The full review
What is Elastic?
Elastic is the company behind Elasticsearch, the open source distributed search and analytics engine its product page describes as built for speed, scale, and AI applications. The commercial platform layers three solution areas, Search, Observability, and Security, onto a single datastore, so logs, traces, metrics, security telemetry, and vector embeddings sit in the same indices and answer the same queries. Kibana supplies the interface, with Discover for exploration and Dashboards for the shared view.
Elastic now brands itself as The Search AI Company, and the homepage leads with retrieval rather than dashboards, arguing that Elasticsearch brings context to AI. That framing runs through the product line, where a vector database, hybrid search, and Elastic Agent Builder sit alongside the familiar log analytics and SIEM tooling.
The Elasticsearch engine underneath
Everything in the stack resolves down to Elasticsearch. The product page names full-text search, semantic search, geospatial analytics, and a vector database in one engine, sparing teams from bolting a separate vector store onto an existing cluster. ES|QL, the piped query language, gives a single syntax across those data types, while connectors and ingest pipelines cover the 350+ integrations Elastic advertises. Newer additions push toward agentic work: Agent Builder, Workflows, and AutoOps automate retrieval and cluster operations.
Observability across logs, metrics, and traces
Elastic Observability covers log analytics, infrastructure monitoring, APM, and digital experience monitoring through real user monitoring, synthetic testing, and uptime monitoring, with AIOps and LLM observability layered on top. OpenTelemetry is a first-class ingest path and PromQL is natively supported, which matters when migrating off a Prometheus and Grafana setup without rewriting every alert rule.
The daily workflow is familiar: Streams applies AI-driven processing to incoming logs, Discover drives exploration and investigation, and SLOs track service levels. The vendor reports up to 30x faster queries than Prometheus and Grafana and up to 75% less storage using the LogsDB index mode, and cites Leader placement in the 2026 Gartner Magic Quadrant for Observability Platforms.
Security operations on the same telemetry
Elastic Security is presented as an agentic security operations platform spanning next-gen SIEM, XDR, and endpoint protection. Because detections run against the same store as observability data, an analyst can pivot from a suspicious process to surrounding host metrics without exporting anything. Elastic emphasizes native automation being built in, removing the need for a separate SOAR product, and bills on compute and storage rather than per device. Searchable snapshots keep older data queryable in place for long-horizon investigations. The vendor reports a Leader placement in The Forrester Wave for Security Analytics Platforms, Q2 2025, and a top rating in the AV-Comparatives 2026 Business Security Test.
Deployment models and subscription tiers
Three deployment shapes are offered: Elastic Cloud Serverless with usage-based billing, Elastic Cloud Hosted on AWS, Google Cloud, and Azure with resource-based billing, and self-managed Elasticsearch under a license. Serverless removes cluster sizing and meters virtual compute units, suiting spiky workloads, while Hosted gives more control over steady volume.
On Hosted, the ladder runs Standard, Gold, Platinum, and Enterprise. Gold adds reporting, Watcher, and third-party alerting. Platinum unlocks machine learning anomaly detection, cross-cluster replication, and semantic search with the ELSER and e5 models, plus 24/7 support. Enterprise adds searchable snapshots, cross-cluster search, GPU inference, Agent Builder, and SAML SSO. Teams evaluating the AI capabilities should read the tier chart carefully, since several headline retrieval features begin at Platinum.
Who should choose Elastic
Elastic fits platform teams consolidating a log pipeline, an APM vendor, and a SIEM onto shared infrastructure, and engineering organizations with real data volume where per-host or per-seat pricing has turned punishing. It also fits AI teams needing a production vector database who would rather run retrieval beside their operational data.
It is less ideal for small teams wanting an opinionated monitoring tool that works untouched out of the box. Elastic rewards tuning, since index modes, retention settings, and cluster sizing all move the cost and performance needle, and someone has to own those decisions. A five-person startup needing uptime alerts will find the platform heavier than the job requires.
