Elastic (ESTC) Stock Q4 FY2020 Earnings Results Review

Elastic released their Q4 FY2020 earnings report on June 3. They delivered a strong beat on growth metrics and demonstrated profitability improvements. If judged based on Q4 metrics alone, the results were outstanding. However, management set forward revenue guidance lower than expected – inline for Q2 and 8% less for the full year. This left investors and analysts confused, particularly as management asserted that all top-line metrics were steady in May. Management attributed the reduction to general conservatism around macro conditions and the start of their fiscal year. The markets reacted by pushing shares down 3.8% the next day, after a nice pre-earnings run up. Sell-side analysts uniformly raised price targets and almost all maintained buy equivalent ratings.

In this post, I review the earnings results and progress on the product development front. I also try to break down Elastic’s portfolio of packaged solutions, platform strategy and general positioning in the market relative to competitive offerings. I realize investors are more polarized on this name than other stocks I cover. In that spirit, I will try to present an objective explanation of Elastic’s strategy and let investors decide how much latitude they are willing to give the company. As a refresher, please see my previous analysis of Elastic for a comprehensive view of their products, the addressable market and competitive offerings.

Headline Financial Results (EPS is Non-GAAP)

• Q4 FY2020 Revenue of $123.6M, up 53% year/year (57% in constant currency). This compares to the consensus estimate of $117.2M, representing growth of about 45.3%. Elastic beat estimates by almost 8% in annualized growth. Q3 revenue growth was 59.9% and 63% in Q4 FY2019.
• Q4 EPS was ($0.12) vs. ($0.31) expected, representing a beat of $0.19. This compares to ($0.28) in Q3 and ($0.28) in Q4 FY2019.
• Q4 Non-GAAP operating loss was $12.7M, generating an operating margin of -10.3%. This compares to an operating loss of $17.5M in Q4 FY 2019, representing an operating margin of -21.7%. Q3 operating margin was -18%.
• Q4 FCF was -$6.8M, for a FCF margin of -5.5%. This compares to a FCF margin of -26% in Q4 FY2019 and -21% in Q3.
• FY2020 Revenue of $427.6M, up 57% year/year (60% in constant currency). This compares to 70% growth in FY2019.
• FY2020 EPS of ($0.93), compared to ($1.11) in FY2019.
• FY 2020 operating loss was $75.6M, representing an operating margin of -17.7%. FY2019 operating margin was -20.5%.
• FY2020 FCF was -$35.6M, generating a -8% FCF margin. FCF margin in FY2019 was -10%.

• Q1 FY2021 (July end) revenue guidance of $119-122M, representing growth of 33-36%. This compares to the consensus revenue estimate of $121.8.
• Q1 EPS estimate of ($0.19) – ($0.17) vs. ($0.37) expected, representing a raise of about $0.19.
• Q1 operating margin is expected to be between -12% and -11%.
• FY2021 Revenue is expected to be between $530-540M, representing growth of 25% at the midpoint. This compares to the consensus revenue estimate of $561.3M, or 33% growth.
• FY2021 EPS is estimated between ($0.98) and ($0.85), versus the consensus estimate of ($1.32).
• FY2021 operating margin is expected to be between -15% to -13%, compared to -18% in FY2020.
• Ended Q4 with cash and cash equivalents of $297M. On the earnings call, management mentioned that they were not planning a capital raise.

Other Performance Indicators

• Q4 Non-GAAP gross margin of 75.8%, compared to 73.8% in Q4 FY2019. For the full year of FY2020, gross margin was 74.7%, compared to 74.0% in the prior year.
• Q4 calculated billings was $175.1M, an increase of 52% year-over-year, or 55% on a constant currency basis.
• SaaS (Elastic Cloud offering) revenue was $29.0M, an increase of 110% year-over-year, or 120% on a constant currency basis. SaaS revenue made up 23% of total revenue in Q4 FY2020, compared to 17% in Q4 FY2019. In Q3, SaaS revenue was up 114% year/year (or 118% in constant currency).
• Q4 Net Expansion Rate continued to be greater than 130%. Elastic does not report the exact number, but anything over 130% is best in class.
• In Q4, 42% of revenue came from outside the United States.
• Average contract length was over 1.5 years on average, with a slight improvement year/year.
• Total subscription customer count was over 11,300 in Q4, compared to 8,100 in Q4 FY2019, representing annual growth of 39.5%. Q3 customer count was 10,500.
• Total customer count with ACV greater than $100k was over 610, compared to 440 in Q4 FY2019, representing annual growth of 38.6%.
• On the earnings call, leadership shared a new metric of customers with ACV greater than $1M. In Q4, this passed 50 customers, up from 30 a year ago. They don’t plan to disclose this metric regularly, but wanted to highlight the achievement.

• Breaking down Q4 Non-GAAP expenses by category, we see a substantial reduction in y/y percentage of revenue spend in S&M and consistent spend in R&D and G&A.
  • R&D = 31.4% (versus 31.3% in Q4 FY2019)
  • S&M = 40.9% (versus 50.1% in Q1 FY2020)
  • G&A = 13.9% (versus 14.1% in Q1 FY2020)

