Search. Observe. Protect. | Our Investment in Elastic NV (NYSE:ESTC)
Unpacking the opportunity that exists with a compelling and undervalued business that is supporting the data revolution
Please note that this article does not constitute investment advice in any form. This article is not a research report and is not intended to serve as the basis for any investment decision. All investments involve risk and the past performance of a security or financial product does not guarantee future returns. Investors have to conduct their own research before conducting any transaction. There is always the risk of losing parts or all of your money when you invest in securities or other financial products and individuals should consult their financial advisor to discuss their specific situation before taking any action.
Too Long, Didn’t Read? Quick Highlights:
Investors must understand and implement the power of second-order thinking into their investment framework. Businesses are complex adaptive systems and many times things are not as they first appear. Companies that have a strong overarching consensus narrative can present quite interesting investment opportunities, especially if investors identify asymmetric risk-to-reward situations associated with a non-consensus choice. While the goal is not to dissent for the sake of dissenting, these situations generally merit further consideration.
Continued internet and cloud expansion is causing companies to rapidly integrate a myriad of technology products into their fundamental stack, causing exponential growth in various forms of data. This expansion of data presents a hurdle for companies since it becomes critical to properly structure and evaluate such information to make advantageous business decisions. Elastic allows companies to organize, search, and make sense of data and also helps IT professionals adequately monitor and protect key infrastructure which is becoming imperative in a digital native ecosystem.
The CEO of Elastic, Shay Banon, built the company via an open source software model to improve initial distribution and garner validation through an engaged community. Open source allowed Elastic to build a robust product through a loyal following before shifting focus to monetization through commercialization. This decision resulted in slower initial monetization but has resulted in a fantastic product and should lead to greater network effects over time.
Open source can be a problematic business model in a cloud native environment given that major cloud providers can easily capture value by taking the open source code and adding it as a feature to their cloud service. Elastic has implemented a recent license change which moves away from a “true open source model” but forces the cloud providers to maintain their own version. This licensing revamp will produce further product differentiation and should drive future commercial success.
Elastic exemplifies Hamilton Helmer’s business strategy principle of process power by having an incredibly strong product release cadence due to an obsession with reducing customer friction. While this sounds simple, the rate at which Elastic improves the product is a competitive advantage.
Elastic’s core product offering, Elasticsearch, drives the lion’s share of initial customer adoption, but Elastic is increasingly upselling its customers on relevant adjacent product offerings such as monitoring, logging, and security. As customers adopt more than one product offering, friction is reduced and switching costs increase resulting in improved customer life time values.
Despite strong execution, Elastic is undervalued compared to its software peers and currently trades at 17.3x TEV/2021 Revenue vs. the peer median of 28.2x.
Elastic is led by a fantastic CEO who has a deep understanding of the industry, built the product from the ground up to solve a fundamental problem, and has done a superb job of utilizing M&A to build a software platform.
The Power of Second-Order Thinking and Overcoming the “Common” Narrative
In order to improve as investors, we often reflect on our decision making process to understand what we did right, what we did wrong, and where we were lucky or hindered by misfortune. Through analyzing our decision making process overtime, we have come to appreciate the power of second-order thinking.
To understand second-order thinking, imagine playing a game of chess where an opponent places their queen directly in the kill zone of your pawn. Of course you would take the queen…right? That initial choice is what we would classify as first-order thinking, where the focus surrounds the consequence of an immediate, and even impulsive, action. While taking the queen may indeed be the correct move, a player should really be thinking, “After I take the queen, what happens next?”
Reframing the idea that quickly taking an opponent’s queen is a possibly disastrous move helps players refine their decision making to focus on inputs that actually increase their chances of winning the match. This is why superior chess players are often times thinking 5-10 moves ahead.
“Failing to consider second and third-order consequences is the cause of a lot of painfully bad decisions, and it is especially deadly when the first inferior option confirms your own biases. Never seize on the first available option, no matter how good it seems, before you’ve asked questions and explored. To prevent myself from falling into this trap, I used to literally ask myself questions: Am I learning? Have I learned enough yet that it’s time for deciding? After a while, you will just naturally and open-mindedly gather all the relevant info, but in doing so you will have avoided the first pitfall of bad decision making, which is to subconsciously make the decision first and then cherry-pick the data that supports it.”
–Ray Dalio (Principle 5.1)
While the chess example relates directly to how first-order thinking can be disastrous in the short-term, this mental model can be advantageous when a situation presents itself and the consensus opinion is “take the queen”. After careful consideration, there may be tremendous value that lies in not taking the queen.
One thing we have observed in the public markets is that often a broad and overarching narrative surrounds a company (and consequently their stock price). This narrative is generally a proliferation of first-order thinking by market participants. The majority of such participants choose to play a short-term results oriented game, which shapes a short-term and quarterly focused consensus view.
We believe that sometimes things are not as they first appear. Companies that have a strong overarching consensus narrative can present quite interesting investment opportunities, especially if investors unpack the risk-to-reward situation of the non-consensus choice. While the goal is not to dissent for the sake of dissenting, these situations generally merit further consideration to properly understand risk.
While there are plenty of examples, both long/short, a few mispriced long opportunities come to mind:
Circa ~2015: “Tesla is just a poorly run car company that loses money on every car it sells…Porche, Audi, and other car manufacturers are starting to create electric vehicles…bankruptcy is inevitable, it’s just a matter of time.”
It was misunderstood that Tesla was a technology company, had favorable accounting advantages in being able to resell environmental credits, was years ahead of the competition in self-driving, and perhaps most importantly, had also developed a cult like community of followers
Circa Feb 2021: “Apple killed the IDFA and it will subsequently kill FB…who uses it anymore anyways?”
In process…but statement continues to misunderstand the vast amount of the world that spends countless hours each day in the family of Facebook apps and the subsequent advertising reach Facebook brings to most brands
We also believe that we have found another simple overarching narrative in 2021.
