Simplified agent deployment and highly responsive support
What is our primary use case?
My main use case is for security, specifically for the SIEM aspect, as I work as a cybersecurity engineer.
We specifically use this system for security-related topics. We have a dedicated environment for Large Language Models (LLMs). We have connected our LLM, but our primary focus remains on security. When we encounter any incidents or need to gather information about connected IPs, we rely on established rules and alerts. We utilize the chat functionality of this LLM to generate queries in Kibana language.
What is most valuable?
My favorite feature is the ease of use, particularly in how you integrate the agent. I've been using it since version 7, and we're on version 9 now, and I've seen the progress from using Beats to using the agent, making it so simple today to enroll a server with the Elastic Agent.
What needs improvement?
Deploying the Elastic Agent internally is relatively straightforward; it only requires a few commands to be run on the server. However, to manage this deployment at scale, we needed to develop a solution using Ansible. This involved creating scripts to install, restart, and uninstall the agent. While I would have preferred if Elastic had provided an official solution for these tasks, they haven't yet developed one that addresses all the necessary aspects. As a result, we've taken it upon ourselves to create these tools internally.
There are two areas in which it could improve. One is the smoother enrollment process for 1,000 or 2,000 servers at the same time, rather than having to develop something internal.
The second topic is the actual support of YARA rules—it's Y-A-R-A, which is specific for security. As of today, this is not supported, and I've been asking for a while now; I'm unsure if they will ever release it.
For how long have I used the solution?
I have been using this solution for at least four years.
What do I think about the stability of the solution?
I haven't seen any downtime.
What do I think about the scalability of the solution?
It is really scalable. Since we're on the cloud, whenever we need to upgrade or add resources, they handle everything. It takes a couple of hours due to the amount of data we have, and I've never faced any issues during upgrades.
How are customer service and support?
I have contacted technical support because we encountered issues when we started using the Elastic integrations, some of which were not finalized on their side. I had countless meetings with engineers from Elastic, including product managers and support engineers, to work on and fix the integrations we wanted to use. They have always been really responsible and responsive to my requests. Once, we had an issue with GCP, Google Cloud Platform, and they even sent us a complimentary five or six hours with an Elastic consultant to help set things up.
I would give them a nine out of ten because they are very responsive. They clearly know what they are talking about. I never encountered a situation where the support team didn’t understand what we needed.
How would you rate customer service and support?
How was the initial setup?
The initial setup process took around a month.
What they need is to be more transparent about the actual setup of the cluster and the deployment process. When using Elastic out of the box, there is information that is not readily available, requiring users to dig deep into the documentation to truly understand how it works. If you're looking to set up the cluster automatically, it works well for testing purposes. However, when installing two thousand servers at once, if your deployment isn't large enough, it can lead to crashes. Occasionally, we have to delete the logs just to access the interface. Therefore, I believe they should provide clearer guidance on using the deployment manager effectively.
We started four years ago with 200-300 servers, and now we are at around 2,000 servers. The learning curve involved understanding how it works, doing labs, and the difference between Elastic Search and competitors. Elastic really helped with support; we had weekly sessions with engineers from their side to assist us in setting up.
Maintenance on my end is limited to updates. Since we are using Elastic Cloud, they take care of the infrastructure.
What's my experience with pricing, setup cost, and licensing?
I am familiar with the pricing, as we negotiated it last year. Compared to other tools, it's fair. However, if we are talking with full transparency, Elastic pushes clients to buy the Enterprise edition instead of the Premium edition, and we don't see the value in that other than to spend more money more quickly. So, while pricing is good and what we expect to pay for this type of product, I'd love to finalize this concern.
Which other solutions did I evaluate?
We've tested multiple open-source tools based on Elastic before signing with them, including one tool called Wazuh that is built on top of Elastic. We've also tested the open-source edition of Elasticsearch where we manage the cluster and Splunk. Overall, I believe Elastic Cloud is still one of the best products out there.
What other advice do I have?
I would rate this solution an eight out of ten.
Searches through billions of documents have become impressively fast and consistent
What is our primary use case?
Our main use case for Elastic Search is primarily for application search and document discovery.
