Platform Services
Managed Elasticsearch and Kibana
Deployment autoscaling
Same day version availability
Instant access to security patches
Single-click deployment upgrades
In-place configuration change
Deployment templates
Hot-warm-cold architecture, with automated index curation
Hot-warm-cold architecture, with automated index curation and searchable snapshots
Frozen data tier with automated index curation and searchable snapshots
Automated snapshots (configurable, default every 30 minutes)
REST API for deployment management
REST API support in ecctl CLI, Golang SDK, and generated SDKs
Providers: AWS, Azure, Google Cloud
FedRAMP authorized at Moderate Impact level on AWS GovCloud (US)2
High availability across zones
Console signup with Google Account
Console signup with Microsoft Account
Multi-factor authentication
Multi-user management
AWS Marketplace billing integration
Microsoft Azure Marketplace billing integration
Google Cloud Marketplace billing integration
AWS PrivateLink integration
Azure Private Link integration
Google Cloud Private Service Connect integration
IP filtering
SOC 2 and CSA Star 2 compliance
HIPAA BAA ready
ISO 27001/27017/27018
Elastic Stack Operation & Management
Inverted index (for search)
Evaluating calculated fields at index time
Runtime fields
Lookup runtime fields
Document store (for unstructured)
Columnar store (for analytics)
Doc-values only fields
BKD trees (for numeric, dates, geo)
Flattened field type
Histogram field type
Match only text field type
Shape field type
Vector field type
Version field type
Wildcard field type
Searchable snapshots
Snapshot/restore APIs
Snapshot as simple archives
Snapshot lifecycle management
Snapshot-based peer recoveries
Data rollups
Data streams
Data tiers
Data transforms
Index lifecycle management
Data import tutorials
Ingest Node Pipeline Builder UI
Grok Debugger
Upgrade Assistant
Centralized Logstash pipeline management
Clustering and high availability
Automatic data rebalancing
Cross-region cross-cluster replication
Same-region cross-cluster replication
Cross-environment cross-cluster replication
Cross-region cross-cluster search
Same-region cross-cluster search
Cross-environment cross-cluster search
Dedicated master nodes
Dedicated coordinating nodes
Secure settings
Data encryption at rest
Encrypted node-to-node communications
Role-based access control
Anonymous access control (public sharing)
Native authentication
Kibana Spaces
Kibana feature controls
Kibana subfeature privileges8
Prelogin access agreement
API Keys management
Elasticsearch Token Service
Single sign-on (SAML, OpenID Connect, Kerberos)
Attribute-based access control
Field- and document-level security
Custom authentication and authorization realms
Full-stack monitoring (including Beats and Logstash)
Multi-stack monitoring
Configurable retention policy
Kibana alerting and actions4
Automatic stack issue alerts
Kibana Alerts
Kibana Alerts: suppression and noise reduction - throttling, muting, and snoozing
Kibana Alerts: tracking containment (geofencing)
Kibana Alerts: anomaly detection alert (machine learning)
Kibana Alerts: operational alerts for transforms
Kibana Alerts: search threshold alerts for Discover
Kibana Actions: Index and Logging
Kibana Actions: email, webhooks, Jira, Microsoft Teams, PagerDuty, Slack, Swimlane, xMatters
Kibana Actions: IBM Resilient, ServiceNow® (ITOM, ITSM, SecOps)
Watcher
Search & Analysis
Relevance scoring
Highlighting
Type ahead
Corrections
Suggestions
Percolations
Async search
Results pinning
Query profiler
Dynamically updateable synonyms
Similarity functions for vector fields
Vector search
Aggregations
Boxplot aggregation
Cumulative cardinality aggregation
Geoline aggregation
Geoshape aggregations
Geohexgrid aggregations
Geogrid query
Moving percentiles aggregation
Multi terms aggregation
Normalize aggregation
