$ESTC — Four indexes in one shard, and why agents suddenly need all four

Elastic gapped +19.3% to $99.91 on Friday after a Q1 FY27 print that beat every guided line and lifted the year. The interesting part of that call was not the beat. It was that management spent its airtime on index structures, quantization and permission models — and the reason those details now belong in an earnings call is that agentic AI is the first workload that needs all of Elasticsearch’s storage engines at the same time, in a loop.

For fifteen years a search engine answered a human who would then read the results. Return ten links, rank them well, do it in under a second. A person could compensate for a mediocre result by rephrasing. Two things broke that. IDC puts data generated in 2025 at 175 zettabytes, roughly 90% of enterprise data unstructured — prose, tickets, code, logs, audio, images, none of it carrying a stable schema. And the consumer of retrieval became a model that does not ask again; it answers confidently from whatever it was handed.

The first AI wave hid how hard this is. Retrieval-augmented generation as built in 2023 and 2024 is close to a single lookup: chunk, embed, fetch nearest neighbours once, paste into the prompt. A single vector lookup is genuinely a commodity, which is why every hyperscaler could attach one to a product enterprises already bought. Agents change the shape of the work before they change the storage. Once retrieval sits inside an execution loop, the system must find the right thing under the right permissions with the right recency, cheaply — and then do it again after the state changes. Cost per retrieval stops being a rounding error and becomes the unit economics of the application.

Elasticsearch stores the same document four ways — inverted index, dense vector graph, learned-sparse term expansion, and now columnar time series — inside one shard, behind one query language, under one document-level permission model, deployable in a customer’s own data centre or air-gapped facility. No competitor holds all four. Pure vector databases hold one. Warehouses and operational databases were built around a schema the messy corpus does not have. Hyperscaler search services hold two or three, but only where that hyperscaler runs.

That combination was an accumulation of unglamorous engineering with no obvious buyer for most of its life. Agentic retrieval is the workload that makes it scarce. The evidence that enterprises have started paying for it is not the revenue line — it is the commitments running visibly ahead of it, and the composition of the customers making them. What the market has already conceded, in one session, is most of the discount that made the bet cheap.

Elasticsearch — started by Shay Banon in 2010 and still developed in public — sits underneath Search & AI, Observability and Security, all running over one copy of a customer’s data. Revenue is 94% subscription; FY26 was $1.739B, +17.3%, at a 76.1% gross margin. Elastic develops the majority of its software in public repositories under AGPL v3 alongside a proprietary licence and, as the 10-K puts it, does not build an enterprise version separate from the free distribution — one code base. The consequence is adoption most enterprise software cannot buy.

Elasticsearch is a document store with an inverted index — a library card catalogue, industrialised. A document arrives with no schema commitment; the engine tokenises it and writes, for every term, a sorted list of the documents containing it. That is why exact tokens survive: a part number, an error code, a customer identifier. Vector search cannot find SKU-4471 reliably, because a number absent from the training distribution has no meaningful embedding.

Onto that base Elastic layered three more representations, each solving a failure of the last. Native vector search with HNSW graphs (v7.x, 2021) catches meaning when the words do not match — and Better Binary Quantization cuts the memory that costs by up to 32×, which turns semantic search over a billion documents from a demo into a line item. ELSER, a learned-sparse model (v8.x, 2023), expands a document into weighted terms and then rides the existing inverted-index machinery, giving semantic recall without a second system. Columnar Mode (v9.5, technical preview) stores metric samples column-wise rather than as documents.

The advantage is not any single structure — competitors have each of them. It is that all four live in one shard, so a single query can fuse lexical and semantic scores, filter on recency and tenant, rerank the survivors with a Jina cross-encoder, and apply document-level permissions at retrieval time rather than after the model has already seen the data. Every one of those steps is a separate network hop and a separate security boundary in a stitched-together stack. In Q1 a Global 2000 semiconductor company chose Elasticsearch Serverless in a seven-figure new-logo win, in a competitive RFP against pure-play vector databases, because it needed hybrid retrieval over a live product catalogue with per-user document-level security and an agent layer on top.

The poster above draws the path; the board below draws the inventory — what Elastic actually sells, so the single-engine claim can be checked rather than taken on faith.

Management has been candid that metrics were a weak spot: a metric sample stored as a document carries per-document overhead a purpose-built time-series database does not pay, and at millions of samples per second that overhead decides the bill. Columnar Mode removes it — a backend started roughly eighteen months ago, reachable through the same API. Alongside it, native Prometheus ingestion with PromQL support removes the migration tax: teams keep their query language and their dashboards. That combination already converted a global insurance company running application logs in Elastic and metrics and traces elsewhere.

The second investment is agentic operations. Elastic acquired Deductive AI, whose reinforcement-learning harness pairs code repositories and Elastic alerts with downstream signals from Slack, PagerDuty and ServiceNow to build decision trees from past investigations and reuse them on new incidents. And the Jina models acquired in 2025 — multimodal and multilingual embedding plus rerankers — now run on-premises and air-gapped, which extends first-party inference into regulated environments where the alternative is not a worse vendor but no vendor at all.

