Elastic N.V. (ESTC) Earnings Call Transcript & Summary

Okay. Welcome to our next session. With me is Shay Banon, CEO of Elastic. Shay, great to have you here. Just -- we've been on a nice journey since pre-IPO, IPO, now as a public company.

And that's where my first question goes a little bit. It's like, for you, what's been the biggest difference of running like a private company versus a public company? What's your experience been like?

Yes. Hi, Raimo, and really happy to be here at the conference. And welcome, everybody, listening in or listening to the recording. Always excited to engage and answer questions. I think maybe it ties into part of my answer. I think that once you become a public company, there's multiple vectors that you need to think about or aspects. The first one is just the mechanics of being a public company. So you want to make sure that you have the team in place to be able to go and close a quarter and file and understand all the new rules that suddenly get added. None of them are necessarily bad or something like that. They're just like additional rules that you need to go and execute as a company. I actually view many of them as just a mature way of execution as a company and very healthy to have. I think the other part is we've been managing communities at Elastic for a very long time, even personally, on an open source level, managing hundred of thousands of developers using your open source projects and then your products and just the breadth and the ability to go and communicate on multiple levels. And then as we grow as a company, you can make it with communities that are now C-level executives and communities that are software analysts. So once I think you think about our investors, shareholders, analysts like yourself as just another community that we're just happily engaged with and enjoy talking to about technology, about the economics, macro, micro, about the situation of the market, then it's just a wonderful way to do that. I think internally, within the company, the things that really changed is to make sure that nobody at Elastic says, now that we're a public company, we should do x, y and z, if that makes sense because being public is a moment that we were all very proud about, but we've been executing as a company towards the long term, and we need to do things because they're right, not necessarily because now that we're a public company, we should do x, y or z or something like that. And I think that, that has been something that I personally really stressed at Elastic. I love our culture. I love our team. I think they're amazing in the way that they execute, especially during the pandemic has been very humbling to see. And just making sure that we don't get blinded by a quarter or by an event and continuously think about the long-term and just delivering value to our customers.

Yes. Okay. And then talk a little bit about the evolution of your offering. So I remember like when I've talked with Steve, actually the first time like years and years ago, there was a lot of search still. And now you're kind of much, much broader position. Just can you bring us on -- or get us on that journey from back then to now?

Yes. Yes, of course. We -- I brought the first few lines of code of Elasticsearch many, many years ago. And the idea was that search is really an experience. You put a search box in front of a user and they feel empowered, right? It's like, I know what you do. I'm going to type in a question, I'm going to type in a query and I'm going to get the results. These results are going to come back fast irregardless of the scale of data that you have, and these results are going to be relevant. There might be a visualization, there might be something else. And the data is limitless, right? It can be any type of data where -- from a recipe to a web application, to a log event, to a metric or infrastructure monitoring or security event or any type of data, you will just go and start to search it, e-commerce products. And we really built Elastic in the early days to really build this engine, this stack or this platform that really can solve any type of search experiences. Now like any, I think, great products, you live in this duality of you really focus on building something fundamental to satisfy many different needs, but also ends up being adopted in specific areas over time. And then in the beginning, it was like the old school enterprise search use cases, how do I search my workplace or my company and how do I transition from Endeka or Fast or other implementations that I had to something newer? How do I add a search box to my website, whether it's Wikipedia, whether it's Uber, whether it's others or my application, and then slowly users started to see true value, I think, the ability to just take a search box and put it on other things. They took a search box and put it on application logs to be able to go and monitor their infrastructure. And thanks to our bottom-up adoption model and developer adoptions, the creator class, the practitioners that ends up starting to use our software, just started to get adopted more and more. So we started to get into logging, and from logging, that ended up going into the observability space with APM. A few years ago, we've been leading the -- we've been leading that market or that evolution within that market into becoming an observability market, which is basically, just take a search box and put it in your infrastructure or applications and make sure that they're up. It's as simple as that and as complicated as that.

Yes, yes, yes.

Then the other part is security. Take a search box and put it on your company to protect it because you want to put a search box at the hands of threat hunters to make sure that there isn't a malware lurking around in your company data servers, network or something on those lines and make sure that your company is well protected, and we've been investing there as well significantly. But at the same time, everything is built into a single-technology stack. So all of these things that I've just mentioned, they are just features in a single product. All of our various teams that we have at Elastic work on a single holistic product, collaborate together, whenever someone goes and deploy our product on the cloud or download and run it themselves on-prem or on Kubernetes, they end up getting -- they end up being able to use it to all of that and more, right? It's like all of these crazy use cases from fraud detection to business analytics to, I don't know, wind tunnel tests that carmakers do with Elastic.