We built an application with APIs that make documents available for search to the enterprise and we store the documents as well. A typical flow would be when an upstream application delivers a document to us, and then a different application or different user looking for some documents comes to our application, enters the metadata for that document, which we use to search in Elastic Search to retrieve the document and then deliver that document to the end user.
What is most valuable?
The seamless scalability is something I see as among the best features Elastic Search offers.
The speed with which Elastic Search is able to search through all of the documents we place into it is quite remarkable, as we search through 65 billion documents in less than a second in most cases, on a constant consistent basis.
I find configuring relevant searches within Elastic Search platform very straightforward. Elastic Search is easily scalable.
The customer support for Elastic Search is quite good.
I advise others looking into using Elastic Search to think about the future of your platform and where you intend it to be in five years, and based on that, which version of Elastic Search best suits the needs of your platform. Additionally, jump into the AI products first as you're in the planning phase so that as you're filling out your data, the AI products and machine learning products can enrich the data real-time early on in the process, which will save you a lot of time later.
The overall performance of the platform, scalability of the platform and other additional features, especially when it comes to AI, really earn the nine.
What needs improvement?
The ability to change field types seamlessly would be a huge improvement for Elastic Search, and more seamless upgrades would also be a big improvement, especially with regards to upgrading between major versions.
The upgrade experience and inflexibility with fields keeps Elastic Search from being a perfect 10.
For how long have I used the solution?
I have been using Elastic Search the whole time I have been at Optum since 2019.
What do I think about the stability of the solution?
Elastic Search is stable.
How are customer service and support?
The customer support for Elastic Search is quite good.
I would rate the customer support a nine.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
We previously used a self-hosted Elastic running on virtual machines, and we switched to Elastic Cloud on Kubernetes at the urging of Elastic Search itself, as well as an internal drive towards cloud-first technologies. The features of Elastic Search Cloud on Kubernetes seemed to mesh well with the overall goals of our organization.
How was the initial setup?
My experience with pricing, setup cost, and licensing for Elastic Search is overall fairly straightforward.
What was our ROI?
I do not have any specific numbers on a return on investment, but I do have a general sense of the overall improvement of efficiency of the platform as we moved from on-prem hosted to Elastic Cloud on Kubernetes, where the time saved from maintaining the platform itself was significant.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing for Elastic Search is overall fairly straightforward.
What other advice do I have?
We have tried the hybrid search capability, and we have seen overall fairly positive results, though we have yet to roll it out in production.
We have implemented a proof of concept using Inference APIs in our processes, but we have yet to release it into production.
To be clear, we are not on Elastic Cloud serverless; we are on Elastic Cloud on Kubernetes, running on the Azure platform self-hosted.
We have not utilized Better Binary Quantization, BBQ, in our operations.
On a scale of one to ten, I rate Elastic Search a nine out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Powerful and Flexible, but with Some Gaps
What do you like best about the product?
Elasticsearch is a fantastic search and analytics platform. It’s easy to use as a SIEM tool, and creating exceptions is straightforward. I really appreciate the ECS field schemes, the agent/fleet/integrations setup, and the quality of support. These features make the platform flexible and enjoyable to work with.
i use elastic every day with our siem
it's easy to setup without certificates
What do you dislike about the product?
The documentation could be improved—especially around “detection as code,” which is difficult to set up and barely documented. Having “exceptions as code” would also be a great addition. I miss certain features that competitors like Wazuh provide, such as a built-in vulnerability scanner. Another gap is the lack of community-driven blogs and integration examples (like those published on Medium by SOCFortress for Wazuh). Finally, I find it strange that certain wildcard searches (e.g., *test* across large datasets like Palo Alto logs) can crash the entire stack.
i would expect for small bussiness, there should be an automatic rotation and trust for certificates between clients and fleet server, our between nodes.
What problems is the product solving and how is that benefiting you?
we use it for threat hunting and to solve problems in our it environment;
We also use it for apm data
Great SIEM, security product
What do you like best about the product?
elastic is always improving their products and integrating more AI int their suite of products
What do you dislike about the product?
documentations can get better about newer products.
