Curiosity is a fundamental part of what defines us as a species, and in order to find answers, we need efficient systems of record and retrieval. Today, up to 73% of company data never gets used or analyzed. There exists a huge opportunity for applications that can rapidly obtain insights from large amounts of data via search.
Source: Elastic Website
When you hail a ride home from work with Uber (UBER), Elastic helps power the systems that locate nearby riders and drivers. When you shop online at Walgreens (WBA), Elastic helps power finding the right products to add to your cart. When you look for a partner on Tinder, Elastic helps power the algorithms that guide you to a match”.
These examples are just the tip of the iceberg. Management has previously stated that the only limit to Elastic Stack is one’s imagination.
As of July 31, 2018, Elastic was used by 32% of the Fortune 500 and 21% of the Forbes Global 2000. Today, Elastic Stack has been downloaded over 350 million times and 10,500 companies all over the world use it to power mission-critical systems. With search at its core, Elastic has built an integrated product suite that leverages Elastic Stack for use cases across enterprise search, observability, and security.
I believe Elastic’s attempt to create a holistic, developer-friendly platform based around these three core solutions has established a unique competitive position that is underappreciated by the market, offering the potential to generate significant positive alpha for investors.
Product, Market, and Competition
Built on open-source, the Elastic Stack includes Elasticsearch, the core search and analytics database; Logstash and Beats, used for ingesting data into Elasticsearch; and Kibana, used for data visualization. Elastic’s solutions can be deployed in 3 different configurations. Elastic Cloud is their fast-growing SaaS offering where they handle hosting for you, this can be deployed in 3 pre-sets: basic Elasticsearch w/Kibana or specialized for use cases in Site Search. Elastic has partnered with AWS, Azure, GCP, Tencent, and Alibaba cloud, allowing them to be where their customers need them to be. Elastic Stack can also be self-hosted through Elastic Cloud Enterprise or Elastic Cloud on Kubernetes. I expect Elastic Cloud to continue to grow at very fast rates given the difficulty of setting up and managing on-prem deployments.
Source: Software Stack Investing
Enterprise search is the primary solution that Elastic Stack is known for, management boasts that they have a fast, intuitive, and scalable search box “you can put on just about anything”. Elastic estimates its addressable market in search as $8B in 2018 based on IDC figures. Their Enterprise Search offering itself is comprised of 3 products: Workplace search, allowing teams to search for data across platforms whether it be Google drives, Slack messages, Salesforce, JIRA, ServiceNow data, etc.; App Search, which powers features like search bars or product recommendations; and Site Search, which allows companies ranging from Twilio (TWLO) to Shopify (SHOP) to easily implement search features on their websites.
Elasticsearch can consider the open-source search engine Apache Solr, commercialized by Lucidworks, as their primary competition here. Lucidworks offers an enterprise version of Solr called Fusion which is used by companies such as Reddit, Bank of America (BAC), and Lenovo (OTCPK:LNVGY), but it is not as fully featured as Elastic Stack. In the May 2020 DB-Engines ranking for search engines, Solr comes in at a distant 3rd place with falling popularity, whereas Elasticsearch is 1st with increasing popularity. NoSQL database MongoDB (MDB) also offers text-search capabilities, Microsoft (MSFT) offers Azure Cognitive Search, and Google (GOOG) has a Cloud Search product, but they are all very limited in terms of search and analytics capabilities compared to Elasticsearch. Elastic dominates search as its core competency.
Elastic has recognized they can leverage their strength in search to take the same search box they use for full text and documents and apply it to log, metric, and APM data, forming their next solution: observability. This encompasses the need to aggregate application performance data, troubleshoot root causes, and prevent similar issues from occurring in the future. Elastic takes a similar approach as fellow monitoring platform Datadog (DDOG), integrating previously separate tools for APM, Logs, Metrics, and Uptime into a common data store and leverage machine learning to immediately identify and resolve issues. Elastic competes with a multitude of vendors in this area including Datadog, Dynatrace (DT), Splunk (SPLK), AppDynamics (APPD), and New Relic (NEWR). Although Elastic faces the most competition in this market, it is for good reason as it is the one with the largest opportunity. Gartner estimates the market of IT Operations Management represents a $37B opportunity by 2023 and the number of applications that are monitored will quadruple from 5% in 2018 to 20% by 2021. In the most recent quarter, a JPMorgan analyst noted that 10% of new cloud budgets are being dedicated to this area. Furthermore, recent commentary from earnings calls has suggested that COVID-19 has significantly accelerated the speed of digital transformations so it would not be unreasonable to assume that the observability market will grow at a faster pace than estimated.