Range aggregation over histogram fields
Random sampler aggregation
Rate aggregation
Significant terms aggregation p-value score
String stats aggregation
Top metrics aggregation
T-test aggregation
Graph exploration
Vector tiles API
Machine Learning
Single metric and multi-metric
Population/entity analysis
Log message categorization
Rare analysis
Root cause indication
Forecasting on time series
Inference
Language identification
Third party models support
Kibana space model separation
Data Ingest & Transformation
Filebeat, Metricbeat, Winlogbeat, Packetbeat, Heartbeat, Auditbeat, real browser-based synthetic monitoring agent (beta)
Functionbeat
Logstash
ES-Hadoop
File import wizard
Fleet Server
Fleet app
Fleet integrations
Elastic Agent
Selective agent binary updates
Selective agent policy reassignment
Selective agent unenrollment
Cloud services
Containers and orchestration
Datastores and queues
Operating systems
Web servers and proxies
1Password
Abuse.ch
ActiveMQ
Akamai
AlienVault Open Threat Exchange (OTX)
Anomali Limo & ThreatStream
ArcSight (as CEF)
Atlassian Jira
Audit system data
Auth0
AWS (S3, EC2, ECS, ELB, WAF, Billing, CloudTrail, Network Firewall, etc.)
Azure
Bitbucket
Cassandra
Check Point Firewall
Cisco Duo, IOS/ASA, Firepower, Meraki, ISE, Secure Endpoint & Umbrella
Citrix Web Application Firewall
Cloudflare
CockroachDB
Common Event Format (CEF)
Confluence
CoreDNS
CrowdStrike Falcon
Cyberark Privileged Access Security
Cybersixgill
Docker Logging Plugin
Envoy Proxy
Fortinet Fortigate
GitHub audit data
Google Cloud (Pub/Sub, VPC, etc.)
Google Workspace
Hashicorp Vault
IBM MQ
Iptables
Istio Service Mesh
Jamf Compliance Reporter
Juniper SRX
Microsoft 365 Defender & Defender for Endpoint
Microsoft (Office) 365
Microsoft SQL Server
Microsoft Windows security events and custom event logs
Mimecast
MISP
ModSecurity
MQTT
MySQL Enterprise Audit Logs
NetFlow and IPFIX
Okta
Oracle Database
Osquery
Palo Alto Networks Cortex XDR
Palo Alto Networks Firewalls
Pensando
PostreSQL
PowerShell
Pivotal Cloud Foundry (PCF)
Prometheus
QNAP NAS
Recorded Future
Redis Enterprise
Session initiation protocol (SIP)
SIEM connector (legacy)
Snyk
Sophos XG
Suricata
Symantec Endpoint Protection
Sysmon
Tenable.sc
ThreatQuotient
VMware Carbon Black Cloud & EDR
VMware vSphere
Zeek (formerly Bro)
ZeroFox
Zoom
Zscaler
Index time enrichment
Processors
Analyzers
Tokenizers
Filters
Filter on ANN - vector Search
Grok
Field transformation
External lookup enrichment
Circle ingest processor
Match and geo-match enrich processor
Data Exploration & Visualization
Dashboards
Drilldown between dashboards
Drilldown to URL
Discover
Field statistics (beta)
Console
Kibana query autocomplete
Kibana runtime fields editor
Run search sessions in background
Graph analytics
Embeddable dashboards
Anonymous access control (public sharing)
CSV exports
PDF and PNG reports
Saved queries
Elastic Observability
Observability overview
User Experience overview
Curated ad hoc data exploration
Elastic APM3
APM server
Jaeger intake
OpenTelemetry intake for traces and metrics6
APM app
Distributed tracing
Service maps
Correlations
Elastic Logs
Log shipper (Filebeat)
Dashboards for common data sources
Logs app
Elastic Metrics
Metric shipper (Metricbeat)
Dashboards for common data sources
Metrics app
Elastic Uptime
Send data using Heartbeat
Uptime dashboards in Kibana
Uptime app
Elastic Security
Elastic Common Schema
Extended detection & response (XDR)
Security information and event management (SIEM)
Host security analysis
Network security analysis
User security analysis
Timeline event explorer
Case management
Detection engine (e.g., correlation, indicator match, threshold)
Prebuilt detection rules
Detection alert external actions
Machine learning anomaly detection
Prebuilt anomaly detection jobs
Malware prevention
Admin-defined endpoint blocklist