The market’s error was never about the technology; it was about tense. It priced the revenue Elastic had printed rather than the commitments it had signed. Reported revenue was $478M, +15% against a $470M consensus, with non-GAAP earnings of $0.70 against $0.58 and non-GAAP operating income of $77.3M against $65.7M — a beat on every line, but still mid-teens growth. Current remaining performance obligations reached $1.153B, +21% as reported and +20% in constant currency, the second straight quarter at 20% CC, and total RPO $1.854B, +27%. Backlog compounding roughly twelve points faster than revenue is the signal, and the duration objection is harder to sustain when management reports healthy consumption against commitments already signed.

The customer mix is where the AI claim becomes checkable. Elastic added more than 80 net new customers above $100K ACV, its largest quarterly increase ever, and 37% of that cohort now uses Elastic for AI against roughly 21% a year ago. Profitability is doing the quieter work: subscription gross margin held at 81%, non-GAAP operating margin printed 16.2% against guidance, and adjusted free cash flow was $143M after paying $13M of restructuring cash. The FY27 guide went up on every line — revenue to $2.004B, non-GAAP operating margin to ~19.4%, EPS to $3.33, adjusted FCF margin to ~21.5%. One number the headline hides in the other direction: GAAP operating margin was −5%, a $24M loss, on $20M of restructuring and heavy stock compensation.

On 26 August the board nominated Julia Liuson to stand for appointment at the October 2026 AGM. Liuson ran Microsoft’s Developer Division as President from November 2021 to June 2026 and was a Corporate Vice President there from 2012 — the organisation behind Visual Studio, VS Code, .NET and GitHub. For a company whose thesis is that developers and coding agents reach for Elasticsearch by default, recruiting the person who spent a decade owning the world’s largest developer surface is a more precise signal of intent than anything in the prepared remarks. In the same filing, Caryn Marooney told the board she will not stand for re-appointment.

Two honest qualifiers. Kulkarni’s record is genuine — margin and gross-margin expansion across four fiscal years — but it is a record of disciplined mid-teens execution, not of re-acceleration; that is the thing being underwritten now and it has not been done before. And the product organisation is unsettled: the CPO departed in July after June’s restructuring, which cut roughly 7% of staff. Separately, Pictet Asset Management filed a 13D/A on 20 August disclosing 5,393,567 shares, 5.18%, at a cost of roughly $400.8M. A 13D reads as activist and this one is not: the filing states Pictet is engaging on strategy and governance and does not currently have plans that would result in a change in control.

What forces a change of view: the 19 November Q2 print. Constant-currency cRPO holding 20% for a third straight quarter with NER turning up validates it. A cRPO break below 16%, or NER sliding again while management repeats that it is a trailing artefact, ends the re-acceleration case regardless of what the revenue line does.

Friday was violent and it faded. $ESTC closed $99.91, +19.31%, on 10.1M shares against a ~2M average — but it opened $103.89, printed a 52-week high of $108.00, and gave back most of that to close in the lower third of the day’s range. The stock has roughly doubled off the 10 April low of $42.05 and sits 48% above its 50-day ($67.44) and 57% above its 200-day ($63.75). Nothing about that is a low-risk entry.

Dealer positioning explains part of the fade. On the live chain the call wall sits at $100 and the put wall at $75 — the stock closed on the call wall, the strike where dealer short-call hedging is heaviest and where upward moves meet the most supply. The nightly snapshot taken before Friday’s open still carried a $65 call wall and a $56.87 gamma flip; both are stale by a full repricing. Implied volatility did not collapse the way it usually does after an event: ~47.8% at the 18 September expiry and ~46.8% at 16 October, rising to ~56% by 20 November — the market pricing the next print as the real decision point rather than this one.

At $99.91 against 105.0M shares, market capitalisation is $10.49B. Cash and marketable securities of $1,461M against $575M of debt leave $886M of net cash, so enterprise value is roughly $9.60B — 4.8× the FY27 revenue guide and 30.0× the $3.33 FY27 non-GAAP EPS guide, against forward adjusted free cash flow of about $431M, a 4.1% yield. Five weeks ago, at $59, the same company was 2.7× forward sales, ~18× forward earnings and a ~7% free-cash-flow yield.

The technology case is stronger after this print than before it, and for a reason that is checkable rather than rhetorical: management described the storage architecture, the quantization, the permission model and the migration path in enough detail to be wrong about, and the one competitive RFP they narrated was won on precisely the capability the architecture predicts. The commercial evidence moved the same way — two consecutive quarters of 20% constant-currency cRPO, a record cohort addition, AI penetration up sixteen points in a year.

What did not improve is the price. A base case that returns 6% over eighteen months is not a position; it is a subscription to being right slowly, and the distribution around it is wide because the two facts that would settle the argument — net expansion and the AI cohort’s incremental spend — are the two management has not quantified. Own it if it retests $75 and holds, which is both the put wall and the level the pre-gap range was built on. Chasing it at the call wall means paying for a re-acceleration that has been announced twice and delivered in backlog only, with the first hard confirmation still eighty-two days away.