managed Basic is free
- Alternative
- Self-managed Elastic — same software, you operate it
- Buy in India via
- TechBag — INR invoicing, GST, tier sizing
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
SIEM and endpoint security built on Elasticsearch — detections, hunting and cases on the store your logs are already in, with one agent doing both telemetry and endpoint protection.
A two-copy SIEM architecture vs Elastic’s — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | No / separate AI tool | Elastic Cloud |
|---|---|---|
| Data copies | Logs, then a copy in the SIEM | One store, queried three ways |
| Agents | Log shipper + separate EDR agent | One Elastic Agent does both |
| On-premises | Cloud-only SIEMs cannot | Self-managed, including air-gapped |
| Evaluation | Sales cycle, then a PoC | Free tier on real data, no contract |
| Pricing axis | Per GB ingested or per seat | Subscription tier + resources |
| Retention cost | Priced per GB per month | Hot/warm/cold/frozen — your policy |
| Honest caveat | — | Thinner OOTB content; you operate it |
| Best fit | — | On-prem mandates; ELK estates |
The deployment-freedom answer — for the deepest out-of-the-box content, weigh Splunk (TechBag sells it).
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Elasticsearch
The distributed search and analytics engine underneath everything Elastic sells. On Elastic Cloud you size it rather than build it — nodes, hot and warm tiers and storage are provisioned for you and scale on demand. It is the same Elasticsearch you would run yourself, which is why moving between managed and self-managed is a genuine option rather than a migration.
Kibana
Dashboards, search, alerting and the workspaces for Observability and Security. Managed and upgraded in step with the cluster, so you are never running a Kibana that has drifted out of version alignment with Elasticsearch — a common and tedious failure mode in self-managed deployments.
Solutions
The same deployment can carry any combination. This is Elastic's core commercial argument: one store and one agent rather than a log platform plus a separate SIEM plus a separate APM tool, each with a copy of your data. If you already run Elastic for logs, adding Security is a licence decision rather than a new platform.
Tiers
Standard covers core search and analytics. Gold and Platinum add alerting, machine-learning anomaly detection and cross-cluster replication. Enterprise adds the advanced Security and orchestration capabilities. Read the tier boundaries carefully before sizing — teams routinely assume machine learning is included and discover it sits two tiers up.
Regions
AWS, Azure and Google Cloud, including Mumbai on AWS and GCP and Central India on Azure. For an Indian buyer with a residency obligation this is the material difference between Elastic Cloud and the cloud-only security platforms that have no India region at all.
Serverless
Serverless projects remove capacity planning entirely and bill on usage. Attractive where load is spiky or unknown; less predictable where it is steady and well understood. Model both against your actual pattern rather than assuming serverless is automatically cheaper.
One workspace where people meet, make, and share — work moving in one place, not emailed between tools.
Twelve capabilities. Draft, analyse, automate.
Sentinel collects, correlates and stores security telemetry — and the tier each table lands in is what sets your bill. Here are the five pieces that matter. Part of Defender XDR, managed in one portal, with Security Copilot AI.
A cluster in minutes
Deploy a sized, production-ready Elastic Stack on AWS, Azure or Google Cloud without procuring hardware or building a cluster.
Scale without a rebuild
Add nodes, storage or hot-warm tiers as data grows, rather than re-architecting a cluster you sized eighteen months ago.
Indian data residency
Deploy into Mumbai or Central India so an India-residency obligation is answered by where you put the cluster.
Version upgrades handled
Elastic runs the upgrade path and keeps Elasticsearch and Kibana in version alignment — the tedious part of self-managing.
Replication and snapshots
Managed high availability across zones, with automated snapshots, rather than a backup regime you design and test yourself.
Search, Observability and Security
License any combination on one deployment, so logs collected once serve operational monitoring and threat detection without a second copy.
Machine-learning anomaly detection
Unsupervised anomaly detection on the higher tiers — genuinely useful, and genuinely not included at Standard.
Watch Microsoft Defender in action
Endpoint protection, XDR and Security Copilot.
Elastic Security Solutions Overview
One of the solutions you can license on an Elastic Cloud deployment.
Want a live, India-context walkthrough for your environment?
Book a guided demo →AI works best where the work already happens.
Here’s what genuinely sets Elastic Cloud apart (and where Splunk or Sentinel may fit better).
The decision is who operates the cluster, not what the software does
This is the honest centre of the page, and it is unusual enough to state plainly: Elastic Cloud is not a different or better Elastic. It is the same Elasticsearch, the same Kibana and the same solutions, with the operational work moved to Elastic. So the question is never 'is Elastic Cloud better than Elastic' — it is whether running a distributed search cluster well is a job your team should be doing. For many teams it is not: cluster sizing, shard strategy, version upgrades and 2am node failures are real engineering, and doing them badly produces an expensive, slow platform that people stop trusting. For teams who already run Elasticsearch competently, self-managing is a legitimate and fully supported answer that costs less in licence terms.
