Elastic Observability: Monitoring Ledger 2026

Part of the Infrastructure Monitoring Ledger (edition 2026-10-04). How the scores work: methodology.

Snapshot

Tier: Challenger
Owner: Elastic N.V., listed on NYSE (ESTC) since 2018
Licence model: Open-core: free tier under AGPLv3, SSPL or ELv2; Platinum and Enterprise subscriptions quoted per resource unit
Products scored: Self-managed Elastic Stack for observability (Elasticsearch, Kibana, Elastic Agent and Fleet, APM) up to Enterprise tier; Elastic Cloud not scored
Latest release: 9.5.4, 2026-09-09 (9.5.0 on 2026-08-04)
Next signal: Agentic incident workflows over MCP, ES|QL on cold tiers, gNMI and OTel streaming; no dated release
Archetype: Logs-first observability platform
Evidence grade: B. Release tags and docs are primary, but the two files disagree on AI Assistant GA timing, MCP maturity and the DCGM release date, and network-device depth is thinly documented.

Scorecard

Dimension	Score	Direction
Capability today	81.2 / 100	higher is better
Momentum since end of 2022	+3.4 points	higher is better
Credibility	21.0 / 25	higher is better
Commercial risk	8.5 / 25	lower is better
Technical lock-in	11.0 / 25	lower is better
Integrator fit	15.0 / 20	higher is better
AI leverage	14.5 / 20	higher is better
Ledger Index	73.0 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Server, virtualization and storage (12)	2.5	3	3	3.5
Network monitoring (12)	2	3	3	3.5
Application and service monitoring (10)	2.5	4	4.5	4.5
Data collection and scale (12)	3.5	4.5	5	5
Alerting and event management (12)	2.5	2.5	3.5	3.5
Visualisation and reporting (8)	3	4	4	4
Logs and traces (8)	4	4.5	5	5
Automation and remediation (8)	3	3.5	4	4
Security and compliance (8)	3	3.5	4.5	4.5
New-platform support (VMware exit) (10)	1	2.5	3	3.5
Total / 100	53.0	69.0	77.8	81.2

Year by year: 2016: 53.0 · 2017: 53.0 · 2018: 53.0 · 2019: 69.0 · 2020: 69.0 · 2021: 70.2 · 2022: 77.8 · 2023: 77.8 · 2024: 79.0 · 2025: 81.2 · 2026: 81.2

What moved the score

Year	Domain	Change	Points	Trigger
2019	Application and service monitoring	2.5 → 4	+3.0	7.x (2019): Elastic APM GA with distributed tracing and service dependency maps; Heartbeat uptime checks
2019	Automation and remediation	3 → 3.5	+0.8	7.x (2019): official Ansible collection and Terraform provider
2019	Data collection and scale	3.5 → 4.5	+2.4	7.0 (2019): index lifecycle management with hot, warm and cold tiers; petabyte-scale clusters
2019	Logs and traces	4 → 4.5	+0.8	7.x (2019): Logs app with live tail, Elastic Common Schema, APM traces
2019	Network monitoring	2 → 3	+2.4	7.x (2019): Metricbeat SNMP module GA, Filebeat NetFlow v5/v9 and IPFIX with top-talker dashboards
2019	New-platform support (VMware exit)	1 → 2.5	+3.0	7.x (2019): Kubernetes and Docker modules GA; KVM module; no Proxmox or AHV package
2019	Security and compliance	3 → 3.5	+0.8	7.x (2019): TLS and RBAC free in Basic; SAML and OIDC in paid tiers; Spaces
2019	Server, virtualization and storage	2.5 → 3	+1.2	7.x (2019): Docker, Kubernetes and KVM modules; SAN/NAS metrics via SNMP and syslog
2019	Visualisation and reporting	3 → 4	+1.6	7.x (2019): Lens, Canvas, Elastic Maps and per-team Kibana Spaces; no network maps
2021	Data collection and scale	4.5 → 5	+1.2	7.14 (2021): Fleet and Elastic Agent GA, central policy for tens of thousands of agents
2022	Alerting and event management	2.5 → 3.5	+2.4	8.5 (2022): unified alerting with grouping, flap detection, maintenance windows, ServiceNow, Jira and PagerDuty connectors
2022	Application and service monitoring	4 → 4.5	+1.0	8.5 (2022): OTLP intake in APM Server, Playwright browser synthetics GA, SLO tracking
2022	Automation and remediation	3.5 → 4	+0.8	8.x (2022): Fleet API and certified ServiceNow connector for incidents and CMDB
2022	Logs and traces	4.5 → 5	+0.8	8.5 (2022): logs, metrics and traces correlated via ECS and OTel trace IDs
2022	New-platform support (VMware exit)	2.5 → 3	+1.0	8.x (2022): Kubernetes and OpenShift integrations; AHV only via community Prism scripts
2022	Security and compliance	3.5 → 4.5	+1.6	8.0 (2022): security on by default, audit logging, FIPS 140-2 mode; KEV entries dated 2022, no deduction
2024	Server, virtualization and storage	3 → 3.5	+1.2	8.12 (2024): NVIDIA DCGM integration; Fleet host, Kubernetes and Redfish integrations; AHV still community scripts
2025	Network monitoring	3 → 3.5	+1.2	9.0 (2025): sub-minute SNMP poller and topology discovery; 9.4 gNMI; no NCM or device template depth
2025	New-platform support (VMware exit)	3 → 3.5	+1.0	9.0 (2025): OpenShift Virtualization and KubeVirt via Kubernetes integration; Proxmox only as a Linux host