Circa 2021+: “Amazon’s ability to replicate Elasticsearch, results in no reason for users to pay for ESTC’s product offering and will ultimately lead to the demise of ESTC”
We suggest that by digging deeper it can be realized that not only is this narrative misunderstood, but that ESTC is a severely undervalued company solving an incredibly important pain point for companies as they build products in the continued digital revolution
Company Overview
In 2004, Shay Banon (CEO & co-founder of Elastic) moved to London to support his wife’s dream of becoming a chef. Shay was unemployed at the time and decided he would start playing around with technology to improve his software programing skills. Shay focused on building an app that his wife could use to capture all the cooking knowledge she was gathering.
“I picked many different technologies for this cooking app, but at the core of it, in my mind, was a single search box where the cooking knowledge experience would start as a single box where typing a concept, a thought, or an ingredient would start the path towards exploring what was possible.
I got completely hooked with the project, and was working on it more than the cooking app itself, up to a point where it was taking most of my time. Now, 10 years later, it is the basis of Elasticsearch.” – Shay Banon, CEO & co-founder of Elastic
Elastic is a software company that offers 3 main product offerings:
Elasticsearch (Commonly referred to as The Elastic Stack which includes 4 main sub-products)
Elasticsearch – The foundational product offering. It is a distributed, real-time search and analytics engine and datastore for all types of data, including textual, numerical, geospatial, structured, and unstructured
Kibana – The user interface for the Elastic Stack. It is the visualization layer for data stored in Elasticsearch. It is also the management and configuration interface for all parts of the Elastic Stack
Logstash – Dynamic data processing pipeline for ingesting data into Elasticsearch and storage systems from a multitude of sources
Beats – The group of lightweight, single-purpose data shippers for sending data from edge machines to Elasticsearch or Logstash
Elastic Observability – A solution that provides real-time insights into software applications and IT infrastructure performance to enable better user experiences, faster problem detection, and quick resolution when there is a critical issue; Elastic Observability gives users a central place to add and configure data sources, a variety of charts displaying analytics relating to each data source, and an ability to view in app options to drill down and analyze data in the Logs, Metrics, Uptime, and APM apps
Logs – Logs indexes, searches, and analyzes structured and unstructured logs at large scale to monitor the health and performance of an organization’s services, infrastructure, and applications. Users can analyze and visualize information extracted from logs to understand system behavior and trends to optimize performance and preemptively address potential issues. By querying logs in ad hoc ways, users can triage, troubleshoot, and resolve performance issues
Metrics – Metrics ingests, searches, visualizes, and analyzes numeric and time series data from IT systems, including applications, datastores, hosts, containers, cloud infrastructure, and more. Users can review performance and utilization trends to optimize and plan for future needs. Metrics helps users deliver on infrastructure service level objectives, and resolve downtime or performance issues by understanding how the state of individual components fits into the bigger picture
Uptime – Customers and users leverage Uptime to track and monitor the availability of the hosts, websites, services, and application endpoints that support business operations. Through proactive monitoring, customers can detect troublesome components before they are reported by end users
APM – APM delivers insight into application performance at the code level. Developers can instrument apps and see the lifecycle of a transaction across services from front end to back end. This can give developers confidence in the code they ship, and can give operational teams visibility into code-level errors and performance bottlenecks to accelerate root cause analysis and resolution during an investigation
Elastic Security – Allows customers to detect threats in real time and investigate security signals across the IT ecosystem
Security information and event management (SIEM) – SIEM provides an interactive workspace for security teams while automating threat detection and remediation, reducing time to detect and respond to threats. Teams can triage events and perform investigations, gathering evidence on an interactive timeline. SIEM also streamlines opening and updating cases, forwarding potential incidents to security operations workflows and IT ticketing systems
Endpoint Security – Combines prevention, detection, and response into a single, autonomous agent. It is designed to stop threats in the early stage of an attack and includes protection against ransomware, malware, phishing, exploits, fileless attacks, and more
Elasticsearch is the foundational product on which Elastic was built when the company was founded in 2012 and we find this short excerpt useful of how the company explains their product.
Elasticsearch is the distributed search and analytics engine at the heart of the Elastic Stack. Logstash and Beats facilitate collecting, aggregating, and enriching your data and storing it in Elasticsearch. Kibana enables you to interactively explore, visualize, and share insights into your data and manage and monitor the stack. Elasticsearch is where the indexing, search, and analysis magic happens.
Elasticsearch provides near real-time search and analytics for all types of data. Whether you have structured or unstructured text, numerical data, or geospatial data, Elasticsearch can efficiently store and index it in a way that supports fast searches. You can go far beyond simple data retrieval and aggregate information to discover trends and patterns in your data. And as your data and query volume grow, the distributed nature of Elasticsearch enables your deployment to grow seamlessly right along with it.
While not every problem is a search problem, Elasticsearch offers speed and flexibility to handle data in a wide variety of use cases:
Add a search box to an app or website
Store and analyze logs, metrics, and security event data
Use machine learning to automatically model the behavior of your data in real time
Automate business workflows using Elasticsearch as a storage engine
Manage, integrate, and analyze spatial information using Elasticsearch as a geographic information system (GIS)
Store and process genetic data using Elasticsearch as a bioinformatics research tool
We will spare you from additional technical details of the product offering as many of our readers do not have a technical background, but if you want to have a better understanding of the technical aspects of Elastic’s product offering, we recommend that you check out Muji’s HHHYPERGROWTH article, where he did an in-depth technical review. The company also has an extensive reference guide here.
Elastic’s Core Value Proposition is Increasingly Relevant
As the cloud continues to gain prominence and as companies continually integrate technology into product offerings, the amount of data grows exponentially.
In 2019, it was estimated that 90% of the world’s data was created in the prior 2 years. If you find business memes enjoyable, the below illustration sums up how such a statistic needs a refresh.
