ESTC conference call notes

Hi all,

my notes from the CC, hope its helpful. Looked like an excellent execution, I’m inclined to check back in a year to see what the SIEM traction etc looks like. Default log solution, SaaS good growth, no concern about AWS OpenDistro, well positioned for “convergence of logging, metrics, APM, and uptime monitoring” (and SIEM eventually).

I’m pretty happy with this call.


Q1 2020

Preview of ElasticSIEM
Security related data - don’t have to be security analyst. Just there - just works.
Platinum-level ML features - auto alerts
Collaborated with community
BlackHat - premier cyber-security conference. Fascinating to see the prevalence of commercial/closed product approach. Our basic subscription is free and open. Lot of questions about integration, EndGame, demo with Elastic stack on top on EndGame endpoint data.


US Navy, SmartSheet, BPCE (France) - for this use case"
ASB Bank in New Zealand - expanded, primarily security logging and analytics, replacing existing SIEM.
US Defence information system agency - replaced legacy SIEM, joint regional security staff program.
US Dept Homeland Security - Continuous Diagnostic Mitigation dashboard (proposed by partner ECS).

“Tremendous opportunity to get more value out of stack (for existing customers)”

Goal: magical experience → deploy Elastic through context of logging, can get APM, seamless SIEM [GD: hahaha]


General availability of Geospatial analysis product. Curated experience in Kibana.

  • Where are attacks on networks coming from?
  • Where are shipments delayed?
  • Where do I need more sales force?


AWS - London
GCP - Tokyo
Partnerships with TenCent and Alibaba → being where users

Logging, Metrics, APM, and Uptime monitoring (Observability)

Trending towards convergence of these usecases - “Can store, search all data in one place from one UI”
Simple unified pricing model (node-based). Removes friction for trying new products - early signs of resonance [GD: to be monitored?].

ElasticAPM .NET.
More tooling for Kubernetes

NVidia - closed new business
TomTom [GD: Dutch?!] - replaced Splunk for online apps.
FreddieMac - New business this quarter. Replacing encumbent logging with Elastic.

Enterprise and Application Search

More connectors → Atlassian (Jira and Confluence)
EAS - can now run on-prem. Gives customers ease and flexibility.

General Motors - search across vehicle inventory visibility platform.
Atlassian - search in Confluence
Sumitomo … - help fund managers search internal applications for decision making.

ECK (ElasticCloud on Kubernetes)

Latest release: allows running on custom Kubernetes distros (eg: AWS, GoogleKE, Azure, Redhat…)
Available on basic offering.
Everything under proprietary license
If you want to deploy as SaaS, must run on ElasticCloud.

#### Finances
|                           |           |                                                                      |
| Revenue                   | $89.7m    | +62% yoy CC                                                          |
| ---- International        | 45%       |                                                                      |
| **Subs revenue**          | $82.4m    | +63% yoy CC                                                          |
| --- SaaS                  | $17.6m    | +77% yoy CC ElasticCloud strength                                    |
| --- Prof Services         | $7.3m     | +45% yoy - can fluctuate. Strong adoption of training and consulting |
| Billings                  | $89.4m    | +53% yoy CC                                                          |
| TTM billings growth       | 61%       | Longer term view.                                                    |
| Deferred revenue          | $169.8m   | +64% yoy CC                                                          |
| Short-term DR             | 90%       | of total DR                                                          |
| RPO                       | $363m     | +59%, 88% revenue in next 24 months                                  |
| GAAP operating loss       | -$42.3m   |                                                                      |
| GAAP operating margin     | -47%      |                                                                      |
| Non-GAAP operating loss   | $24.3m    |                                                                      |
| Non-GAAP operating margin | -27%      |                                                                      |
| Operating cash flow       | -$1.7m    |                                                                      |
| Free cash flow            | -$3.3m    | vs +$4.8m yoy. Shift in expense timing.                              |
| Cash and equivs           | $315m     |                                                                      |
| Gross profit              | $65.7m    |                                                                      |
| Gross margin              | 73.3%     |                                                                      |
| Subs GM                   | 80.2%     |                                                                      |
| PS GM                     | -4.7%     | Small, expect significant fluctuation                                |
| SM                        | $47.1m    | +65% yoy, 52% of total revenue. Expect to expand.                    |
| RD                        | $29.4m    | +76% yoy 33% total revenue - increasing investments                  |
| GA                        | 13.5m     | +54% yoy                                                             |
| Subscription customers    | >8800     | vs 8100 Q4 2019                                                      |
| Customers >$100k          | >475      | vs >440 Q4 2019   [GD: +8%]                                          |
| Subscription revenue      | 92%       |                                                                      |
| NER                       | >130%     |                                                                      |
| Contract length           | 1.5 years |                                                                      |
| Employees                 | 1600      |                                                                      |

Q2 last year - updated SAAS services, pricing model, headwind - mid single digits? Q1 last quarter of billings headwind.

EndGame - expect transaction to close in Q3. Guidance includes EndGame - negligible. -2% headwind to operating margin.

| Guidance                    |                                                       |
| Q2 revenue                  | $95 million and $97 million   +51% yoy                |
| Non-GAAP operating margin   | -23.5% -> -21.5%.                                     |
| Non-GAAP net loss per share | -$0.32 -> -$0.30                                      |
| Shares                      | 77m-78m weighted average ordinary shares outstanding. |
|                             |                                                       |
| FY 20 revenue               | $406m-$412m +51% yoy                                  |
| Non-GAAP Operating margin   | -24.5% -> -22.5% (-2% EndGame)                        |
| Non-GAAP net loss/share     | -$1.40 -> -$1.24                                      |
| Shares                      | 77m-81m weighted average ordinary shares outstanding. |

Q and A

Q: Talk about evolution of pipeline, sales force supporting new efforts?
A: APM - acquired opdata - apm,logs,metrics will converge. .Net support → last major language. Goto market → go to existing logging customers to sell APM, but starting to see APM first deals.

