Elastic N.V. (ESTC) Earnings Call Transcript & Summary

Welcome, everyone, to the Jefferies Software Conference. This is Brent Thill. Thanks for joining us. We've got a very long list of companies presenting in the next couple of days. So I'm looking forward to engaging with you all. We want to thank the team of Elastic, Janesh and Anthony, for joining us this morning for our fireside chat. Janesh, welcome. Thanks again for joining. For those of you that did not know Janesh, he's the CFO, has served since 2018, and he was previously CFO at Infoblox and held senior roles at VMware and Cisco.

Janesh, maybe to kick off, maybe if you can just frame the opportunity for the company. When you look at the 3 big categories of enterprise search, observability and security, just give us a sense of kind of what you're seeing across all 3 of these categories today?

Yes, happy to, Brent. And thanks for hosting us. We appreciate it very much. So as I reflect back, Elastic was started on the premise that making large volumes of data searchable almost instantly. It's a pretty compelling idea that can find application across many different use cases. And as both data volumes grow as well as the value of that data increases, that becomes an even more compelling idea. And with large data sets, you want to just understand what's in the data. You want to have a conversation with your data. You want to search within it looking for trends or insights or sometimes just to find things. And over time, as we grew, some use cases became more prominent than others. And as you noted, we now focus on 3 solutions, enterprise search, observability and security. Enterprise search includes not just powering a search box on a website or on an app, but it also includes being able to search for enterprise data that's not limited to the 4 walls of the enterprise, but also includes data that's stored across applications in the cloud. And on the observability side, while we initially were used mainly for logging related use cases, today, we're used for APM and infrastructure monitoring as well. And for the IT abstraction, their needs or their ask is pretty straightforward. They just want to be able to search across all of their infrastructure and all of their apps to ensure things run as expected, and they want to be able to do that in one place. And then while you're observing, why not also protect? Threat hunters started to use our software sometime back actually to search just the breadth of security events to discover threats and bad actors. And today, we offer a [ seamless ] product that is combined with endpoint protection through our acquisition of Endgame. So each of these solutions today for us represents a pretty significant market opportunity by itself. If you think about the TAM, it would be measured in several billion dollars for each of those 3 solutions. But what's even more compelling for us is that all of our solutions are built on top of the unified stack, which is the Elastic Stack. It's a single technology stack. It's all driven by search, and it's got a single unified pricing model on top of it. So although we are used for 3 different solutions, what we really sell our subscriptions that provide access to different levels of features across these solutions. And as I think about the mix across these different areas, while that's largely directional and supported by our team, since logging was one of our more popular solutions in the past, historically, more than 1/3 of our business used to come from logging, we've now seen an even greater shift towards observability, where we are seeing strong traction on the APM side as well. And then similarly, we've seen pretty strong traction on the security front, which is growing quite nicely for us. We've provided many different examples of that in the past, ranging from the enterprise all the way to nation-level security for which many governments adopt us. So we're seeing strong traction on that front as well. So we're quite excited about the market opportunity really across the 3 solution areas.

The TAM is pretty big, $45 billion. Many ask kind of where you sit today inside the penetration? And what you see is the main drivers inside the installed base from here?

Yes. It's a great question. As I think about the overall TAM, I talked about the benefits of the stack, but one of the things we also did was we leveraged a free and open distribution model. So developers could just download our software and get up and running for free or they could choose to get started on SaaS with a pretty low monthly amount. And so our initial adoption was primarily at the developer level or at the departmental level. And from there, we started to grow further up within the enterprise, moving up to higher levels within the organization. And that's been a journey for us in which I think we've been quite successful. It's still early innings, but we've got a number of large customers today. If I think about customers that are, say, more than $1 million in size, that was more than -- we had more than 50 such customers at the end of our last fiscal year. And if I think about another metric, which is one we publish every quarter around customers, more than $100,000 in ACV, that number has been growing quite nicely as well. It was more than 630 customers at the end of Q1. So I'd say we've still got significant room to expand within the enterprise and within that installed base. And I think about those expansion drivers really in 2 ways. One is at a macro level, when I think about customers' IT spending priorities, their priorities are increasingly shifting towards areas where our solutions are very well aligned across enterprise search, observability and also security. So those shifts in customer spending will just be natural catalysts for us over a longer period of time. And then within an individual customer, the expansion occurs in multiple different vectors. So a customer who starts a project for a particular solution, that project itself can grow as the underlying volume of data grows and they get more value from it. Or what can happen is a solution gets adopted in multiple parts of the enterprise. So division A set up a security project and their friends in division B, C, they success with that and they set up a security project of their own. Alternatively, a customer starts to adopt us for multiple solutions. They started with observability, but extend into security or they started with enterprise search, but extend into observability. All of those different motions help drive expansion for us. And just given the free and open model that we had, we tend to see adoption at the lower levels and then we move up, and we refer to that as a bottom-up motion. I would have used an analogy of starting brushfire and watching them grow. But in this time, that would be a bad analogy to use. So I won't go there. But that's generally how I think about the expansion. It can be pretty viral once we're within an enterprise.

