The Moat Question — Open Source, the AWS Fork, and Whether "Search AI" Defends Itself

The Moat Question

Chapter 1 fixed the through-line: the case turns on whether Elastic can hold mid-to-high-teens growth and expand margins, or whether it is a fairly-priced ~3x-revenue compounder facing deep-pocketed rivals. That question is, at bottom, a question about the moat — and Elastic's moat is unusual, because the company gives its core engine away. This chapter establishes what actually defends the franchise: a 5.8-billion-download distribution base and a vector-search engine that management claims runs eight times faster than the Amazon fork — set against the uncomfortable reality that Elastic competes, in three separate markets, against firms two-to-three times its size that out-spend it on engineering by wide margins. The moat is real but narrow, and it rests more on data gravity and product depth than on any license.

The license is the moat's fault line

Elasticsearch began life as an open-source project, and that openness is both the source of Elastic's distribution advantage and its single greatest vulnerability — because open source can be copied. The defining episode came in February 2021: with version 7.11, Elastic relicensed the Elasticsearch and Kibana source code that had historically been Apache 2.0 — a permissive license anyone could resell — to a dual Elastic License 2.0 / Server Side Public License model designed to stop cloud providers from offering it as a managed service [1].

Amazon answered within weeks. It forked the last Apache-licensed version into an open-source project called OpenSearch, and rebranded its existing Elasticsearch Service as OpenSearch Service [2]. That fork is the permanent competitive overhang: a free, AWS-backed near-clone of Elastic's engine, sold inside the largest cloud on earth.

Then, in a reversal that says a great deal about how the relicensing actually played out, Elastic walked part of the way back. On November 12, 2024 it added the AGPL — an Open Source Initiative–approved open-source license — as an option for the free portion of Elasticsearch and Kibana, restoring Elastic's standing as a genuine open-source vendor [3]. Management framed the move not as defense but as offense: it expects the open license to "drive further engagement and adoption … in areas such as vector search" and AI use cases [4].

Sources: FY2022 10-K, Risk Factors [5] [6]; FY2026 10-K, Business [7].

The license arc reveals the moat's true mechanics. A license cannot be the moat — Elastic itself concedes that "limited technological barriers to entry" let others enter its markets, and that Amazon's offerings "reduce the demand for our products" while limiting Elastic's pricing freedom [8]. The 2024 AGPL reversal is an admission that fighting OpenSearch by restricting access cost Elastic more in developer goodwill than it gained in protection. The defensibility has to come from somewhere else.

Who Elastic actually competes with

The corpus's auto-selected peer set understates the problem. Elastic does not face one set of competitors; it faces three, one per solution, and in each it meets a specialist that is larger and more focused. Its own FY2026 10-K names them [9].

Source: FY2026 10-K, Business — Competition [10].

This is the structural disadvantage hiding inside the "single platform" story. Elastic's pitch is breadth — one data store for search, logs, and security — but breadth means it is the second- or third-best-funded contender in every fight: against Datadog in observability, CrowdStrike in security, and a swarm of well-capitalized vector-database startups and hyperscaler-native search tools in AI. The company acknowledges that many competitors have "substantially greater financial, technical and other resources" [11].

The scale-and-spend gap

The clearest way to see the disadvantage is to put the income statements side by side. Among its closest public peers, Elastic is mid-pack on revenue, the slowest grower, and — most tellingly — spends the least on engineering relative to its hyper-growth rivals.

Source: latest-year income statements per company filings, as reported (ESTC FY2026; DDOG FY2025; CRWD/MDB/DT/S/CVO FY2026). Derived from reported financials [12].

The R&D figure is the one to sit with. Datadog spends roughly $1.55 billion a year on R&D — close to Elastic's entire revenue base — versus Elastic's $452 million. CrowdStrike spends $1.39 billion. Elastic's 26% of revenue going to R&D is healthy in isolation, but in absolute dollars it is funding three product fronts on a fraction of any single rival's budget. In a market where the next two years are defined by an AI feature race, the side with $1.5 billion of annual engineering spend can iterate faster than the side with $0.45 billion.

Source: latest-year income statements per company filings, as reported; growth, margin, and R&D ratios derived from reported financials.

Elastic posts the lowest revenue growth in the group except for the smallest peer (Coveo), and a 76% gross margin that trails the observability specialists Datadog and Dynatrace. This is the empirical core of the bear's case from Chapter 1: a sub-scale generalist, growing slowest, out-invested in every lane. If the moat were imaginary, this is what it would look like.

Where the moat is real: data gravity and the vector engine

It is not imaginary — but the defensibility lives in two specific places, and an investor should hold the company to both.

The first is distribution and data gravity. Fifteen years of free downloads have seeded Elasticsearch into millions of developers' workflows — 5.8 billion cumulative downloads, roughly eleven per second [13]. Once an enterprise stores petabytes of logs and documents in Elasticsearch, moving that data is expensive and risky, which is why management keeps winning "consolidation deals in the most data-intensive environments" — in one seven-figure win it displaced a two-vendor legacy stack to search a repository of over two billion documents [14]. That is the open-source flywheel functioning as designed: free adoption becomes paid, sticky, hard-to-rip-out infrastructure.

The second is the vector engine — and this is where the moat connects most directly to the growth half of the thesis. Elastic's argument against the wave of vector-database startups is that a bare vector store is a feature, not a product: "while others offer simple vector databases … vectors alone are not enough," and Elastic instead delivers the full retrieval toolkit — hybrid search, re-ranking, the context an AI agent actually needs [15]. The claim has teeth: management says binary-quantization work has made Elasticsearch vector search "up to eight times faster than OpenSearch," a differentiation it credits with winning seven-figure deals [16].

Sources: Q3 FY2026 transcript [17] [18]; Q4 FY2026 investor presentation [19].

The traction is measurable, not aspirational: more than 2,700 customers now use Elastic Cloud as a vector database [20], and over 470 customers with $100,000-plus annual contracts run AI use cases on the platform, of which more than 410 use it specifically as a vector database [21]. Management reinforced the engine with the acquisition of Jina AI, adding multilingual embedding and re-ranking models that it says proved decisive in a competitive evaluation [22]. The same data-gravity logic is now the spearhead of a Splunk-displacement opportunity in security and observability that analysts have asked management to size as an upside catalyst [23].

What it means for the thesis

The moat is real but conditional. Elastic's defense is not the license — it gave that lever away twice — but the combination of an installed base too sticky to migrate and a retrieval engine deep enough to out-perform both the AWS fork and the single-purpose vector startups. Crucially, this is built on a deliberately open foundation: Elastic maintains a single code base across self-managed and cloud, with the core of Elasticsearch and Kibana open-source under AGPL [24]. That openness is what feeds the download flywheel that becomes the data gravity that becomes the moat.

The risk the numbers expose is that this moat must hold while Elastic is out-spent on R&D by the very rivals — Datadog, CrowdStrike, the hyperscalers — whose budgets let them close product gaps fast, and while Elastic's own growth runs slowest in the peer group. The through-line's two halves meet exactly here: the vector-engine differentiation is the mechanism by which "Search AI" could re-accelerate growth, and the data-gravity stickiness is what could let margins expand without buying every customer twice. If both hold, the bull is right and the market is mispricing a re-accelerating compounder. If the spend gap tells the truer story, the moat narrows feature by feature, and the ~3x-revenue, mid-teens-grower valuation is fair. The next chapters should test the side of that question Chapter 1 flagged as the hinge — whether the AI traction shown here is enough to bend the Net Expansion Rate back up.