Elasticsearch Pricing in 2026: Serverless, Tiers, and Alternatives

Elasticsearch does not have one price. It has three products, two hosting models, and a set of usage rates that change depending on which of them you pick.

The Elastic Stack is sold as three solutions: Search, Observability, and Security. Each has its own pricing, so the first question is not how much Elastic costs, but which Elastic you are buying.

On top of that, Elastic sells two ways. Serverless is usage-based, priced per GB or per compute unit. Elastic Cloud Hosted is tier-based, from Standard up to Enterprise.

This guide lays out the numbers for all three solutions on Serverless, the four hosted tiers, the add-ons, and support, so you can see the full shape of Elasticsearch pricing in one place.

The strength is that Serverless pricing is granular and public. You pay for what you ingest, retain, and compute, with no seat licences.

The catch is complexity. Three products times two models times several usage lines makes the total hard to estimate until you map your own data volumes.

So here is how Elasticsearch pricing works in 2026, and where a platform like Motadata ObserveOps fits when the per-GB math gets heavy. Let's get into it.

Elasticsearch Pricing at a Glance

Short on time? Here is the structure before the detail.

The three Serverless solutions share a shape: you pay to ingest data, to retain it per month, and to transfer it out, plus compute or add-ons where they apply.

Two things this table cannot show. Each solution has its own per-GB rates, so Search, Observability, and Security do not cost the same for the same data.

The second is add-ons. AI features, synthetic monitoring, cloud protection, and managed LLM tokens are billed on top of the base ingest and retention.

If per-GB and per-unit billing across three products is what makes Elastic hard to budget, Motadata ObserveOps is worth a look, since it is quoted to your environment rather than metered by volume. You can book an ObserveOps demo and walk your own telemetry through it first.

What is Elasticsearch?

Elasticsearch is the search and analytics engine at the centre of the Elastic Stack, alongside Kibana, Beats, and Logstash. It stores, searches, and analyzes large volumes of data at speed.

Elastic packages it into three solutions. Elasticsearch handles search and generative AI retrieval, Elastic Observability handles logs, metrics, traces, and synthetics, and Elastic Security handles SIEM and endpoint protection.

You can run all three self-managed for free under the Basic licence, or on Elastic Cloud as a managed service, either Serverless or Hosted.

Its main strength is flexibility and scale. The same engine powers app search, log analytics, and security analytics, which is why one platform can span all three jobs.

It is worth being precise about the model. Elastic is powerful but priced on usage, so cost tracks data volume and compute, which can rise faster than a flat platform fee.

How Elasticsearch Pricing Works

Elastic Cloud has two pricing models, and which one you choose changes everything about how you are billed.

Serverless is fully usage-based. You pay per GB ingested, per GB retained each month, and per GB transferred out, plus compute units or executions for some features.

Elastic Cloud Hosted is tier-based. You pick Standard, Gold, Platinum, or Enterprise, and pay a monthly rate based on your cloud resources, with features unlocking as you move up.

Self-managed is the third route. The Basic tier is free and open, while Platinum and Enterprise features require a paid subscription, quoted by Elastic.

The Serverless Building Blocks

Every Serverless solution bills on the same three basic lines, so it helps to understand them once.

Ingest is charged per GB of data brought into your project. Retention is charged per GB kept per month. Egress is charged per GB transferred out, with the first 50 GB free.

On top of those, Search adds compute pricing in Virtual Compute Units, and every solution adds optional AI, synthetic, or protection features as metered add-ons.

Elasticsearch Serverless Pricing by Solution

This is the core of Elastic pricing. Each of the three solutions has its own Serverless rates, so here they are, one table per solution.

Elasticsearch (Search) Serverless Pricing

Elasticsearch Serverless is the search and AI retrieval product. It is priced mainly on Virtual Compute Units, since search and AI workloads are compute-driven, plus storage and egress.

How the Compute Units Work: Search bills on three separate Virtual Compute Unit types, each with 1 GB of RAM. Ingest VCUs handle indexing into the Search AI Lake. Search VCUs power queries, vector search, semantic search, and geospatial lookups. Machine Learning VCUs run inference, ELSER, and ML jobs.

What Search Serverless Includes: the platform provides adaptive resource provisioning, so compute scales with demand, plus a baseline of always-provisioned search resources billed at a reduced rate. Storage is measured in GB in the Search AI Lake, separate from compute.

AI Costs to Watch: the Managed LLM and Inference Service are token-metered, and Agent Builder and Workflows bill per execution after a free allowance. For a RAG or AI-heavy search workload, these can become a large part of the bill on top of compute.