COVID-19 forced companies to work from home and dramatically accelerate supporting infrastructure, which has pushed the data revolution forward. It was simply an adapt-or-die type situation for corporations around the world. While it is conjecture on our part, we wouldn’t be surprised if the new headline read something similar to, “90% of the world’s data was created since the start of the COVID-19 pandemic.”
The problem with expounding data is that people and companies struggle with the enormous challenge/opportunity of how to quickly make sense of it. Elastic is a company that helps organizations make sense and sift through aggregated data by allowing users to run informational searches of sorts.
A few prominent examples include the following:
Elastic powers the search behind ride sharing apps to help locate nearby riders and drivers
Elastic powers the search for finding the right products when a user searches an e-commerce website for an item they want to add to their cart
Elastic powers the search box when you visit a website like Cooking.com and the users are looking for their favorite recipe
Elastic powers the search engine for Slack. The next time you are searching for the presentation your boss sent you 2 weeks ago for the meeting that starts in 5 minutes, but you can’t seem to find it, thank Elastic for helping you locate it quickly.
Elastic powers Instacart’s search for when you need your favorite flavor of Ben and Jerry’s ice cream.
Elasticsearch has become the default search tool to be integrated into one’s website or to search one’s data. While Google is used to search the internet, Elastic exists for the rest of the data.
The below example given in a customer call speaks to the robust nature of Elastic’s search capability.
Interviewer: “Can you talk about what makes Elasticsearch better or differentiated?
SVP, Information Technology Company: “You can do a bunch of cool things with Elastic that isn’t possible with other products. There is a relationship between public and private data where we can conduct what I call relevant searches which is different, in that, most traditional data services are built on hard matches. For example, let’s say that you live in Dallas and you had an elementary teacher who you are trying to reconnect with. Maybe you remember her first name, you knew she lived in Dallas but you heard she moved to Colorado. In Elasticsearch, because it connects multiple data sources into one record, you can create a search that says, ‘Show me Nancy who lived in both Dallas and Colorado who was also a school teacher.’ Elastic will go through all the databases of the 330 million individuals who live in the USA and singularly identify that individual in less than a second. That is crazy raw power. You can’t do that with any other product.
While search is Elastic’s core functionality and easiest to understand use case, given the large amount of data flowing through Elastic’s software, it made sense for Elastic to expand its product offering to include observability and security which helps IT professionals ensure their IT applications, networks, and infrastructure continue to run smoothly.
Interviewer: “If you had to force rank the various search offerings available, where does Elastic fall in that ranking?
CEO of Software Development Consulting Firm: “Elastic is number 1. I don’t even have to pause to answer that honestly. In search, they are simply the best product out there. You can call them the Apple of search if you want. Additionally, they are building an amazing ecosystem that is extremely cheap to get started with and then easy to expand usage overtime given the value it provides…and let me tell you, when it starts to expand, Elastic will make a lot of money in a variety of ways. At that point, I don’t see how anyone could rip out Elastic and bring in something else. They [Elastic] have a massive advantage here that once a customer implements Elastic, there really is no going back.”
The Magic of Utilizing Open Source Built a Strong User Base and Primed the Commercial Opportunity
When Shay Banon first began writing the software behind Elasticsearch, he knew it had to be open source. Open source allowed a better development and distribution model as it reached a larger audience and garnered stress testing and validation through an engaged user community.
Our business model is based on a combination of open source and proprietary software. We market and distribute the Elastic Stack and our solutions using a free and open distribution strategy. Developers and other users are able to download our software directly from our website. Some features of our software can be used free of charge. Others are only available through paid subscriptions, which include access to proprietary features and support. These paid features can be unlocked with a simple license update, without the need to re-deploy the software. The source code of all Elastic Stack features, whether they are open source or proprietary, is visible to the public in the form of “open code.” – Elastic 10K
Elastic indeed differs from many of its software peers in that it was originally based purely off an open source model. This is one of the reasons, that when compared to other fast growing SaaS companies, Elastic has exhibited a slightly longer runway to scale. Shay made it a priority to build a great product with a dedicated community before thinking about monetization. Then, when the scale and support were there, switched on a monetization engine to drive topline growth.
While many top SaaS companies don’t employ an open source business model, we believe that if a company builds the right open source software it can represent somewhat of a competitive advantage.
In 2010 Elastic had been downloaded only a handful of times, whereas in 2018 it had amassed over 350 million downloads, an impressive number by any standard.
Competitive advantages from successful open source projects are largely the result of a highly engaged developer community which provides almost automatic and continual product validation. This creates a powerful feedback loop as companies like Elastic benefit from having their core product stress tested by a global audience. Elastic benefits tremendously from this approach as the empowerment loop indicates exactly what users want, which in turn helps the company continually improve the software and maintain a high product release cadence.
“I think the critical thing about open source software is actually not that the source code is available, it's rather what that represents. So by making your source code available, you can affirm some degree of trust with the community, you can of course invite contributions into the source code, you can make it very easy for people to deploy that source code and customize it to their needs within an environment without the sort of corporate sponsor being involved.”
– Jeremiah Lowin, CEO & Founder of Perfect
The feedback loop mentioned is also advantageous for developing proprietary commercial software. Through customer feedback, Elastic is able to deliver an enterprise solution in a way that dramatically reduces friction for customers, that is, users are paying for convenience in the form of expertise and additional features via Elastic. By not paying Elastic it would cost customers a great deal of time, money, and focus to create an equally scalable and effective solution.
“The open source is a way for people to inform us what they want us to do. We redeliver that proprietary platform in an open source way, but our challenge is to make sure that we deliver it to our paying and our enterprise customers in a way that scales across their entire organization, plugs right in with as little configuration as possible.”
