Elastic Cloud Pricing 2026: Ultimate Guide on the Costs

Elastic Cloud pricing starts at $99 per month for an Elastic Cloud Hosted deployment on the Standard tier, and Elastic Security on Elastic Cloud Serverless starts at $0.09 per GB ingested plus $0.017 per GB retained per month, according to Elastic’s pricing pages in October 2026. Self-managed Elastic is free to download, and its paid Enterprise subscription is sold by quote.

Elastic Cloud supports real-time threat detection, cloud-native deployments, and endpoint protection, and its price depends on the product line and the deployment option you choose. This guide shows what Elasticsearch, Elasticsearch Vector Database, Elastic Observability, and Elastic Security cost, how serverless, hosted, and self-managed pricing differ, how billing works, and which costs sit outside the list price.

Disclaimer: the figures below come from Elastic’s pricing pages and billing documentation, read on October 20, 2026. Elastic changes its packaging often and shows most rates as “as low as” figures that vary by cloud provider and region, so treat each one as a starting point for your own estimate.

An Elastic Security bill grows with every gigabyte you ingest and retain, and none of that spend pays for someone to read a critical detection at 2 a.m. UnderDefense Agentic AI SOC works on top of the Elastic deployment you already run, whether serverless, hosted, or self-managed: AI agents investigate each alert, and analysts on shift 24/7 decide what happens next.

How Much Does Elastic Cloud Cost?

Elastic Cloud costs from $99 per month on Elastic Cloud Hosted, where the Standard, Gold, Platinum, and Enterprise tiers start at $99, $114, $131, and $184 per month. Elastic bases those figures on a production configuration with 120 GB of storage across 2 availability zones, and the bill rises with the RAM, storage, and zones your deployment uses.

On Elastic Cloud Serverless, you pay for usage: per GB ingested and retained for Elastic Security and Elastic Observability, and per Virtual Compute Unit (VCU) hour for Elasticsearch. Self-managed subscriptions are licensed by the number of nodes and the RAM they use, and Elastic sells the paid ones by quote.

Elastic Cloud Pricing Comparison

Elastic now organizes its pricing around four product lines, and each one is sold on up to three deployment options. The table shows the lowest published rate for each combination in October 2026.

A Hosted deployment includes search, observability, and security under one subscription tier, so the $99 Standard price is the same whichever solution you use. Serverless projects are priced per solution, which is why the rates in the first column differ.

Elastic Cloud Pricing Calculator

Elastic Cloud pricing is calculated from the resources you use. Elastic offers two tools to estimate it: the Elastic Cloud Hosted pricing calculator, which prices a deployment by cloud provider, region, and instance type, and a serverless estimator for each project type. The serverless estimator supports estimates up to $10,000 per month, and above that Elastic asks you to contact sales.

The total price depends on the following variables:

• The more data you ingest and store, the higher the cost.
• Longer retention of logs and security events increases storage charges.
• On Hosted, each component, such as Elasticsearch, Kibana, machine learning, and APM nodes, is charged per GB of RAM per hour.
• The subscription tier sets which features you can use, such as machine learning from Platinum.
• Prices vary by cloud provider and region across AWS, Google Cloud, and Azure.
• Each extra availability zone multiplies the capacity cost.

Elastic describes Hosted pricing as linear: a high-I/O node with 8 GB of RAM costs eight times as much as the same node with 1 GB, and three availability zones cost three times as much as one. Each Hosted deployment also gets a free allowance of a 1 GB Kibana instance, a 1 GB machine learning node, a 2 GB search instance, and a 1 GB APM server.

Elastic Pricing by Product Line

Elastic sells Elasticsearch, Elasticsearch Vector Database, Elastic Observability, and Elastic Security as separate product lines. On Hosted and self-managed, the Standard, Gold, Platinum, and Enterprise tiers still decide which features each solution gets. On Serverless, each solution has its own usage rates and its own feature tiers.

