Elastic N.V. (ESTC) Earnings Call Transcript & Summary

Okay. I think we got everyone on now. Good afternoon, everybody. My name is Tyler Radke. I cover the data and analytics and vertical software space here at Citi. And for our next presentation, we have Elastic. And we're happy to have both the Co-Founder and CEO, Shay Banon; and Janesh Moorjani, the CFO. And so thank you guys for joining us today.

Thanks, Tyler. Happy to be here.

So Shay, I thought we'd just start off at a high level. I mean I think most folks with -- know that Elastic is synonymous with search, but they may not really know exactly what that means, what different use cases you address. Maybe could you talk about the history of the company, elaborate on the technology stack and kind of where you fit in terms of the markets you said and maybe relative to other companies out there that folks are familiar with?

Yes, happy to. So I've personally been involved in search for many years now, closing in, in 15 years. And when I think about search, it's a very foundational level. And it is around the fact that as data volumes grow and people put more and more value into the data that they generate and aggregate and being able to derive any type of insight out of a search is such a foundational way of go and explore data. It's like once you get a wall of text or a website or any type of data that you have, the first instinct that you have is just to be able to go and search it. And at the very, very core level, we want to go and beat the place where people can go and search across stored data. And it doesn't really matter what data they have. It can be a list of e-commerce products on a website, it can be applications logs out of the observability market or it can be security events for someone to go and try hunt against. When we started, the biggest use case that we had was put a search box on your website, right? Like Wikipedia uses us to go as the engine that powers search, for example. So just the very natural, put -- take a search box, put it on the website, put it on an application on your iPhone and take all of that data that you have that represents that application and make it searchable. Over the years, users have started to use this more and more and some other use cases became more significant. One of them is IT operation logs and then together with APM and infrastructure monitoring is now known as observability. And again, like, the need is just very simple. And I want to take a search box and put it on my infrastructure and maybe able to go and search it and make sure that our applications are running, they're up, they're healthy, everything is operating at the right level. And then once you put IT operation logs into something like Elastic, you can also look at them from a security perspective. So threat hunters started to use our software to just being able to go and search the breadth of security events that you can have to find people who might hack into the system. So we evolved as a company. We have three main solutions: enterprise search that I mentioned, observability and security. All three of them are built on top of a single technology stack or within a single technology stack, if it makes sense. That is all driven by search, and it still can be used to power many, many different use cases. That's our technology study. That's what we try to bring to our users. And I got to go back. It's very, very -- almost like first principal level need of users that they want to do the first time when they have data around them. They just want to go and search it, and that's what we try to enable.

Got it. And sticking to the high level, I mean you touched on this a little bit how the product offerings have kind of evolved over the recent years into those 3 key initiatives. But maybe just talk about the company's strategy in more detail. I think nearly a year ago, you did close the acquisition of Endgame, which was an endpoint security company. I think at the time, there were at least some questions we were getting with from investors is, is this going to be too distracting for Elastic if they try to go after all these different market opportunities, perhaps spreading themselves too thin. I guess how would you just kind of describe your go-to-market and evolution in your product messaging just kind of over the last 2 years? I mean it seems like you've gotten more focused, but would love to kind of hear you dive into that a little bit.