• On the earnings call, leadership highlighted a number of customer wins:
  • Ellie Mae. Adopted Elastic observability solutions.
  • 2 Fortune 50 companies – one in technology and one in retail. Both expanded usage to encompass multiple solutions across enterprise search, observability and security.
  • BNP Paribas (global financial services). Existing Elastic customer for logging and application search. Expanding to include SIEM, as part of a new security operations center.
  • OverDrive (digital reading platform). Elastic already powers search and log analytics for customer-facing applications. In Q4, they added security and made a multi-year commitment for all these solutions.
  • Collector Bank (Nordic digital bank). Renewed multi-year deal in Q4 to run their logging and security workloads.
  • Fortune 50 energy company. Using Elastic Cloud on Kubernetes product to monitor logs.
• The pace of Elastic’s product development continues to be rapid. In the earning’s release and on the call, Elastic reviewed the product additions from the prior quarter:
  • Released v7.7 of the Elastic Stack. According to the CEO, Elastic point releases generally include major functionality. v7.7 was packed with a number of enhancements.
    • Elastic Workplace Search was released to GA. This represents a brand new offering that enables enterprises to power a search experience for employees across their primary business productivity tools. Workplace Search can ingest content from Office 365, G Suite, Salesforce, Zendesk and others. This content is then indexed by Elasticsearch and made searchable.
    • Integrated alerting features across the Elastic Stack. Alert workflows can be adjusted by the user. Alerting is an important outcome of observability and security monitoring, so this addition filled a hole in the current offering.
    • Added case management capabilities, allowing teams to create tickets to track observability or security incidents for response. This integrates with ServiceNow ITSM.
    • Added service maps to Elastic APM. These provide full visibility of infrastructure dependencies to allow for rapid troubleshooting by DevOps teams. According to the CEO, this was a major feature requested by observability customers and represents the last “gap” as compared to other solutions.
    • Added support for asynchronous search to handle long running queries.
  • Released Elastic Cloud Enterprise (ECE) 2.5. This included performance improvements, support for snapshot lifecycle management and migration automation from index curation to index lifecycle management.
  • Released Elastic Cloud on Kubernetes (ECK) 1.1.0. This included support for remote clusters and Elastic APM instrumentation out-of-the-box. Remote clusters allow for cross-cluster search and replication across multiple global clusters.
  • Made several enhancements to the Elastic Cloud offering.
    • Launched a public API for administrators to programmatically provision and configure Elasticsearch Service deployments.
    • Achieved FedRAMP “In Process” status, which adds Elastic Cloud to the FedRAMP marketplace.
    • Beta availability of a new region of Elastic Cloud for government use. This is hosted on AWS GovCloud in US East.
    • Google customers can now purchase annual subscriptions of the Elasticsearch Service on Elastic Cloud through the Google Cloud Marketplace.
    • Rolled out several new hosting locations for Elastic Cloud. Note that several of the international locations would represent new markets due to data locality requirements.
      • Google Cloud: South Carolina, Finland, Taiwan, the Netherlands, Sao Paulo and Singapore.
      • Azure: London, Ireland
      • AWS: Ohio
• Integration of Endgame is progressing. The acquisition added 100 employees to the engineering team with expertise in security. This aids both endpoint protection, and also SIEM. Plan is to fold Endgame’s endpoint security solution into the core Elastic stack. This will allow any existing search, observability or SIEM customer to add endpoint protection seamlessly.

Workplace Search

As mentioned above, the release of v7.7 of the Elastic Stack introduced the Workplace Search offering to the Enterprise Search product line for general availability. Workplace Search provides a centralized search engine for all the content stored in various enterprise productivity tools. It includes pre-built content ingestion connectors for most popular SaaS workforce applications, like Confluence, Dropbox, GitHub, G Suite, Jira, Microsoft 365, OneDrive, Salesforce, ServiceNow, SharePoint Online, Zendesk and more. It also includes a flexible Custom Source API that allows for ingestion of content stored in home-grown repositories like databases or file directories.

Once content is ingested, Workplace Search supports search result personalization on an individual or team basis. Curation tools allow organizations to fine-tune the retrieval algorithm to boost results for certain types of content or filter out items based on security or privacy requirements. For example, the engineering organization could customize their results weightings to favor content from GitHub, Jira and other developer tools.

Workplace Search is included as part of the Elastic Platinum subscription, which provides enterprises with advanced Elastic Stack functionality and full support.  Like other Elastic offerings, pricing is resource based, so customers don’t need to worry about separate costs accumulating for using this product based on number of users/documents/etc.

There appears to be demand in the industry for a better search experience to facilitate centralized retrieval of all the content accumulating in the web of SaaS enterprise productivity applications. Elastic leadership expects this product to drive high customer interest going forward and cites a metric that Forrester predicts spend on enterprise search solutions will increase by 3x over the next 3 years. Forrester also noted that with the release of Workplace Search, Elastic is well positioned to capitalize on this trend.

Additionally, as companies move more interactions to be virtual and remote, there will be more records of conversations generated. Examples are video call transcripts and group messages. Virtual workforces will make the need for Workplace Search more acute.

Analyst Reactions

Following Elastic’s Q4 earnings on June 3rd, 7 sell-side analysts provided updated coverage reports. Of these, they all raised their price targets. Six rated the stock at a buy equivalent and one gave it a neutral rating. The average price target for these updates is about $98, representing a 14% increase from the closing price on June 4th of $85.85.

Date	Analyst	Rating	Price Target
6/4	Piper Sandler	Overweight	Raise from $66 to $94
6/4	DA Davidson	Buy	Raise from $70 to $100
6/4	JP Morgan	Neutral	Raise from $85 to $90
6/4	Canaccord	Buy	Raise from $90 to $100
6/4	Monness Crespi	Buy	Raise from $80 to $100
6/4	Barclays	Overweight	Raise from $70 to $108
6/4	Oppenheimer	Buy	Raise from $90 to $95

Following the earnings results, Barclays set the highest price target, raising from $70 to $108. Analyst Raimo Lenschow provided the following commentary:

Barclays analyst Raimo Lenschow raised the firm’s price target on Elastic to $108 from $70 and keeps an Overweight rating on the shares. Following the “strong” Q4 results, Elastic should see a “re-rating higher” back to the level of other high growth software assets, Lenschow tells investors in a post-earnings research note. The company has reported strong back-to-back quarters with billings growth above 50% and “even more impressive” bookings growth in Q4 of 80% plus, adds the anlayst.

Thefly.com, June 4, 2020

Monness Crespi also raised their price target from $80 to $100. Analyst Brian White gave his perspective on forward guidance.

Monness Crespi analyst Brian White raised the firm’s price target on Elastic to $100 from $80 and keeps a Buy rating on the shares after the company reported “strong” Q4 results and gave what he views as “prudent guidance” for FY21 given the current environment. The company’s key metrics are moving in the right direction while management had a “constructive tone laced with conservatism,” White tells investors.