Elasticsearch Pricing

Elasticsearch is Elastic’s general-purpose search datastore, sold on all three deployment options. Elasticsearch Serverless charges separately for compute and storage, at these starting rates:

• Ingest VCUs cost from $0.14 per hour.
• Search VCUs cost from $0.09 per hour.
• Machine learning VCUs cost from $0.07 per hour.
• Storage and retention cost from $0.047 per GB per month.
• Egress costs from $0.05 per GB transferred.

Elastic’s own examples put a development environment with 2 GB of searchable data at $24 per month on the On-demand Search Power setting and $27 per month on Performant. A production environment with 20 GB of searchable data comes to $190 per month on On-demand and $210 per month on Performant. Elastic labels both examples illustrative.

On Hosted, Elasticsearch costs from $99 per month on the Standard tier, and the free self-managed download includes the full Elastic Stack.

Elasticsearch Vector Database Pricing

Elasticsearch Vector Database is Elasticsearch optimized for vectors, and Elastic lists it as a Serverless product. Its monthly bill has four parts:

• Data retention covers the total size of your stored vectors and metadata.
• Active data covers hot, searchable data scaled by Search Power, billed on a minimum of 16 GB.
• Data ingest covers the vectors you write or update each month.
• An infrastructure fee adds a flat monthly platform charge.

Quantization changes the bill the most. According to Elastic’s estimator, Better Binary Quantization stores 0.125 bytes per vector dimension, scalar quantization (int8) stores 1 byte, and full precision stores 4 bytes. On Hosted and self-managed, vector search is part of Elasticsearch, and Elastic’s ELSER and e5 semantic models need Platinum or higher.

Elastic Observability Pricing

Elastic Observability Serverless comes in two tiers, Logs Essentials and Complete, and Elastic introduced new metrics pricing on July 1, 2026. The starting rates are:

Complete adds curated analysis of logs, metrics, traces, and synthetic tests, plus Service Level Objectives, AI-assisted parsing, machine learning, and workflow automation. Synthetic browser tests cost $0.0123 per test run, and lightweight test locations cost $28 per location per month. On Hosted, APM, logging, and metrics apps come with Standard, and Platinum adds service maps, Service Level Objectives, and tail-based sampling.

Elastic Security Pricing: What Elastic SIEM Costs

Elastic Security is Elastic’s SIEM, with endpoint and cloud protection built in, and it runs on all three deployment options. On Serverless, it is billed by data volume. On Hosted and self-managed, the subscription tier decides which SIEM features you get.

Elastic Security Serverless: Security Analytics Essentials vs Complete

Elastic Security Serverless has two feature tiers. Elastic describes Security Analytics Essentials as everything most organizations need to operationalize traditional SIEM, and Security Analytics Complete as the tier that adds advanced analytics and generative AI.

Elastic’s Security Serverless rates took effect on November 1, 2025. Since March 23, 2026, Elastic charges no per-endpoint fees on Serverless: you pay for the alerts and telemetry your endpoints send, at the ingest and retention rates of your tier.

Optional add-ons are priced per asset or per use. Cloud Protection for CSPM costs from $0.65 per billable asset per month, and cloud workload protection from $0.41 per asset on Essentials and $0.49 on Complete. On Complete, Workflows cost from $0.0108 and Agent Builder from $0.025 per execution after the free 10,000, and the Elastic Managed LLM costs $4.50 per million input tokens and $21 per million output tokens.

Elastic publishes these per-GB rates for its SIEM, while Splunk Enterprise Security is sold only by quote, so you can check an Elastic estimate before the first sales call.

Elastic Security on Hosted and Self-Managed

On Elastic Cloud Hosted, Elastic Security comes with every subscription tier, and the tier decides the SIEM features. The detection engine, prebuilt rules, and case management start at Standard, machine learning anomaly detection and behavioral ransomware protection start at Platinum, and Attack Discovery and host response actions start at Enterprise.

On self-managed Elastic, the free download includes threat detection with alerting, case management, and malware prevention. Machine learning detection and entity analytics are part of Platinum, and Elastic Workflows, endpoint response actions, and Attack Discovery are part of Enterprise. The tier-by-tier detail follows in the Hosted and self-managed sections.