Sure. So I'll start with -- we're just saying that we have a free and open distribution at Elastic. So we have the ability to go and look into all the usages that our users are just being imaginative in terms of using us. And that's pretty amazing because we've build this foundational level of technology around search, but then our users take and use us in many different ways. So to a degree, we have this ability of looking into the future, if you will, and seeing where users will end up using us in the future. When we started Elastic, we were being used more in the enterprise search use cases, but users started to put application logs into Elastic or IT operation logs, and we started to be using that use case, and we decided to double down on it because it became an important enough use cases to start to package a solution, if you will, on top of it. When we started to be using the application logs, users started to put application performance monitoring data, APM, into Elasticsearch because the combination of both APM and logs is actually what's extremely valuable. So we decided to get into the APM market about 3 years ago, and almost like pull that future forward that today we look around and say it's pretty obvious, right? It's called observability. And it's pretty obvious that APM and logs are actually features of a bigger product or a bigger opportunity that we have in the operation space or the DevOps space. The same thing happened in security. When we started to look at our opportunity that we have in security, there's the obvious step that we will take, and that's getting into the SIEM market, S-I-E-M, which is connect to all the various data sources that you have of firewalls, network, host, all the different cloud-based data and bringing into a single place and allow people to hunt and write rules, apply machine learning algorithms or AI on top of it, to be able to address that opportunity in the security market. But then when we looked at it more closely, we also saw the fact that host base protection is actually the place where you generate a significant amount of data that ends up fitting into the SIEM market. And the same way that when we looked at logs and at APM, and we said it's a wonderful addition to logs and it's going to be a single go-to-market motion or a single use case in the future, we looked at SIEM and endpoint protection or endpoint security and we thought that it made sense to try to combine them. So we did that a year ago. It felt very natural to us as a company, even though externally, it might seem like 2 different markets. And we do think that these 2 markets are combining and while you observe for security events, why not protect it. Another reason why we got into this market, we always love to delight our users with more, give them the expected and -- but also deliver on the unexpected. When we go to our logging users, especially 2 years ago or a year ago, and we also gave them APM, they were delighted, right, because we can give them more for the same pricing and packaging. And we want to do the same thing for the security user base. We want to be able to go and bring them more for SIEM, but we also want to go back to our observability user base and bring them more when it comes to endpoint protection and security in general. So that's -- those are the things that we get excited about in being able to pull this future forward and collapse maybe some boundaries or some lines that are drones within markets or within products and try to go and deliver the best user experience within them.

Okay. And sticking on that theme, I mean, a related question that we get asked often is, how does Elastic fit into the broader ecosystem within all those markets, right? So you have companies like Splunk and Datadog, New Relic, AppDynamics, Sumo Logic. Like what is Elastic's key differentiator? And maybe how do you view yourselves as -- in relation to those vendors? And I imagine most companies like, for instance, at Citi, it's like we use most of those vendors internally. And so how do you kind of view yourselves in relation to those? Are you more complementary, solving a different use case? Or are you kind of full head-to-head competitors?

Yes. Sure. So I mean within the specific solutions that we play out, enterprise search, observability or security, I mean we're building the products to be the best product within that market. And we do that because we think our users deserve that better on our products or want to go and adopt our product deserve the best product and our customers. So our goal is to go and build the best endpoint security product out there. We actually joined forces with Endgame that was always ranked as one of the best endpoint security solutions out there. So even when we join forces with other companies, we want to join forces with the best within their respective markets. And that's our Northern star. Things that, I think, makes us unique in how we go-to-market within these solutions, I think the first one is that we're all built on top of a single technology solution, the Elastic Stack. So built on top of Elasticsearch, top of Kibana. Those are like 2 of the most popular products in the world today. And we worked really hard to make it happen, like building on a single technology stack or a single platform, that requires a lot of engineering efforts, but it manifests itself in significant leverage across all the solutions. If we make search fast, we make search fast with threat hunters in SIEM. We make it fast for DevOps people in observability. And obviously, we make it fast for any users that uses their search box on Instacart or Wikipedia or something like that, right? So it's like we have these power plays that are reflected through the single technology stack. And I think because we have the opportunity to look at everything through a single prism of data and how do we make it searchable and how do we empower users through the power of search, it means that we treat these things differently. And to me, so far, it's been proven to pull a future forward, right? It's like a -- great example is single product like pricing and packaging that we've been providing to our users since day 1. And we don't charge users based on hosts or applications for APM or endpoints for endpoints, it's all about the data. The value is in the data. This resonates really well with our customer base, and they pay for what they use. And that's another effort for us to try to just focus on collapsing all of these use cases into one, and it's just another data stream, just another feature that you have and doubling down on that to our customer base. And I think that ends up creating a very strong, healthy and both expected and surprising relationship to our customers, where we keep on delivering more.

I see. I see. Janesh, I wanted to turn things over to you and maybe just specifically on the most recent results, we have been getting a fair amount of questions just around folks trying to understand your guidance, which looks pretty conservative in the context of recent growth trends. So you recently came off a really strong Q1 with most leading indicators, whether it was currency adjusted billings or bookings and revenue, pointing to high 40s growth, yet annual revenue guidance kind of points us in the back half of the year towards only the high 20s. So maybe just first talk us through the puts and takes of the quarter and how it played out relative to your expectations.