Strengths
- Cost-effective at high data volumes vs per-host competitors; retention as low as $0.017/GB per month
- One platform for search, observability, and security (SIEM), reducing tool sprawl
- Powerful full-text/vector search, ML and anomaly detection built on Elasticsearch
- Flexible deployment: self-manage free, or use managed Elastic Cloud or auto-scaling serverless
Watch out for
- Usage-based pricing is complex and hard to forecast; billed on uncompressed ingest volume
- Steep learning curve; efficient operation (especially self-managed) demands real expertise
- Costs can spiral with high ingest plus retention across multiple line items (ingest, retention, egress, VCU)
- Official pricing page shows no fixed hosted dollar minimums, so upfront cost is less transparent
Key features
| Feature | What it does |
|---|
| Full-stack Observability | Logs, metrics, traces/APM, SLOs, synthetics and universal profiling in a single platform |
| Elasticsearch core | Fast full-text and vector search over huge datasets powers queries, dashboards and RAG use cases |
| AI Assistant, ML & AIOps | Anomaly detection, machine learning jobs and AI-assisted analysis to surface issues faster |
| Serverless option | Auto-scaling, zero cluster management; pay per GB ingested/retained or per VCU-hour |
| Integrated Security (SIEM) | Threat detection, correlation and response on the same data as observability |
| Flexible deployment | Elastic Cloud on AWS/GCP/Azure, serverless, or self-managed on your own infrastructure |
How Elastic compares
| Alternative | How it differs |
|---|
| Datadog | More polished, faster to set up, but per-host (~$15-23/host/mo) plus per-GB costs climb fast at scale |
| New Relic | Consumption plus per-user seat pricing; simpler for small teams, but pricier as full-platform users grow |
| Grafana Cloud | Open-source friendly with cheap Loki log storage; less unified and less turnkey than Elastic |
Frequently asked questions
How much does Elastic cost?
Elastic Cloud hosted deployments start around $95/month on Standard, scaling to roughly $175/month for Enterprise, plus resource usage. Serverless Observability is usage-based: as low as $0.07/GB ingested (Logs Essentials) or $0.09/GB (Complete), with retention from $0.017/GB per month. Real production clusters commonly run $1,500-$8,000+ monthly depending on data volume.
Is Elastic free?
Partly. Elasticsearch and Kibana can be self-managed for free under Elastic's open-source and Basic licenses, and Elastic Cloud offers a no-commitment free trial. But managed hosting, serverless, and higher tiers (Gold, Platinum, Enterprise) are paid. Self-managing avoids subscription fees, yet you cover your own infrastructure, scaling and maintenance, which adds real operational overhead.
Elastic vs Datadog: which is cheaper?
Elastic is usually cheaper at high data volumes. Datadog charges per host (about $15-23/host/month) plus per-GB ingest, so costs climb fast with infrastructure size. Elastic bills mainly on data (from $0.07/GB ingested, $0.017/GB retained), making it more economical for log-heavy workloads. Datadog offers a more polished UX; Elastic wins on cost at scale.
How is Elastic Observability priced?
Elastic Observability Serverless uses usage-based pricing across two tiers. Logs Essentials is as low as $0.07/GB ingested and $0.017/GB retained monthly. Complete is $0.09/GB ingested ($0.023/GB for metrics) and $0.019/GB retained. Both include 50GB free egress, then $0.05/GB. Billing is on uncompressed volume at the end of the ingest pipeline, so budget above raw data size.
Elastic vs New Relic: which is better?
New Relic uses consumption pricing (per-GB ingested) plus per-user seat fees, simple for small teams but costly as you add full-platform users. Elastic prices mainly on data volume with no per-seat charge, so it scales better for large teams and heavy log ingestion. New Relic onboards faster; Elastic offers deeper search, ML and integrated SIEM at lower data cost.
Elastic ratings on other platforms
Independent user ratings from third-party review sites, linked here for transparency.
These are not our editorial score, are captured on the date shown, and may have changed since.