Thefly.com, June 4, 2020

B of A Analyst Event

The day after the earnings announcement, Elastic’s CFO participated in the Bank of America 2020 Global Technology Conference. This event provided a bit more color on the quarter’s performance and Elastic’s strategic positioning. Here are a few notes from the call:

• After building the core search platform originally, Elastic has doubled down on developing proprietary solutions on top of it over the last couple of years. This heavy investment in solution development will continue going forward.
• Instacart uses Elastic for grocery product search and has driven a lot of incremental usage.
• Color on the prior quarter’s results. Q4 was strong across all dimensions of the business – SaaS revenue growth, customer adds, calculated billings. etc. Strong profitability improvement as well. So far in April and May, nothing specific to Elastic’s business along any of these metrics has worsened.
• Thought process on forward guidance – COVID-19 has been a huge economic shock. Elastic modeled several recovery scenarios – could be “V” shaped, “L” shaped, etc. Leadership landed somewhere in between on recovery, and generally thinks economic conditions will be weak over the next two quarters. After that, they expect conditions to return to prior growth levels.
• Elastic’s fiscal year and Q1 starts in May. For 2021 guidance, they are initiating the full year guidance this quarter, versus other companies that would be updating an existing guide. To start, they want to take a measured and prudent approach. This conservatism is associated with the expected speed of economic recovery, not specific to any Elastic business changes.
• For May (start of Q1), top of funnel activity was the same as April (which was good). The challenge with issuing guidance in early June is that the sales team conducts their annual review in May. Sales people are re-assigned territories and quotas are set. This is typical every year. This process makes extracting sales targets by early June difficult, particularly in this macro environment.
• If they see headwinds in Q1, they would take the form of extended sales cycles in June/July. So far, it is “steady as she goes” according to the CFO. But, most of the sales activity thus far has been top of funnel activity, versus having deals ready to close. April benefitted from many deals that were already teed up earlier in the quarter.
• Elastic leadership intends to push through Q1 and then update annual guidance. They seem comfortable with the idea of raising it, once the true impact of the macro situation becomes clear.
• Have doubled down on Elastic’s partnerships with GCP and Azure. The GCP marketplace supports the direct purchase of the Elastic Cloud. An Azure Cloud executive, Scott Guthrie, spoke at Elastic’s sales team kick-off.
• Logging is a third of the business and is often the first use case for customers. Seeing strong traction with APM and have new customer wins for that solution.
• Splunk is a direct competitor on logging. Feels Elastic is catching up in SIEM. Also encounters Datadog and other vendors on observability. Feels that Elastic’s unified stack with a usage-based pricing model positions them well. There are no incremental costs for customers to add new monitoring features, beyond the associated usage of resources.

Competitive Landscape

Elastic is a difficult company to understand. While the technology offering makes sense to software engineers, its product strategy and competitive positioning can be confusing. This creates challenges with Elastic’s go-to-market strategy for mainstream customers. Worse, it clouds the thesis for investors, who sometimes punt in favor of other software companies with a clearer market focus.

I will try to explain Elastic’s platform, solution offerings and their alignment with competitive offerings. I will also try to present an investment thesis, but appreciate that it relies on formative assumptions that may not play out. At a high level, I think Elastic represents a bet on a long-term platform play, that would have a large upside as the offering solidifies. If Elastic can provide “good enough” solutions across multiple product categories, their argument for consolidation of tooling onto a single platform with flexible, usage-based billing should drive meaningful customer adoption and could leapfrog past competitors offering best-of-breed point solutions. However, this strategy and the sales execution behind it are still developing. It also assumes some degree of commoditization of solutions in observability and security over time. The safe bet for investors would be to simply pick the leader in each category that Elastic competes in. Of course, with some of those names, you could argue that leadership is already priced into the stock valuation. I won’t try to make a strong case for which path to take, but will try to provide you with all the inputs you need to decide. At the end, I will share my personal investment strategy for Elastic.

Product Review

You can read my full analysis of Elastic in a prior post for the complete product explanation. For the purposes of this quarterly update, I will review each component of Elastic’s product suite and then focus on how those align with competitive offerings by category.

At its core, Elastic provides a programmable platform for search. They even market themselves as a “search” company. However, for most investors, this is about as useful as calling oneself a “data” or “collaboration” company. In Elastic’s case, they have built a technology platform called the Elastic Stack that enables three generic functions for processing any kind of data.

1. Data ingestion. This means providing tools to connect to any data source, map the values and enable transformations to a common format. For this, Elastic provides Logstash, which contains a set of over 200 data connectors to external systems with common data formats, and Beats, which provides a set of agents that run on the servers themselves to collect the data and ship it back to the central store. Beats agents enable observability use cases, similar to other monitoring solutions.
2. Data indexing and querying. This involves indexing the ingested data into a storage format that supports fast retrieval. These indexes are then wrapped in a set of code libraries that allow the data to be efficiently queried. The libraries include many controls for boosting, scoring and filtering of results to improve relevancy. In the Elastic Stack, these functions are enabled by Elasticsearch.
3. Data Display. The simplest form of display is to list the search results, like a search engine. However, more sophisticated use cases require summary visualizations of the data, like charts, graphs, tables, etc. For this, Elastic provides Kibana, which delivers the user interface to view and navigate through the ingested and indexed data set.

All components of the Elastic Stack are open source and programmable. This means that developers can review source code for any component to understand the mechanics of it. More importantly, developers can extend the base code to create a custom solution for their company’s use case. Many companies have embraced the Elastic Stack for just these reasons. The customer use case page provides numerous examples, many with technical diagrams in videos and slide decks reflecting the depth of integration of the Elastic Stack into the bowels of customer application infrastructure. Some common examples include powering the logic that connects riders and drivers at Uber, enabling product search on the Walgreens e-commerce app, locating the right creative asset in the Adobe Cloud and matching user profiles on Tinder. In these cases, Elastic solutions are at the core of these companies’ customer experiences and would have high switching costs due to the custom code that wraps them.