Elastic Cloud Serverless Pricing: How Usage-Based Billing Works

Elastic Cloud Serverless is the fully managed option: Elastic runs the hardware, cluster size, node count, and versions, and each project scales up and down with search and indexing load. You pay for usage at rates set per solution, either monthly as you go or from prepaid credits.

Serverless meters three things you should understand before you estimate:

• Elastic Security and Elastic Observability bill per GB ingested and per GB retained each month.
• Elasticsearch bills compute in VCUs, each with 1 GB of RAM, split into ingest, search, and machine learning.
• Ingest and retention volumes are measured on uncompressed, normalized, fully enriched data.

The third point catches most first estimates. Elastic warns that metered volumes will be much higher than the raw or compressed size of your data on the wire, so size your estimate on enriched data and test it with a trial project before you commit.

Support is priced as a share of consumption. Limited support is included on Standard, and Gold, Platinum, and Enterprise support add 5%, 10%, and 15% of the charge. Platinum and Enterprise also carry a 99.95% monthly uptime SLA. Elastic’s comparison table lists bring your own key as an upcoming Serverless feature in October 2026, so check the roadmap if your compliance team requires it.

Elastic Cloud Hosted Pricing: Managed Elasticsearch from $99 per Month

Elastic Cloud Hosted is Elastic’s hosted Elasticsearch: a public cloud managed service on AWS, Azure, and Google Cloud, which Elastic used to call Elasticsearch Service. It is Elastic’s own managed Elasticsearch, and Elasticsearch Serverless is its fully managed SaaS alternative. On Hosted, Elastic operates the platform, and you keep control of the hardware profile, cluster size, node count, and version.

Hosted pricing is resource-based. Each component is charged per GB of RAM per hour, with CPU and disk scaled with RAM, and Elastic says deployment capacity is usually the majority of the bill. Data transfer and snapshot storage are metered on top, and the four tiers compare as follows:

Each tier includes everything in the tier below it. The sections that follow show what each one adds and where it falls short.

Elastic Cloud Hosted Standard Pricing and Features

Elastic Cloud Hosted Standard starts at $99 per month and includes core search, logging, metrics, and basic security monitoring. It suits small teams or early deployments that need centralized visibility and can work without machine learning detection or round-the-clock support.

Its key features are:

• Detection engine with prebuilt rules and alerting.
• Centralized ingest and agent management.
• Malware prevention and host data collection.
• Case management.
• Cloud security posture management (CSPM) and cloud vulnerability management (CNVM).
• Discover, dashboards, field statistics, maps, and the developer console.
• Monitoring on by default with AutoOps.

Its strengths come from Elastic running the platform:

• Fully managed and scalable Elasticsearch clusters.
• Logs, metrics, and traces for basic monitoring.
• Integration with existing workflows through APIs and language clients.
• Quick setup and minimal maintenance effort.
• The core components of the Elastic Stack are open source and free to use.

Its limitations are mostly about support and advanced analytics:

• Limited security-specific features.
• Web-based support only, with a 3-business-day target response time.
• No machine learning anomaly detection, which starts at Platinum.
• No uptime SLA, which starts at Platinum.
• No cross-cluster replication, which also starts at Platinum.

If your team needs alerts to reach other tools, Gold is the next step.

Elastic Cloud Hosted Gold Pricing and Features

Elastic Cloud Hosted Gold starts at $114 per month and adds reporting, alerting actions, and business-hours support. This tier suits growing organizations that need detection alerts to reach their ticketing and incident response tools, while keeping the monthly cost below the machine learning tiers.

Its key features are:

• Reporting.
• Watcher and third-party alerting actions.
• Optimized workflows, including third-party incident response workflows.
• Detection alert external notifications and actions.
• Advanced host management configuration.
• Multi-stack monitoring.
• Phone and web support with 6 support contacts.