– Jeremiah Lowin, CEO & Founder of Perfect
This is where we have been quite impressed with Shay and the Elastic team. They have been focused, patient, and disciplined enough to realize that building the right open source project around a robust community has the potential to create an accumulating advantage in the long run as they upsell additional enterprise software features.
While Elastic is a great open source project that built the foundation for the rest of the business, the future enterprise software business is increasingly attractive.
“We are a business. And part of being a business is the belief that those businesses who can pay us, should. And those who cannot, should not be paying us. In return, our responsibility is to ensure that we continue to add features valuable to all our users and ensure a commercial relationship with us is beneficial to our customers. This is the balance required to be a healthy company.”
– Shay Banon
There are essentially 3 ways for an open source company to make money:
Sell support subscription services
Create a separate ‘Enterprise Edition’ of the software
Identify high-value features and offer them as commercial extensions to core software
Breaking down each option:
In our view, support-only businesses have a conflict of interest between what is best for the end user and what is best for the company. The company isn’t motivated to make the product easier to use because that would hurt future support revenue
Enterprise Editions often fracture the community and create a divide between paying users and free users with the free version lagging the paid version in software updates, features, and security
The route Elastic has chosen (“Elastic X Pack”) allows the company to continually invest in a product that is available to everyone, but also protect their IP and make money from the software they work hard to build and improve
In speaking to customers who use Elastic’s product offering, we gained an appreciation for how open source encourages initial use under a free tier and allows a user to see the value Elastic adds before paying for additional features/scale.
Interviewer: “If Elastic has an open source version where you don’t have to pay them anything to monitor your applications, why don’t you use that version?”
Fortune 500 Senior Director of Cybersecurity Architecture (Elastic Client): “Initially we did, but once you scale monitoring across many applications, you really need to upgrade from the basic version. From a cyber perspective, the amount of data per node really requires a paid license, so once we realized we were going to utilize Elastic in the org, we quickly moved beyond the open source version into the paid model
Interviewer: “So obviously, your company has a ton of resources and employees, why don’t you just hire a bunch of engineers and build this product in house? Especially since the source code is available?”
Elastic Client: “It’s not only that. I mean it’s like building a car or something. Do you want to build the steel mill to support the production of the car or do you just want to focus on building the car? This is not our core competency. We have a generally small team that works on cyber and I don’t want them focusing on building something like this since 1) there are actually things we could build ourselves in other areas of cyber which would be useful for us and trying to rebuild Elastic in-house would take away time from other projects and 2) we’d rather have Elastic’s expertise where there is literally hundreds of engineers dedicated to building this vs. us trying to re-build it with only a few engineers. Remember, we are trying to operate our business at scale and building everything in house is not really a scalable model, so we would rather pay Elastic.”
——
Interviewer: “You started with the open source version and then moved to paid, can you explain why you decided to start paying for Elastic, also, why not just build it in-house?
Fortune 500, Head of Product Data: “Look, any open source software we use, especially at scale, we know this is not our core competence. It’s also expensive to build these services on your own, right? In the Bay (San Francisco), if you hire 3-4 engineers to work on this, that’s probably $2mm of compensation per year. That’s not cheap! Then you realize that you can use the paid version of Elastic, which not only gives us peace of mind, helps in deployment, bugs being solved, and other enterprise level security features, and it makes sense to pay for it.
The Problem With Open Source in a Cloud Native Environment and the Looming Competitive Threat
A specific problem with open source has stemmed from the cloud native environment. Once an open source project becomes interesting and popular to many end users, it becomes easy for cloud vendors to capture a majority of the value and give nothing back to the community by taking the open source code and adding it as a feature to their cloud offering.
In 2018, MongoDB was frustrated with the cloud giants ripping off its database platform and pursued a new route. MongoDB announced they would change to a new type of license, the SSPL (Server Side Public License), which explicitly disallows running Software-as-a-Service if it’s not open source. With the SSPL license, everyone using it must make available not only the software source code and any modifications, but also the source code of applications used to run the service. In essence, a large cloud provider would have to reveal everything they are running which would allow anyone to clone the cloud service provider’s architecture. Cloud providers are unwilling to comply with this request, so they build a forked version of the software that they must maintain if they want to continually offer the service to customers.
~2 years later after the license change, MongoDB has grown revenue from $267mm to $591mm and the stock price had appreciated +375%. When MongoDB CEO Dev Ittycheria was asked if this sparked the company’s growth, he responded, “I mean, you won't really know, but I would say that a big part of what happened is that a lot of people suggested, "your adoption is going to be hurt because people won't consider this a real open-source product." That's the furthest thing from the truth in terms of what's happening. Our popularity has exploded. But we do think that was important for us. We roughly spend about 50% of our R&D [budget] on the core [MongoDB open-source project], which is free, right? A lot of cloud providers spend a minuscule amount of R&D on open sourcing their products; 99.999% of their work is on work that they're trying to monetize. And we just did think it was patently unfair for someone to take our hard work, our time and our money and then try and take advantage of that. And so we made that change.”
As Elastic has become generally accepted, and its use case viewed as critical, it has been interesting to observe how hyperscale cloud players have chosen to work with or compete against Elastic. Google and Microsoft both made the choice to partner with Elastic for managing the Elastic Stack on their cloud platforms, as opposed to building a competing service. Amazon, on the other hand, decided against associating with Elastic and instead opted to run a self-implementation of Elasticsearch to provide a fully managed service that allowed users to operate and scale Elasticsearch in AWS.
Amazon’s “Open Distro of Elasticsearch” is based off the open source code of Elastic and includes security, alerting, and SQL modules created by AWS. The narrative surrounding this competitive threat from Amazon and their Elasticsearch offering has been somewhat concerning over the past several years to many market participants.