Elastic’s broad capabilities around data ingestion, indexing and display can be applied to many common data processing use cases. At a basic level, system monitoring (observability) is just a combination of these steps. An observability solution pulls in activity data from a variety of application sources, aggregates the data along facets (like machine name, request URL, resource type) and provides DevOps personnel with a visual summary to navigate. The same applies to security monitoring – ingest, index, display, alert. For security, the user can add custom pattern matching rules to identify common security threats, or leverage pre-packaged rules. Data analytics and business intelligence tools go through the same steps as well.

If Elastic left customers to do all of this themselves, it would limit the growth opportunity and probably wouldn’t cross most investors’ radar. To broader their appeal and market fit, Elastic began building packaged solutions on top of the Elastic stack for various use cases and marketed those directly to customers. In this way, they are meeting customers half way. Instead of expecting customers to adopt the Elastic Stack and build solutions from scratch, the Elastic team began providing pre-packaged solutions with working source code for several common use cases.

Packaged solutions are available for a number of product categories – observability (logging, APM, metrics), security (SIEM, endpoint security), site search, workplace search and application search. While the code is open sourced (it can be viewed), it has both proprietary and commercial licensing. This means that some capabilities are free, but proprietary. This prevents cloud providers from just downloading the package and selling a hosted version of the service. Amazon tried to do this with their own Elasticsearch offering, but had to pin their offering to an older version of the Elastic Stack. They then tried to engage the community by launching a separate open source project, called Open Distro for Elasticsearch, in March 2019. However, a year later, the 32 contributors appear to be mostly employees of AWS and the depth of contributions is fairly light. For comparison, the Elastic GitHub project has 159 contributors with most core repos getting commits every few minutes.

Beyond the free but proprietary subscription, Elastic offers paid versions of the Elastic Stack that include more advanced features and dedicated support. The value of having the actual code committers on the other end of the support line during an outage should not be underestimated.

Underlying Elastic’s entire commercial model is the concept of resource based pricing. This means that once a subscription level is selected, the customer can apply their allocated usage to any use case desired – some processing cycles for observability, some for security, some for enterprise search, some for custom use cases. Elastic doesn’t try to charge on a per machine/document/log/user basis. This flexibility in usage is presented as a competitive advantage by management. Elastic is pushing this notion of universal pricing in its marketing strategy. The graphic below from the Q4 Earnings Deck illustrates the point and is directed towards competitive offerings in the same categories.

It is this platform approach that Elastic thinks differentiates their offering from competitors in each category. A common motion is for an Elastic customer to adopt the Elastic Stack to address one use case and then expand into others over time. This explains Elastic’s ability to maintain a DBNER over 130% consistently. Several new examples of this expansion motion were mentioned on the earnings call. BNP Paribas had been using Elastic for logging and application search. In Q4, they added SIEM. Overdrive used Elastic for their application search and analytics. In Q4, they added security. This cross-selling of observability, security, application search and now workforce search will be a powerful motion going forward. All of these use cases can be addressed through one platform with one usage-based pricing model. Elastic leadership posits that addressing multiple use cases with one toolset creates efficiencies for customer technology teams in training, maintenance and infrastructure management. The CEO discussed this in the earnings call.

I am extremely confident about our ability to provide significantly more value for the same amount of dollars that companies spend either because they want to collapse their tooling bingo, if you will, and the observability space into a single technology stack and train their employees only once on it, for example. The ability for us to be there for the customers wherever they are, whether it’s on cloud or on-prem, to make sure that they make the best financial decisions; and then even further than that, being able to collapse their technology investments across SIEM or endpoint with observability. So I think this consolidation of tools is going to be a tailwind for us because we spent quite a few years investing quite heavily in our technology stack and our products to be here for them, for our customers.

Shay Banon (Elastic CEO), Q4 FY2020 EArnings Call

The big question will be whether customers agree. Elastic is rapidly building out its solutions in these different categories, but they currently lag competitors who offer the best-of-breed solution in each. In order for the platform argument to work, Elastic’s solutions will need to reach some sort of base level parity with competitors’. There will probably become a baseline of “just good enough” functionality in most categories. For example, in observability, the checklist has been to address the “3 pillars of observability” in one platform (logs, metrics, traces). Now that Datadog, New Relic, Splunk and Dynatrace have all three, differentiation is becoming more nuanced, focusing on usability or advanced features like AIOps. As the core feature set begins to look the same across observability solutions, the category risks commoditization and competition based on price. This may explain why Datadog and Splunk are already moving into adjacent segments.

Commoditization of these solutions would work in Elastic’s favor, based management’s positioning. By offering a single platform under a universal usage pricing model that can be applied to many data processing use cases, Elastic could encroach on market share from the point solution providers. At the same time, some customers will always gravitate towards the best-of-breed solution, even if that creates extra overhead and cost.

There are some other companies that have taken a parallel approach of a core platform offering with solutions built on top of it. Twilio offers a programmable communications platform as a service (CPaaS). Their mission statement is similarly vague – Twilio powers the “future of business communications.” They provide core services to address messaging, email, voice, chat and video. After watching customers use their APIs to build custom contact centers, Twilio decided to offer a packaged cloud-based contact center solution in Flex. The value proposition from Twilio’s perspective is that their contact center offers a basic starter kit with most expected functionality, that customers can further customize to meet their unique needs. In theory, this product competes with best-of-breed cloud contact center solutions like RingCentral (RNG). Twilio doesn’t expect to take all of RingCentral’s customers, but is benefiting from a set of companies that seek to consolidate and customize all their programmable communications onto a single platform. The reasoning is that these enterprise customers want to create a unique experience for their customers in order to establish competitive advantage.