Its advantages over Standard are faster support and better integration:

• Target initial response of 4 business hours for urgent issues.
• Detection alerts that trigger actions in external tools.
• Monitoring of several stacks from one place.

Its limitations:

• More expensive than Standard, which may not suit smaller budgets.
• Support covers business hours only.
• No machine learning detection or uptime SLA, which start at Platinum.
• Advanced security features may need skilled people to use them well.

For teams running a security operation around the clock, the gap between Gold and Platinum is the one that matters.

Elastic Cloud Hosted Platinum Pricing and Features

Elastic Cloud Hosted Platinum starts at $131 per month and is the first tier with machine learning, behavioral ransomware protection, and 24/7 support. It is designed for organizations running active security operations that need anomaly detection, prebuilt SIEM jobs, and alert suppression across cloud and endpoint data.

Its key features are:

• Advanced Elastic Stack security features.
• Machine learning anomaly detection, supervised learning, and third-party model management.
• Prebuilt machine learning SIEM jobs.
• Behavioral ransomware protection.
• Detection alert suppression.
• Semantic and vector search with the ELSER and e5 models.
• Cross-cluster replication.

Its advantages:

• Security analytics and response capabilities for a full SIEM workload.
• 24/7/365 support with a 1-hour target for urgent issues.
• A 99.95% monthly uptime SLA.

Its limitations:

• Higher cost compared to the Standard and Gold tiers.
• Machine learning jobs need machine learning nodes, which add to the RAM-hour bill.
• Requires expertise for setup and tuning.

Platinum covers most SIEM needs, and Enterprise adds long retention and Elastic’s generative AI features.

Elastic Cloud Hosted Enterprise Pricing and Features

Elastic Cloud Hosted Enterprise starts at $184 per month and targets large or complex environments. It adds searchable snapshots for long retention, Elastic’s generative AI features, and premium support with a 30-minute target for urgent issues. Enterprise deployments scale with ingestion and storage requirements, like every Hosted tier.

Its key features are:

• Searchable snapshots in cold and frozen tiers.
• Attack Discovery, Elastic’s agentic investigation of alerts.
• Host response actions and cloud workload protection.
• Automatic Import and Automatic Migration for SIEM onboarding.
• Elastic Workflows and Elastic Agent Builder.
• Elastic Maps Server and synthetic _source for storage reduction.
• Semantic reranking with the Elastic Rerank model.
• Elastic Cloud SAML SSO.

Its advantages:

• Years of searchable data on low-cost object storage.
• Built-in tools for migrating from another SIEM.
• The fastest support target Elastic offers on Hosted.

Its limitations:

• The highest starting price of the four tiers.
• AI features add usage charges, such as Managed LLM tokens and executions beyond the free 10,000 per month.
• Requires dedicated staff or expertise to use the advanced features well.

Elastic Cloud Enterprise (ECE), the software for running many Elastic deployments yourself, is a separate self-managed product, covered next.

Elastic Self-Managed Pricing: Free and Enterprise

Self-managed Elastic runs on your own infrastructure: on-premises, air-gapped, or in any private or public cloud. Elastic licenses paid self-managed subscriptions by the number of nodes and the RAM they use, and it sells them by quote. Three tiers are listed in October 2026:

• The Free and open tier includes the full Elastic Stack, threat detection with alerting, case management, and malware prevention, with community support.
• Platinum adds single sign-on, field-level security, audit logging, and machine learning, and Elastic sells it to existing customers only.
• Enterprise adds searchable snapshots, Attack Discovery, endpoint response actions, Elastic Workflows, and orchestration with ECE and Elastic Cloud on Kubernetes (ECK).

Self-managed Gold is also closed to new customers, so a new buyer who needs machine learning detection or single sign-on prices Enterprise. Paid subscriptions include 24/7 support, and Elastic says searchable snapshots can cut infrastructure costs by up to 80% by keeping years of data on object storage such as Amazon S3. With ECE, one team deploys and manages many Elastic deployments through a single UI and API, with automated snapshots and deployment autoscaling.