Ransomware prevention
Malicious behavior protection
Memory threat protection
Interactive response console
Customizable on-endpoint protection notifications
CIS posture findings and dashboards
Workload session auditing
Elastic Agent
Native host-based response
Elastic APM
Response - Host isolation
Response - Process operations
Response - Self-healing
Elastic Maps
Osquery Manager
Network Packet Analyzer
Threat intelligence feeds and platforms
Machine learning
Kibana Alerts and Actions4
Atlassian Jira
Swimlane SOAR
IBM Resilient
ServiceNow ITOM, ITSM, SecOps
Elastic Maps
Shapefile and GeoJSON upload
Multiple layers
Native vector tile support
Layer-based filtering
Client-side styling
Individual points and shapes
Tracking alerts
Containment alerts
Embed maps in dashboard
Embed maps in Canvas
Geo-threshold alerts
Display up to 24 zoom levels
Custom raster and vector tile service support
Kibana Alerts: tracking containment (geofencing)
Elastic Enterprise Search
Enterprise Search server
Enterprise Search management UI
Content management UI
Enterprise Search stack monitoring
Elastic App Search
Index once, sort all you want
Customizable relevance model
Language-specific relevance
Synonyms management
Analytics API
Clickthrough API
Adaptive Relevance: Curations (beta)
Precision tuning (beta)
Web crawler
Web crawler HTTP proxy authentication
Web crawler HTTP authentication
Web crawler PDF Extraction
Index lifecycle management
Passthrough Elasticsearch queries
Elasticsearch-based App Search engines
Elastic Workplace Search
Workplace Search server
Unified search interface
Out-of-the-box search applications
Customizable look and feel
Natural language query filtering
Search history
Typo-tolerant relevance model
Synonyms management
Customizable filtering and faceting
Content source prioritization
Search analytics
Search API
First-party cloud source synchronization
First-party on-premises source synchronization
Global sync scheduling configuration
Source-level scheduling configuration
Custom source support via API and connector packages
Custom source support via API
Full-text content indexing for files, documents, and records
Document-level permission support
Object synchronization selection
Path-based content synchronization
File extension-based content synchronization
Private sources
Content source indexing rules and scheduling
Support
Support coverage
Business hours
24/7/365
24/7/365
Response times
Critical: 4 hrs
L2: 1 day
L3: 2 days
L2: 1 day
L3: 2 days
Critical: 1 hr
L2: 4 hrs
L3: 1 day
L2: 4 hrs
L3: 1 day
Critical: 1 hr
L2: 4 hrs
L3: 1 day
L2: 4 hrs
L3: 1 day
Unlimited # of incidents
Support contacts7
2
6
8
8
Ticket-based support
SLA-based support
Platform Services
Managed Elasticsearch and Kibana
Deployment autoscaling
Same day version availability
Instant access to security patches
Single-click deployment upgrades
In-place configuration change
Deployment templates
Hot-warm-cold architecture, with automated index curation
Hot-warm-cold architecture, with automated index curation and searchable snapshots
Frozen data tier with automated index curation and searchable snapshots
Automated snapshots (configurable, default every 30 minutes)
REST API for deployment management
REST API support in ecctl CLI, Golang SDK, and generated SDKs
Providers: AWS, Azure, Google Cloud
FedRAMP authorized at Moderate Impact level on AWS GovCloud (US)2
High availability across zones
Console signup with Google Account
Console signup with Microsoft Account
Multi-factor authentication
Multi-user management
AWS Marketplace billing integration
Microsoft Azure Marketplace billing integration
Google Cloud Marketplace billing integration
AWS PrivateLink integration
Azure Private Link integration
Google Cloud Private Service Connect integration
IP filtering
SOC 2 and CSA Star 2 compliance
HIPAA BAA ready
ISO 27001/27017/27018