What problems is the product solving and how is that benefiting you?
elastic's edr is helping us to secure our environment even better, and having a unified all in product to look at the logs ingestion and edr
Centralized log data has improved issue resolution and reduced operational costs
What is our primary use case?
My main use case for Elastic Cloud (Elasticsearch Service) is to capture logs from our various systems.
For our cloud service, we have various Elastic agents that ship logs into a central location. We have it all aggregated in our Elastic Cloud. From there, we use the logs for troubleshooting, creating alerts, look for specific patterns, understanding our service a little bit better, and aggregating all that data in one place.
What is most valuable?
One of the better features of Elastic Cloud (Elasticsearch Service) is Lucene Search, which gives our users the ability to search through the mountains of logs without giving them direct access to production systems.
Another great feature is Index Lifecycle Management that allows us to move data to cheaper storage tiers as our data ages out. The feature that we love the best is LogsDB, which allows us to index our data differently so that it doesn't accumulate as much storage in our hot tier and allows us to ship many of those logs, especially older logs to cheaper storage such as S3.
Elastic Cloud (Elasticsearch Service) has positively impacted my organization by allowing us to move away from expensive services such as DataDog and gives us about the same level of service while allowing us to keep data for a longer period of time at a cheaper price.
What needs improvement?
The logging feature of Elastic Cloud (Elasticsearch Service) itself is pretty valuable, but we tried the observability module and some of the AI features.
Those need improvement. Observability is not on par with feature and ease of use with some of the leading providers out there. The same applies to some of the AI features within Elastic Cloud.
For how long have I used the solution?
I have been using Elastic Cloud (Elasticsearch Service) for five years now.
What do I think about the stability of the solution?
Elastic Cloud (Elasticsearch Service) is stable.
What do I think about the scalability of the solution?
Elastic Cloud (Elasticsearch Service) is very scalable and very easy; we've had no issues with scaling our solution out.
How are customer service and support?
The customer support for Elastic Cloud (Elasticsearch Service) is fantastic. They're very responsive, and gave us great detail in all our tickets.
I would rate the customer support as 10 out of 10. They are very knowledgeable.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
I previously used DataDog. We switched because DataDog was too expensive, especially when it comes to logging.
How was the initial setup?
It was very quick and easy to set up. The hard part for us was taking out the metrics and observability because it wasn't relevant for us.
What was our ROI?
The ROI for this has been positive. We have seen a return of 30-40% in lower costs and improved productivity.
Teams are more productive because they have a level of self-service to research problems without accessing production systems, which they previously did not have the ability to do.
Previously, accessing logs was complicated, but now everything is centralized. This has boosted productivity for our support teams, and both engineers and other staff can quickly view service logs and troubleshoot issues in a timely manner.
Which other solutions did I evaluate?
Before choosing Elastic Cloud (Elasticsearch Service), we evaluated other options, such as Grafana Loki, and Observability.io. We found that Elastic matched what we needed the most.
What other advice do I have?
LogsDB has made the biggest difference for our team because Elastic can get expensive as your data grows. Our teams want to view data back 30, 60, 90 days and with LogsDB, it allows us to be able to capture that data for a longer period of time and without the expense.
The advice I would give others looking into using Elastic Cloud (Elasticsearch Service) is to identify your pain point and find the tool that your users are familiar with.
For us, it was logging, and Elastic was perfect for that. Our users were very familiar with Lucene Search and the Lucene Search syntax, which made Elastic the ideal option for us. There are other solutions out there that are more multi-service, but Elastic does logging the best.
Elastic Cloud (Elasticsearch Service) really saves your organization money. You don't need the folks on the back end to manage it and support it on a daily basis.
On a scale of one to ten, I rate Elastic Cloud (Elasticsearch Service) a nine.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Machine learning features have improved search projects and user experience
What is our primary use case?
We use Elastic Search for search purposes and things related to semantic search.
It is not being used for the moment regarding my main use case for Elastic Search.
What is most valuable?
In my experience, the best features Elastic Search offers are its stability and brand new features that I consider very interesting.
The machine learning features of Elastic Search are very interesting, including the possibility to include models such as ELSER and different multilingual models that let us fine-tune our searches and use them in our search projects.
