#06: Elastic | $ESTC
The boring search company sitting in the middle of the AI boom
Elastic
US: NYSE
Industry: Software
Market cap: $6,300 MM
Creator of Elasticsearch, the most widely used open-source search engine
One engine, three products: Search, Observability, Security
Outlines
AI makes search more important, not less
Agents need real search engines, not just vector databases
Elastic’s age may become a moat in an AI world
Cohorts keep expanding, and GenAI is accelerating spend
The market still prices Elastic like old software, not an AI winner
What won’t change in ten years
“I very frequently get the question: ‘What’s going to change in the next 10 years?’ I almost never get the question: ‘What’s not going to change in the next 10 years?’ And I submit to you that that second question is actually the more important of the two, because you can build a business strategy around the things that are stable in time.” — Jeff Bezos
Every conversation about AI investing is stuck on Bezos’ first question. Which model wins, which lab ships the next breakthrough, which benchmark matters this month. I have no edge there, and I doubt anyone does. The leaderboard reshuffles every quarter.
So I want to start from the second question. Not what will change, but what won’t.
In geometry you begin from axioms: statements you take as true without proof, because everything else is built on top of them. I think AI investing needs the same foundation. Below are three axioms about AI that I believe are not temporary limitations of today’s models but structural properties of the technology. They will still be true in ten years, no matter who wins the model race.
AI will always need the right context.
AI can never be fully trusted.
AI prefers what it already knows.
I’ll defend each on its own terms first, then show you the one company I follow that sits in the path of all three: Elastic, a search business the market has largely written off.
For non-technical readers: a large language model (LLM) is not a database. It is a probabilistic system trained on huge amounts of text, code and other data to produce the most likely next token given what it has seen before and what you put in front of it now. That second part, what you put in front of it now, is the context window. Enterprise AI lives or dies on whether the right facts make it into that window.
Axiom 1: AI will always need the right context
The simplest version of the Elastic thesis is this: AI does not replace search; it makes search more important.
A language model is only as useful as the context it sees. Ask it a generic question and it can answer from training data. Ask it a company question, a legal question, a customer-support question, or a codebase question, and the model needs something outside itself: the right internal document, ticket, log line, contract clause, policy or code file.
That is not a model problem. It is a retrieval problem.
It is tempting to think bigger context windows solve it. If a model can read one million tokens, why bother searching? Just paste the whole corpus.
That is the wrong mental model.
First, context is not free. The transformer architecture behind modern language models is built around attention, where tokens are compared with other tokens in the input. There are ways to optimize that, but the direction is still obvious: more context means more compute, more latency and more cost. A company will not feed every internal document into every question just because the window technically allows it.
Second, more context is not always better. The paper usually cited as Lost in the Middle1 found that long-context models often perform worse when the relevant fact sits in the middle of a long input rather than near the beginning or the end. The practical lesson is simple: giving the model more material can bury the answer.
So the bottleneck becomes selection. Out of everything a company knows, which small slice should the model read right now? There is always a ceiling, and it sits far below everything a company knows.
That is search.
And the search problem is getting more complex, not less. The first wave of AI retrieval was often described as if one vector lookup would solve it. Turn the document into an embedding, turn the question into an embedding, find the closest match. That is useful, but it is not enough for many real workflows.
A developer searching a codebase does not only ask for “semantic similarity.” He searches an exact function name, filters by file type, narrows by date, jumps between results, searches again, and combines clues. A security analyst does the same with logs. A support agent does the same with tickets and product docs.
AI agents are starting to behave the same way. They need keyword search, vector search, filters, structured query languages, permissions, reranking, logging and evaluation. In other words, the useful product is not a standalone vector index. It is a search platform.
That is where Elastic is strongest.
One objection worth answering directly: if an agent can just “search”, who needs Elastic? On your laptop you can grep a folder of code. You cannot grep a petabyte of company data on every question. At that scale, fast iterative keyword-and-filter search requires an index, which is exactly what a search engine is.
Axiom 2: AI can never be fully trusted
The second axiom is less fashionable, but just as important: a probabilistic system cannot certify its own output.