Elastic Stack Operation & Management
Inverted index (for search)
Evaluating calculated fields at index time
Runtime fields
Lookup runtime fields
Document store (for unstructured)
Columnar store (for analytics)
Doc-values only fields
BKD trees (for numeric, dates, geo)
Flattened field type
Histogram field type
Match only text field type
Shape field type
Vector field type
Version field type
Wildcard field type
Searchable snapshots
Snapshot/restore APIs
Snapshot as simple archives
Snapshot lifecycle management
Snapshot-based peer recoveries
Data rollups
Data streams
Data tiers
Data transforms
Index lifecycle management
Data import tutorials
Ingest Node Pipeline Builder UI
Grok Debugger
Upgrade Assistant
Centralized Logstash pipeline management
Clustering and high availability
Automatic data rebalancing
Cross-region cross-cluster replication
Same-region cross-cluster replication
Cross-environment cross-cluster replication
Cross-region cross-cluster search
Same-region cross-cluster search
Cross-environment cross-cluster search
Dedicated master nodes
Dedicated coordinating nodes
Secure settings
Data encryption at rest
Encrypted node-to-node communications
Role-based access control
Anonymous access control (public sharing)
Native authentication
Kibana Spaces
Kibana feature controls
Kibana subfeature privileges8
Prelogin access agreement
API Keys management
Elasticsearch Token Service
Single sign-on (SAML, OpenID Connect, Kerberos)
Attribute-based access control
Field- and document-level security
Custom authentication and authorization realms
Full-stack monitoring (including Beats and Logstash)
Multi-stack monitoring
Configurable retention policy
Kibana alerting and actions4
Automatic stack issue alerts
Kibana Alerts
Kibana Alerts: suppression and noise reduction - throttling, muting, and snoozing
Kibana Alerts: tracking containment (geofencing)
Kibana Alerts: anomaly detection alert (machine learning)
Kibana Alerts: operational alerts for transforms
Kibana Alerts: search threshold alerts for Discover
Kibana Actions: Index and Logging
Kibana Actions: email, webhooks, Jira, Microsoft Teams, PagerDuty, Slack, Swimlane, xMatters
Kibana Actions: IBM Resilient, ServiceNow® (ITOM, ITSM, SecOps)
Watcher
Search & Analysis
Relevance scoring
Highlighting
Type ahead
Corrections
Suggestions
Percolations
Async search
Results pinning
Query profiler
Dynamically updateable synonyms
Similarity functions for vector fields
Vector search
Aggregations
Boxplot aggregation
Cumulative cardinality aggregation
Geoline aggregation
Geoshape aggregations
Geohexgrid aggregations
Geogrid query
Moving percentiles aggregation
Multi terms aggregation
Normalize aggregation
Range aggregation over histogram fields
Random sampler aggregation
Rate aggregation
Significant terms aggregation p-value score
String stats aggregation
Top metrics aggregation
T-test aggregation
Graph exploration
Vector tiles API
Machine Learning
Single metric and multi-metric
Population/entity analysis
Log message categorization
Rare analysis
Root cause indication
Forecasting on time series
Inference
Language identification
Third party models support
Kibana space model separation
Data Ingest & Transformation
Filebeat, Metricbeat, Winlogbeat, Packetbeat, Heartbeat, Auditbeat, real browser-based synthetic monitoring agent (beta)
Functionbeat
Logstash
ES-Hadoop
File import wizard
Fleet Server
Fleet app
Fleet integrations
Elastic Agent
Selective agent binary updates
Selective agent policy reassignment
Selective agent unenrollment
Cloud services
Containers and orchestration
Datastores and queues
Operating systems
Web servers and proxies
1Password
Abuse.ch
ActiveMQ
Akamai
AlienVault Open Threat Exchange (OTX)
Anomali Limo & ThreatStream
ArcSight (as CEF)
Atlassian Jira
Audit system data
Auth0
AWS (S3, EC2, ECS, ELB, WAF, Billing, CloudTrail, Network Firewall, etc.)