To maintain positioning in the competitive frontier, Elastic recently changed its licensing structure to prevent companies from charging money for the open source code. Elastic mentioned the following via their official statement earlier this year:
“As companies continue the shift to SaaS offerings, some cloud service providers have taken open source products and provided them as a service without investing back into the community. Moving to the dual license strategy with SSPL or the Elastic License is a natural next step for us after opening our commercial code and creating a free tier, all under the Elastic License, nearly 3 years ago. It is similar to those made by many other open source companies over these years, including MongoDB, which developed the SSPL. The SSPL allows free and unrestricted use, as well as modification, with the simple requirement that if you provide the product as a service, you must also publicly release any modifications as well as the source code of your management layers under SSPL.”
Elastic is moving their Apache 2.0-licensed source code to be dual licensed under the Serve Side Public License (SSPL) and the Elastic license. This will give users the ability to choose which license they want to apply and guarantees that customers have free and open access to modify and collaborate on code.
As anticipated, Amazon decided to fully commit to an Elasticsearch fork. On April 12th Amazon announced the introduction of OpenSearch, a community-driven, open source fork of Elastic. This move indicates that Amazon is intensely committed to developing a competing product in search.
“Today, we are introducing the OpenSearch project, a community-driven, open source fork of Elasticsearch and Kibana. We are making a long-term investment in OpenSearch to ensure users continue to have a secure, high-quality, fully open source search and analytics suite with a rich roadmap of new and innovative functionality. This project includes OpenSearch (derived from Elasticsearch 7.10.2) and OpenSearch Dashboards (derived from Kibana 7.10.2). Additionally, the OpenSearch project is the new home for our previous distribution of Elasticsearch (Open Distro for Elasticsearch), which includes features such as enterprise security, alerting, machine learning, SQL, index state management, and more.”
– Amazon AWS
As Amazon begins to fork the code to avoid the SSPL license, they will have to invest in the R&D themselves. This adds a tremendous amount of friction as they can no longer “take and bake” Elastic’s R&D. While it seems like the large cloud providers could potentially be positioned in search and logging, it is much easier said than done.
Interviewer: “I’ve always thought, why has Amazon screwed this up? They have a search offering but they don’t have a community. Given they are so large, it seems like they are best positioned to contribute to these open source type of projects and really drive their own product offering vs. using something like Elastic.”
Industry Consultant (Elastic Client): “I think two reasons really. 1) Open source really has to be in your DNA as a company. Someone like Amazon just doesn’t have that in their DNA. They are an Apex predator. 2) It could generate a massive conflict of interest from other open source projects. Imagine, if they decided to dedicate significant resources to building an Elastic search, then the Hadoop or Linux community would be like, wait a minute, what about us running this on AWS? Where is our commitment? So AWS picking and choosing is not really possible as it could alienate users from their platform.
We believe the recent license change will insulate Elastic from somewhat unfair competition and allow for increased market share. It is quite possible that Elastic’s product will become more differentiated as Amazon won’t be able to compete via replication and they don’t have software development muscle like Elastic.
Elastic has also exhibited strong execution in terms of product improvement with a rapid release cadence, which has provided a competitive advantage. We have a high degree of confidence that the recent license shift will only deepen this competitive moat, especially if the team continues to iterate at hyper speed.
“The competitive landscape will no longer be a replica of Elastic that is just provided as a service by a third party vendor. Over time, enterprises and mid-market customers will increasingly choose to adopt Elastic over other forks as product differentiation and security features expand.” – Raimo Lenschow, Barclays Equity Research
It is not our intent to dismiss Amazon and other providers as competitive threats, but we have a high degree of confidence that Elastic will continually be able to maintain a competitive edge as the default search provider over the next decade. While not impossible, we feel it highly improbable that Amazon will shift their focus to developing an equally feature rich search product as it would detract from their core business focus.
Additionally, while the community has been valuable for Elastic over the years, we aren’t overly concerned with what has been perceived to be a somewhat negative community reaction regarding the license change. We understand why some open source enthusiasts may be unsettled, given Elastic is not “truly open source” anymore; but the vast majority of concerned community members have never been, and never will be, paying customers. Community support is vital for carrying a company to a certain scale, but once the community has performed the heavy lifting, the non-paying user becomes less valuable as paid users drive further product features and thus become the primary focus.
As with any investment, some of our concern revolves around how a company’s strategic decisions will impact the business opportunity over the long-term. We genuinely believe that Elastic’s strategic license decision will result in value creation over the next several years and will not dampen opportunity, scale, and penetration with customers.
In speaking with customers, we have observed that they want to pay for a validated, proven, and leading solution; in the world of enterprise search that product is undoubtedly Elastic.
Elastic Exemplifies Hamilton Helmer’s Business Strategy Principle of Process Power
In our article on Counter Positioning, we discuss using Hamilton’s Helmer’s 7 Power framework to think about how an upstart can use a larger incumbents margin profile against them. Another Helmer principle that is apparent with Elastic is what Helmer lists as his 7th power, referred to as Process Power.
Upstart Benefit = A company with Process Power is able to improve product attributes and/or lower costs as a result of process improvements embedded with the organization
Barrier = The Barrier in Process Power is hysteresis: these process advances are difficult to replicate, and can only be achieved over a long time period of sustained evolutionary advance
Elastic’s product release cadence is unusually strong. By digging into the Github repository, speaking to active customers, and reading Elastic’s blog, it is evident that Elastic releases new versions and adds product features at a high clip.
This incredible product focus gives Elastic an additional advantage over its peers. While it sounds simple, the rate at which they improve the product offering is differentiating. Not only do they add new features, but they also quickly repair any bugs in previously released versions.
Elastic’s rapid product iteration DNA has assuredly contributed to the development of a robust community. We also believe Elastic’s focus on product improvement is one of the fundamental drivers behind their best in class search product and improving monitoring, logging, and security functionality.
