Description

Idea: Long Elastic, a software business that enables enterprise search. Elastic’s open-source model has led to various concerns regarding Amazon simply copying their code and offering their own version in the AWS stack. However, with recent licensing changes, and the increased emphasis on security (one of the key reasons people sign up for the paid version of Elasticsearch), we believe paying user growth is ready to inflect. Additionally, we believe sell-side is sandbagging Net Retention as they are extrapolating a one-time deceleration from Covid into the future. Putting things together, the little implied user growth despite our belief that this is ready to inflect creates a highly asymmetric opportunity that we expect will generate a 30% 4-year IRR. 

Business Summary

Elastic is a search business. The company’s core product, Elasticsearch, provides search software to enterprises. How do you organize the search results for a website with thousands of products? If a product is unavailable, how do you find relevant alternatives? How should one deal with typos? Elasticsearch solves for this. Over time, the company has built a stack of software beyond search, including data visualization and security (powered by Kibana), and data ingestion and transformation (with Logstash). 

Shay Bannon, Elastic’s CEO, built the platform as an open-source project to assist his wife in easily searching through a vast collection of recipes. Today, the company is going to do close to 600m in revenue in FY21 growing 38% and has remained committed to an open-source model. The company’s core software is available for free, with certain proprietary features and support available upon subscribing to a paid version. This is very much like a freemium business model where developers can try the software for free before committing to the paid version with proprietary features and support. 

Open-Source Software

While we acknowledge the challenges associated with monetizing open-source code, we believe that some of the key benefits include: 

1. Large developer mindshare drives rapid pace of software development: As of 2018, Elastic’s software was downloaded over 350M times despite having just 5,000 paying customers at the time. Additionally, it is encouraging to see that Elastic’s developer Meetup group members grew at a 22% CAGR over the last 4 years. 

This large developer mindshare that continues to grow deepens Elastic’s moat as the pace of development and bug fixes continues to grow. 

“So, the open-source model works really well in the long run as long as you have a really high base of contributors, active contributors is what I would say. Because now when we're using them, we don't have to wait for them. We can go fix the problem in our end of the spectrum” – CEO of leading IT Consulting Firm

2. Flexibility: You do not have to make a huge commitment upfront and continue to expand as you need more capabilities. We are able to confirm this through discussions with customers: 

“We can start without making a huge investment, and any kind of a support contract as we need to, we can expand that. As we need more capabilities, we could expand it. And so, it's just a lot more flexible and we can control the costs a lot better.” – Director of Engineering at a Software Business

3. Lower Customer Acquisition Costs: Given the freemium model, we think that while it is back with hard data, Elastic enjoys a greater share of customers organically signing up at zero CAC. 

Competition

While Elastic has significant capabilities beyond just search, such as Observability and Security, those products are often viewed as incremental value relative to the primary capability which is Search. So, the focus when analyzing the competitive landscape should be on Enterprise Search. 

The major competitive aspect that most are worried about is the AWS Elasticsearch fork. Essentially, given that Elasticsearch is open-source, Amazon will copy the source-code and offer maintenance and support on top of that. Several AWS customers found this as a convenient way to use Elasticsearch. However, with recent license changes from Apache to SSPL, which we will discuss in Thesis 3, Elastic is poised to accelerate customer penetration in coming years. It is also encouraging to us that Elastic differentiates from the AWS Elasticsearch beyond simply offering managed services (cloud) themselves through proprietary, mainly security features, to paid customers.  

In terms of competing businesses, on the open-source side, the only competitor that might pose a threat is Solr, the incumbent open-source search business that Elastic was up against. However, what led Elastic to win was a couple of things: 

1. They built a platform that was developed for scale, while Solr was not hyper focused on that. 

2. Solr remained a search company while Elastic expanded into other use cases like visualization. 

Google trends data confirms this as Elastic overtook Solr in popularity in 2014 and Solr’s popularity has been in secular decline since. Stack Overflow data shows a similar trend. 

On the non-open-source side, the key competitor is Endeca. According to industry experts, Elastic offers a superior value proposition to Endeca in three key areas: Scale, Ease of Use, Flexibility (access to source code). It is encouraging that while Elastic has grown their workforce by ≈ 40% over the last two years according to LinkedIn job data, Endeca’s employee count has been flat. Furthermore, from an industry expert: 

“Endeca, FAST and dtSearch have lost a huge chunk of the market, especially if you look at the numbers of deployments and everything and the amount of developers that are out there.” – Industry Expert

The superiority of Open-Source software can also be analyzed through an exodus of customers leaving Splunk for Elastic in Observability. Utilizing LinkedIn, we can see a number of businesses replacing Splunk with Elastic: 

Thesis

1. Sell-side is sandbagging Net Revenue Retention

2. Long runway for growth given massively underpenetrated TAM

Thesis Point 1) Sell-Side is sandbagging NRR

We think sell-side is sandbagging NRR given very little implied customer growth in the business after accounting for revenue growth from increased usage and upsell. The NRR tends to be directly correlated with global search data growth. This makes sense, given Elastic prices on a per node basis. Essentially a node is able to store 128GB of data, and as companies scale, they continue to add more nodes. Per IDC: 

“While the COVID-19 pandemic has hindered the creation of new unique data, the increased consumption of replicated data has fueled the continued growth of the Global DataSphere. This growth is forecast to continue through 2024 with a five-year compound annual growth rate (CAGR) of 26%.” – IDC Global Dataspehere Forecast

It is also encouraging that the velocity of data growth tends to outpace the underlying growth of the business itself. This underpins the durability of organic growth that Elastic really has from customer data growth. 