Another company that investors seem excited about is the upcoming IPO for Snowflake. They describe themselves as a “modern data platform”. If you drill into the Developer section, they provide a list of sample use cases with architecture diagrams at the bottom. Included are applications for IoT, Customer 360, Machine Learning and Analytics. They also have a category called Application Health and Security Analysis. The implication is that Snowflake could be applied to monitor application health (like observability). The reference architecture diagram is interesting. It includes Elastic Logstash for data collection and shows one possible output to SIEM vendors, like Splunk. In the middle, however, I don’t see other popular observability solutions.

This is not to say that Elastic will become the next Twilio or generate the buzz of Snowflake. I acknowledge that Elastic’s platform and target use cases are different. I provide a few reference points for investors to understand the Elastic platform positioning and how it might play out going forward.

With that background, let’s briefly look at the current landscape for Elastic’s three main solution offerings.

Enterprise Search

The Enterprise Search category for Elastic includes three pre-built solutions – Site Search, App Search and the newest addition, Workplace Search.

The Site Search solution provides a tool set to quickly implement a website search experience. This usually takes the form of the search box that users see in the corner of a website. Some customers have gone beyond basic site search and applied it to specific types of content where there is a large body of documents, like technical specs, patent filings, product guides or a knowledge base. The tool set provides a crawler, which can be scheduled to frequently walk the site’s content and update the index. The search box can be enabled with a few lines of embedded HTML/Javascript code. Customers can tune the search results by tweaking the relevancy scores through weights and boosting. This technology was enabled through the acquisition of Swiftype in 2017. Swiftype was already a long-time user of Elasticsearch and built their site search solution on top of it. Site search has a number of customers. Twilio uses it to power content search for their knowledge base and FAQs. SurveyMonkey and Shopify use it to search customer support content. Airbus enables search of aircraft technical documentation with it. The New York Times can retrieve content from all 164 years of articles.

App Search represents the use of the Elastic Stack to power a data querying feature as part of an application’s core functionality. While Site Search generally focuses on language in documents or web pages, App Search provides a more programmable solution to create a custom search experience for other data types, like products in a catalog, objects on a map or individuals in a population. Through a set of programmable APIs and code libraries, developers are able to construct these bespoke application search features. Examples of App Search are profile matching for Tinder, driver location for Uber, product catalog search for Walgreens, candidate to job matching for Workday, grocery shopping for H-E-B, seat selection for Ticketmaster, restaurant selection at Just Eat and Grubhub, and several different use cases at Facebook for internal tools and their external apps.

As discussed previously, Workplace Search is the newest offering, allowing a customer organization to set up a global content search function across all of their workforce productivity apps. These include popular SaaS tools like Office 365, Github, Salesforce, Dropbox, ServiceNow, Google Drive, etc. The list of pre-built connectors is limited currently to major SaaS tools, with more connectors in the works. Set up and configuration are easy. The toolset supports relevancy tuning, personalization and privacy features.

In terms of competitors for Enterprise Search offerings, Lucidworks has been a popular solution with developers. It is built on the Apache Solr open source project, which could be considered a peer to Elasticsearch. Microsoft offers Azure Cognitive Search and Google has a Cloud Search product. The Microsoft and Google solutions are more tailored towards search of text-based content, versus a broader data matching capability. Also, published customer lists for both cloud vendor products appear rather limited, so it’s not clear how popular these solutions are with enterprises.

Forrester publishes a formal review of a category they call Cognitive Search. Forrester defines cognitive search as “A new generation of enterprise search solutions that employ AI technologies such as natural language processing and machine learning to ingest, understand, organize, and query digital content from multiple data sources.” Their application of cognitive search is primarily text based and uses language processing to infer context to improve relevancy. This overlaps with Elastic’s solutions for Site Search and Workforce Search.

Forrester’s latest evaluation of cognitive search solutions is from May 2019. Elastic is listed as a Contender, far outside of the Leader circle. However, Elastic did not formally participate in the survey (the designation of the gray circle above) and was included by Forrester based on customer feedback and Elastic’s prominence in the industry. The rating is likely lower than peers due to missing information. Going forward, Elastic will hopefully participate more actively in these industry analyst reports. We see a similar trend as we look at Gartner and Forrester reports for other solution categories.

Forrester provided the following commentary about the Elastic solution for cognitive search.

Elastic App Search and Elastic Site Search are ideal for developers, including enterprise developers, who wish to quickly embed search in web or mobile applications. It includes client APIs for Ruby, Java, Python, Node.js, and JavaScript. These are offered as cloud-based services, so developers use them almost instantly by creating an online account. Once implemented, business users can use a management dashboard to tune relevancy. Elastic declined to participate in our research.

Forrester Wave Cognitive Search, Q2 2019

As a measure of the appeal of Elasticsearch to developers to address custom data retrieval solutions (App Search), Stack Overflow conducts an annual survey in which they ask 65,000 developers about their preferences across a number of technology types. Included is input on programming languages, frameworks, tools and platforms. Elasticsearch is lumped into the databases category. Developers rank it as the third most “loved” data store. While above Elasticsearch, Redis and PostgreSQL do not address the same type of data retrieval use cases.

Observability

Elastic offers an observability solution that addresses logging, metrics and traces, which meets the basic requirements for the “3 pillars of observability“. Comparing to other competitor feature sets, Elastic solutions support coverage for logging, infrastructure, APM, network and RUM. Elastic is rapidly adding features to this solution set. In the version 7.7 release from May 2020, they added service maps (a major feature requested by customers), a new alerting framework and more third-party integrations. This follows the version 7.6 release in February. That release added supervised machine learning capabilities to the stack, ranging from training a model to applying the model for inference at data ingestion. This allows machine learning methods like classification and regression to be applied to both observability and security use cases (AIOps). They also added more integrations, release annotation support for APM and intelligent log categorization. The point of this is that Elastic is adding major features to their observability solution in large releases occurring every 3 months. As basic feature gaps close, it will become more difficult to differentiate between observability solutions across vendors, beyond advanced features or use cases.