Elastic Observability Serverless Pricing

Observability has two tiers, Logs Essentials and Complete. Complete splits its rates between logs and traces on one side and metrics on the other, since metrics are cheaper to store.

What Logs Essentials Includes: ad hoc logs analysis, out-of-the-box and custom dashboards, integrations, and alerts and notifications. It is the tier for teams that mainly need to store and search logs at scale, without full-stack tracing or AI.

What Complete Includes: fully curated experiences for logs, metrics, traces, and synthetic tests, Service Level Objectives (SLOs), AI-assisted pipelines and parsing, machine learning, unified agentic AI and scripted workflow automation, and private connectivity with IP filtering.

Why Most Teams Pick Complete: APM, traces, SLOs, and machine learning only appear at Complete, so any team doing full application monitoring rather than log storage alone lands here. The metrics split matters too, since metrics ingest at $0.023 and retain at $0.005, far below the logs rate.

Add-Ons Available on Complete: synthetic browser tests, synthetic lightweight testing locations, the Elastic Managed LLM, cross-project search, Workflows, and Agent Builder, each billed separately.

Elastic Security Serverless Pricing

Essentials covers everything most teams need to run a traditional SIEM. Complete strengthens it with advanced analytics and generative AI. As of March 2026, per-endpoint fees no longer apply, so you pay on ingest and retention.

What Analytics Essentials Includes: ad hoc analytics and machine learning, prebuilt detection rules, triage, investigation, and hunting, collaboration workflows, threat intelligence integration, and endpoint protection with Elastic Defend, ransomware prevention, and memory and behavior prevention.

What Complete Includes: entity analytics and UEBA, threat intelligence management, a bidirectional response framework, extended security content, the Elastic AI Assistant, advanced endpoint protection with response actions and tamper protection, unified agentic AI and scripted workflow automation, and private connectivity with IP filtering.

The Endpoint Fee Change: endpoint protection is now bundled into the Security tiers rather than charged per endpoint, which is a genuine shift from Elastic's older model and removes a cost that used to grow with device count.

Security Add-Ons: Cloud Protection CSPM and Cloud Workload Protection are billed per asset, and Workflows, Agent Builder, and the Elastic Managed LLM bill per execution or per token. There is also a separate AI SOC Engine (EASE) option that layers AI onto an existing stack at $0.11 ingest and $0.019 retention.

Elasticsearch Serverless Add-Ons

The base ingest and retention rates are only part of the bill. Each solution has metered add-ons, and these are where AI and protection costs appear.

Two points are worth noting. The Managed LLM tokens can grow quickly on AI-heavy workloads, since they bill per million input and output tokens separately.

Endpoint Protection is now included in Security rather than a per-endpoint charge, which is a genuine change from Elastic's older model.

Elastic Cloud Hosted Tiers

If you want a managed cluster rather than Serverless, Elastic Cloud Hosted uses four tiers. Prices are starting points based on a standard configuration.

These starting prices are based on a standard cloud configuration of 120 GB storage across two zones, so your rate rises with resources.

Standard is the entry tier and a good place to start. It gives you the distributed Elasticsearch platform across AWS, Azure, and GCP, robust API and language clients with ESQL data access, AutoOps monitoring, and the core security, observability, and search features.

Gold adds reporting, third-party alerting actions, Watcher, and multi-stack monitoring on the operations side, along with optimized security workflows and third-party incident response. It is closed to new customers, who move from Standard to Platinum instead, though existing Gold subscriptions continue.

Platinum is the tier most enterprises target. It adds advanced Elastic Stack security, machine learning with anomaly detection and supervised learning, cross-cluster replication, and on the observability side AI-assisted pipelines, log categorization, service maps, tail-based sampling, SLOs, and APM correlations.

Enterprise is the top tier. It adds searchable snapshots in cold and frozen tiers, Elastic Maps Server, cross-cluster search with ESQL, GPU inference via the Elastic Inference Service, the Elastic AI Assistant powered by the Managed LLM, Elastic Workflows, and Elastic Cloud SAML SSO.

Elasticsearch Support Costs

Support is not a flat add-on. Beyond the included Standard level, Elastic charges support as a percentage of your consumption.

The practical effect is that support scales with spend. A larger deployment pays more for the same support percentage, since the base it is calculated on is larger.

Higher tiers add 24/7 coverage, faster response targets, more support contacts, and a 99.95 percent uptime SLA on Serverless.

What Increases Your Elasticsearch Costs

Five things raise an Elasticsearch bill above the headline rates.

• Data volume: Ingest and retention both bill per GB, so every new log source, index, or retention extension adds to the total across all three solutions.

