Elastic Observability

What Elastic Observability actually is

Elastic Observability is the observability solution built on the Elastic Stack: Elasticsearch as the storage and query engine, Kibana as the interface, and Elastic Agent, Beats and APM agents — or plain OpenTelemetry — as the collection layer. It ingests logs, metrics, traces, synthetic checks and real user monitoring data into one store, and lets you search all of it with the same query language instead of a separate tool per signal. The differentiator has always been the engine: Elasticsearch was built for high-volume search, so log analytics at scale is a native capability rather than an add-on, and the data tiers plus searchable snapshots let you keep long retention without keeping everything on hot storage.

The stack's history is well known and worth stating precisely. Shay Banon wrote the first Elasticsearch code in 2009; he co-founded the company in Amsterdam in 2012 with Simon Willnauer, Steven Schuurman and Uri Boness. It went public on the NYSE as ESTC, acquired Opbeat to enter APM, and now sells search, observability and security on one platform used by more than half of the Fortune 500 according to the company. Licensing went through a famous detour — the 2021 move to SSPL and the Elastic License followed Amazon's launch of a hosted Elasticsearch service — and in August 2024 Elastic added AGPLv3 as an option, making Elasticsearch and Kibana open source again under a tri-license (AGPL/SSPL/ELv2) while keeping the client libraries on Apache 2.0.

Today the product ships in three shapes: Elastic Cloud Serverless (consumption-priced SaaS projects — Observability Logs Essentials and Observability Complete), Elastic Cloud Hosted (resource-based deployments you size yourself, on AWS, Google Cloud or Azure), and self-managed — your own hardware or VMs, free under the licenses above, with ECE and ECK for running fleets of clusters. That range is the reason we file it under monitoring hosting rather than pure SaaS: it is one of the few serious observability platforms you can run yourself.

Pricing: what you really pay

Serverless pricing is pure consumption, published per gigabyte. Logs Essentials — log storage and analysis at scale with ad hoc search, dashboards, integrations and alerting — charges as low as $0.07 per GB ingested and as low as $0.017 per GB retained per month, with 50 GB of egress free each month and $0.05 per GB after. Complete, which adds full metrics, traces, synthetic testing, SLOs, machine learning, AI-assisted pipelines and agentic automation, is as low as $0.09 per GB for logs and traces ($0.023 per GB for metrics) with retention at $0.019 and $0.005 per GB-month respectively. Those "as low as" rates are volume-tiered; small consumers pay more per gigabyte.

Add-ons price separately and clearly: synthetic browser tests at $0.0123 per test run, virtually unlimited lightweight ping tests at $28.00 per location per month, the Elastic Managed LLM at $4.50 per million input tokens and $21 per million output tokens, cross-project search from $0.0023 per GB-month of linked retention, and Workflows and Agent Builder with 10,000 free executions each before per-execution charges apply. Support is bundled as a percentage of your bill: limited support included at Standard, then Gold at 5%, Platinum at 10% and Enterprise at 15% of the monthly charge.

Two billing subtleties matter more than the headline rates. First, Elastic meters ingest and retention at the fully enriched, normalized data size after your ingest pipeline and before compression — this is deliberately stated in the billing docs, and it means your bill is based on a larger number than the raw bytes on the wire. Pipeline design therefore changes cost. Second, the self-managed option is genuinely free — software-wise — so for teams with infrastructure and engineering time, the price of entry is your own servers, which is how a great many Elasticsearch and observability deployments actually run.

Our read: per-GB pricing in the single-digit cents is competitive with the incumbent observability SaaS vendors, and the tiered model rewards the kind of high-volume log retention Elasticsearch has always been good at. The metering convention and volume tiers mean you should model cost from your enriched data volume, not your raw log size.

Performance & infrastructure

On Elastic Cloud you can deploy in 50+ regions across AWS, Google Cloud and Microsoft Azure, single- or multi-cloud, with PrivateLink private connectivity, bring-your-own-key encryption, SAML/OIDC single sign-on, and index-, document- and field-level access control. Compliance coverage is broad: FedRAMP High authorized (on AWS GovCloud), SOC 2 Type II, ISO 27001, HIPAA, PCI DSS and IRAP. Self-managed deployments run wherever you put them, from one VM to a large cluster; ECK (the Kubernetes operator) and ECE handle orchestration at scale.