Elastic has a number of customers that fall into the observability solution category. What is interesting is how some have customized the notion of logging to meet their business specific needs. These examples do not represent the common observability use case of aggregating and analyzing log data from a web application, and then tying that in with APM. While the market for traditional web/mobile application observability is large, having a programmable platform to address custom logging use cases is unique (at least as compared to Datadog, Dynatrace, New Relic, but not Splunk). Here is a sampling of customers using Elastic for observability:

• Box. Uses logging solution for microservices. Generates 20TB of logs a day. Was originally a Splunk customer. Added a custom solution for business analytics. Planning expansion to APM and SIEM.
• Sprint. Monitoring the performance of their cellular network and tying that to business metrics.
• Keybank. Generalized enterprise monitoring solution for a variety of inputs.
• Sky. Monitoring and anomaly detection for Sky Mobile and OTT ad insertion.
• Cox. Log aggregation and analysis for their content delivery network.
• Volvo. Centralized logging for millions of connected transportation devices (IoT observability).
• VW. Distributed logging and monitoring solution for many internal manufacturing systems.
• Fitbit. Log aggregation for a number of data sources.

Considering the competitive environment, observability is becoming a crowded space. Datadog is the leader, benefitting from being the first company to combine logging, metrics and traces (the 3 pillars of observability) into a single commercial solution. They also have an extremely clear go-to-market posture and efficient sales motion. In the last year, Dynatrace, New Relic and Splunk have rounded out their product offerings to meet the full set of observability requirements. These four providers are jockeying for market share, with Datadog leading by a large margin, in terms of growth rate. I provided a review of the competitive state between these four in my prior review of Datadog’s Q1 results.

For APM, Gartner publishes a Magic Quadrant each year. The most recent version from April 2020 lists New Relic and Dynatrace as leaders, with Datadog and Splunk as visionaries. If we go back to the March 2019 evaluation, Datadog and Splunk were not included. They were named Honorable Mentions, along with Elastic. This should give investors a sense for how quickly the observability landscape is evolving.

Each of these vendors is trying to differentiate themselves from the others through advanced features. Dynatrace is investing heavily in AIOps. New Relic has made their views programmable. Datadog recently added deep support for serverless monitoring and is expanding into security monitoring.

For the 2020 APM Magic Quadrant, Elastic was not evaluated due to an unnamed inclusion requirement. Gartner dropped the Honorable Mention label from this year’s evaluation. It may be that they felt the Elastic solution was lacking a key feature, like AIOps, when the survey was started (likely late 2019). As Elastic’s APM solution is advancing quickly, we should expect them to be added to some future incarnation.

Security

Elastic’s Security category provides packaged solutions for SIEM (Security Information and Event Management) and Endpoint Security. SIEM is the older offering from Elastic, as it was developed as an extension of logging after Elastic observed several logging customers customizing the Elastic Stack for security monitoring. Elastic then formalized the solution by adding common exploit pattern detection and other features. Endpoint security is a more recent addition to the security suite. This was enabled by the acquisition of Endgame in June 2019. Endpoint security was launched as a complement to SIEM in October 2019. Both SIEM data collection and endpoint security are combined into a single agent, providing both centralized monitoring and proactive response to security exploits.

Elastic has a number of customers utilizing its security solutions. Many of these have customized the core log analysis solution to add their own security rules. Some are also benefiting from the enhanced visibility of combining log monitoring through observability with security monitoring. Several recent customer expansions have exhibited this motion of starting with app search or logging and then adding full observability and security.

• Bell Canada. Security events logging.
• USAA. SIEM and security analytics.
• Oak Ridge Labs. Log monitoring and anomaly detection as part of a central security information hub.
• Barclays. Data analytics to enable cyber security processing.
• US Air Force. Started with vulnerability detection and expanded to other security monitoring use cases. Also used to detect anomalies in the AWACS aircraft data bus.
• Vitas. Endpoint security.
• University of Oxford. Building a next generation SIEM solution.

SIEM

In terms of competitive analysis, Splunk provides the leading commercial offering for SIEM and has had a solution in the market for several years. Datadog launched their security monitoring solution in April 2020, as a new product offering in addition to their full suite of observability solutions. Datadog leadership foresees a consolidation of application (DevOps) and security (SecOps) monitoring functions and wants to enable the two teams to collaborate on a single toolset. Other independent observability vendors do not currently offer a security solution.

Gartner lists Splunk as a Leader in its latest Magic Quadrant for SIEM.

Elastic is mentioned in the report as a SIEM vendor that did not meet all of the inclusion criteria. They did make this interesting comment in the report about Elastic “Although they didn’t meet the inclusion criteria for the research, Gartner customers have expressed interest in whether they might be able to satisfy security use cases and enable a single log and event collection architecture for security and for IT operations.”

Gartner also provides the following commentary under a section called SIEM Alternatives. This speaks to Elastic’s offering, which is marketed as a SIEM solution.

The complexity and cost of buying and running SIEM products, as well as the emergence of other security analytics technologies, have driven interest in alternative approaches to collecting and analyzing event data to identify and respond to advanced attacks. The combination of Elasticsearch, Logstash and Kibana (aka the ELK Stack or Elastic Stack) is a leading example. There has also been an emergence of alternatives to broad-based SIEM solutions that are focused primarily on the log collection and security analytics elements.

Gartner Magic Quadrant for SIEM, Feb 2020

The comments above are interesting, not only within the context of Elastic, but supportive of Datadog’s expansion into security monitoring.

Endpoint Security

Elastic added endpoint security with their acquisition of Endgame in 2019. Not only did this bring a packaged solution, but also added 100 engineers with security expertise to the technology team. These resources are being leveraged for both supporting the endpoint protection offering and contributing incremental capabilities to SIEM. The Endgame solution was built on the Elastic Stack, even prior to acquisition, providing an easy glide path to code integration. While the solution is separate from the core Elastic offering now, the plan is to integrate it into the full Elastic Stack, like other packaged solutions.

In endpoint security, the most advanced competitor is CrowdStrike. Neither Splunk nor Datadog has an endpoint protection solution currently. Crowdstrike provides a modern cloud-based security platform that addresses a number of security use cases, including threat intelligence and endpoint security.