Indian regions, which several competitors simply do not have
Elastic Cloud can be deployed into Mumbai on AWS and Google Cloud, or Central India on Azure. That sounds mundane until you compare it against the cloud-only security platforms an Indian regulated buyer is likely to be shortlisting alongside it — several have no India region at all, which for an IRDAI-regulated insurer or a bank under RBI localisation expectations is not a pricing disadvantage but a disqualification. Being able to choose where the cluster sits, and evidence it, is a structural advantage rather than a feature.
One deployment, several jobs, no second copy of your data
The strongest architectural argument for Elastic generally applies here too. Most organisations run a log platform for operations and a separate SIEM for security, which means collecting the same data twice, storing it twice and paying for it twice. On Elastic Cloud one deployment can carry Observability and Security against the same indices. If you already run Elastic for logs — and a great many engineering teams do — adding Security is a licence decision rather than a new platform, a new agent and a new rollout.
Consumption pricing behaves differently from an ingestion meter
Elastic Cloud bills for the compute and storage your deployment actually consumes, not per gigabyte ingested under a licence meter. The distinction is real but should not be oversold: a noisy source still costs you, because it consumes resources. What changes is the shape of the relationship — you can tier data to cheaper storage, control retention per index and size the cluster to your actual pattern, so cost is something you engineer rather than something the licence dictates. Teams who have watched a per-GB SIEM invoice climb quarter after quarter find this materially easier to manage.
The honest limits
Three. First, no air gap — by definition, since Elastic operates it. If your mandate requires a disconnected deployment, Elastic Cloud is not a more expensive option, it is not an option, and you want self-managed Elastic instead. Second, the tier boundaries catch people out: machine-learning anomaly detection and cross-cluster replication are not in Standard, and teams routinely size a deployment assuming capability that sits two tiers up. Read the tier table before you model the cost. Third, consumption pricing is only predictable if your load is predictable — spiky ingestion produces a spiky bill, and the answer is retention and tiering policy set deliberately at the start rather than reviewed after the first surprising invoice.
The numbers behind the platform
What your Elastic Cloud rollout looks like
Decide managed or self-managed first
This is the actual decision and everything else follows from it. If a mandate requires air-gapped operation, stop here — Elastic Cloud cannot serve you and self-managed Elastic is the same software under your control. If not, weigh your genuine spare platform-engineering capacity against the subscription rather than against a bare hosting bill.
Choose the region deliberately
Mumbai on AWS or Google Cloud, or Central India on Azure, if Indian residency binds you. Choose it because your obligation requires it and record why, rather than defaulting to whichever region the console offers first — this is the evidence an auditor will ask for later.
Size the tier against the capability you need
Map the features you actually intend to use to the tier that contains them, machine-learning anomaly detection especially. Sizing on Standard and discovering a needed capability sits at Platinum is the commonest and most avoidable costing error on this product.
Model retention and tiering before you load data
Decide what stays hot, what moves to warm and what is deleted, per index, at the start. Consumption pricing rewards this and punishes its absence. Retrofitting a retention policy onto a cluster already carrying a year of undifferentiated data is far harder than setting one on day one.
Review the bill against the pattern
Give someone ownership of the monthly consumption review. Not because the pricing is unfair but because it is responsive: it reflects what you are doing, and nobody notices a source that doubled in volume until it appears as money.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We moved off a self-managed cluster after our one Elasticsearch expert resigned. That risk was the entire business case.”
“Mumbai region meant our residency question had a one-line answer. Two other vendors on the shortlist could not say the same.”
“Read the tier table properly. We sized on Standard and then discovered machine learning was two tiers up.”
“Consumption pricing is fair but it is not set-and-forget. Retention and tiering policy needs an owner or the bill drifts.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the endpoint-security (EDR/XDR) market — tap any vendor to see why it sits where it does.
TechBag Endpoint-Security (EDR/XDR) Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Managed, with Indian regions — no air gap.
In-App Integration × Estate Breadth
The grid nobody publishes — detection efficacy & agent maturity vs Microsoft-estate fit and TCO.