Yes, yes. And then, like, it's funny, because like, I remember when the -- initially I thought -- and I thought about like, oh, now they're going to observability, and then, oh, they're going to security. But actually, the more time I'm spending, the more this looks all -- like it's all about data because you're bringing it all together, and you want to have security data in your observability data set because they're all related to each other. Is that kind of the right way to think about it? It's really more about that -- creating that central data hub and you with search and the foundational layer below that is kind of the -- really want to bring that forward. Is that the right -- am I on the right track? Or am I just dreaming something here?

I think you're right. I think there's a level -- there's a question of intensity on how much do you lean into that thought process, if that makes sense. So when we started to get adopted in the context of logging, I was really excited as a member of Elastic and in Easticsearch itself, because it was like one of these markets were this large incumbent commercial closed source, and it's like it's the bread and butter of something new, fresh, fast, technology superior, I would argue, to other solutions out there that was there and -- but also open and bottom-up and like really being part of these movements of DevOps and community and creator class collaborating together to make something to -- and use a product. But then if you look at the markets itself, you see that from logs, many, many companies evolved very naturally from application logs in the what is called an observability market, now to the SIEM market, the S-I-E-M market because almost like it's very natural. You probably won't do it from APM or infrastructure monitoring or something like that. But logs -- every log is a security event. It's like you look at someone opened the file, closed the file, did some events that happened in the application, it can actually go and use it for threat-hunting and figuring out if someone is actually trying to do something bad with your -- in your company. And you see that with other companies like Splunk, took logs and then expanded to security through SIEM. So it's not like -- I don't feel like we're innovating at one level in like how obvious -- we always knew that we would get to the SIEM market at one point. But I think that if you look at what we've done, the things that we care deeply about is that if you really believe that it's all in the data, it's all about experiences that you get that starts with the search experience at the fundamental aspects of it, they all need to be developers features, if that makes sense. And we don't have a suite of products. We don't have one product for observability and another one for enterprise security and another one for IT, operational monitoring or something like that. We really just have one and that ties into what you're saying. Like we think that the data is the same. And if the data is the same, then the product needs to be the same. And the experiences that users have needs to be the same and that gives leverage to us because when we develop something once, we can benefit it across all of these solutions, but also to the customers because they only need to train once. They really have this ability to consolidate usage through data and really start to gain insights out of that data and act on them much faster because it's in a single place. So that's definitely the case, and I'm looking forward for the same movement that happened 15 years ago in the operational monitoring market where devs and ops became DevOps to happen within the security market, but then across the security and observability market as well. And we're building our products and our go-to-market to go and capture it as it unfolds.

Yes. And then the -- on that note, if you think about where are your customers on that journey? Or are the customers actually ahead because they know they have a problem. And just the vendors haven't been able -- this is more of a different thing because the vendors haven't been able to kind of develop that quickly?

Yes. It's a great question. I think customers are at different levels of maturity. Even within the observability market, for example, some customers are ahead, and they say, yes, logs and APM application performance model needs to be together, needs to be in the same place, and then we'll happily solve that for them. Sometimes they have an APM incumbent, but they're only instrumenting 10% of their application and they have us operating for logs. So we'll happily with the same installation, same -- everything is there for them, they'll just shift the other applications performance monitoring instrumentation into Elastic. But then sometimes we go to companies and they still have 2 different teams, sometimes reporting way all the way up to different people even within observability between APM and logs, but it's -- you know where the market is going. You know that these things are going to converge. In security versus observability, I don't think it's versus, but in security and observability, there is another aspect of security data, the prism. The ability to look at security data is slightly different, but it might be more delicate data. There might be more requirements, a threat hunter is slightly different than a DevOps person, but we're running ahead with our products being the same one that we're dealing with the challenges of what does it really mean to have everything in the same place, same schema of data, same experiences, different prisms, different user experience, different workflows, but still the underlying mechanics being the same. But it's still -- I think it's going to take a few years until these 2 things converge because you still have 2 buying centers in many companies. There's still a security team and an ops team, and that's okay as well, right? It's like people specialized in one way or another. So I think, hopefully, we're trying to push that the conversion will start with the product level, you might still have different teams and then slowly go up and up and up and give more value to the customers.