From a customer: 

“Lyft as a company itself is growing at like 50% year over year. But the volume of data that we are putting it in Elastic or the data we're generating is probably growing 100 percent.” – Customer of Product

Using IDC data thru 2024 and assuming a deceleration of 200bps a year post then leads us to believe NRR can sustain at 125% over the next 5 years. 

Based on estimates from one sell-side firm, they have 2020 NRR down, which makes sense as several enterprises were hit due to Covid and definitely reduced spend, even as the growth of Global Search Data accelerated, which I think is a factor of more time spent on the internet. Discussions with Lyft, an Elastic customer, corroborate this: 

“I would say short-term, there might be some hiccup. But I think speaking also more long-term or not considering COVID, I think at least 30% increase year over year.” – Head of Product Management, Lyft

However, some sell-side firms are considering this to be a permanent (as they continue to decline NRR off the FY21e level) which is definitely not the case. 

If anything, we believe Covid-19 has created easy comps for this business and organic growth is going to crush sell-side numbers. It is also encouraging that customers view 30% data growth as durable at least for the medium-term. 

Putting things together, if we assume that Elastic can put up 125% NRR over the next 4 years, there is basically no implied growth from customer adds for this business using street revenue estimates.  

Thesis Point 2) Long runway for growth given massively underpenetrated TAM

Search is mission-critical, and as the world becomes increasingly digital, we believe that search has a place in most organizations. For example, let’s say you have a database of internal employees and want to search for specific data on one person, you would use something like Workday, a company that utilizes Elastic for search. So, when thinking about customer TAM for Elastic, we think that businesses with over 100 employees would end up utilizing some sort of search capabilities as the world becomes increasingly digital. This view is reinforced by SolarWinds, a company that develops software for IT infrastructure management, as they view the market opportunity using a similar framework. We use numbers from SolarWinds’ 2019 Investor Day to size the market opportunity for Elastic.  

Historically, Elastic has grown penetration at about 38 bps a year. We assume an acceleration to 50 bps/ year due to reasons we will dig into in thesis 3.

On these assumptions, we see customer count more than doubling over the next 5 years while TAM penetration remains low at 4%. 

Thesis 3) We are at an inflection point in customer growth

We believe that customer growth is ready to inflect for two key reasons: Security Spend Inflection and License Changes

1. Security Spend Inflection: With the rapid Covid-19 driven digitization, security is making up a greater mindshare of CIOs at enterprises. From a BAML survey of 175 professionals with IT budgets: 

“The COVID-19 pandemic sparked a surge in security spending intentions as enterprises

moved quickly to secure remote workforces and expand Firewall capacity. Net spending

intention for security software was 36% vs. 27% in the previous survey, the highest level

since the survey’s inception.” 

Furthermore, we think that the recent Solarwinds hack will catalyze Security to make up a greater mindshare in CIO decision making. 

The reason we focus so much on Security, even though Elastic is at its core a search business, is that security is one of the main reasons people convert into the paid version. 

“So a lot of those customers end up just buying the enterprise version to get the security, and that's where Elastic has the phenomenal growth it has.” – CEO at Leading IT-Consulting firm

We are also able to sanity-check this thru a BAML CIO Survey, where 73% of CIO’s responded that Alerting and Monitoring (security features) were the key factors for them to upgrade to the paid version. 

2. License Change

Recently Elastic announced that they will be changing their license to SSPL from Apache. What this essentially does is those who were leaching off the open-source code, mainly Amazon, have to now start to program the changes themselves, rather than simply use an updated version of Elastic code. So, if some major new developments come out in the next version update, Amazon would have to code these changes themselves in their Elastic fork.  

The impact of this will be significant. While Elastic already had proprietary security functionality with the paid version that Amazon’s Elasticsearch did not offer, I think the gap between the quality of the two services is now set to really widen, driving a significant amount of customers to adapt Elastic’s product. We can confirm this through industry experts: 

“But they (Amazon) will not improve Elasticsearch in a way how the Elasticsearch is moving like adding more machine learning technologies, like all the security stuff, alerting stuff, that has been added recently in latest 7.10 version and that will be added in version 8 as well.” – Industry Expert

Given the inflection in security demand and license changes, we assume that customer growth inflects to 50bps of incremental penetration a year for the next 3 years before wanning off. 

Valuation

We assign a 10x multiple on 2026e sales of $2.7B to arrive at a ≈ 30% IRR. We are also encouraged by a 42% delta to consensus revenue estimates on relatively conservative numbers. Elastic will likely do gross margins close to 70% in steady state, which translates to a 30% operating margin assuming S&M at 15% of sales, R&D at 15% of sales, and G&A at 10% of sales. This translates into us applying a 33x steady-state EBIT multiple on a business growing top-line 30% in 2026. 

Putting things together, I think a 30% IRR on estimates that do not seem aggressive leads us to believe that Elastic is one the most asymmetric investment opportunities today.

Appendix 1 – SaaS Multiples

We believe applying a 10x Sales multiple at exit is fair as companies growing revenues at 30% tend to trade north of 15x Sales today. 

Catalyst

Growth outpaces multiples compression