A language model produces likely answers. Better models make the answer more likely to be right, but they do not turn probability into proof. Asking the model to check itself helps in some cases, but it is still another probabilistic answer from the same family of systems.
This matters more as AI improves, not less. The more capable the agent, the more damage a wrong action can do. A chatbot hallucinating a paragraph is annoying. An agent with credentials, budget, write access and production tools is a different category of risk.
So serious AI systems need an external watching layer. They need logs of what happened, traces of why it happened, permissions around what the agent can touch, anomaly detection when behavior changes, and security workflows when something goes wrong.
Verification lives outside the model.
Elastic already sells into that outside layer. Observability is search over software behavior: logs, metrics, traces and events. Security is search over attack surfaces: endpoint data, alerts, authentication events and network signals. The data is different, but the primitive is the same: ingest a huge amount of messy machine data, find the important pattern fast, and let a human or agent act on it.
I do not underwrite Elastic primarily on observability. That market is brutally competitive and Datadog is the obvious benchmark. But I do treat it as a meaningful option. If AI puts more agents, more code, more logs, more credentials and more automated actions into production, the world does not become quieter. It becomes noisier. Elastic already sells into that noise.
Axiom 3: AI prefers what it already knows
This is the least obvious part of the thesis, and probably the most important.
A model generates what is most represented in its training data, not what is newest or best. It reaches for the most common pattern, the most documented tool, the most-written-about way of doing things.
That creates a strange inversion in software. Before AI, a newer developer tool could beat an incumbent by being cleaner, faster or easier to use. The human developer would try it, like it, and bring it into the stack.
Agents change the adoption path. A coding agent tends to reach for tools that are common in public code, documentation, examples and Stack Overflow answers. It is much easier for the model to use what the internet has already explained a million times than a newer system with a thinner corpus.
The consequence is simple: AI entrenches incumbents.
Not every incumbent. Not forever. Better products still matter. But in agent-driven software, being widely documented becomes a real distribution advantage.
You can already see the shape of this in databases. When Databricks acquired Neon in 2025, it said that more than 80% of the databases on Neon were being created automatically by AI agents rather than by humans.2 What do those agents overwhelmingly choose? Postgres: a thirty-year-old database whose main qualification is being the most documented default on the internet. Not the newest. Not always the best for every use case. The most familiar.
Elastic has the same kind of advantage in search.
Elasticsearch has been around since 2010. It has millions of developers behind it, billions of downloads, a large open-source ecosystem, years of GitHub issues, examples, tutorials, Stack Overflow answers and production patterns. Elastic’s 2025 Analyst Day deck says 17% of professional developers and 19% of AI developers use Elasticsearch, with 5.5B total downloads and more than 120K GitHub stars across the ecosystem.3
That is not a small thing.
Next to a shiny vector-database startup from 2021, Elastic can look old. Under the old rules, that is a liability. Under the new rules, it can be a moat.
There is one honesty to add up front: this moat protects Elastic better against ‘new challengers’ than against a free fork of itself. OpenSearch exists. It speaks much of the same language. If agents start defaulting to the fork, the corpus advantage flips from moat to trap. That is the biggest risk, and I come back to it below.
Elastic: the overlap
Elastic builds Elasticsearch, one of the most widely used search engines in the world. It powers search bars, log analysis and, increasingly, AI retrieval inside large enterprises. Three commercial workloads run on the same core platform: Search, Observability and Security.
That single engine is why Elastic touches all three truths.
Axiom 1: AI needs the right context. Choosing that context is a search problem, and search is Elastic’s core product.
Axiom 2: AI can’t be fully trusted. It needs an external layer watching what it does, and that is exactly what Elastic’s Observability and Security do.
Axiom 3: AI prefers what it already knows. Elasticsearch is one of the most documented search tools on the internet, so it is what an agent reaches for by default.
The thesis is not that Elastic wins every AI workload. It will not. The thesis is that enterprise AI fundamentally requires context, monitoring, and tools that agents already understand. Elastic is unusually well placed across that intersection, and the market is not pricing it that way.