Yes, happy to, Tyler. So as you said, Q1 was a strong quarter for us. We're really pleased with the performance that we delivered in the quarter and how the team executed. Just to recap that, we reported 44% growth on the revenue side, 86% in terms of SaaS revenue growth and just strong results down the rest of the P&L and on the cash flow side as well. In terms of the demand environment and the puts and takes there, I'd say broadly, things played out as we expected. It was a mixed environment. We did see sales cycles get a little bit longer. Our customers continue to scrutinize spending a little bit more than they had in the past just against the backdrop of what I think is the biggest economic shock that we've all seen in recent history. But on the other hand, customers also, in terms of tailwinds, as they reconsider their spending budgets, their priorities are now increasingly shifting to areas where our solutions are well aligned, and that's across enterprise search, observability as well as security. So we saw some tailwinds from that. And then, of course, with respect to verticals, as everyone knows, there are some verticals that are beneficiaries of COVID and some that are impacted adversely by it. But just to think about the guidance and the model and how I see it playing out, when we reported back in early June for Q4 and we were laying out our guidance model for the year, we did state at the time that we'd likely see some headwinds associated with COVID-19, and that's how things played out. And so we're just staying consistent with the framework that we had laid out back then. And just to recap that, because the effects of COVID-19 are uncertain, we looked at the model under many different scenarios. We've -- one aspect of our business that, by the way, we are quite proud about is that we've got strong diversification across many different dimensions, whether you're looking at new and expansion or renewals or looking at the business by verticals or by geographies or by segments, and the effects of COVID can appear really in any of those dimensions. So we looked at it really across all of those and eventually built our plan on the premise that we'd see these billings headwinds for a couple of quarters and then a more gradual recovery over time beyond that. So we've, generally speaking, I think, stuck to that model. From a revenue perspective, one of the impacts to keep in mind is that because of the way our fiscal year turns out because we've got these billings headwinds in the early part of the fiscal year, the effect on revenue takes time, but it plays out for the full 4 quarters of this fiscal year. If the headwinds had been experienced later in the year, then it wouldn't have had as much of an impact on revenue. So that's just a timing factor to keep in mind as well. But broadly, I'd say we are quite pleased with how things turned out. We're very optimistic about the longer-term opportunity as well. It remains large. And we think we're very well positioned as Shay was explaining. So we've started to also now gradually increase our investments towards that goal, and that's reflected in the rest of the margin profile for the business.

I see. That's helpful. And Janesh, just to clarify, so you talked about billings headwinds in the first half of the year. I think your reported billings growth in Q1 were in the 40s, right, which I don't think were -- to me, at least relative to where the Street was, didn't seem like much of a headwind. I guess what do you exactly mean by headwinds? Is it just kind of lower year-over-year growth relative to what you saw a year ago? Because I think I've heard from some investors, it didn't seem like there were much headwinds at all with respect to billings in Q1. So were there any factors driving an abnormally strong billings performance in Q1 that you want to call out? Or just help us walk us through that?

Yes. And Tyler, you're right. I mean, billings overall came in, in mid-40s, which was really strong from our perspective. The one thing I'll point out there, which is something I mentioned on the earnings call as well that as I think a lot of people know in our business model, even though customers contract with us for multiyear periods, we invoice them only annually, typically. And in any particular quarter, there's always some puts and takes where somebody wants to be invoiced upfront for an entire multiyear contract or there's sometimes customers that want billing spread out over time. Usually, those tend to be pretty small. But this time around in Q1, we had about -- the benefit of about $5 million of a multiyear billing that we build in the quarter. And so I did call that out. And once you consider the effects of that on billings, just given the fact that the denominator for billings was a smaller number last year, that can have an impact in terms of how people think about the billings growth rate. And when I talked about the headwinds, it was really in the context of not any one particular metric, but more broadly what we are seeing in the business. So billings growth rates in the mid-40s, but to be adjusted for that one call out, I talked about our net expansion rate, which continues to be above 130%, but we did see that slowing by a few percentage points. The effects of COVID don't show up in any one place. It's a little bit more of a diffuse effect in many different parts of the business that can collectively add up. And so that's what I was really referring to.

