Elastic Cloud Standard tier lists at $0.1144 per GB RAM per hour, Platinum at $0.2552, and Enterprise at $0.3104, a 2.7x range that puts tier choice ahead of negotiated discount in total cost impact. Realised Elastic discounts at $250,000 annual commit sit at 8 to 15 percent. At $1 million commit the band moves to 15 to 25 percent. At $3 million it reaches 22 to 35 percent. This guide covers Elastic Cloud tiers, ECK self-managed pricing, the ELv2 and SSPL licensing controversy that matters in vendor negotiation, and the four levers that move an Elastic contract beyond list.
Elastic Cloud tier pricing
Elastic Cloud is the managed Elasticsearch and Kibana service from Elastic NV, sold on AWS, Azure, and GCP. Pricing is per GB RAM per hour of running Elasticsearch nodes, plus per-GB storage, plus per-GB ingest for Observability and Security solutions.
| Tier | Per GB RAM per hour (AWS US East) | Key features included |
|---|---|---|
| Standard | $0.1144 | Core search, basic security, monitoring, alerting |
| Gold | $0.1696 | Standard plus role-based access control, advanced alerting, machine learning add-on |
| Platinum | $0.2552 | Gold plus full ML, anomaly detection, cross-cluster replication, JDBC and ODBC drivers, Elastic Maps Service |
| Enterprise | $0.3104 | Platinum plus searchable snapshots, frozen tier, FIPS-validated security, dedicated support |
Cluster sizing is the first cost lever. A typical observability deployment runs 6 to 16 hot-tier nodes at 64 GB RAM each on Platinum, costing $63 to $169 per hour just for the hot tier. Warm and cold tiers add 30 to 80 percent on top. Frozen tier (searchable snapshots, Enterprise tier only) adds 5 to 15 percent more. Storage is charged separately at $0.024 to $0.10 per GB per month depending on storage class.
Observability and Security solution pricing
Elastic Cloud now charges for Observability and Security on an ingest-volume basis on top of the cluster pricing. This shifted in late 2024 and caught many existing customers off guard at first renewal:
| Solution | Pricing unit | Rate |
|---|---|---|
| Observability ingest | Per GB ingested | $0.16 to $0.40 depending on retention tier |
| Observability retention | Per GB stored per month | $0.024 (frozen) to $0.10 (hot) |
| Security ingest | Per GB ingested | $0.20 to $0.50 |
| Security retention | Per GB stored per month | $0.024 to $0.10 |
| Machine Learning | Per ML node hour | From $0.1696 per GB RAM hour (Gold) plus ML add-on fee |
For high-ingest observability workloads (300 GB per day and above), the ingest charge typically dominates the bill, ahead of the cluster compute. The cost lever is data tiering: route raw logs to the frozen tier with searchable snapshots, route summarised metrics to the hot tier, and discard non-essential fields at ingest time. A well-tiered Elastic estate runs 40 to 60 percent cheaper than the default hot-tier-everything pattern.
ECK and self-managed Elastic
Elastic Cloud on Kubernetes (ECK) is the operator that runs Elasticsearch and Kibana on customer-managed Kubernetes clusters. The license model is the same Elastic tiers (Basic, Gold, Platinum, Enterprise) sold as subscriptions per node or per Elastic Resource Unit (ERU). For customers with existing Kubernetes platforms, ECK can run 25 to 45 percent cheaper than Elastic Cloud at equivalent scale, before counting the operational overhead.
The Basic tier is the source of the licensing controversy. Basic is free to run, including the proprietary security and alerting features added in 2018. It is not, however, open-source software. The Apache 2.0 licensed components were re-licensed in early 2021 under the Server Side Public License (SSPL) and the Elastic License v2 (ELv2). Existing pre-2021 deployments running the Apache 2.0 codebase forked into OpenSearch (the AWS-led fork) and remain on the original Apache 2.0 terms.
The licensing decision that shapes negotiation negotiating power: Customers willing to migrate to OpenSearch (Apache 2.0, fully open source, AWS-managed available) have meaningful negotiating power in Elastic discussions. Customers locked into ELv2 or SSPL because of specific Elastic features (Cross-Cluster Search, advanced ML, Endpoint Security agent, APM Server) have weaker negotiating power and should expect smaller discounts.