The -- and on that note, a little bit like -- there's obviously -- you're going to have a different set of competitors or there's a different set of competitors emerging for you? The weird thing is, like a good few of them are actually using Elastic, like if I read some of the SignalFx kind of white papers, they are really proud how they scale with Elastic and stuff. Like how does that feel to you? On one hand, it's a great complement because it proves like what you're offering is great. On the other hand, because you're the foundational layer, you're just kind of basically supporting everyone. Like, so how do you think about that dynamic?

Yes. So I mean, I just -- first of all, I'll start with saying that we started, we grew, we became successful, thanks to open source and community and everything around that. And I think people don't use a product just because they can. They use it because they want to, because it provides significant value. So the value that searches and experience it's providing to users across the globe is just amazing, right? It's like the adoption of Easticsearch, just its own as a technology. The Elastic Stack, the experiences that we provide to our users is significant. And I'm very happy about it. It's like we don't want to stop to intentionally hold back of making Easticsearch better or making Kibana better or making our product better and making our experiences better. Over the years, we have evolved and I think you -- we chatted a bit about how we're thinking about the market. We've always put commercial features under our own commercial license next to the open source and made significant investments there. Advanced security capabilities, anomaly detection within machine learning and a few others. And about 2 years ago, we also created a lane, they try to still maintain the free and open aspects of the open source and community and things on those lines. But under a more restrictive license that doesn't allow, for example, to take it and run it as a service or embed it within an application to solve an observability use case or something on those lines. And since then, over the last 2 years, many of our investments have gone into this free and open, yet basic license, right, like non-open source license. And that includes like major efforts, like all of our APM efforts are under this basic license. Our SIEM solution is under this basic license. And if you look at our Analyst Day that we did just recently, I really went and listed how we're thinking about it and what we're putting there. And the great news is that our community loves it, like they really care about the free and the open part and the free part obviously applies to on-prem and the ability to engage with us. And they're adopting it in en mass. So we're benefiting because we can create a slightly bigger moat and more protection around us that we care, obviously, about. We're trying to provide as much of the open source aspects as possible because we care deeply about our community and our collaboration with all of our user base, and we don't want to lose it. It's something that I deeply care about on a personal level, but also trying to make sure that we even things out a bit, if that makes sense.

Yes. I mean, do you see that also play out, like if you think from an investor perspective, you probably got it like a year or two ago, and I got a lot as well, like, oh, it will be us offering Elastic, then they did their Open Distro. But now it's gone a lot more quiet around that. I don't know, maybe it's just kind of less marketing or they moved on for other marketing efforts, but it feels a little bit more quiet and I would almost say it's the basics SKU that created more differentiation again. Is that the right way to think about it?

Yes. I think so or we believe so as a company. We said on that basic journey, if you will, about 2 years ago. And when we started that journey, the difference -- basic had zero in it. There was nothing in it. And then we put some security capabilities into it because their core level capabilities that they need to be free, we actually took all of our commercial IP, everything, including the ones in our gold, platinum and enterprise SKUs and opened that code to make sure that everything is at the same level. But then over the last 2 years, I think you see how quickly we moved as an engineering team, and it's so humbling to just -- every release, we put so much out there. And even -- especially during the pandemic, just watching from the outside, our distributed engineering team continue to deliver is, it's just -- it's amazing to see as the CEO of Elastic. And a lot of it has been put towards basic. And then if you fast forward 2 years into today, you see SIEM, you see APM. You actually see also some low-level deep, highly technical capabilities go into basic, like our ability to use wildcard queries in a very efficient manner that threat hunters really care about. And beyond that, you look forward into our big innovations, searchable snapshots, the ability to have limitless everything, right? It's like just store as much as you can on low-cost object storage. It's going to be slower. But it's like logs, traces, monitor everything. That's under our enterprise subscription. Schema on read is going to be under basic. Our unified fleet and single agent, that's on the basic. So tons of investments even looking forward goes into it and we're very happy with it.

Yes. Okay. Let me change subject a little bit. Like the one thing that you need to work hard on and everyone as well that started a little bit earlier. It's like you need to get the cloud right and get the cloud journey right. Remind us of where you are on that journey. And I'll give you one positive data point. So we track in one of our reports like the web lock-ins, so we do web scraping. And you can see how the Elastic Cloud have a little bit like a slower start. And now like every month, I check the data, it's going in the right direction. So that's good to see. But like talk a little about the efforts you made there and where you are on that journey?