“There have been a few times, maybe 8-10 different cases where we’ve found some type of bug that was affecting our cluster and not only did Elastic listen to our feedback and made changes within the week, they helped us implement a configuration that enhanced the ability of cluster. This type of relationship is very valuable and we’ve developed a great relationship with them over the years…it’s interesting that they purchased Endgame and have moved towards the endpoint to tie everything into the Elastic Stack. It makes sense with the flow of data and I think that could be an appealing offering for us. We haven’t used it yet because we have some existing commitments to endpoint security, but as it (Elastic’s Endgame) gets better and our other agreements expire, we’ll probably seriously consider consolidating everything at Elastic” – Fortune 500, Cyber Security Director
Not only is Elastic making the product continually better, but they implement features to improve ease of use.
“Elastic’s product guys are incredibly smart. For instance, when I first started talking about implementing Elasticsearch, I have a bunch of SQL server guys that work for me who were pretty nervous. These guys know SQL server, they don’t know how to use Elastic and there is always some resistance to learning a new product. However, Elastic was paying attention. They were listening. So they built an SQL interface into Elasticsearch so now these guys can query Elasticsearch using SQL language they grew up with and rely on…this took out the fear in my conversation with these guys. I would have gotten really passive aggressive pushback on accepting this new platform but now it’s just another product they use”
–SVP, Information Technology
From multiple conversations, and additional research, we haven’t found many direct competitors who seem to be this customer obsessed. Elastic’s relentless product iteration is best-in-class and we believe a continued focus on commercial opportunity is going to further separate them as a market leader.
The Power of a Platform – How Search Has Provided Elastic With Product Differentiation and Scalability
While Elastic’s bread and butter is robust search functionality, we are impressed by the company’s ability to construct a platform and build a three-pronged product suite.
Having search as a core use case allows Elastic to adequately develop additional customer inroads via monitoring and security. Over the last several years, Elastic has been able to successfully onboard customers onto more than one solution, providing them with platform optionality.
Elastic’s platform has been primarily constructed via acquisitions, and we feel the company has done a superb job executing this strategy. This aggressive bolt-on strategy has allowed Elastic to expand their product line by building on top of Elasticsearch to develop three core product offerings, which in turn has greatly expanded their TAM opportunity.
Below is a list of the respective acquisitions Elastic has made over the years:
Kibana (2012) – Visualization dashboard app that worked on top of Elasticsearch
Logstash (2012) – Converts log files into data objects and imports into Elasticsearch
Found (2015) – Cloud-neutral Elastic Hosting SaaS Service (Elastic Cloud)
Packetbeat (2015) – Also known as beats; network packet analytics library and built ELK stack to monitor distributed systems
Prelect (2016) – Predictive analytics surrounding cybersecurity and IT operations
OpBeat (2017) – APM system for Javascript apps
Swiftype (2017) – SaaS search service designed to make it easier for enterprises to add search capabilities to a website or app
Insight.io (2018) – Dev-focused SaaS tool for creating search interface over source code
Endgame (2019) – Endpoint protection platform
Integrations of the above listed acquisitions have allowed Elastic to create three main product lines: Search, Application Performance Monitoring (APM), and Security (SIEM and EPP). We find these acquisitions are increasingly relevant to Elastic’s end users as they are all product offerings that take advantage of the extremely high flow of data through Elastic’s core platform. While Elastic’s APM, SIEM, and EPP products may not be considered best in class, they have become increasingly palatable and are increasingly recognized as “good enough” when compared to leading offerings.
This platform offering reduces friction, especially given that the average requirements of many enterprises may not particularly demand best of breed functionality across the board. It is important to note that Elastic’s resource-based pricing model encourages core search customers to receive security and monitoring as cost-effective add-ons. While some sophisticated customers may require the premium product for every enterprise data use case, a vast majority of businesses are perfectly fine using APM and security solutions that are ~85% of the way there. We become even more enthused when product upsell via a platform approach reduces friction in terms of implementation, support, and pricing, all of which occur with Elastic.
“Elastic has been a product we’ve used in some shape or form for a long time. Originally we used it for search but maybe 3 or 4 years ago, we made the decision to get out of Splunk and use Elastic for logging. Look, Splunk is great, potentially the best product within logging, but it’s extremely expensive. We were paying like 6 million dollars and with Elastic, not entirely sure but it’s probably around 1 million. What’s really interesting is when we first started using Elastic for logging, it actually struggled. We had some performance issues. But we persisted and Elastic actually kept getting better. Today the products are very comparable. Sure, if you have no cap on your spend, Splunk is still probably better, but unlimited spending caps aren’t realistic and Splunk hasn’t been innovating.
– Fortune 500, Head of Product Data
We expect this land and expand platform model to continually develop over the next several years, and feel there is particular opportunity with endpoint security. Since Elastic acquired Endgame in late 2019, we feel optimistic about the amount of slack left in the rope of product development and security ecosystem partnership opportunities. As referenced above, Elastic has proven to be quite capable with product iteration and we expect the company to continually iterate, and integrate, security and APM developments into the overall stack.
The data shows that Elastic is consistently pushing the platform into the enterprise, especially to those customers that have higher ACV. As observed below, it is exciting to see that >45% of customers with $1mm+ ACV are using 3 or more solutions.
Such customer expansion and platform upsell is captured in Elastic’s Net Dollar Retention (NDR) figure, which they release on a quarterly basis. Elastic has maintained an NDR figure above 130% since becoming a public company (2+ years). We view NDR as one of the most important metrics for a SaaS business as it captures the value of a cohort of customers over time and factors in expansion, cross-sell, and churn.
The way we like to think about this metric in simple terms is if Elastic had zero new customers next year’s revenue would still grow at approximately 30%. In the SaaS world an NDR figure over 120% is strong, while anything over 130% is the absolute gold standard, especially when sustained for longer periods of time. Oddly enough, some customers are surprised it’s not more than 130% given how they continue to allocate spend in the category.