Azure
Bitbucket
Cassandra
Check Point Firewall
Cisco Duo, IOS/ASA, Firepower, Meraki, ISE, Secure Endpoint & Umbrella
Citrix Web Application Firewall
Cloudflare
CockroachDB
Common Event Format (CEF)
Confluence
CoreDNS
CrowdStrike Falcon
Cyberark Privileged Access Security
Cybersixgill
Docker Logging Plugin
Envoy Proxy
Fortinet Fortigate
GitHub audit data
Google Cloud (Pub/Sub, VPC, etc.)
Google Workspace
Hashicorp Vault
IBM MQ
Iptables
Istio Service Mesh
Jamf Compliance Reporter
Juniper SRX
Microsoft 365 Defender & Defender for Endpoint
Microsoft (Office) 365
Microsoft SQL Server
Microsoft Windows security events and custom event logs
Mimecast
MISP
ModSecurity
MQTT
MySQL Enterprise Audit Logs
NetFlow and IPFIX
Okta
Oracle Database
Osquery
Palo Alto Networks Cortex XDR
Palo Alto Networks Firewalls
Pensando
PostreSQL
PowerShell
Pivotal Cloud Foundry (PCF)
Prometheus
QNAP NAS
Recorded Future
Redis Enterprise
Session initiation protocol (SIP)
SIEM connector (legacy)
Snyk
Sophos XG
Suricata
Symantec Endpoint Protection
Sysmon
Tenable.sc
ThreatQuotient
VMware Carbon Black Cloud & EDR
VMware vSphere
Zeek (formerly Bro)
ZeroFox
Zoom
Zscaler
Index time enrichment
Processors
Analyzers
Tokenizers
Filters
Filter on ANN - vector Search
Grok
Field transformation
External lookup enrichment
Circle ingest processor
Match and geo-match enrich processor
Data Exploration & Visualization
Dashboards
Drilldown between dashboards
Drilldown to URL
Discover
Field statistics (beta)
Console
Kibana query autocomplete
Kibana runtime fields editor
Run search sessions in background
Graph analytics
Embeddable dashboards
Anonymous access control (public sharing)
CSV exports
PDF and PNG reports
Saved queries
Elastic Observability
Observability overview
User Experience overview
Curated ad hoc data exploration
Elastic APM3
APM server
Jaeger intake
OpenTelemetry intake for traces and metrics6
APM app
Distributed tracing
Service maps
Correlations
Elastic Logs
Log shipper (Filebeat)
Dashboards for common data sources
Logs app
Elastic Metrics
Metric shipper (Metricbeat)
Dashboards for common data sources
Metrics app
Elastic Uptime
Send data using Heartbeat
Uptime dashboards in Kibana
Uptime app
Elastic Security
Elastic Common Schema
Extended detection & response (XDR)
Security information and event management (SIEM)
Host security analysis
Network security analysis
User security analysis
Timeline event explorer
Case management
Detection engine (e.g., correlation, indicator match, threshold)
Prebuilt detection rules
Detection alert external actions
Machine learning anomaly detection
Prebuilt anomaly detection jobs
Malware prevention
Admin-defined endpoint blocklist
Ransomware prevention
Malicious behavior protection
Memory threat protection
Interactive response console
Customizable on-endpoint protection notifications
CIS posture findings and dashboards
Workload session auditing
Elastic Agent
Native host-based response
Elastic APM
Response - Host isolation
Response - Process operations
Response - Self-healing
Elastic Maps
Osquery Manager
Network Packet Analyzer
Threat intelligence feeds and platforms
Machine learning
Kibana Alerts and Actions4
Atlassian Jira
Swimlane SOAR
IBM Resilient
ServiceNow ITOM, ITSM, SecOps
Elastic Maps
Shapefile and GeoJSON upload
Multiple layers
Native vector tile support
Layer-based filtering
Client-side styling
Individual points and shapes
Tracking alerts
Containment alerts
Embed maps in dashboard
Embed maps in Canvas
Geo-threshold alerts
Display up to 24 zoom levels