Query performance is the platform's core competence. Search across logs, metrics and traces happens in one engine with one query language (ES|QL these days), backed by data tiers: hot for active data, cold and frozen for cheap retention, searchable snapshots for archival data that still answers queries. Machine learning jobs, anomaly detection and alerting run inside the same stack rather than as separate products. Agentic AI features and the managed LLM sit on top for teams that want assisted investigation.

Scale is not in question — this is the engine behind a large fraction of the world's log analytics — but we should be explicit that our own benchmark program measures infrastructure hosts rather than observability suites, so we have no hands-on Elastic numbers of our own. What we can point at: the architecture (Lucene-based inverted indexes, horizontal sharding, snapshot-backed tiers) is designed for exactly the high-ingest workloads that break naive monitoring stores, and the OpenTelemetry support means you are not locked into proprietary agents if you prefer collector-based ingestion.

Reliability of the vendor: a public company (NYSE: ESTC) with thousands of customers and a mature release cadence; the project has been continuously developed since 2009. Elasticsearch Cloud Hosted carries the certifications above; the self-managed version's reliability is, by definition, your operations team's.

Where it falls short

The learning curve is real and it is the most common complaint. Elasticsearch query DSL, index lifecycle policies, shard sizing, mapping decisions and Kibana configuration are all things you must understand to run this well. The new query languages and serverless packaging reduce the surface, but a serious deployment still asks for expertise — or the willingness to buy Elastic's help.

Self-managed operations are a project of their own: JVM tuning, cluster upgrades, capacity planning, snapshot management, security configuration. Elastic's own docs admit the operational overhead of self-hosting, which is why the managed offerings exist. Teams that choose self-hosting to save money sometimes pay it back in engineering time.

Cost predictability is the third issue. Consumption pricing on enriched data volumes means a chatty application or a misconfigured pipeline can move the bill quickly, and the support percentages scale with spend. The volume-tiered "as low as" rates flatter large consumers; small deployments pay noticeably more per gigabyte than the headline.

Finally, this is a platform, not a product. If what you need is "is my site up and how slow is it", a lighter tool gets you there faster. Elastic's depth pays off when you have multiple signals, long retention, and real investigation work to do.

Who should pick this

We pick Elastic Observability for engineering teams with high-volume telemetry and real search requirements: platform and DevOps groups consolidating logs, metrics and traces into one place, organizations with long retention obligations that want cold-tier economics, teams already running Elasticsearch who can add observability without a second data platform, and anyone who wants the option of self-hosting today and managed cloud tomorrow — the skills and data models carry over. Regulated industries get strong coverage from the certification set.

We would not pick it for a small team that wants dashboards up this afternoon with no learning investment, for organizations without anyone who can operate Elasticsearch (choose the serverless tier or a simpler product), or for teams with tiny data volumes where the minimums of a real platform outweigh its benefits.

Key takeaways

• Observability on the Elastic Stack: Elasticsearch + Kibana + Elastic Agent/Beats/APM or OpenTelemetry for logs, metrics, traces, synthetics and RUM in one search engine.
• Open source again since August 2024: AGPLv3 alongside SSPL 1.0 and Elastic License 2.0 for Elasticsearch and Kibana; self-managed is free.
• Serverless consumption pricing: Logs Essentials from $0.07/GB ingest and $0.017/GB-month retention; Complete from $0.09/GB (logs, traces) and $0.023/GB (metrics).
• Meters run on enriched, pre-compression data volumes, so pipeline design — not just raw log size — decides the bill.
• Elastic Cloud spans 50+ regions on AWS, Google Cloud and Azure with FedRAMP High, SOC 2 Type II, ISO 27001, HIPAA and PCI DSS coverage.
• Strongest for high-volume, long-retention, multi-signal environments; too much platform for teams that just need uptime checks and a few dashboards.

Sources

• https://www.elastic.co/pricing/serverless-observability
• https://www.elastic.co/cloud/
• https://en.wikipedia.org/wiki/Elastic_NV
• https://ir.elastic.co/News--Events/news/news-details/2024/Elastic-Announces-Open-Source-License-for-Elasticsearch-and-Kibana-Source-Code/default.aspx
• https://www.elastic.co/docs/deploy-manage/cloud-organization/billing/elastic-observability-billing-dimensions.md
• https://www.elastic.co/blog/elastic-cloud-serverless-pricing-packaging