The business underneath
Everything up to here has been the AI thesis: why search matters more, not whether Elastic is a good enough business to own. So set the axioms aside and look at the company on its own. What follows are its moats: the reasons a rival can’t easily take its place.
Elastic is not just a vector database. That is the lazy way to file the company away, and it is wrong. A vector database is one component inside AI retrieval. It is not the stack. A real enterprise has to ingest messy data, index it, search it, rank it, secure it, monitor it, respect permissions, and make all of that work across the systems where company knowledge actually lives. Elastic’s moat is not any single item on that list. It is that Search, Observability and Security run on one Elasticsearch engine, over one copy of the data, so a customer buys several workflows on a shared relevance layer instead of stitching together four or five narrow tools.
Run it anywhere. Enterprise AI runs on private data, and not every customer can move that data. A bank, a hospital, a defense contractor or a government often has legal or contractual reasons to keep it inside its own walls. For those buyers a cloud-only vendor is disqualified however good the product, and most AI-native infrastructure is cloud-only by design. Elastic is the rare one that also runs self-managed, on the customer’s own hardware, so it brings the search to the data instead of forcing the data out to the search. As data sovereignty becomes a bigger deal, that flexibility is a real moat, not a legacy burden.
Hybrid search. Keyword search wins when the exact string matters: a SKU, an error code, a function name, a customer ID, a suspicious IP. Vector search wins when meaning matters: synonyms, paraphrases, a vague question, intent. Real enterprise retrieval needs both, because the right context is sometimes the semantically similar paragraph and sometimes the one log line with the weird identifier in it. Hybrid search is the practical answer: lexical where precision matters, vector where meaning matters, and reranking to decide what actually earns a place in the model’s limited context window.
Multimodal search. Most of what a company knows, and most of what its customers send, isn’t plain text: recorded support calls, complex PDFs (which traditional text embeddings can't parse), scanned contracts, product photos, video. Searching any of that by meaning runs on embeddings, where each file becomes a point in space and things that mean the same land near each other. Multimodal embeddings are harder to build, and most teams end up renting them from an outside provider and wiring them into their stack. Elastic took the other route: its 2025 acquisition of Jina AI, whose latest family of models embeds text, images, audio and video in a single space, brought that capability in-house. And because the models are open-weight, that retrieval can run wherever Elastic runs, including on the customer’s own hardware.
Open-weight does not mean free. You can download Jina’s models and run them yourself, but the license is non-commercial: put them inside a product and you pay Elastic. Elastic learned this the hard way, giving Elasticsearch away under a permissive license and watching AWS fork it into OpenSearch.
There is another moat that doesn't show up in the product specs: Elastic is still founder-led.
Shay Banon wrote the original code and remains the CTO and one of the largest shareholders. He is still deeply embedded in the product roadmap rather than managing from a distance. You can see this in his recent Q&A session with developers, where he is still visibly engaged in the granular details of search architecture. When a creator keeps that engineering focus and has his own net worth tied to the outcome, it creates a long-term alignment that is hard to replicate.
The proof is in the cohorts
A moat you cannot see in customer behavior is just a story. So here is the proof that the lock-in is real.
They land small and expand for years. Elastic has more than 21,550 customers, including more than 1,550 spending over $100K a year. But the more important point is how accounts grow. A customer running one solution spends roughly $32K of average ARR; two solutions, roughly $103K; three, roughly $390K.
That is the economic expression of the one-engine thesis. Search, Observability and Security are not random adjacencies if they let Elastic enter through one pain point and expand into the next. The customer may start with search and add observability, or start with logs and add security, or start with security and later use the same platform for AI retrieval. The path varies. The pattern is the same: more data, more workloads, more spend.
And the expansion compounds with age. Customers that signed up before FY21 still drove about 61% of all growth since FY20, according to Elastic’s Analyst Day materials. That is not a treadmill of new logos replacing churned ones. It is an old base that keeps compounding.
This one chart is almost a thesis in itself. A business whose oldest customers are still a major engine of growth, more than a decade in, is durability you can measure. It is what would get me interested in Elastic at a reasonable price before adding a word about AI.