One of the things that I think is a compelling opportunity for you is ease of use, you definitely attract a harder core developer. But when you think about the larger population that can use Elastic inside a company. It seems like things are changing a little bit. It's becoming more usable and easier for Joe in accounting or Mary Jane in the travel department to start to potentially look at using your solution? And maybe if you could just talk about the ability for those outside the technical realm to adopt and embrace adoption across the enterprise?

Yes. I'm happy to -- and I saw the results of that survey as well. So that was a pretty well researched note, and thank you to you and the team for that. As I think about ease of use, one of the things that's important to understand is just our overall approach to product development. So sometimes when companies announce a product, they may take a couple of years to bring it to market. But in our case, because so much of our development is just based on direct feedback from our customers, we tend to have a pretty rapid pace of innovation and a very rapid cadence of product releases. So we will develop foundational features, and then we put them out there for our customers to use. And these will tend to be robust and enterprise-class features that customers can drive a lot of value from. And then over time, we'll iterate fairly rapidly to add more features and add more capabilities. And so the ease of use directly correlates to the duration of time that we've had our product out there. If I think about logging, for instance, customers have used us for logging for many, many years. And so the feedback around ease of use for logging was probably valid, say, 4 to 5 years ago. But today, for logging projects, customers can be up and running literally in minutes. And they can start to get the full value and the full advantage of using the Elastic Stack quite easily. APM is probably another example of that, where we put features out there a couple of years ago, and then we added much more over several releases. And today, we're winning deals on APM against pure-play APM companies. So we've seen good traction there too. And that's even before you consider all the advantages of having Elastic for the full breadth of observability. Similarly, on the enterprise search side, customers today can put a search box on a site or start to search enterprise content quite quickly, again, literally in a matter of minutes. So we've made some pretty significant progress there. And even on the security side, with natively integrating the endpoint security functionality from Endgame into the Elastic Stack, that's gone quite well. You may have seen some of these things, even in our most recent release in 7.9, where one of the features that we're actually quite excited about, is a unified agent. So it's a single agent to ship data for logs as well as metrics and endpoints into Elasticsearch rather than having separate agents for each of these. And that's a pretty big step forward for customers in terms of ease of deployment and ease of use. And there are many more features surrounding ease of use in 7.9 and even more to come. So something we're actually quite excited about.

Maybe you can talk a little bit about the enterprise search offering, and what you're seeing there? What are kind of the drivers economically to help the business on that side?

Yes. I mean, enterprise search was one of our earliest use cases. So if I think about enterprise search, it includes site search, app search as well as Workplace Search. So 3 different potential use cases. And it all started really with just this idea that search meant adding a search box to the website. But it's not just to search on a website, it's also to power e-commerce applications as well. And that's what we call site search. So we've been very popular for site search now. And in fact, COVID-19 has been a tailwind when it comes to e-commerce-related usage. So that's been encouraging to see. And we power many of the experiences that people just commonly use for such searches. Within an app, we are used for app search, which is very common as well. And again, most people, when you think about many apps, if not most apps, they have got some sort of search embedded within the app. It could just be a search box where you type or it could be something a lot more sophisticated like a rider driver matching experience in a ride-sharing app. And those kinds of searches are also powered by Elastic. And then when I think about Workplace Search, we recently launched the next-generation of workplace search. And think of this as what traditionally used to be referred to as enterprise search many years ago where you had companies like FAST and Autonomy and Endeca that didn't really live up to their full promise because it was just so hard to connect so many different data formats and sources. But now with so much enterprise data sitting outside of the 4 walls of the enterprise, the nature of the problem has shifted. Now with all this data sitting in SaaS applications, there are common APIs. And once you build a connector to one SaaS app, you can use it for all customers. But the problem then becomes one of handling security and handling searches across all of these different assets with the speed that only a search engine can deliver. So today, with our Workplace Search product, customers can now search across many popular apps, Salesforce, Jira, Confluence, ServiceNow, Google Drive, GitHub, Gmail and more. And all of that with a single search in a single box. We just launched this some months ago, and we just delivered a free and open tier on this with the most recent release. So it's still early days, but we're pretty excited about the possibilities for Workplace Search in its next form as well.

Just a follow-up on that. How is that price for customers? How do you approach them with an economic model around this?

Yes. It's very similar. It's again just pricing based on resources. So based on the resources that they consume, if they create copies of the data and store that and as those underlying data sets grow and as they continue to use more and as they grow with us, it's the same resource-based pricing model that we have with them. And that's one of the benefits of using Elastic. So regardless of the use case or regardless of the solution, it's a unified pricing model.

Great. Turning to security. I know it's early there, but when you think about how big this business could be, and kind of what your aspirations are in security? I know it's a big topic, we could talk for an hour on this, but how would you compartmentalize it and think about your traction so far and where you could be in security market?