Deep dive on Elastic, a leader in enterprise search, and now the rising player in observability and cybersecurity

Projected IRR 22%

While it is widely known that data is growing at an unprecedented scale, it is actually the growth in unstructured data that is truly extraordinary:

Wikipedia defines unstructured data as “information that either does not have a pre-defined data model or is not organized in a pre-defined manner.” Unstructured data are basically long strings of text containing also hard data such as dates and numbers in a wide variety of formats. This results in a large number of irregularities and ambiguities making it hard to query and make use of this data.

The most common source of this data are the plethora of log files that any organization’s applications are continuously spewing out. Another typical example are the large text-based descriptions of products in an e-commerce store like Amazon.

This is where Elastic’s core search business comes in. The company’s platform creates indices of all this data, making it highly searchable so that insights can be drawn from it. The platform is known for its high-speed, ability to process huge volumes of data, and user-friendly interfaces and query language. The software code leverages the developer community by open-sourcing it which results in a continuous flow of software improvements. Elastic is extremely popular in this community with 63k GitHub stars. For comparison, the most widely used SQL database, Postgres, has 12k stars. The most popular programming language, Python, has 51k GitHub stars.

The leader in Software-as-a-Service (SaaS) for business travel, Concur, uses Elastic to ingest one million documents per second to provide analytics for their customers on business trips. Uber uses Elastic as the data gathering engine to power its prediction tools, such as estimates of driver demand or when a customer’s UberEATS order will arrive.

Elastic adds advanced capabilities on top of the open-source version, and these are sold as the platform’s platinum and enterprise versions. Recently the company has moved to a more restrictive open-source license. The previous license was the Apache 2 license, which is a very liberal license to use the software. This resulted in Amazon offering the open-source version of Elastic on its AWS cloud business under the name OpenSearch. In order to negate this risk going forward, in 2021 Elastic changed the license to SSPL which was created by MongoDB. This prevents other companies from hosting their own version based on Elastic’s code base.

Additionally, Amazon’s OpenSearch version won’t be able to add all the innovations which Elastic recently has been adding such as vector search, which makes use of machine learning to automatically retrieve additional data relevant to your query, or Elastic’s new query language, which enables piping your query results into a series of subsequent queries, avoiding the need to write one long query string.

Amazon’s AWS also provides Elastic’s platform on its cloud marketplace, as do Microsoft Azure and Google GCP. Elastic’s cloud business is growing at extremely fast rates of above 40% annually. Customers are clearly seeing the value in paying for Elastic’s platinum and enterprise versions.

During the latest earnings call, Elastic mentioned how a large Indian e-commerce player moved from AWS’ OpenSearch to the Elastic Enterprise Cloud: “We closed a new 7-figure deal with a major e-commerce platform in India, which moved from AWS OpenSearch to Elastic Cloud via the Google Marketplace. With Elastic Enterprise Search, they were able to dramatically reduce search latency across an average of 2.8 million transactions per day while optimizing the shopping experience for their users.”

They continued: “We also expanded business with a 7-figure deal this quarter with the top U.S.-based global heavy equipment manufacturer. Previously, an OpenSearch customer, the company consolidated its logging platform with Elastic Observability on Elastic Cloud to improve service availability and customer satisfaction. We partnered with AWS on this deal through the AWS Marketplace.”

The other attraction of Elastic is that the software can be run in any environment. The large majority of enterprises today are running their operations in a hybrid environment, meaning that part of the workload is running in private datacenters, with on top of that workloads being diverted to the hyperscalers such as AWS. Elastic’s platform is able to bundle together all data being generated from this multitude of environments. A recent survey concluded that 87% of enterprises are running a multi-cloud environment with 72% operating a hybrid environment.

For companies purely making use of the public cloud, research house Forrester predicts that 81% of them will be opting for a multi-cloud environment as opposed to being locked in at a single cloud provider in the coming years. The key reason is that companies want to be able to shift their workload where pricing is cheapest. So you might be running 75% of your virtual machines with one cloud provider and 25% at another, and shift accordingly to which has the most attractive pricing.

The conclusion from this is that software platforms which allows clients to make use of multiple clouds and mixing that with private datacenters is an attractive area to be exposed to. So Elastic is a nice play on this thematic as well as the growth in unstructured data. Especially as the software’s pricing model is based on the amount of data flowing through it. So as clients analyze more data with Elastic’s engine, this results in more dollars.

Elastic is a leader in the enterprise search market. Forrester sees as key competitors Coveo, smaller player Sinequa, Microsoft, Google and Lucidworks. However, the hyperscalers such as Microsoft, Google and Amazon, are much less of a threat because their products are used to analyze data within their cloud environments.