The machine learning features of Elastic Search have helped us with many things such as improving our searches and experience for the guests.
What needs improvement?
We could benefit from refining the machine learning models that we currently use in Elastic Search, along with the possibility to integrate agents, intelligent artificial intelligence, form of agent, and MCP.
It would be useful to include an assistant into Kibana for recommendations, advice, tutorials, or things that can help improve my daily work with Elastic Search.
For how long have I used the solution?
I have been using Elastic Search and Kibana for about four years.
What do I think about the stability of the solution?
In my experience, Elastic Search is quite stable.
What do I think about the scalability of the solution?
The scalability of Elastic Search is very good in my opinion. It never has incidents that cause issues in our daily tasks.
How are customer service and support?
The customer support for Elastic Search is one of the best I have ever tried. Whenever I had to create a new incident, I got the responses that I needed.
How would you rate customer service and support?
What other advice do I have?
I consider Elastic Search a very good project. On a scale of 1-10, I would give it a 10.
The features and capabilities that Elastic Search provides are very easy to use, and the documentation is rich. You can find and understand everything here to use it properly.
I would tell others looking into using Elastic Search that they can try it and see if it fits their use cases.
Elastic Search is a very good product. I really appreciate all the features that it provides, and I hope this product continues its evolution in the way it has been.
Which deployment model are you using for this solution?
Private Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
My Experience with Elasticsearch
What do you like best about the product?
Elasticsearch is awesome for fast and flexible search. It’s great at handling huge amounts of data and giving near-instant results. You can search, filter, and analyze text, numbers, logs pretty much anything. It’s super helpful for building search engines, monitoring systems, and real-time dashboards. Speed, scalability, and powerful full-text search.
What do you dislike about the product?
Elasticsearch is powerful but not always easy. It can throw errors that are hard to trace, especially with complex queries. Setup and scaling take effort, it uses a lot of resources, and security features are limited unless you pay.
What problems is the product solving and how is that benefiting you?
Elasticsearch helps spot errors and inaccurate X-ray details quickly. It makes it easy to track which technologist used single, double, or triple exposures. The data is searchable and organized, so issues and patterns are easier to find and fix.
Elasticsearch for Observability
What do you like best about the product?
We run Elastic on Kubernetes and have run up to 20 separate elastic clusters throughout the world. Three years ago we invested in the ECK operator and consolidated 9 of those elastic clusters down to 3. ECK has increased our confidence to run fewer, larger environments with multiple node pools and greater flexibility.
What do you dislike about the product?
Elasticsearch can be a bear to tune for performance, at scale, on a budget. Like any database, it's resource hungry. Additionally, the company has work to do to keep up with modern-day vulnerability management practices and remediation schedules.
What problems is the product solving and how is that benefiting you?
As a platform team, we deploy self-hosted Elastic in multiple configurations: vector search, observability, SIEM, and unstructured document storage.
AI Logging Power House
What do you like best about the product?
The bulk logging features and an ability to index, store and search data with ease
What do you dislike about the product?
Complexities involved in having ready out of the box solution for deep dive Observability and log based metrics and insights.
What problems is the product solving and how is that benefiting you?
A single Logging Repository store for IOT workloads and thousands of stateless infra elements used in our product architecture.
Don't run production workloads without Elastic's observability stack
What do you like best about the product?
Elasticsearch's stack is a must-have for application developers where observability can be achieved through APM's distributed tracing, and logs and metrics acquired through the Elastic Agent. A lot of observability into the system can be seen with minimal application configuration so developers can understand latency, throughput, error rate, and saturation of the system. I wouldn't run a production service without Elastic. I use APM every day to monitor the health of services I'm responsible for. A lot of valuable information comes for-free, but creating custom dashboards is also available.
What do you dislike about the product?
Setting up Elasticsearch and running it for production workloads is non-trivial. Many valuable features require a commercial license.
What problems is the product solving and how is that benefiting you?
Elasticsearch provides observability solutions where keeping applications running in a healthy state is critical. Tools within Elastic like Transforms can create views/dashboards that power decision making.