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-05	8.8: ELSER semantic search model	D7 AI-assisted operations	V
2023-11	8.11: AI Assistant for Observability	D7 AI-assisted operations	M
2023-11	8.11: ES	QL GA	D8 Logs and traces
2024-02	8.12: NVIDIA DCGM Fleet integration	D1 Server and virtualization	M
2024-05	8.13: AI Agent Builder	D7 AI-assisted operations	M
2024-06	8.14: Universal Profiling GA	D3 Applications and services	C
2024-08	8.15: AGPLv3 licence option restored	D12 Packaging and licensing	M
2024-08	8.15: streaming NetFlow analyzer	D2 Network	C
2025-03	Official MCP server repository (0.x)	D11 Ecosystem openness	M
2025-04	9.0: LLM inference tracing	D7 AI-assisted operations	M
2025-04	9.0: Lucene 10 engine	D4 Collection and scale	U
2025-04	9.0: sub-minute SNMP poller and topology discovery	D2 Network	C
2026-05	9.4: ES	QL columnar acceleration on cold tiers	D4 Collection and scale
2026-05	9.4: gNMI streaming telemetry	D2 Network	C
2026-08	9.5: multi-tenant Fleet policy scoping	D9 Security	C

Centre of gravity: AI-assisted operations (4), Network (3), Collection and scale (2)
Driver mix: Vision 13%, Customer need 40%, Market window 40%, Upstream 7%, Portfolio 0%

Credibility: 21.0 / 25

Criterion	Score	Basis
Cadence	4.5	Minor releases every few weeks and a major every two to three years (8.0 2022, 9.0 2025)
Roadmap transparency	4	Public release notes and GitHub repositories; direction via ElasticON and blogs, no written roadmap
Say-do	4.5	8 of 8 tracked promises GA within 12 months 2023-2026, lags 0 to 2 months
Velocity	4.5	Several observability features per minor release, e.g. ES
Lifecycle stability	3.5	Majors bring breaking changes and upgrade assistants; support window length not in the research

Say-do record, 2023 to 2026: 8 of 8 research-ledger promises shipped (ES|QL, AI Assistant, DCGM, Universal Profiling, AGPLv3 option, MCP, 9.0, ES|QL cold-tier acceleration), lags 0 to 2 months. AI evidence: 3 of 3 on time.

Commercial risk: 8.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2	2024-08: AGPLv3 option added after the 2021 SSPL/ELv2 move; quote-only resource-unit pricing
Purchase constraints	2.5	Free tier exists, but ML, SSO, ServiceNow connectors and AI Assistant need Platinum or Enterprise
Channel and access	1	Open downloads and public documentation; certification open to all
Owner stability	1	Independent listed company since 2018; no change of control
Cost of staying supported	2	Subscription tiers gate key features; 2019 moved basic security to free

Security record of the product itself: Three KEV entries, none dated 2023-2026: CVE-2019-7609 Kibana Timelion RCE (KEV 2022-01-10, fixed 2019), CVE-2015-1427 and CVE-2014-3120 Elasticsearch scripting RCE (KEV 2022-03-25, fixed 2014-2015). No deduction (the security record).

Technical lock-in: 11.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	Lucene indices readable only through Elasticsearch; ECS schema and Kibana saved objects are documented JSON
Export path	2	Snapshot API, scroll search, Logstash outputs and OTLP export; no importers into other tools
Stack coupling	3.5	Elasticsearch required as store and ES
Hardware / cloud coupling	0.5	Any hardware, VMs or Kubernetes via ECK; runs offline
Skills and tooling coupling	2	ES

Integrator fit: 15.0 / 20

Criterion	Score	Basis
Partner programme openness	3	Partner programme not covered by the research; large certified engineer base and official clients
Multi-tenancy and self-service	3	Kibana Spaces, document and field security, 9.5 Fleet policy scoping; no MSP billing
API and infrastructure-as-code	4.5	Full REST APIs, official Terraform provider, Ansible collection and ECK operator
Skills and certification	4.5	Elastic Certified Observability Engineer and Engineer exams, hands-on and proctored

AI leverage: 14.5 / 20

Strand	Today	Latest step
AIOps on monitoring data	4.5	2024: 8.12 (2024): NVIDIA DCGM metrics; 9.0 (2025) LLM inference tracing
AI platform stack	3	2025: 9.0 (2025): LLM observability with token and latency tracing
AI-assisted operations	3.5	2024: 8.13 (2024): Agent Builder for diagnostic and remediation agents with operator confirmation
Agent openness	3.5	2026: 9.4 (2026): release notes list MCP support; AI evidence still shows 0.x, half step

AI say-do: 3 announced, 3 GA on time (AI Assistant, DCGM integration, Agent Builder), 0 preview, 0 pending, 0 dropped. ML anomaly detection has shipped since 2017; the generative assistant recommends and drafts queries but does not act alone.

Reading

Elastic approaches infrastructure monitoring from search and logs, and since 2023 has put its effort into ES|QL, OpenTelemetry intake, profiling and generative AI on top of an ML engine it has shipped since 2017. Its record is strong: frequent releases, every tracked promise delivered within a quarter, and a licence that moved back toward open source in 2024. The trade-off is thin network-device and hypervisor depth compared with dedicated monitors, and the features that matter most for operations sit in paid tiers on an Elasticsearch-centred stack.

Open questions and evidence caveats

Scores assume Platinum or Enterprise; the free AGPLv3 tier lacks ML, SSO, ServiceNow connectors and the AI Assistant.
The files disagree on AI Assistant GA (8.11 in 2023 or February 2024) and on whether the MCP server is GA; the lower reading was used for MCP.
SNMP polling, traps and device templates are thinly documented; the network score may be high or low by half a point.
Self-managed prices are quote-only per resource unit.