Besides these names there are also open-source offerings available such as Apache Solr. My personal experience with pure open-source software is that it works well as long as you’re interacting with it as a developer i.e. via code or commands. The UIs on the other hand are often clunky with regular bugs. Also, if you decide to run an open-source solution in your enterprise, there will be limited support. So you need to be sure that your staff really knows that they’re doing and that you’re able to retain them. Additionally, when you need additional functionality added to a software, with open-source it can take years whereas with Elastic turnaround times will be much faster as there is a whole organization behind the software to drive innovation. Then there’s the question if the software can scale up sufficiently to handle your volumes of data. With Elastic you already know from their key customers that the platform is able to handle huge amounts of data.

Typically what you will see is that some organizations can run smaller, non-critical workflows on open-source alternatives. Looking at a list of Solr’s customers they are mostly small companies which I haven’t heard of. The only names that I recognize are Tata Motors and Lam Research. However, as discussed, I suspect these are non-critical workflows. Reading a comparison online on ServerGuy, who I presume knows what’s he talking about, between Elastic and Solr, Elastic clearly has far more functionality.

The time is now ripe to move on to Elastic’s new business ventures, where I actually got pleasantly surprised. Recently the company has been adding both observability and cybersecurity modules within their software platform.

Do me a favor and hit the subscribe button. Subscriptions let me know you are interested in research like this, which is a good motivation to publish more of the analysis I’m carrying out. Special thanks to the 400 subscribers so far!

First, let’s dig in into observability. This module allows a company’s operations teams to monitor the health of their apps running on their servers. Observability software provides customizable dashboards to monitor key metrics of apps’ health statuses such as for example throughput rates, latencies, and error rates. If requests are failing, resulting in errors, the software allows you to drill down where exactly these requests were coming from and how they flowed through your system. This process is called tracing.

The pricing of this module is similarly based on the amount of data you’re running through it. This allows for new customers to enter at a low price point and then gradually pay more as they increase their usage. Naturally the data collection underneath is powered by ElasticSearch. Datadog, one of the two leading platforms in this space, makes use of ElasticSearch underneath as well.

Let’s go into an example of tracing. Below is a simple example of what a system architecture behind an e-commerce store could look like. There is an API gateway to which any consumer’s mobile app connects, whereas the browser’s webpage is generated by an app called ‘storefront web app’. Both of these services connect to three different apps in the background, one to process accounts, one to process product inventory and one to process shipments. All three of these services subsequently connect to their respective database in the background to retrieve and store data.

Suppose that the inventory service starts displaying significant error rates. With the observability dashboard, you can not only drill down to see what these errors are saying, but you can also trace where these requests are coming from. So for example, tracing might show that the requests generating the errors are coming from the storefront webapp. Then the system flags that this app was recently updated with a new code base. So now you know that there’s likely a software bug in the new version. What you can do then is use the observability software to immediately roll-back this app’s code base to the previous version. With this your web store is immediately operational again.

If you manually would have to go through the underlying logs while running tests yourself, it can take a long time to figure out what exactly is going on. Speed can be of critical importance. Every hour that an online store is not functioning properly means lost revenues as well as client dissatisfaction. But an even worse scenario would be a ransomware attack - quick detection allows for an isolation of the possible threat, which might save the business in its entirety.

The above example is what a simple system architecture looks like. A large company utilizing a microservices architecture such as Netflix can have hundreds or thousands of apps like the above in communication with each other on their servers. Below is an illustration of Uber’s microservices architecture and how a particular request can flow through the system’s needed services. Each bubble here is an app with its size indicating how frequently it has to process requests.

Despite its recent entry, Forrester already sees Elastic as one of the strong performers in this market and rates them third in terms of offering behind clear leaders Dynatrace and Datadog (vertical axis).

At their Q2 call, the company gave the following example of a recent client win in this area: “This quarter, we expanded an 8-figure multiyear piece of business with a multinational financial services company, which uses Elastic Observability and Elastic Security. The company relies on Elastic Observability for distributed tracing to enable the migration of thousands of applications from the company's data centers to Microsoft Azure and Google Cloud, and uses Elastic Security to significantly reduce the time spent on threat hunting.”

Now we can turn our attention to the highest growth area, security. The cherry on the cake if you like. This module underneath makes use of ElasticSearch as well – data is pulled in from network, application, and access management logs. The platform then conducts analysis to detect potential security threats. Security analysts can monitor the health of their system on customizable dashboards within Elastic’s platform. The platform also has collaboration built-in, so you can flag potential threats and issues to other analysts and add comments and screenshots.

At the recent capital markets day, Elastic gave the example of OLX, a Dutch online marketplace, which recently added Elastic’s security solution. Their existing tools had reached their limits in terms of the data volumes they could process. With Elastic’s platform, they were able to increase their security-related data collection by 20x, from 500 gigabytes per month to 10 terabytes per month.

