Open Source Moat

Open Source Moat

Elastic's defensibility does not live in its code. Under its own licenses, anyone may take the free features of Elasticsearch and use them to compete [1]. What holds customers is the cost of consolidating a business onto one data platform, and the developer funnel that open distribution feeds. This chapter traces the 2021-to-2024 license journey that defines the tension, tests how strong the switching costs actually are, and sizes Elastic against the larger, more focused rivals it meets on each front.

The license journey

How Elastic has licensed its own software runs through the investment case. For most of its history Elasticsearch and Kibana were free under the permissive Apache 2.0 license. In February 2021, with version 7.11, Elastic pulled that option — relicensing the core to its proprietary Elastic License 2.0 and the source-available SSPL [2]. The trigger was Amazon: AWS had built a managed Elasticsearch service on the open code. Within weeks of the relicensing, Amazon forked the last Apache-licensed version into a new open-source project, OpenSearch, and rebranded its service accordingly [3].

That was a defensive move with a cost. The Elastic License bars anyone from offering the software as a managed service, which stops a hyperscaler from reselling Elastic's own work [4] — but neither the Elastic License nor SSPL is recognized as open source, so Elastic could no longer call itself an open-source company, and some developers for whom that label matters had reason to look elsewhere [5].

On November 12, 2024, Elastic reversed the optics without giving up the protection. It added the AGPL — an Open Source Initiative-approved license — as a third option for the free core, alongside the Elastic License and SSPL [6]. Elasticsearch was "officially considered open source again." Management was explicit that the point was the AI wave: CEO Ash Kulkarni said the change means "in all the places where developers typically go to get access to open-source software, we can now proudly have Elasticsearch as an open-source option," and tied it directly to winning vector-search and GenAI adoption [7].

Sources: FY2022 Annual Report (Form 10-K) [8], [9]; FY2026 Annual Report (Form 10-K) [10].

What the moat is not

Elastic states the constraint plainly in its own risk factors: there are "limited technological barriers to entry" because anyone can obtain the source code for its open and source-available features and "use it to compete in our markets" [11]. The OpenSearch fork is the proof: a well-resourced competitor stood up a free, API-compatible alternative in weeks, without the overhead a traditional software rival would need [12].

So the code itself confers no durable advantage, and any moat has to come from elsewhere. What the license does protect is narrow but real: a forker gets the open features but "cannot provide our proprietary software," and cannot legally offer the Elastic-licensed code as its own managed service [13]. The paid product — proprietary features plus the hosted Elastic Cloud service — sits behind a fence the open license cannot cross.

What the moat is

The defensible core is switching cost, and it rests on consolidation. Elastic runs a single code base with one underlying data store — Elasticsearch — across all three solutions, sold through resource-based pricing that lets a customer add Observability or Security use cases without re-platforming [14]. Once a company has ingested its logs, metrics, traces, and security telemetry into that store and built dashboards, alerting, and detections on top, moving is expensive. Management frames its product work explicitly around lowering the cost to "consolidate onto the Elastic platform" — an admission that consolidation, not code, is what it is selling [15].

The cleanest read on how strong that lock-in is comes from the Net Expansion Rate — how much existing customers grow their spend year over year. It has cooled materially from the 2021–22 peak, then stabilized. A rate above 100% means the installed base keeps expanding net of churn even without new logos; at ~112%, it still does, but with far less force than the ~130% of four years ago.

Sources: FY2022 (~130%) [16], FY2023 (117%) [17], FY2024 (110%) [18], FY2025 (112%) [19] and FY2026 (112%) [20] Annual Reports.

A ~112% expansion rate is a moderate, not a commanding, signal: it says customers stay and grow modestly, but the pricing power that drove 130% has faded — consistent with a mid-teens grower rather than a business that compounds on entrenched pricing. It is a switching-cost moat that keeps customers in, not one that lets Elastic push price at will.

The second pillar is the developer funnel, and this is where the AGPL reversal earns its keep. Open distribution seeds adoption: developers pull the free software, learn it, and bring it into their employers, shortening the sales cycle. Elastic's specific claim to that funnel today is AI retrieval — it markets Elasticsearch as "the world's most downloaded open source vector database," the store that holds the embeddings behind retrieval-augmented generation [21]. Independent evidence supports the mindshare gap over its fork: as of early 2026, the Elasticsearch repository carried on the order of 74,000 GitHub stars against roughly 10,500 for OpenSearch's core, per third-party benchmarking. The 2024 AGPL move is best read as re-arming that funnel for the AI wave, where its developer mindshare is strongest.

The fork, four years on

The bear case in 2021 was that OpenSearch would commoditize Elastic. Four years of results argue that it capped the low end without breaking the paid business: revenue compounded from roughly $1.07 billion in FY2023 to $1.74 billion in FY2026 straight through the fork years, and the expansion rate stabilized rather than collapsed. OpenSearch is now a durable, independently governed project — it moved under the Linux Foundation in 2024 with hundreds of member organizations — so the free alternative is real and improving. But it competes mainly for the price-sensitive, self-managed user who was never going to pay Elastic; it does not reach the proprietary features or the managed cloud service.

Amazon is now both forker and Elastic's largest channel. Elastic sells Elastic Cloud jointly with AWS, Google, and Microsoft, integrating with each [22], and a single channel partner accounted for 11% of total revenue in FY2026 [23]. The relationship that produced OpenSearch also produces cloud-marketplace revenue. The same hyperscaler both feeds Elastic's distribution and stands as its most credible substitute, a concentration risk and a partnership at once.

Sub-scale on each front

Elastic's answer to competition — three solutions on one platform — is a genuine differentiator; it argues, credibly, that "few competitors currently have the capabilities to address our entire range of use cases," while conceding that many competitors have "substantially greater financial, technical and other resources" and larger sales and marketing budgets [24]. Breadth has a cost: Elastic's $1.74 billion of revenue is spread across Search, Observability, and Security, while the front-leading rival in each category — Datadog and Dynatrace in observability, CrowdStrike in security, MongoDB in search — is a larger, focused specialist that concentrates everything on one. On no single front is Elastic the scale leader, so scale does not reinforce the switching-cost moat. The quantified peer comparison is in Three Fronts.

The read

The moat is narrow but real, and it is not the one the "open source" label implies. The code is a commodity anyone can fork; the defense is switching cost from platform consolidation, plus a developer funnel that the AGPL reversal has repointed at AI retrieval, where its developer mindshare is strongest. The strongest fact for that read is a Net Expansion Rate that stabilized near 112% through the fork years while revenue kept compounding. The strongest fact against it is that the same rate fell from ~130%, that the moat leaves no pricing power, and that Elastic is sub-scale against focused, better-capitalized leaders on each of its three fronts.

What would move the read: a Net Expansion Rate that re-accelerates back toward the high-110s would signal the moat is widening as AI workloads land; one that slips below roughly 105% would signal erosion and put the mid-teens growth case at risk. The other thing to watch is whether Elastic's vector-search mindshare converts into paid share, or whether hyperscalers bundle "good-enough" AI search into their clouds and capture the wave Elastic is betting the AGPL move will win.