Which is exactly what comes next: that durable base is now being hit by a tailwind you can see.
The AI tailwind is already visible
Most AI theses ask you to believe a forecast. Elastic’s asks you to read a chart that already happened.
Start with adoption. Among Elastic’s high-value customers (those spending over $100K a year) GenAI use cases went from 4% penetration in FY23 to 11% in FY24 to 21% in FY25. That is a curve still in its first act: roughly one in five of the best customers has adopted, which means four in five have not yet.
And adoption is showing up as spend. The FY24 customer cohort expanded its sales-led ARR by 42% from its first year to its second, about double the ~20% five-year average, and the highest year-1-to-year-2 expansion Elastic has seen in over five years. Management tags the difference as GenAI.
This is the part I find most persuasive. The AI story here is not a slide about some future TAM; it is a measurable acceleration in what existing customers are already paying, visible in the exact cohort that arrived as the wave hit.
Simple math
As in the last posts, I do not want to build a detailed projection that pretends to know too much. The big numbers are enough.
Growth. At its 2025 Analyst Day, management set a medium-term target of 20% a year, framed as 15% base growth + 5% GenAI tailwind. That target looks reachable: Elastic has grown in the mid-to-high teens for years, and the GenAI lift is already showing up in the numbers.
My own view is that 20% may even be conservative. If Elastic becomes a default layer for AI retrieval, that tailwind could re-accelerate the business well beyond 20% a year. I hold the view loosely, but the asymmetry runs in the company’s favor.
Margins. Management’s other target is the Rule of 40: 20% growth plus a roughly 20% adjusted free-cash-flow margin. I would rather haircut that. Competition is real, AI infrastructure is expensive, and Elastic may need to keep investing in product and go-to-market. So use 15% FCF margin as the base case and treat 20% as upside.
What that compounds to. Start from the recently reported $1.7B in revenue for FY26. Grow it at 20% for five years and revenue reaches about $4.2B. Put a 15% FCF margin on that and you get roughly $635M of adjusted free cash flow in FY31.
Elastic’s fiscal year 2026 ended on April 30, 2026, and results were fully reported in late May. This fresh baseline serves as the starting point for our 5-year projection.
Dilution. Like most software companies, Elastic pays people partly in stock, and that dilutes owners. The offset is that Elastic authorized its first $500M buyback in 2025. That does not make dilution disappear. But buying back stock while the multiple is depressed is the right time to do it, because it converts cheapness into per-share value instead of letting it sit. Management’s medium-term framework also targets net dilution below 2.5%.
The multiple is the punchline. This is what makes the setup asymmetric. Elastic is not priced like a company sitting in the middle of enterprise AI infrastructure. It is priced closer to a good but unexciting software company.
It is not just optically cheap. It is cheap for its growth. Plot revenue growth against price-to-sales across the group and Elastic sits below the fair-value line. You are paying less per unit of growth than for almost any peer.
So the arithmetic has two layers. Even if the multiple never moves, free cash flow compounding at about 20% drags the equity along with it. You roughly double your cash earnings in four years, and that is your return. And if the market ever decides that a profitable, growing AI-infrastructure incumbent deserves even half the peer multiple, that re-rating is a second engine you are not paying for today.
That is the shape I look for: an asymmetric bet. If AI compounds the way it is already being priced into Elastic’s peers, today’s valuation will look like a joke in hindsight. If it doesn’t, you still own a sticky, profitable, founder-led search business bought at a reasonable price. Heads you win a lot; tails you don’t lose much. Bets like that are rare in AI. This is one of the few I have found.
Pitfalls
The free fork wins. OpenSearch speaks Elastic’s language for free. If agents default to it, incumbency flips from moat to trap. This in the one I watch most.
Search collapses into the database. If “good enough” search inside Postgres or the hyperscalers is enough, the thesis plays out without Elastic capturing it.
Observability keeps melting. Datadog keeps taking share, and that leg turns from upside into drag.
Disclaimer: This article is for informational and educational purposes only. Do not interpret anything above as financial advice. Always do your own research before making any investment decision. This is NOT a buy or sell recommendation.