Elastic was not included in the Gartner Magic Quadrant for EPP. While Endgame was in the 2018 report, Gartner noted that Endgame was dropped from the 2019 survey because they “did not meet the minimum business licenses inclusion criteria.” Gartner raised the threshold for inclusion to a “minimum of 4.5 million deployed licenses.” Gartner did name Endgame as an Honorable Mention and provided the following commentary:

Endgame is one of the new crop of vendors from the EDR market that have added EPP functionality. Its core differentiator is ease of use and good efficacy test results with multiple major labs. Endgame provides a single-agent architecture and has feature parity across Windows, macOS and Linux. As well as providing full event fidelity, Endgame’s EDR features remediation of exploits via guided response actions to revert damage to the system. Recent enhancements include: Reflex, an autonomous behavior detection engine and Artemis 3.0, which is a chatbot that provides security admins with a natural language interface for hunting and guided investigation and remediation. Endgame also provides instrumentation for detailed examination of PowerShell and other scripts. Unfortunately, it did not meet the market presence inclusion criterion, which required a minimum threshold of 4.5 million centrally managed license instances.

Gartner, Magic Quadrant for EPP, August 2019

In March of 2020, Forrester published their Forrester Wave for Enterprise Detection and Response (EDR). They named Crowdstrike as a leader and Elastic as a Strong Performer.

Crowdstrike has the leading EDR solution due to its superior threat detection capabilities. These are supplemented by Crowdstrike’s OverWatch product which provides a threat hunting service. This data, combined with Crowdstrike’s other threat intelligence services, is fed back into threat detection rules in real-time. Due to Crowdstrike’s expanding client base and centralized platform, their threat detection capabilities are constantly improving and are best positioned to identify bleeding-edge attacks.

Forrester provides an interesting mix of complimentary and critical commentary about Elastic’s EDR solution. I will paraphrase the salient points:

• Excited about the potential for combining an EDR solution with a security analytics platform.
• Very negative on the Elastic licensing model that is based on consumption rather than number of endpoints being protected. Forrester thinks this will limit adoption by customers as usage-based billing is less predictable than licensing a set number of devices to protect.
• Product feels disjointed. There is good vision, but seems like a cobbling together of several advanced concepts.
• Client feedback is very positive about detection capabilities and the ability to customize the solution and the data that is being collected.

The point about licensing contradicts what Elastic leadership contends, that customers appreciate a single usage-based pricing model to which they can flexibly allocate varying loads of processing across Elastic solutions on a single platform. The customization concept plays into Elastic’s programmability for customers who wish to create a more purpose-built security solution.

Beyond this, I won’t try to parse through the nuances of these evaluations or competing products. CrowdStrike and Splunk clearly have leading solutions in their respective categories, with Elastic on the periphery but moving upwards.

Competitive Summary

The big question for investors to consider around Elastic for all these solution categories is whether having a second tier position in each will ultimately be deemed “good enough” by a sufficient number of enterprises. In that case, Elastic leadership’s argument stands that a unified platform with a flexible, usage-based pricing model would drive efficiencies for customers looking to address multiple use cases across search, observability and security. This would allow Elastic to make an end run around the other point solution providers and roll up a lot of customer spend. Datadog seems to have recognized the benefit of combining security monitoring with observability and may be executing a platform strategy of their own.

Elastic is rapidly improving each solution and adding new ones with each quarterly release. The number of substantial features across all solution categories in the 7.7 release is impressive, on the heels of a large release three months earlier in version 7.6. The pace of Elastic’s product development is rapid, driven by their single platform. In the past, Elastic has successfully plugged in new functionality through acquisitions, as companies build their own commercial point solutions on the Elastic Stack. Rolling these into the fold is fairly straightforward, versus more involved integrations of acquisitions at other companies with different technology stacks. With this development pace, it is likely that Elastic solutions will begin appearing on Gartner and Forrester reports and moving up and to the right.

The programmability of the Elastic Stack is another important consideration. Elastic solutions are pre-packaged open source projects with a proprietary/commercial license. Customers with a strong developer organization are free to create their own custom solutions, either by starting from scratch or extending an existing solution’s source code. These can address use cases that fall outside of the standard pre-packaged offerings. These use cases generally represent business functions that are critical to a particular company’s operations, for which a packaged commercial solution is not available. The Elastic customer page lists a number of these. An example is Walmart, which uses the Elastic Stack to detect fraudulent gift card activity.

What is important to consider about these types of custom implementations is the stickiness of the solution. Once a company builds a critical business function through a customized implementation of the Elastic Stack, it is very unlikely they would swap that out for a competing technology. The switching costs in this case are high. On the other hand, swapping out an observability solution is fairly straightforward. The technology team would just deploy the new vendor’s data collection agents on all relevant infrastructure, using an automated configuration management tool.

As a parting thought, in a customer presentation from Home Depot at a past Elastic conference, the presenter cited so many example uses for the Elastic Stack in his organization that he described the Elastic platform as their “Swiss Army Knife”. I think this provides an apt metaphor for investors to consider. A Swiss Army knife can be used to address a lot of common problems at a base level, but may not be the best tool to use in each case. Elastic takes this metaphor one step further, in that customers can extend any of the base tools to suit their needs with some effort.