Source: Elastic Blog
In observability, Elastic comes in with the advantage of being widely used for its logging solution, but management has noted they are seeing increasing adoption for use in metrics and APM as the observability space grows. Now, logging users get easily exposed to the rest of the observability paradigm and those silos start breaking down. Datadog was able to quickly capture significant share from specialists like New Relic in APM or Splunk in logging although both have recently announced full observability platforms. The enhanced visibility and productivity created by a single pane of glass approach have had the market coming to Datadog. I believe that by not only consolidating use-cases in observability but also search and security, that Elastic is well-positioned to take advantage of IT departments’ efforts to reduce vendor sprawl and adopt a single, dependable tool to manage their systems on. Furthermore, in Datadog’s recent Q1 2020 earnings call, they note that they are seeing more consolidation and more customers looking to rationalize costs. These are all positive trends for Elastic.
Finally, Elastic has recently branched into security with a SIEM product to aggregate and analyze log data and identify threats and an Endpoint Security product powered by their $234M acquisition last year of Endgame to protect user devices. Before Endgame was taken out, they ranked very highly in the visionary category in Gartner’s 2018 Endpoint Protection report. This has translated into a holistic solution that combines prevention, detection, and response to one agent. Among others, Elastic competes against Splunk, LogRhythm, Rapid7 in SIEM and CrowdStrike (OTC:CRWD), Trend Micro (OTCPK:TMICF), SentinelOne, and Carbon Black (NASDAQ:CBLK) in endpoint security. On their website, they note several features that CrowdStrike and Carbon Black lack in their base product but most notable is having the ability to deploy in cloud, on-prem, or hybrid environments.
Source: Elastic Website
Forrester Wave ranked Elastic in their EDR Q1 2020 report as a “strong performer” and notes that while they are a good option for companies looking for mature endpoint capabilities and have a strong vision for the future, their unique pricing model based on usage rather than per endpoint may affect a company’s ability to scale its use of the solution. I would like to note here, based on management commentary in past earnings calls, that this single, usage-based pricing model has resonated well with customers. It becomes much less confusing considering the rest of Elastic’s products are billed on usage, so I am of the opinion that their current pricing model is wise. CEO Shay Banon notes that:
From hands-on practitioners and decision-makers visiting our booth at RSA this week to the CSO at a major financial institution I met with recently, they’re hungry for something different. They’re wary of the unintegrated tooling, restrictive pricing model, and the need for specialized expertise to operate”.
Source: Forrester Wave
In terms of the actual capabilities of their security offering, Elastic recently released an evaluation of 21 different security products including leaders like CrowdStrike and SentinelOne by the MITRE Corporation, a US-based, federally funded research and development center. MITRE outlined 20 major steps to qualify how all the vendors detected different procedures during an attack (e.g., Initial Breach, Rapid Collection, and Exfiltration) and surprisingly, despite having just launched Elastic SIEM in June 2019 and Endpoint Security in October 2019, Elastic score among the highest of all vendors. Part of this outperformance is coming from how synergistically their security solution fits in with the existing capabilities of Elastic Stack.
Customers are also being drawn to try out their offering, in the last earnings call, Shay notes:
even with RSA, which is a more business-oriented conference, you could see people getting drawn. I think we had full capacity in every single demo and every single time that we showed our products. The excitement is contagious when it comes to our efforts in the security space”.
Quite possibly one of the best references for the strength of Elastic Stack’s security offering is its extensive use by the US Department of Defense and all branches of the US military. In particular, the US Air Force uses Elastic Endpoint Security to prevent, detect, and hunt for advanced threats to protect critical infrastructure. In March, Elastic achieved the FedRAMP “in process” milestone and Elastic Cloud was made available for federal customers to deploy on AWS GovCloud.
Again, the current work-from-home trend necessitated by COVID-19 plays in Elastic’s favour here, as does the increasing consolidation occurring in the endpoint security market. In CrowdStrike’s Q4 2019 earnings call in April, CEO George Kurtz notes that they have seen significant demand as Symantec abandons large segments of the market:
One of our partners submitted a list of several thousand of their customers that will be migrating away from Symantec in the next year and we found that there was very little overlap between these prospects and our existing customer base”.