Forrester already sees Elastic as a leader in security analytics, rating them number one in terms of strategy (horizontal axis) although still lagging Splunk and Microsoft in terms of offering.

Recently Elastic added XDR (extended detection response) to their security module. XDR is basically the most advanced approach in the field of endpoint security, which is where an organization employees interact with the companies’ systems. XDR applies machine learning to detect potential security threats. For example, it can prevent phishing attempts, which are still the most common way to get inside a corporation’s systems. So if an employee attempts to run a malicious file he has received over email called ‘danger.xls’, or perhaps a more subtle name, XDR can block execution of this file.

The leaders in this field are CrowdStrike and Microsoft. Forrester rates Elastic as a strong performer and number three in terms of strategy. Over time they should be able to expand their offering and move up the vertical axis.

On the Q2 call they gave the following example of a large client win in this area: “We renewed and expanded our cloud business with Uber. They have been using Elastic for threat hunting, investigation and response and recently expanded their use of Elastic SIEM to power their entire enterprise defense platform.”

The company recently acquired two smaller security startups, build.security and Cmd, both active in cloud security. When Elastic makes tuck-in acquisitions like these, it integrates their code base into their platform. So it’s not like they’re selling a product on the side like Oracle has historically done. Typically they acquire small start-ups with novel tech that would have taken them considerable time to build themselves.

Clearly the company is broadening their offering in this area and this should be a good market to be exposed to given the strong growth rates in cybersecurity. A large part of this market is also still covered by legacy solutions. So there’s plenty of prospect for an upgrade cycle over the coming 10 years.

Looking at Elastic’s annualized contract values (ACV) split by business, despite their more recent launches, observability and security are already large contributors. Currently security is showing the fastest growth rates. As observability is a larger market than search, it already has become the largest contributor to Elastic’s revenues at 40%.

I suspect that software consolidation within the SaaS space will become a key theme during the coming 10 years. Firstly, clients will look to consolidate the number of tools they use on a more select number of platforms. Secondly, as growth rates moderate over time, the smaller, unprofitable players are likely to go out of business and we will see further M&A amongst the top players resulting in an attractive margin expansion story. Elastic has a strong position to participate in both these trends. They should be able to leverage from their strong position within search, giving them a competitive advantage into the adjacent observability and security markets, which underneath make use of enterprise search.

Booking.com, the largest app in Europe for travel accommodations, is an example of a company using Elastic’s entire suite. Elastic’s CEO:“Booking.com started with us on enterprise search. When you go to Booking.com and you're purchasing anything related to travel, you're hitting Elastic under the covers. It was a classic enterprise search use case. But from there, they quickly realize that the application could be used for observability. They started using us for log analytics, and over time, have started using us for security.”

Valuation (share price at time of analysis is $55)

Elastic has been generating consistently high organic revenue growth rates. Percentage growth rates have been moderating over time which is logical due to the law of large numbers.

Below I calculated the absolute growth in sequential quarterly revenues while adjusting it for currency impact (using the data in the chart above). You can see that the company has been adding on average $15 million to quarterly revenues each quarter over the last ten.

Given that Elastic’s end-markets are growing at attractive double digit rates, and with Forrester already rating highly Elastic’s new offerings in observability and security, which are much larger markets than search, it seems reasonable to project growth levels to be sustained for the foreseeable future. Barring of course a general downturn in the macroenvironment. CrowdStrike for example, the leader in endpoint security, is already doing $2.2 billion in annual revenues. Datadog and Dynatrace, the strong players in observability, are doing $1.7 billion and $1.1 billion respectively. Elastic is currently doing around $1 billion in annual revenues. According to IDC data, Elastic’s total addressable market is $88 billion currently.

If we model in continued revenue growth of around $15 million per quarter for the coming nine quarters, this gets us to $1.54 billion in annual revenues by 2025. This brings us slightly above consensus expectations for 2025. $1.54 billion implies the business growing at an average rate of 20% over that period.

Consensus estimates

Consensus improvements in EBIT margins are roughly in line with the company’s guidance of 4 to 5 percentage points per year. Due to the mix shift to the cloud, as 90% of new customers are landing on the cloud, they mentioned that over time they can improve both gross and EBIT margins. Some of Elastic’s peers have considerably higher gross margins e.g. Datadog (79%), Dynatrace (82%) and Zscaler (78%) so there’s certainly room for upside.

The company has $280 million in net cash and is already cash-flow positive, so there shouldn’t be any risk that a further capital raise would be necessary.

During the final quarter of last year, the company has started seeing macro headwinds, especially in the small-and-medium-sized business segment. The enterprise segment on the contrary, has remained very solid (chart below). And the large segment ditto continued to show strength.