Operations removed; residency answerable.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Elastic Cloud vs the field
The SIEM field — honest lanes; the edge is deployment freedom and one agent for logs and endpoint. Deepest content and talent pool? Splunk. We say so (and sell it).
| Dimension | Elastic Cloud | Self-managed Elastic | Elastic on your own cloud account | Elastic Serverless |
|---|---|---|---|---|
| Who operates the cluster | Elastic — sizing, upgrades, availability | You, entirely | You, on infrastructure you rent | Elastic, with no nodes to size at all |
| Licence cost | Consumption — compute and storage used | Basic tier is genuinely free (AGPL) | Subscription if you want commercial features | Usage-based, no provisioned capacity |
| True cost to compare | One bill: infrastructure AND operations | Infrastructure plus real engineering time | Cloud bill plus your engineering time | One bill, scales with what you do |
| Air-gapped deployment | Impossible — Elastic runs the control plane | Fully supported | Possible in a private/isolated network | Impossible by design |
| India data residency | Mumbai (AWS/GCP), Central India (Azure) | Wherever you put it — yours to prove | Your account, your region choice | Check region availability for serverless |
| Version upgrades | Handled, and kept in version alignment | Yours — the task teams most often defer | Yours | Invisible to you |
| Key-person risk | Low — the vendor holds the expertise | High — often exactly one person knows it | High, same reason | Lowest |
| Cost predictability | Responsive to load — needs a retention policy | Fixed infrastructure, fixed salary | Depends on your commitments | Most variable — spiky load, spiky bill |
| Best fit | No spare platform capacity; India region needed | Air-gap mandates, or real spare capacity at scale | Large committed cloud spend you already hold | Spiky or unknown load you cannot size |
Does Elastic Cloud fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Elastic Cloud if…
- ✓You want the Elastic Stack without running a distributed search cluster yourself
- ✓You need an Indian region — Mumbai or Central India — and can evidence that choice to an auditor
- ✓Your Elasticsearch expertise sits with one or two people and that dependency worries you
- ✓You would rather engineer cost through retention and tiering than negotiate a per-GB licence
Choose self-managed Elastic instead if…
- ✓A regulator, a contract or an air gap rules out a vendor-operated control plane
- ✓You already run Elasticsearch competently and have genuine spare capacity — the Basic tier is free
- ✓You are at large, steady volumes where engineering cost grows more slowly than consumption
Run it in your own cloud account if…
- ✓You hold a substantial committed-spend agreement with AWS, Azure or GCP
- ✓You need full control of networking and data placement
- ✓You accept that you still supply all of the operations
Look at Wazuh or Splunk instead if…
- ✓You want a security platform complete out of the box rather than a stack to assemble (Wazuh)
- ✓You have a detection-engineering function that wants the deepest query language (Splunk)
Elastic Cloud is the managed way to run the stack behind 20 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
Self-managed, or managed?
Elastic is priced on deployment and subscription tier, not on gigabytes ingested — so the question that decides your bill is whether running the cluster yourself costs less than letting Elastic run it. The engine is free under AGPL; what is not free is your engineers’ time on shard strategy, index lifecycle, capacity and upgrades. Drag both sliders. Illustrative, at ₹12,000 per fully-loaded engineer-day and ~₹84/USD.
Engineer-days means real time on shard strategy, index lifecycle, capacity planning and version upgrades — not incident response. If you put 0, you are assuming the cluster runs itself, which is the assumption this calculator exists to question. Illustrative: your TechBag quote models your real tier and resources.
Three ways to consume it
Elastic is priced on your DEPLOYMENT plus a subscription tier — not per seat and not per GB ingested, which changes the arithmetic against volume-metered SIEMs at scale. The engine itself is free and open source under AGPL, so the real question is which features you need above the free tier, and who runs the cluster. Figures below are reported entry rates and scale with what you provision. TechBag scopes tier and deployment and quotes in INR with GST.
Self-managed
Best for on-prem and air-gapped
- Engine free and open source — pay for a tier above it
- Runs fully air-gapped; residency answered by definition
- You operate the cluster — price your engineers’ time
Elastic Cloud Hosted
Best if you want it managed
- Reported ~$99/mo Standard to ~$184/mo Enterprise at entry size
- Priced on provisioned resources, not per seat or per GB
- 60 regions; support charged as a % of consumption above Standard
Serverless
Best for variable volume
- Reported from ~$0.50/GB ingested plus storage per GB/month
- No cluster to size and no monthly minimum
- Consumption-based — closest to the cloud SIEM model
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every SIEM vendor
Take this into your next vendor call — including ours.
Does any mandate require air-gapped or on-premises operation? If so, Elastic Cloud is out — use self-managed.
Do we have genuine spare platform-engineering capacity to run a distributed cluster, counted honestly?
Which region will hold the deployment, and does that satisfy our residency obligation in writing?
Which tier contains the capabilities we actually intend to use — machine learning especially?
Are we licensing Search, Observability, Security or a combination, and on the same deployment?
What is our per-index retention and tiering policy, decided before we load data rather than after?
Do we already run Elasticsearch for logs, making Security a licence decision rather than a new platform?
Who owns the monthly consumption review, so a source that doubled in volume gets noticed?
Questions buyers ask
Ready to evaluate Elastic Cloud?
Find out what you already run, work out which tier you actually need above the free one, or get an honest Elastic-vs-Splunk comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.