In their S1, Elastic estimates that their opportunity in security analytics to be $5B in 2018 based on IDC figures. In Endpoint Security, IDC estimates the market to be $7.6B in 2019, growing to $8.7B by 2021. These figures have likely changed given the effects of COVID-19 on accelerating the pace of digital transformations and creating a work-from-home paradigm.
Also, it should be noted that AWS offers the ELK stack themselves via “Open Distro for Elasticsearch” which has met limited success. In the last earnings call (Q3 2020), CEO Shay Banon restated that it has seen very little adoption. Because of Elastic’s increasing differentiation on the product level, Amazon (NASDAQ:AMZN) has not been able to keep up. Elastic has posted a comprehensive feature comparison on its website, noting that several key features like machine learning, integrated stack security, and metrics and logs apps being unavailable with Open Distro. Combined with support and the freedom to deploy in any environment, it is evident that Elastic has a better offering for large scale deployments. The lack of code commits on Open Distro’s Github and low activity on their support forums versus Elastic supports this.
Open Distro Comparison (Source: Elastic Website)
Total Addressable Market
It’s easy to see how one could view Elastic’s rapid expansion into several competitive markets as a disjointed and inefficient use of resources, their stock has been punished for this spending. However, I view this relationship as synergistic, leveraging their strength in search to capture adjacencies. Their high DBNER of >130% and consistently strong revenue growth at ~60% for the past couple quarters help to prove this. This is not unlike Livongo (LVGO), a leader in digital therapeutics, which leveraged their strength in diabetes to expand to hypertension and weight management, both common conditions that diabetics have to deal with, becoming a dependable, one-stop-shop for HR departments.
In Elastic’s S1, they list their total addressable market as $45B. I think this estimate is inaccurate today as they have greatly expanded their platform’s capabilities, namely in security.
Elastic TAM (source: Elastic S1)
I created the following representation of each of Elastic’s current markets and their 5-year CAGR with data from the aforementioned sources. Elastic’s TAM today should be $52.4B, rising to $92.91B by 2025.
Data from CrowdStrike S1, Datadog S1, Elastic S1, IDC estimates
Elastic has a resource-based pricing model where cost is directly tied to usage. There are four tiers: standard, gold, platinum, and enterprise. The standard version can run for as low as $16/month and on-prem deployments can opt for the free basic/open-source plan. Elastic Cloud also offers a site search plan for easy deployment of that feature, starting at $79/month for the standard version with Pro and Premium options coming in at a higher cost for additional features and support. Although most capability is available in the standard version, large scale deployments would likely require support and the latest features like machine learning, endpoint security, or workplace search which are only available in the higher-priced tiers. Management reiterated that they have heavily invested in building out their proprietary tiers available via the Elastic License over the past year and a half.
Source: Elastic Website
Management and Culture
CEO Shay Banon started Elastic as a recipe app when his wife was attending cooking school after he open-sourced it, adoption skyrocketed, and eventually joined forces with two other open source projects being created at the time, Logstash and Kibana. Shay is a big proponent of open source and that is built into the culture; engineers frequently evangelize Elastic Stack at conferences, community events, and meetups, helping to build a future funnel for paid subscriptions.
Shay has been able to create an impressive, people-first culture at Elastic, with 4/5 stars and a 92% CEO approval rating on Glassdoor. The company operates around a set of ideas it calls its “source code” including humility and ambition, work-life balance, diversity, and being a distributed company. Even though Elastic is headquartered in Mountain View, California, they have distributed workforce of 1,600 employees in more than 40 countries that have been called out as a competitive advantage in helping Elastic recruit the best talent. This evidently means that Elasticians had very low friction in adjusting to the work-from-home mandate as a result of COVID-19, they had already formed a tight-knit culture on Slack and Zoom. After reading Elastic’s glowing reviews on Glassdoor and the background and credentials of its management team, I believe that Elastic has created a unique culture that is capable of continuing to attract impressive talent.
The open source nature of Elastic’s product has resulted in widespread adoption – it had been downloaded over 350M times at the time of their IPO in 2018. The developer community around Elastic is strong; currently, there are over 146k members in the Elasticsearch meetup group with 261 groups around the world. Elastic has a bottom-up go-to-market model predicated on upselling customers who have previously used their free plans and have a good understanding of the merits of the technology. Customer growth has also been strong, for the past 3 quarters, customers grew 700 -> 900 -> 800 QoQ to 10,500 and accounts with >$100k ARR grew 35 -> 50 -> 45 QoQ to 570 today. Again, with DBNER at 130%, it is clear that Elastic has a strong land and expand model and is finding success in upselling. With the addition of their endpoint security features in the enterprise version, the reasons to become a paying customer of Elastic are only increasing.
