Expedient innovates with Elastic Observability to deliver better management, monitoring, and more to customers


Observability has emerged as a critical component for businesses striving to maintain a competitive edge. Modern observability extends beyond traditional monitoring, offering a more granular and real-time understanding of health across systems and enabling organizations to not only detect issues but also understand their impact, root causes, and the context in which they occur.

digital infrastructure

In parallel, we have seen a surge in cloud computing, IoT devices, and distributed architectures that has led to more intricate and dynamic IT environments. Navigating these complexities requires a level of visibility that traditional tools cannot provide.

orgs need ai-powered observability

Elastic Observability is uniquely positioned as a comprehensive solution designed to provide full-stack observability powered by AI. It unifies logs, metrics, traces, profiling, and business data, offering context-aware insights leveraging GenAI coupled with retrieval augmented generation (RAG) to integrate organization specific knowledgebases and runbooks for greater accuracy and relevance. Elastic Observability eliminates tool silos, efficiently stores data, and ensures unified visibility across hybrid and multi-cloud environments, enabling 24/7 monitoring of digital experiences.

Top observability challenges organizations are facing

Dimensional Research’s 2024 Observability Landscape report mentions that only 14% of organizations have mature observability capabilities and expertise, and 99% face challenges implementing observability capabilities and expertise — managing different requirements from different teams tops the list at 68%, and 55% of organizations report insufficient skills and expertise.

challenges - bar graph

With organizations lacking skills, expertise, and maturity, many industry analysts have cited an emerging trend where organizations are seeking to outsource their observability needs to managed service providers (MSPs). MSPs are well-positioned to assist organizations, with many businesses relying on them to manage their infrastructure, cybersecurity, and observability.

By integrating Observability as a Service into their service offerings, MSPs can offer scalable solutions that adapt to changing needs and technologies, enabling their clients to focus on core operations while ensuring their digital ecosystems are robust, reliable, and conducive to growth.

One such partner that is leading in observability is Expedient, an Elastic Verified MSP that is productizing Observability as a Service.

Who is Expedient?

Expedient is a full stack cloud service provider with services ranging from shared or private cloud platforms to data protection and disaster recovery services. Leveraging Elastic to power observability and security services for their clients to provide deeper insights into their environments and faster responses to issues.

We spoke with AJ Kuftic, principal product strategist at Expedient, to hear about his experience using Elastic for Observability as a Service:

Choosing Elastic: Expedient's perspective

Q: Why did Expedient choose Elastic for Observability as a Service?

A: It started, as most Elastic clients do, with logs, but it very quickly pivoted beyond that. We brought it in as part of our managed Kubernetes offering because we had developers who wanted to offload their application logs, and we also wanted to offload the logs of our Kubernetes platform to something that could actually do things with them. We had had log management tools before, but they weren't capable of doing what Elastic does. Our managed Kubernetes platform has Prometheus and Grafana and while they’re great tools, they're baked into just that platform. We wanted to expand it to more than just that. We wanted to provide application and infrastructure views together in one pane of glass for our clients because that's what they really were asking us for. 

Elastic became this really, really great way to kind of blend both the observability and security pieces together. We then used Elastic as the foundation for our next generation system management and monitoring platform. The Elastic Agent allowed us to monitor endpoints regardless of location and provide visibility to our clients that they previously did not have. Fleet gives us the ability to deploy dedicated clusters to our tenants on top of a shared infrastructure, allowing us to leverage our decades of experience managing hardware and operating systems and extend it to our clients.

our elastic story

Reflecting on past solutions

Q: What solution did Expedient use before Elastic, and why wasn't it a good fit?

A: Prior to Elastic, we used native tooling of individual platforms for monitoring. For Windows management, we leveraged Microsoft tooling. For Linux, we used Red Hat tooling. This led to tooling sprawl and disparate views of what was happening in a client’s environment, and because these tools weren’t built for multi-tenancy, clients had no views into the tooling and relied on us to send them tickets when there were issues. We also had to maintain network connectivity and accounts into our clients’ environments, and it created challenges around security and ensuring we only had the rights and connectivity needed to provide the service. 

The transformation with Elastic Observability

Q: What were the results from implementing Elastic's Observability solution?