My Take-aways

• Revenue growth momentum continued into Q4. While 53% year/year growth (57% on constant currency) represented a slight deceleration from nearly 60% in the prior quarter, Elastic experienced half a quarter (mid-March through April) of peak COVID-19 impact. Without COVID, it’s possible revenue outperformance would have been greater. On the earnings call, the CFO mentioned a “pause in mid to late March”.
• The significant improvement in profitability was a refreshing change. Granted, some of this was driven by reduced expenses due to the lockdown and a brief pause in hiring, but management reiterated the intent to begin moving towards more favorable operating and FCF margins. Just judged on the numbers for Q4, Non-GAAP operating margin improved year/year from -22% in Q4 FY2019 to -10%. FCF margin improved from -26% to -5.5%. Q4 Non-GAAP EPS of ($0.12) beat analyst estimates by $0.19. The CFO expects further improvement in FCF margin in FY2021 (current year) to approximately -2% to -4%, with a goal of achieving positive FCF margin in FY2022 (next calendar year). A common complaint from investors about Elastic has been high revenue growth with no bottom line improvement, as other SaaS companies gradually demonstrate profitability improvement over time. Elastic seems have turned the corner on this measure.
• Net Expansion Rate continues to be over 130%. This is best in class and indicative of the spend growth within existing customers. On one hand, customers with a single solution, like observability, security or search, might just be spending significantly more as their usage increases. The other explanation is that the increased spend is reflective of customers picking up additional Elastic solutions, like being a long-time search customer and then adding observability or security. If the latter explanation, this would be very bullish for the long-term platform consolidation argument. On the earnings call, leadership did provide several examples of large customers expanding into additional solutions.
• The fact that 50 customers are now spending greater than $1M in ACV is significant. At another point in the earnings call, leadership mentioned a customer spend range from a couple hundred to multi-million dollars. Clearly, some enterprises are making a significant investment in the Elastic platform.
• Growth in SaaS revenue of 110% (120% in constant currency) maintains a consistent rate with Q3’s growth of 114%. Elastic Cloud revenue now makes up 23% of total revenue versus 17% a year ago. As the percent of cloud revenue increases, this growth rate will have more impact on overall revenue growth. Additionally, Elastic added 9 new cloud hosting locations. Due to requirements around data proximity and access times, it is likely that customers would only utilize Elastic Cloud once it was available in the same availability zone as their production environment. So, Elastic is effectively launching brand new markets with each location addition.
• The changes in spending categories year/year are interesting. R&D remains at 31% of total revenue, almost exactly the same as the prior year Q4. S&M dropped significantly from 50% to 41%. This may reflect efficiency in the sales motion.
• Q2 and full year guidance for revenue growth are disheartening, if viewed outside of COVID-19 impact on enterprise spend. A 25% annual growth rate would represent a significant slowdown. However, on the earnings call, management provided no explanation for the lower growth rate, beyond “we do generally expect that some customers will scrutinize their spending more carefully given a challenging economic environment, and this might cause sales cycles to become longer. Generally speaking, we expect that the recovery will be gradual. And so we believe it’s just best to be prudent in our outlook for the rest of the year at this point in time.” When pressed, the CFO admitted that churn rates, renewals, new customer adds, deal size, net expansion, are all projected to be the same. On a subsequent analyst call the next day, the CFO provided a little more insight. It seems that they are modeling for a slow economic recovery, whether an “L” shaped or extended “U”, versus a sharp “V”. Regardless, the guidance leaves skeptical investors assuming that something else is happening behind the scenes.
• The CFO also said that “our intention is to continue investing through the cycle.” This is interesting to me, as he is committing to improved operating margin and yet is not cutting back on spending. The only justification would be that revenue comes in higher than projected. Further, they have no plans to raise cash at what is now a favorable valuation.

Risks and Items to Watch

• The big question around Elastic’s product strategy is the bet that a single platform for multiple solutions will appeal to enterprise buyers more than licensing multiple best-of-breed solutions. Elastic’s argument is for simplicity and cost savings. The question will be whether Elastic solutions in observability and security can reach a “just good enough” state to make the tool consolidation argument work. This is a big risk to the investment thesis, as some IT departments will insist on the best solution available, particularly around security.
• As mentioned, the Q2 and full year revenue guides were lower than expected. If 25% growth is actually what Elastic delivers for this year, then the near term investment thesis is harder to defend. While many consider this guidance to be very conservative, it is possible management is anticipating other factors besides macro-economic conditions that may come into play, like increased competition. The counter-argument is that competition in SIEM and observability already existed for the prior two quarters, so it’s hard to imagine that getting significantly worse so quickly.

Investment Plan

Based on Q4 results alone, performance was strong, continuing the momentum from Q3. Profitability measures improved substantially, with a commitment from leadership to drive towards positive FCF margins next year. This was a major complaint from investors, who pointed out that high revenue growth in SaaS should eventually lead to improving operating margins. Customer adds, DBNER, billings metrics were all favorable as well.

The issue is with guidance. On one hand, we could chalk it up to conservatism. Elastic starts their fiscal year in May with associated disruption around sales organization resets. Also, a large percentage of their business is international, which may represent a greater concern around macro headwinds. Yet, some other companies, like DDOG and CRWD, raised their full year guidance. If Elastic finishes this fiscal year with 25% revenue growth, that would put them in a lower growth category. On the flip side, they could clear Q1 and gradually raise full year guidance through the year. This would also put them in a favorable position as we exit 2020, presumably moving past COVID-19 impact, and enter 2021. If Elastic is able to return to higher growth performance in 2021, then they would be well positioned for share appreciation coming off a reasonable valuation multiple.

While I acknowledge that the Elastic story is difficult to understand, I see the potential of the platform play. I think that Elastic’s versatility in addressing multiple use cases on a single platform and unified pricing model will appeal to a segment of customers. Elastic will continue improving existing solutions and adding new ones. Additionally, the extensive programmability of the platform is unique and fits the needs of customers that want to build a custom solution. For these reasons, I am maintaining my five year price target of $170. I had recommended ESTC in March, when it was trading at $48. It has appreciated nicely since then, mostly due to the recovery of all software stocks from the COVID-19 drop. Once I have more visibility into actual FY2021 performance this year, I will update my price target.

For my personal portfolio, I plan to maintain my allocation to ESTC. This will allow me to participate in upside if actual performance beats the low guidance, yet be protected if the situation deteriorates. I will continue to track the name closely this year and provide updates on the thesis to investors. I will ramp up my allocation quickly if it becomes clear to me that the long term thesis is materializing. We could see a rapid P/S multiple expansion if the strong performance from Q4 continues later in the year. This could provide a compelling set-up going into 2021.