“Only 130%? I think if I had to guess that is too low. Most companies who are using Elastic are probably growing faster than 30% and you have to realize their data is growing more which will require more nodes which benefits Elastic”
– Fortune 500, Head of Product Data
This fantastic expansion across cohorts is evidence that Elastic is scaling with their customers. Whether Elastic is being deployed at a small startup, an organically growing company, or through an older enterprise that is focused on M&A, nearly all IT professionals note how easy it is to flex up and down with Elastic’s products.
Interviewer: “Can you talk about Elastic’s ability to scale within your org? Is this something that is relatively easy or difficult? Additionally, if you know how this [Elastic] compares to other solutions, that would be really helpful?”
Director, Cyber Security at Fortune 500 (Elastic Client): “One of the things that is unique about our company is that we grow significantly through acquisition. When you have a single network, you control a lot of the tooling on that network. You can standardize around certain vendors. However, when you acquire a company, the cost of standardizing all of those acquisition to a single vendor, say a certain vendor for your firewalls, that cost becomes actually prohibitively high. So the flexibility of the big data environment in our company was especially important. As you mentioned, a core concept we needed in our software was scalability. We needed to be able to double the platform in size in a year or two if we needed it, and it turns out we did. We needed flexibility to be able to ingest any data source, be able to create rules and search over any data source.
Extensibility is another key one that if a year or two years down the line we needed the platform to actually perform a different function than it was today, if there was something that we haven't considered yet, the platform really should have been able to advance into that. We also didn't want to get locked into a vendor solution, I guess, or a solution where the vendor would basically not be able to fulfill one of those requirements. So most vendor solutions that we found would have some kind of proprietary step in the data process basically. This wouldn't allow you to export your data to another system or would have a connector that would only work with their products, and we generally found that Elasticsearch was the only one to fulfill our requirements. We started running Elasticsearch actually open source, which is another key part here. We had the money for hardware, but we didn't have the budget in place for licenses yet. The fact that you can operate Elasticsearch at any scale that you want for free, just as a proof of concept, we did that for maybe four months. Then at some point, we decided these extra features are actually worth paying for because the product works. The whole core product being available for free was a huge differentiator.
From analyzing the core search capabilities and the tangential platform expansion opportunities, we believe that Elastic possesses high switching costs. From customer diligence it is clear that once a company properly harnesses the power of Elastic’s search capability it becomes difficult for them to transition to another search product. If a customer begins to use other Elastic solutions, the implementation scheme, pricing, and vendor relationship all introduce a form of convenience.
While not impossible, it is rather cumbersome and consuming to replace a universal solution with three separate products. As Elastic continues to spread throughout an organization via multiple solutions, switching costs are only increased. While we realize that some organizations demand gold standard solutions (ex. Crowdstrike for endpoint security), we are excited to see Elastic cross-selling to larger customers and are hopeful that continual product development will accelerate this.
Given Elastic’s Efficient Growth and Business Profile, We Believe Them to be Undervalued When Compared to Peers
Elastic’s revenue base combined with it’s growth profile indicate that they possess a powerful go-to market engine. Developers are attracted to Elastic’s product, which drives them to freely serve as Elastic evangelists in the enterprise. This product-led growth model is important since it allows Elastic to maintain efficient revenue growthat scale, which is a metric we care about tremendously.
To measure growth, we tend to look at sales efficiency via unit economics to determine if the fundamental GTM model works. We prefer to analyze sales efficiency through what is known in SaaS as the Magic Number, a metric that tells us how much revenue a company generates given their S&M spend. We like to calculate the magic number by taking new subscription revenue generated in a given quarter, annualizing it to get a rough cut of Annual Recurring Revenue (ARR), and then dividing implied ARR by the previous quarters S&M spend.
A magic number of 0.7x and above is generally deemed attractive, since it indicates that for every $1.00 spent on S&M the company generates $0.70 in ARR. Overtime S&M spend is expected to decrease due to maturity and scale. All else being equal, companies with strong magic numbers should be able to produce ample cash flow as S&M spend is ratcheted back to a lower percent of revenue.
Once we have a magic number we typically perform a quick calculation to produce a payback figure, which tells us how many months it takes for the company to cover its S&M spend. At the public company level, we gain confidence in figures that are less than 18-20 months.
Note: To calculate payback for a magic number of 0.7x, we simply run the following calculation: (1/0.7)*12 = ~17 months
Valuation is perhaps the most interesting part of Elastic’s public market story. The company continues to execute well, has demonstrated staying power in a competitive market, and quarter over quarter has produced strong metrics and unit economics. After such context, it becomes interesting to observe that Elastic trades below the median SaaS TEV/2021 Revenue multiple, yet they produce revenue growth and sales efficiency figures that are far above the median.
In today’s SaaS environment where revenue growth, scale, and efficiency drive valuation, we believe the current pricing is missing the complete story. This may be from an incomplete competitive narrative, the potential threat from Amazon’s forked version, or a failure of the broader investing community to understand the fundamental importance of the product.
While we don’t view MongoDB as the perfect comp, the head to head comparison is warranted given both offer a database solution. Elastic trades at 10.9x turns (TEV/2021 Revenue) and 16.4x turns (TEV/2021 Gross Profit) lower than MongoDB, yet Elastic has a similar revenue base, is growing revenue and billings faster, has a better rule of 40 score, has ~450bps higher gross margins, and also maintains higher NDR. Furthermore, these forward valuation multiples reflect the Wall Street consensus that is relatively conservative in our view given customer diligence.
A complete breakdown of Elastic vs. comparable companies can be analyzed below:
We believe the market exists to serve us, as opposed to guide us, and as such take no issue with the observed valuation disconnect. While we can’t be certain of the future, we feel that from a valuation perspective the odds are certainly stacked in our favor.