Elasticsearch Meetup Groups (source: meetup.com)
In terms of Elastic’s revenue mix by geography, the US formed 56% of total revenues in the most recent quarter and the majority of international revenues came from EMEA. This may be a risk in the near term as Europe has been particularly heavily hit by COVID-19 but usage-based pricing should help stabilize any revenue shortfalls. APJ was the fastest-growing region, followed by the Americas. This also produces a minor FX headwind (-4% on sales).
The second major risk to Elastic is the threat of encroaching competition and worsening losses as customers opt for best-of-breed solutions. As I stated before, I believe this risk is largely unwarranted as AWS Open Distro for Elasticsearch is unlikely to catch up to Elastic’s product development velocity and community adoption. Having a highly programmable, integrated, developer-friendly platform means that Elastic will remain a competitive choice for many companies. The markets that Elastic competes are massive, they already have a large, unmonetized install base thanks to their open-source model, and there is room for multiple winners and the trend towards the convergence of use-cases are in Elastic’s favour. In addition, Elastic’s continued focus on product-differentiation with the added slew of paid features in security should allow for more upselling in the future.
Financials and Price Target
Elastic’s consistently strong revenue growth, around 60% YoY for the past four quarters, is another indicator that their platform is resonating with customers. 92% of total revenue was subscriptions-based. As I mentioned, their SaaS offering Elastic Cloud has seen increasing adoption, with YoY revenue growth accelerating from 71% in Q1 2020 to 106% in Q2 to 114% in the most recent quarter. SaaS has grown to 22% of their total revenues in the most recent quarter, versus 17% a year ago. Because SaaS has lower gross margins, it represents a minor headwind but overall, non-GAAP gross margins have still stayed relatively stable around 74% since their IPO – another indicator of the strength of their offering. It should be noted that around 10% of their total revenues are from their monthly SaaS business, this is a headwind to RPO and deferred revenues. As a result, contract lengths are now slightly shorter at 1.5 years on average.
Management has reiterated the importance of looking at revenue growth in gauging the business but has also pointed out billings. With the exception of Q2 2020, which saw some federal business pushed into next quarter, billings growth has stayed relatively stable with the following YoY growth rates in the past 4 quarters: 57% -> 51% -> 41% -> 54%.
One area of concern for Elastic investors is their losses are showing little indication of improving. In the most recent quarter, non-GAAP net loss per share was $0.28, compared with a loss of $0.16 in the year-ago period. Management is guiding for an operating margin of -20.5% to -19.5% and a net loss of $0.32 to $0.30. Non-GAAP operating margins have been slightly improving in past quarters to -18% but this compares unfavourably with -16.6% in the year-ago quarter. Free cash flow margins were -21% this past quarter, again a setback from -14% in 2019, for the previous nine months FCF margins were -9% compared to -3% in 2018. Management expects a modest improvement for the fiscal year.
R&D expenses have shot up 88% YoY to form 35% of revenues vs 30% a year ago and while S&M has grown a more modest 43% to form 43% of revenues vs 48% a year ago. Much of the outsized spending on R&D can be attributed to the extremely fast product development Elastic has exhibited in recent quarters, from the acquisition of Endgame to create a fully-integrated security offering to the release of Workplace Search and more. These investments will likely draw more paid subscriptions in coming quarters as they are only available in the enterprise tier. Elastic carries no debt and a stable cash balance of $294M as of Q3 2020.
After reaching an all-time high of 104.10 last July, Elastic’s stock has languished in a downtrend that culminated in an all-time low of 39.01 during the March sell-off. Along with the market, Elastic’s stock has recovered but is still far below its highs despite strong business momentum.
Elastic currently trades at a large discount to peers at an EV/S of ~13x for the 2020 fiscal year ending April 30th and a forward EV/S of ~9.8x based on very conservative 2021 estimates of 32.3% growth. I believe this relative undervaluation is largely based on a failure to show improving losses and free cash flow as well as misplaced fears of competition from AWS and best-of-breed vendors like Datadog and CrowdStrike.