Sure. So I mean, as you say, we started in a world where users just download the software and run it themselves. And by the way, even in like a fully cloud world, developers still download software and run it on their laptops. So everything is on the cloud, and you run with a "dumb terminal" and everything is running there. And developers, when they sit down, they create and build -- they build on their laptops. And on their laptops, they go and run Elastic Stack and Elasticsearch and the fact that we can run well on a laptop is something that we care a lot about because that hasn't changed. But also just sort of self-managed aspects. We're very, very happy with our success in public sector and there's various levels of needs and requirements there. So I'm super excited about being able to have a self-managed -- what we call self-manage or an on-prem story, if you will, with our software that we can be there for companies that hasn't yet migrated to the cloud, they need to deploy in certain areas because of certain constraints that they have. We won't stand in their way if that makes sense from using our software. When it comes to our cloud service, we started with the obvious, like, we're going to manage our software for you, if that makes sense. And I think the next step that we're in the middle of now is really leaning into a SaaS experience. Like how can we -- thanks to the fact that we run everything, you can with one click add an integration, start to crawl Jira Classic and Jira, start to crawl Salesforce with one click, start to hook into the logs that comes from Jira or Salesforce with one click being able to go and start to connect to your Okta Deployment because you want to protect it. But also slurp the data of which applications they are, so you can go and start to crawl it to make it searchable because I want to crawl the HR system, for example, that I have connected through Okta. So all of those things suddenly become more of a like a one-click experience, and we're really doubling down on that and trying to bring that not only to our self managed, but through SaaS, looking at it from a SaaS perspective. So we're in the middle of doing it, but we -- I think we've made significant progress, as you noted. And I think we're making significant progress every single release and every single quarter that we progress.

Yes. Okay. Last couple of minutes, I wanted to kind of make it more -- talk more about the pandemic. If you think about it like, so far it's been tough on everyone. I see a little bit in the numbers for you that you guys have been impacted, but not as much as a lot of the other vendors. Can you talk a little bit about what helped you to kind of perform pretty well? Look, you're executing a lot better than a lot of other players. So what are you seeing in the market?

Yes. There's a few aspects. I think the first one is that when the pandemic hit, we started to really think and really understand what are the implications on us as a company and start to go and address it. We didn't go and say like, oh, it doesn't matter, always trying to be in a mindset of like, oh, just wait a quarter or 2 quarters, things will change, it will open up, vaccine will happen or something like this, like we do anything at Elastic, build a plan, be very measured and think about the long term. I think the first thing that we have that helped us is the fact that our solutions are extremely useful also during a pandemic, right? It's like a search box on a website as things become more digital as companies start to think about how do we maybe fast forward store that digital experience, then they need to have more applications, more online applications, all of them need search boxes. They need to be -- they're going to have more infrastructure to monitor, so that's great because -- thanks to our observability solution. And obviously, as everything becomes online and more people work from home, they need to be able to be more secure. So fundamentally, our 3 solutions apply well across industries, across segments, across geos when the pandemic does not exist, but I think it really helps our customers while it's there. During the pandemic and in a difficult macro environment, there are segments that budget get cut. It's like it's not magical and nothing happens. It's like airlines are not doing well and other areas and I'm super happy that we, with our free and open distribution, can go and help these customers during these tough times. So when the things go and come and become better, hopefully, we're going to capture them during our regular motion as a paying customer through value or they move to the cloud. So at the end of the day, there's a developer in a segment that got hit really hard and their budget got really small, and they still need to protect their company, they still need to have that search box, they still need to observe it. So that needs are still there and we're really happy about being able to do that. The other part, I think, that we've done is we're a very distributed company already. Like we've started as a distributed company, we've been working as a distributed company and across engineering, across everything that we do. So I think we got into the pandemic and it affected our workforce as well, right? It's like it's not about working from home with the pandemic. It's working from home with your family or with your roommate. That's a different environment. But at least we know how to communicate asynchronously. We know what the mute button is on Zoom. So we knew some of the basics that I think helped us adjust to it better. And yes, I'm just -- we're seeing some of the effects of the pandemic. Sales cycles are slightly longer. Sometimes another signature is needed on a specific deal or something like that, but just like -- our team just goes and executes and goes and captures that additional signature or continues to deliver value to our customers. And I think you see it in our execution. And again, we're thinking about these things 3 years ahead and trying to invest at that level of like time frame, 5 years ahead.

Yes, yes, yes. Okay. I could talk forever, but like they gave me definite time actually. It was great that you were able to join us. Thanks for making the time, and I'm looking forward to continue to be with you on this journey. It looks really, really exciting. Thank you.

Thank you very much, everyone, and thanks for hosting us in this conference. Always happy to be here.

Thank you. Okay. That's nice. Thank you.