Just released ElasticSIEM.
Early adopters - in security. Still lots of work to mature ElasticSIEM.
Sales approach - bottom first, free and open → upsell. Think this approach is super-critical.

Q: AWS - OpenDistro. Impact in market?
A: Haven’t seen effect any metrics. Very encouraged about our investments in proprietary tier. Single distribution now.

Q: Self-managed subscription increase. How should we model different line items? beginning of broader shift → self-managed/cloud?
A: SAAS really strong. Shift for us is gradual, some seasonal impacts. Q1 usually smaller for license. We look at total subscription number. As SAAS up, license down. SAAS demand higher than on-prem.

Q: Managing implications to gross margins?
A: As we continue to invest in SaaS- continue to see headwind to GM. Couple of other drivers, getting more efficient on PS. As we expected.

Q: SIEM. Roadmap, how much is internal dev vs acquisitions?
A: User behaviour analytics, threat analytics, integrations → internal roadmap. Acquisitions - excited about EndGame, significant investment, acquiring just the first step. Quite a bit of work in next year to make successful.

Perch - small, <10 people. Threat-hunting capability, training materials. Much smaller aspect.
Not modelled any revenue from acquisition.

Q: What the mix shift impact on billings? Saas revenue vs self-managed.
A: SAAS - annual subs (same as self managed from a billings standpoint), and monthly subs.

Q: EndGame integration. How meaningfully can you increase data into Elastic? What does combined vision for remediation look like?
A: Streaming data - depends on why they’ve deployed system. Time aspect - duration. Especially in Endpoint market, convergence in endpoint and SIEM, more data stored. Significant investment into storing more data more cheaply, eg: cold nodes. Never have to throw data away (hopefully in future).

Don’t see a significant portion in endpoint deployment at this stage. Excited.

Q: Splunk → changes in pricing model to reflect yours. You mentioned unified pricing model, view of pricing market?
A: Strategy working nicely - node/capacity-based pricing model for a while. Really compelling for logging [GD: versus splunk]. Not about being low-cost. Think we can win at higher levels because of the value we offer.

No changes in pricing/discounting.

Q: Numbers look strong. AWS. Customers waiting for AWS (free elastic offering)? AWS with proprietary stuff?
A: Not seeing that. Not seeing OpenDistro development. Investments in proprietary vs open-source. ElasticSIEM, ElasticMaps have whole team, logs, APM - all proprietary. Excited and confident about competition.

Q: Current deferred revenue - lower than what we’re looking for? Anything to note?
A: Nothing in particular. Short-term DR 90% of DR. Growth rate 60%. From time-to-time, customers want upfront billing for budgetary reasons.

Q: RPO - implied bookings, anything to call out? Duration, mix shift?
A: Dont manage business on contract duration , ACV. Dont focus on RPO billings. Acquiring at high rate, deal sizes same, NER strong. Customer relations getting deeper. Duration - average 1.5 years. RPO billings can be quite volatile.

RPO growth +59% yoy. Pleased with metrics across board.

Q: You talked a lot about security/SIEM use cases. Win-rates, % new business tied to that market?
A: Early adoption by thought-leaders. Don’t have end-to-end. Great wins in that space (with thought leaders, advanced threat hunters). Opportunity grows as mature product lines, as we can target security analysts (with auto alerts etc). BlackHat conference → seemed like 10 years ago. But takes time.

Q: APM. Additional traction. Differentiate in crowded field?
A: Product line maturing to fully complete APM product. Some minor features missing. Goto market, sales motion not changed. Going to existing (logging) customers. Believe that these markets converge. Single product but also single pricing model.. Charge on data set. Helps adoption of APM.

Start to see early customers leading with APM. Then talk about logs and monitoring, but early [GD: ie, mostly leads with logs]

Q: OpExp - S&M higher than anticipated?
A: Reflective about shift in timing of expenses (global all-hands meeting). Nothing else, just investing heavily in S&M as we said we would.

Q: Lot of entry points into orgs, but need to keep sales people focussed? How does that work?
A: Think about this a lot. Bottom-up adoption model (ie, customers already install ElasticSearch for logs). Don’t rely on salespeople to introduce ElasticSearch, but goal is users self-discover and add other stuff. SIEM: excited every single DevOps now a threat-hunter with ElasticSIEM. Every single log message is now a security event.

Aim default mode orgs going to salespeople after using Elastic [GD: primarily for logs]

Q: SIEM - not just rules, but AI. Can you reuse AI technology? [GD: silly question - Shay said “wonderful question” ;-)]
A: AI doesnt solve everything, (advanced threat hunters) want the opportunity to ask the questions fast.

Pre-alert - great anomaly detection system. Specialised in security (3.5 years ago). Lets build a generic version, APM - not only has APM data, but can also use anomaly detection engine. Just integrated into security (SIEM).

Our goal - take AI/ML development laterally between use-cases.

Q: Whats resonating most with new customer wins?
A: By far, logs. Most popular, best product out there today. Only one playing there. Resonate that can use for other usecases, APM. Consolidation of system. Level of efficiency that is super-critical, jumping between products “is exhausting (mentally)”.

Q: Macro - 45% international, any colour on international demand?
A: Nothing fundamentally different.