Strong CEO Coupled With the Right Board
Like many investors, we search for exceptional founder CEOs that have skin in the game via company ownership, a passion for continually reducing customer friction, and a vision to create optionality through integration / M&A / product development. As founder of Elasticsearch, Shay understands the utility and scope of the product / project better than anyone else. (If you haven’t read our article on why we prefer founder-led companies, we encourage you to check it out.) He created the original search solution to solve a problem he cared about, saw the path to forge ahead and create a more complete solution, and has maintained gritty focus to create a successful commercial opportunity.
We also have become quite confident with Shay’s ability to build optionality into Elastic through proper capital allocation via bolt-on acquisitions. He has done a fantastic job in identifying product areas where expansion can occur, has found and acquired promising young companies, and has integrated and iterated well thus far. While progress must continually be maintained, we have a high degree of confidence in his ability moving forward.
From speaking to former employees and customers who have interacted with Shay, confidence in the management team was increasingly encouraging:
“There is a reason I still hold my Elastic stock. Look, I worked there and I know the people who are still there and the CEO is an absolutely brilliant, brilliant guy….if Elastic wanted me to come back into a role that would fit, I’d do it without question. It’s an amazing place to work. I know I mentioned that Shay is a brilliant CEO and leader, but it’s not just Shay, but all the people that work underneath him. – Former Senior VP at Elastic
“Shay is a pretty data-heavy guy. If the data is suggesting they move into the security space because customers want it and it ties into Elastic’s core offering, that is what they are going to do and that is why they are going to be successful.” – Former VP of Sales at Elastic
“We were one of Elastic’s largest customers early on, so we had frequent discussion with management on how to make the product better. I was able to ask pretty direct questions to Shay, their CEO, and he always gave solid responses and I can tell he really cares about the product and customer experience. Things like that I’ve always appreciated.”
–Fortune 500, Cyber Security Director
While it is not an issue of extreme importance, it is generally a source of additional confidence when companies have strong boards. Oddly enough, we learned about Elastic 4+ years ago on a phone call with one of the current board members. While the conversation was brief, it became clear that Elastic was a highly efficient company and would most likely provide a compelling opportunity in the public markets.
It is interesting to note that Elastic has two board members from Benchmark Capital (a firm we greatly admire) in Peter Fenton and Chetan Puttagunta. Chetan initially invested in Elastic as private company while he was at New Enterprise Associates, but as an industry expert in enterprise SaaS and opensource he continued to stay on the board even after moving to Benchmark Capital with Peter.
Even more interesting, in March 2021 Chetan purchased 5,000 shares at a time when the stock was trading at what we would consider a bargain. While we don’t consider this a material event, and director purchases don’t drive our investment thesis, it is somewhat validating to see Chetan allocating additional capital to Elastic.
The one concern we have with the management team is Elastic’s CFO, Janesh Moorjani. While we can’t critique Moorjani on his performance and execution, we are a bit concerned with his extremely conservative and somewhat pessimistic attitude in terms of quarterly guidance. While we prefer conservative expectations, we feel that Janesh is perhaps too conservative and the market punishes the stock, or doesn’t fully accept / reward it.
This shouldn’t affect the company over the long-term as fundamental execution is what will drive the price, but we would also like to see Janesh improve his delivery and communication to the street.
What Needs to Happen for Our Thesis to Work
While we are confident in the company’s ability to continually execute and iterate, we are also aware that a shift must occur with regards to the current market narrative. In speaking to a seasoned portfolio manager at a well–respected investment firm, he made an observation that we think investors should consider before investing.
He mentioned that “Too many people start their investment pitch saying XYZ company is undervalued vs. its’ peers. I always respond with ‘So what?! That doesn’t make it a good investment unless there is a catalyst that will change how the market appreciates the asset.”
We believe there are multiple catalysts that can shift the narrative of Elastic overtime:
Elastic changing its license to prohibit AWS from ripping of Elastic’s R&D and resulting in AWS creating and maintaining a forked version
This should drive further product differentiation for Elastic and result in more paying users over the long run
Continued implementation of Hamilton Helmer’s Process Power, especially as Elastic improves offerings outside of fundamental search to win more customers via a platform approach
Executing on the above will allow Elastic to beat Wall Street consensus estimates demonstrating that the threat of Amazon is not a major concern
Shay and the team have built an exceptional business which we feel has the opportunity to develop into a powerful platform over the next several years.
As a final thought, we would like to re-emphasize that it is our goal to invest in fantastic businesses that will compound equity at attractive rates over the long-term and we aren’t concerned in the slightest with short-term stock price fluctuations. While this article doesn’t cover the entirety of our diligence, it does highlight some elements we are excited about.
We don’t claim the investment process to be easy, but rather view it as a difficult task filled with complexity and uncertainty. While we can’t control final outputs or guarantee results, we can strive to control our inputs in the decision making process.
In assessing Elastic we do not believe our qualitative and quantitative inputs to be perfect, but to be sound.
Disclosure: The Authors are currently long Elastic NV (NYSE:ESTC).
Please note that this article does not constitute investment advice in any form. This article is not a research report and is not intended to serve as the basis for any investment decision. All investments involve risk and the past performance of a security or financial product does not guarantee future returns. Investors have to conduct their own research before conducting any transaction. There is always the risk of losing parts or all of your money when you invest in securities or other financial products and individuals should consult their financial advisor to discuss their specific situation before taking any action.
Share price as of publishing date (04/16/2021 closing price): $128.45
I have two questions.
1. If Elastic is such a great company, has 30% ARR, has great products, great customer focus... how come it is growing at merely 42% YOY. Whereas companies like DDOG is growing at 74%
2. It is funny that you mentioned conservative/pessimism of CFO.. If that was the issue, every earnings would have been blowout of conservative forecast.
Loved the article.. very well written!!
Hi.. Based on future cash flows, where do you see it today ? Comparing it to other software stacks appears contrary to what you were recommending in your piece on valuation.