To err on the side of caution with these macro headwinds, Elastic laid off 13% of their workforce, like many tech companies have done (even the FANGs). Most of these layoffs were in sales and marketing to the SMB segment. As these customers are more and more landing on the cloud anyways, they reckon a large part of the sales delivery processes can be automated by selling over the hyperscalers’ marketplaces. Nevertheless, this will reduce revenue growth rates over the coming quarters.

Elastic’s CEO on the outlook: “We’re focusing on those customers that are above that $10,000 ACV threshold and focusing less on the long tail of smaller customers that might spend just a few hundred dollars a month. And we are not expecting the SMB environment to change either in the near future. On the other hand, we continue to see on the enterprise side, long-term opportunity for us to continue to do well. The change has been to make sure that we rebalance investment towards areas that I've talked about as being strategically important, and that's all around the cloud. We will continue to hire for the right roles in the second half of fiscal '23 to ensure we are set up successfully for fiscal '24 and beyond.

These actions set us on a path to deliver improved non-GAAP operating income growth in the second half of FY '23 and a 10% non-GAAP operating margin for FY '24. Although we fully expect to be a multibillion-dollar company over time, given the current macro environment we are operating in, we do not expect to achieve the $2 billion revenue mark in FY '25. We believe that it is prudent to consider that consumption trends might slow further before they improve again. Having said this, I will reemphasize our conviction in the long-term opportunity in front of us. And we also saw customers continue to show a preference for consolidation onto our platform for multiple use cases.”

Given the strength Elastic is showing in the large and enterprise markets, and a large number of companies seeing macro headwinds, I’m inclined to believe that the weakness in adding new small customers is indeed driven by the macro environment. As well as the company pulling back investment in this area. A large software company such as SAP boasts 112k customers, so with Elastic only having 19k currently, there’s still plenty of room to grow.

Elastic is currently trading on 4.2x NTM Sales. This looks cheap compared to the company’s peer group of high growth SaaS companies active in data, security, and observability. Elastic is also cheaper than more mature software companies who exhibit lower growth rates. Albeit, you can make the argument that SAP and Workday are much stickier businesses, as its very hard to replace these when the core of your business is running on these platforms.

The other argument you can make is that Elastic is still generating only small profits. Below is an overview of how the business model of a typically good software company evolves. Both the high-growth and mature software company make gross-margins of around 75%. However, as the high-growth company still has to add considerable functionality to their suite, it has to spend much more R&D, around 35% of revenues versus 20% of revenues for the mature company. The biggest cost burden however is sales and marketing. Not only do you have to do substantial on-site client meetings to run new potential clients through your software offering, but once they sign on, there is still considerable support involved especially in the first 6 months to 1 year to get them up and running well. So as the high-growth company is pitching to many clients and winning a lot of contracts, this results in an SG&A spent of around 60% of revenues. Whereas the mature company can cut this in half. This results in an EBIT margin of -20% for the high-growth company, and 25% for the mature company.

This is why comparing software companies on an EV-to-Sales basis is useful. The key is picking the good ones which can transform over time into the quality, mature businesses generating solid EBIT margins.

The same logic goes for share based compensation (SBC), the high growth company has to spend considerable amounts on SBC as typically employees have to go the extra mile to drive growth in the business. However, once the business matures, this is ditto a cost that can be cut back.

Bringing it all together, with the strength of the new businesses and Elastic’s ability to expand revenues at existing customers, this should become a $1.5 to $2 billion business in the medium term. If I model in my revenue forecast of $1.54 billion for 2025, add some modest re-rating to an EV-to-Sales of 5.5x as the near term macro headwinds blow over, while factoring a 5% dilution per annum from SBC (in line with history and company guidance), this brings me to an IRR of 22%.

The shares are listed on the New York Stock Exchange under ticker ESTC. Looking at the sell side, 14 analysts rate the shares as Buy, with 6 Holds and 1 Sell.

Conclusion

Elastic already looks cheap and there should be little downside risk on the multiple. Whereas having gone through their offerings in security and observability, they actually look very promising, with already high ratings from a leading consultant such as Forrester. And plenty of clients signing up. This gives substantial opportunity for the business to grow north of 20% annually over the coming two years, beating consensus numbers. Under reasonably modest assumptions you can get to a 22% IRR. Overall, the risk-reward looks attractive in this name.

If you’ve enjoyed reading this, hit the like button below and subscribe. Also, please share a link to the research on social media with a positive comment, it will help the publication to grow.

You can find a complete overview of all research here.

Disclaimer - This article doesn’t constitute investment advice. While I’ve aimed to use accurate and reliable information in writing this, it can not be guaranteed that all information used is of such nature. The projected IRR is a subjective calculation based on what I estimate a likely and reasonable scenario for the shares to be, however, the shares’ future performance remains uncertain and a more negative scenario could play out. The views expressed in this article may change over time without giving notice. Please speak to a financial adviser who can take into account your personal risk profile before making any investment.