• The solution mix: Running Search, Observability, and Security together means three sets of rates, not one, so a full Elastic estate multiplies quickly.

• Compute units: Search bills per VCU hour, so search-heavy and AI-heavy workloads raise compute cost independently of data volume.

• AI and LLM tokens: Managed LLM, Agent Builder, and Workflows are metered, and token-based AI cost grows fast on busy workloads.

• Support percentage: Gold, Platinum, and Enterprise support add 5 to 15 percent of consumption, so support cost rises with your bill.

The pattern is worth naming plainly. Elastic cost tracks data volume, compute, and the number of solutions you run, so the platform rewards teams that control ingest and question every add-on.

Elasticsearch User Reviews: What Teams Actually Say

This section is based on our analysis of Elasticsearch reviews across G2, Gartner Peer Insights, and Capterra.

Across those sites, Elastic reviews well on power and flexibility, and less well on cost predictability. The themes are consistent enough to trust.

What teams praise is easy to summarize. Search speed and flexibility lead the comments, since Elasticsearch is regarded as a benchmark for large-scale search and log analytics.

The unified stack is a second theme. Reviewers value one engine across search, observability, and security, rather than three separate tools.

The open ecosystem is a third. Many teams value the free self-managed tier and the ability to run Elastic on their own infrastructure.

The criticism centres on cost and complexity. Reviewers describe the usage model as hard to forecast, and the operational effort of running Elastic well as significant.

Scaling cost is a second theme, since ingest and retention grow with data. The learning curve for query language and tuning is a third.

These reflect public review patterns rather than universal facts, so your experience will depend on your data volume and how you deploy.

Top Elasticsearch Alternatives to Consider

If per-GB pricing, the three-solution split, or the operational effort is what prompted your search, here is how the main alternatives compare in one view.

Our pick is Motadata ObserveOps. It folds metrics, logs, flows, traces, and topology into one platform on a single quote, rather than counting every GB across three separate products.

Its adaptive AI is included instead of charged per million tokens, and it deploys on-premises where Elastic Serverless is cloud only.

Why Motadata ObserveOps Leads the List

Elastic charges you three times over, once each for Search, Observability, and Security, and counts every GB inside each. Motadata ObserveOps takes the opposite approach, folding metrics, logs, flows, traces, and topology into one platform on one quote.

That is the difference that matters for budgeting. Instead of modeling ingest, retention, egress, compute, and tokens across three products, you size one subscription to your environment and the number holds.

The log analytics overlap with Elastic is the closest fit. The ObserveOps log analytics engine reads millions of lines with live tail and pattern matching, then pairs logs with metrics and flows for faster root cause than search alone.

Its AI is part of the platform, not a token-metered add-on. The adaptive DFIT model finds anomalies and correlates alerts with no pre-training, so you are not paying per million tokens to get intelligence out of your data.

Deployment is the other contrast. Elastic Serverless is cloud-hosted, while ObserveOps runs on SaaS, on-premises, private cloud, or public cloud.

You can start a free ObserveOps trial and point it at your own telemetry first, or book an ObserveOps demo to compare it against your Elastic setup.

Is Elasticsearch the Right Choice?

Elasticsearch is a strong fit for teams that need search, observability, and security on one powerful engine, and that have the skill to run and tune it.

It also suits teams that want granular, usage-based pricing and are willing to model their own volumes, plus open-source teams that value the free self-managed tier.

It is a weaker fit for teams that want simple, predictable pricing, since the three-solution, per-GB model is hard to forecast without careful modeling.

It is also weaker for teams that want AI included rather than token-metered, or that need a single unified platform rather than three separately priced solutions.

That is the choice. If flexibility, scale, and search power are the goal, Elasticsearch is one of the strongest platforms available.

If you want one quote across observability signals, AI without per-token charges, or on-premises deployment, a platform like ObserveOps is worth evaluating.

Conclusion

The story of Elasticsearch pricing is that it is transparent per unit and complex in total.

Every rate is public: ingest, retention, egress, compute, and tokens, across three solutions and two hosting models. That openness is genuine, and rare.

But the same granularity is what makes the total hard to see. Your bill is many small rates multiplied by your own volumes across whichever solutions you run.

That is not a reason to rule it out. For a team with the skill to model its data and run the stack, Elastic is powerful and flexible.

It is a reason to map your ingest, retention, compute, and add-ons per solution before you commit, since the headline rates alone will not tell you the total.

If you want to see how one quote-to-environment price compares against your own telemetry, you can start a free ObserveOps trial and run a live workload through it.

FAQs