ELv2 and SSPL controversy
The 2021 license change removed certain Elastic source code from the Apache 2.0 license. ELv2 prohibits offering Elastic as a managed service competitive with Elastic Cloud. SSPL requires anyone offering the SSPL-licensed software as a service to release the entire service stack under SSPL. Both licenses are not OSI-approved as open source.
The practical implications for an enterprise buyer are three. First, AWS OpenSearch Service runs the pre-2021 fork (OpenSearch) and is on Apache 2.0. Customers operating multi-cloud or seeking a managed alternative have AWS OpenSearch as a viable option. Second, many features added since 2021 (the new APM agent shape, advanced ML, Endpoint Security) are Elastic-only. Migration parity to OpenSearch requires accepting feature loss. Third, in late 2024 Elastic restored an AGPL v3 option for the core ES and Kibana code, partially walking back the 2021 position. The AGPL option matters for self-hosting customers but does not change the managed-service competitive position.
Discount bands and negotiation levers
Realised Elastic Cloud discounts observed in advisor-led negotiations 2024 to 2026:
| Annual commit (TCV) | Cluster discount | Ingest discount |
|---|---|---|
| $100K to $250K | 5 to 10 percent | 0 to 5 percent |
| $250K to $1M | 8 to 15 percent | 5 to 12 percent |
| $1M to $3M | 15 to 25 percent | 10 to 20 percent |
| $3M+ | 22 to 35 percent | 18 to 28 percent |
Four levers move an Elastic contract beyond list. First, ingest volume discount: Elastic's default position is to discount cluster compute and protect ingest. Push for ingest discount aligned to cluster discount. Second, retention tiering credit: write the data-tiering architecture into the contract and price warm and cold tiers at a fixed lower rate. Third, frozen tier inclusion: searchable snapshots on Enterprise tier should be priced at $0.024 per GB month rather than carrying a separate fee. Fourth, OpenSearch BATNA: signal to Elastic that the buyer has costed and validated AWS OpenSearch migration; this is the single largest negotiation lever in Elastic negotiation.
The four-question decision framework
One: Are you running on AWS already, and are the Elastic-only features (ML, Cross-Cluster Search, Endpoint Security) actually used? If not, AWS OpenSearch is the cheaper path. Two: Is the volume above 500 GB per day ingest? If yes, ECK self-managed typically wins on TCO. Three: Are you in a regulated environment requiring FIPS-validated security and frozen-tier searchable snapshots? If yes, Enterprise tier on Elastic Cloud is the default. Four: Is this a small to mid-size deployment (under 200 GB per day) with operational headcount as a constraint? If yes, Elastic Cloud Gold or Platinum is the right answer.
For broader cost controls, see our cloud cost optimization guide. For data platform context, see our Snowflake pricing pillar and Databricks pricing pillar. For underlying cloud commit, see our AWS EDP negotiation and Azure MACC versus CTP. For observability cost benchmarks, see our Datadog pricing negotiation and observability licensing guide. To engage on Elastic negotiation, see our cloud contract negotiation service.
Ingest pipelines, processing, and node sizing
The Elastic cost picture is dominated by ingest volume and node memory. Two architectural patterns consistently move spend in the right direction. Pattern one: process logs at the source via Logstash, Fluent Bit, or Vector and reject low-signal fields before they reach Elastic. A typical Apache access log carries 80 to 120 fields when fully parsed; production analysis usually requires 12 to 18. Dropping the others at ingest cuts the per-document storage footprint by 70 to 85 percent and proportionally reduces node memory pressure.
Pattern two: separate ingest and indexing nodes from search nodes. The default Elastic Cloud cluster runs ingest, index, and search on the same nodes, which sizes the cluster to peak ingest plus peak query, often double-counting capacity. Splitting roles allows ingest nodes to scale on ingest patterns and search nodes to scale on query patterns. Net cost effect: 20 to 35 percent reduction in total cluster RAM on high-ingest workloads.
Endpoint Security and the agent-based pricing model
Elastic Endpoint Security (the former Endgame product) is sold per endpoint per month, $5.50 list. The agent integrates with Elastic Security and provides EDR, host intrusion prevention, and behavioural detection. For organisations evaluating CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne against Elastic Endpoint, the per-endpoint cost runs 15 to 35 percent below market leaders but the maturity gap remains material. Most enterprise deployments use Elastic for log analysis and a separate EDR for endpoint detection rather than consolidating both on Elastic.