Custom raster and vector tile service support
Kibana Alerts: tracking containment (geofencing)
Elastic Enterprise Search
Enterprise Search server
Enterprise Search management UI
Content management UI
Enterprise Search stack monitoring
Elastic App Search
Index once, sort all you want
Customizable relevance model
Language-specific relevance
Synonyms management
Analytics API
Clickthrough API
Adaptive Relevance: Curations (beta)
Precision tuning (beta)
Web crawler
Web crawler HTTP proxy authentication
Web crawler HTTP authentication
Web crawler PDF Extraction
Index lifecycle management
Passthrough Elasticsearch queries
Elasticsearch-based App Search engines
Elastic Workplace Search
Workplace Search server
Unified search interface
Out-of-the-box search applications
Customizable look and feel
Natural language query filtering
Search history
Typo-tolerant relevance model
Synonyms management
Customizable filtering and faceting
Content source prioritization
Search analytics
Search API
First-party cloud source synchronization
First-party on-premises source synchronization
Global sync scheduling configuration
Source-level scheduling configuration
Custom source support via API and connector packages
Custom source support via API
Full-text content indexing for files, documents, and records
Document-level permission support
Object synchronization selection
Path-based content synchronization
File extension-based content synchronization
Private sources
Content source indexing rules and scheduling
Support
Support coverage
Response times
Unlimited # of incidents
Support contacts7
Ticket-based support
SLA-based support
Business hours
24/7/365
24/7/365
Critical: 4 hrs
L2: 1 day
L3: 2 days
L2: 1 day
L3: 2 days
Critical: 1 hr
L2: 4 hrs
L3: 1 day
L2: 4 hrs
L3: 1 day
Critical: 1 hr
L2: 4 hrs
L3: 1 day
L2: 4 hrs
L3: 1 day
2
6
8
8
2 Elastic Cloud subscriptions on AWS GovCloud (US) are only available annually at this time (not monthly).
3 Elastic APM is not supported on Elastic Cloud Standard when purchased through the AWS Marketplace.
4 Refer to the Alerting section (Kibana Alerts and Kibana Actions items) for further details.
5 Elastic Maps Service - Terms of Service
6 There are two options for OpenTelemetry intake: native support of the OpenTelemetry protocol directly into APM Server (experimental), and the Elastic exporter on the OpenTelemetry collector, which is the recommended approach. If you choose the latter, note that Elastic Cloud does not host the Elastic exporter on the OpenTelemetry collector exporter, refer to documentation to set one up adjacent to your applications.
7 Elastic Certified Professionals can be added as additional Support contacts on paid subscriptions at no additional charge.
8 Access to administering Kibana subfeature privileges start at the Gold tier and are available on a per-feature basis matching the feature’s subscriptions tier.
The list above reflects the features available in the latest version of the Elastic Stack. Any features or functions of services or products referenced on this page or other pages, or in any presentations, press releases or public statements, which are not currently available or not currently available as a GA release, may not be delivered on time or at all. The development, release, and timing of any features or functionality described for our products remains at our sole discretion. Customers who purchase our products and services should make the purchase decisions based upon services and product features and functions that are currently available.