MongoDB is a great comparable as Elastic has very similar run rates and margins, but MongoDB trades at almost double the EV/S. Although arguments can be made for Mongo having a more durable competitive advantage owing to their dominance of document-oriented database market, Elastic dominates the search market and has more optionality in terms of potential use-cases. I believe the valuation gap is largely unjustified. The major difference in the consensus estimates shown below lies in how fast they are expected to reach sustained profitability. I believe that Elastic’s EBITDA estimates are too pessimistic and there is significant room for upside surprises here. With the Endgame acquisition complete and having built out their 3 core solution sets, I see R&D expenses gradually coming down over time. As mentioned, S&M expenses have been reined in previous quarters and I continue to see room for further improvement as they leverage their large install base to accelerate upselling.
Data from Thomson One
In order to determine an appropriate 5-year price target, I created the following framework:
Data from Thomson One
I used Splunk as a comparable, Splunk did 2.36B in revenues in their 2020 fiscal year or 31% growth. In my bullish case, I estimated that it would take until FYE April 2025 for Elastic to achieve the same at 33% growth. Splunk had negative free and operating cash flows with a non-GAAP operating margin of 14.2%, I am assuming Elastic achieves marginal profitability by 2025 for the aforementioned reasons so I feel comfortable valuing Elastic at Splunk’s multiple of 10.40. The base case assumes revenue growth of 20.7% on an EV/S multiple of 8.9, we can use Zendesk (ZEN) as a comparable here. The bear case encompasses the risks I listed previously, namely that Elastic loses to best-of-breed solutions and cloud providers like Amazon step up their offerings, resulting in continued losses and slowing revenue growth to 16.8%, garnering a lower multiple of 7.28 if we use Proofpoint (PFPT) as a comparable here.
I then assigned probabilities to each case and am left with a target EV of $16.66B by 2025 on 1.82B in revenues, which translates to a PT of $219.89, representing 198% upside from ESTC’s closing price on May 19, 2020 of $73.91 or an annual investment return of 24.4% over the next 5 years. To put my revenue targets into context relative to their total addressable market, using the estimates I listed previously, Elastic’s FY2020 estimate of 420.62M currently captures around 0.8% of their TAM. My target of 1.82B by 2025 will mean they capture 1.96%. Thus, I think my estimate is appropriately conservative, especially given that they will likely continue to monetize new markets in the coming years.
Summary and Catalysts
Elastic has done an admirable job in creating a fully integrated platform based on three primary solutions in search, observability, and security. Their heavy investments in R&D are starting to pay off as customers increasingly adopt Elastic Stack for a larger variety of use-cases as well as develop their own. Satya Nadella, CEO of Microsoft, recently said that 2 years of digital transformation has occurred in 2 months as a result of COVID-19. Elastic’s technology stack has never been more important in helping companies to adapt to this new paradigm, whether it be retrieving vital pieces of data or keeping systems at peak efficiency or securing endpoints against security threats.
I believe that an investment in Elastic can benefit both from multiple expansion and compounding as IT departments looking to manage vendor-sprawl increase adoption of Elastic Stack beyond search for both observability and security use-cases. With an increasing focus to drive paid subscriptions with new features like Workplace Search and Endpoint Security, as well as the fast-growing Elastic Cloud offering, I think that Elastic can sustain revenue growth far above analyst estimates. After the launch of Elastic Endpoint Security last October, Elastic, for the first time ever, has a complete solution in security. With a positive initial reception, I believe that this will contribute significantly to customer acquisition and revenue growth in the coming quarters. With a largely complete product offering, and having voiced a commitment to disciplined spending, Elastic should see a gradual improvement to their bottom-line as well as their over-sized R&D spending winds down and their sales force benefits from accelerated secular tailwinds.
As I demonstrated with my market sizing exercise, it will not take much for Elastic to turn out to be a great investment at its current valuation and market cap relative to its opportunity. Elastic’s current 10,500 customers only represent a fraction of their total install base and they are increasingly looking to monetize this. I believe it will not be long before Elastic can show they have a sustainable path to profitability and demonstrate that they are not a disjointed patchwork of inferior tools in several highly competitive markets but instead a comprehensive, developer-focused platform predicated on search and poised to capture share in some of the fastest-growing markets in IT.
Disclosure: I am/we are long ESTC, DDOG, LVGO, CRWD. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.