Okay. And last question on the just kind of demand environment and guidance. I guess what are your assumptions in your base case for Q2 from a business demand perspective relative to what you saw in Q1? Are you assuming kind of the same type of macro environment and closure rates? Just help us think through that relative to what you experienced in Q1?

Yes. In Q1, I'd say, if I think about how Q1 unfolded, it was generally consistent. We saw pretty strong activity in terms of top-of-funnel activity that people normally see around things like attendance at webinars and virtual conferences and momentum around pipeline generation and so forth. And that was generally consistent over the course of Q1. And so we assume that we continue to see generally similar levels of activity with respect to Q2. And then as I think about closure rates and how that all eventually translates into real business, again, I'd say Q1 paid out consistently. There's always the effective timing where you can have a few transactions that might get pulled in or pushed out. But generally speaking, I'd characterize the environment as being consistent over the course of Q1. And again, that's the way we're thinking about Q2 as well. We'll see how that translates in terms of the actual performance for the quarter because, again, there are many puts and takes that can cause things to vary. But we're not fundamentally modeling any significant either improvement or worsening in the quarter.

Okay. Okay. Super helpful. So Shay, I wanted to go back to you on the product side. And I think you touched on this on the last call, but the new 7.9 release, at least to me, seemed like a pretty significant release, and it seemed like you were pretty excited about it on the call. And I guess, how should we think about the 7.9 release relative to other releases? And maybe just walk us through at a high level, like, what you're most excited about. To me, it seemed like this agentless approach was pretty unique in helping customers be a lot more efficient. But just kind of walk us through, contextualize the 7.9 release relative to other product releases and why you're super excited about it.

Yes. Happy to. I think first part is just calling out our engineering work and the ability to deliver such a significant features in minor releases, I don't take it for granted. And definitely, our customers don't take it for granted, right? It's like the fact that we can deliver significant value where, I worked in many other technology companies, those will be major releases, right? And everything that comes with a major release is pain. That just speaks to the foundation -- strong technology foundation that we have, product foundation and just the capabilities of our teams. Specifically, we did it. One of the reasons why I was excited, first of all, it's just a single-agent technology. It's something that we've been working on for more than a year. And just -- it's in preview release, but just the ability to have a single agent managed by a fleet -- a fleet of agents being managed from a single location, centrally managed and one click-enabled collecting logs or one click-enabled collecting, infrastructure monitoring. And then beyond that, one click enabling malware protection, which is one type of protections that come from endpoint security. And maybe that ties this one click enablement, I think, is an important one for us because we're trying to simplify as much as possible the introduction of our software to begin with and how easy it is to onboard users to our products. But then the introduction, after it gets deployed, of new use cases and new types of data, right? It's like if it's one click to go and add endpoint security to a place where you are already collecting logs or infrastructure monitoring and that's exciting because we put a little constraints in front of the user when it comes to them getting more value out of our products in our software. The other reason why I was excited about it is we joined forces with Endgame about a year ago, and we were white boarding the vision. And the vision was, let's take endpoint security and take that technology and fold it into our technology stack, into the Elastic Stack, and this will work because we also were thinking about a single agent and things along those lines and it happened, right? It's in a preview release. It's only malware protection out of the breadth of protections that you get with Endgame -- that you used together with Endgame, but it's happening. Like you can see how, in the next few quarters, you would start to be able to now set deliver more and more and more within that foundation that we just set in 7.9. So that's exciting because we're delivering on our promise to our user base. So we're starting to show our user base that we really mean it when we say when you observe, why not protect. And we mean it, not just being able to bundle it together under single packaging and pricing, under a single technology stack, but also in terms of ease of use. And just like in one click, you can go and enable that wherever you have the Elastic agent deployed. And that's exciting.

Got it. Turning to the competitive environment. I think the open source business model with respect to Elastic, so that has been somewhat controversial for some investors we've spoken to, especially given AWS's kind of competitive rhetoric around their so-called Elasticsearch offering, which I know you may have a little bit of an issue with. Maybe just talk about AWS as a competitor. Like do you think things have gotten more or less competitive with them over the last 6 to 12 months?