A: Our clients now have better alerting and visibility into their environments, and it allows us to better manage their workloads. With Elastic, the agent runs locally on the endpoint and then connects over the internet to the client’s dedicated cluster running in our data centers, which means they get visibility into their environment and they eliminate securing direct network connectivity. It’s a win-win for everyone. 

We’ve also used it internally for collecting client resource usage data so they can see in real time across their platforms how many resources they’re using and when they will need more. It also improved our infrastructure alerting, allowing us to resolve issues faster.

The new Hosts view handles what our clients are looking for:


We create alarm rules for clients and send the alerts to our ticketing systems. Clients can also configure the alerts to send to their own ticket systems like ServiceNow or collaboration tools like Slack or Microsoft Teams.

high CPU usage

Beyond Observability: Elastic's extended impact

Q: In what other ways is Expedient using Elastic today, and how has it helped streamline operations?

A: Prior to Elastic acquiring them, we had Endgame as our endpoint security platform. Endgame was a great product with strong behavior and signature based protections. Elastic was very quick to bring all of the tooling that was in Endgame into the Elastic Agent itself, allowing us to manage through Fleet. And so it became this really, really great way to kind of blend both the observability and security pieces together. 

We’ve also extended Elastic into a SIEM service to collect and alert on issues seen in security logs. One of the biggest benefits of Elastic is that the Elastic Agent can do so many different things, allowing our clients to grow into additional services without a ton of overhead or headaches getting there. It’s simply providing the views and support needed to enable those use cases. We use it for our own workloads, and our security teams have loved being able to quickly generate reports and use Osquery to search for vulnerable versions of software to ensure they get upgraded to safe versions.

We’re also very excited for the Elastic AI Assistant capabilities for Observability and Security. Correlating events isn’t easy, and this tooling will help our clients sort through the noise and get to resolution faster and catch things they may not have otherwise seen.

single agent, multiple services

Tips for organizations considering observability solutions

Q: What would be some practical tips you can share for organizations looking to implement or improve their observability practices?


  • Understand what you’re looking for: Logs won’t give you CPU usage, and metrics won’t tell you what went wrong. It’s by combining those together that you can actually build better observability. Leverage the native dashboards to get an initial level of visibility, and then build custom dashboards for your specific needs.

  • Communicate across silos: Application and infrastructure teams have to work together. Correlation of application events to infrastructure events helps resolve problems faster. Elastic’s application monitoring can pull in logs and traces and correlate to logs and metrics from the infrastructure to build a fuller picture than what two different tools would be able to put together.

  • Leverage an MSP: Building any observability platform takes time, effort, and capital before you even pull in your first log or metric. Using an MSP can get you onboarded faster and keeps your team’s effort focused on what sources to collect from, what dashboards are needed, and what alerts should be configured and away from patching or worrying about space available on the platform. You can start small and grow into your full needs, allowing you to optimize your spend along the way.

Maximizing the value for your business

Partnering with Expedient for Observability as a Service on Elastic offers customers numerous benefits:

  • Faster onboarding to Elastic tooling

  • Better monitoring and management with OperationsCTRL

  • Better security visibility with SIEM

  • Better endpoint protection from a multitude of threats with Endpoint Security

  • All backed with 24/7 support

Guest author

AJ Kuftic

Principal Product Strategist, Expedient

AJ Kuftic is principal product strategist for Expedient. AJ has over 15 years of experience as a customer and partner helping end users build solutions that are sustainable and easy to manage. Having knowledge across various silos of IT infrastructure gives AJ a unique perspective of the pain points and what customers are looking to improve. When AJ isn’t thinking about the next big thing, he spends his time with his wife and two children trying to bake the perfect loaf of bread.

The release and timing of any features or functionality described in this post remain at Elastic's sole discretion. Any features or functionality not currently available may not be delivered on time or at all.

In this blog post, we may have used or referred to third party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use. 

Elastic, Elasticsearch, ESRE, Elasticsearch Relevance Engine and associated marks are trademarks, logos or registered trademarks of Elasticsearch N.V. in the United States and other countries. All other company and product names are trademarks, logos or registered trademarks of their respective owners.