Hosted vs Serverless vs Self-Managed Elastic: Which Deployment Fits

Elastic offers its solutions on all three deployment options, and the trade-off is control against operational work. The comparison follows Elastic’s own table, read in October 2026.

Serverless suits teams that want no capacity planning and a bill that follows usage. Hosted suits teams that want Elastic to run the platform but need to choose hardware profiles and versions, or need a feature that is still on the Serverless roadmap.

When to Switch to Self-Managed Elastic

Self-managed makes sense when the data cannot leave your environment, or when running your own hardware costs less than paying for managed capacity. Consider switching when:

1. Regulation or contracts require on-premises or air-gapped deployment.
2. You already run large, steady data volumes on hardware you own.
3. You need a region, network setup, or feature that Elastic Cloud does not offer.
4. Your team has the engineers to patch, scale, and back up clusters around the clock.

Weigh the fourth point hardest. Elastic itself notes that a free self-managed cluster often carries hidden hardware and maintenance costs, and its Cloud Connect gives self-managed clusters AutoOps and other Elastic Cloud services without a migration. The move also works the other way: Elastic says you can migrate from self-managed to Hosted or Serverless at any time.

If staff time is the blocker, compare managed SIEM options for Elastic before you take on the cluster yourself.

Pay-As-You-Go vs Annual Billing on Elastic Cloud

Elastic Cloud Hosted and Serverless share the same billing models, and every one of them meters usage in Elastic Consumption Units (ECU), where 1 ECU equals $1.00 at list price. The three models compare as follows:

Pay-as-you-go suits a first year, a proof of concept, or usage you cannot forecast yet. On a monthly subscription, an upgrade such as Standard to Platinum takes effect immediately, and a downgrade waits for the next invoice. On an annual subscription, you change the tier through your sales representative.

Through AWS Marketplace, Elastic spend draws against your AWS Enterprise Agreement commitment and starts with a 7-day free trial. Azure Marketplace spend draws down from existing MACC contracts, and Google Cloud Marketplace spend counts toward your committed spending agreement with Google Cloud.

Prepaid credits carry two risks to plan for. If you use up the balance before it expires, Elastic invoices the extra usage on demand at list price. If you do not use it by the end of the contract, the remaining credits are forfeited. You can buy add-on credits mid-term at the original discount, so a conservative first commitment with a top-up later is the safer pattern.

Hidden Costs of Elastic Cloud

The list rate is only part of an Elastic budget. These costs appear on Elastic’s own pricing and billing pages, and each one is worth a line in your business case:

• Serverless meters enriched, uncompressed data, so the billed volume exceeds your raw log size.
• Elasticsearch Serverless keeps a baseline of search VCUs provisioned, billed at a reduced rate when idle.
• On Serverless, support adds 5%, 10%, or 15% of the charge on Gold, Platinum, and Enterprise.
• Hosted data transfer out and between nodes is billed above a 100 GB monthly allowance.
• Hosted snapshot storage is billed above 100 GB per month, and snapshot API requests above 100,000.
• Each extra availability zone multiplies Hosted capacity costs.
• Cloud Protection, Workflows, Agent Builder, and Managed LLM tokens are billed as add-ons.
• Unused prepaid credits are forfeited at the end of the contract.
• Self-managed clusters need hardware, storage, and engineers to run them.

The last item is the one most estimates miss. Detection rules need tuning to your data, and an alert nobody investigates costs the same ingest as one that stops an incident. An Elastic SIEM TCO framework helps you put a number on each of these costs for self-managed and managed deployments.

How to Optimize Elastic Cloud Costs

Most Elastic savings come from sending less data, keeping it in cheaper storage, and paying for the right tier. Work through these steps before you size a deployment or renew:

1. Measure 30 days of enriched ingest before you commit to an estimate or to credits.
2. Trim endpoint telemetry in your Elastic Defend policy, which Elastic says controls your data volume.
3. Set data retention policies, so old data leaves hot storage on schedule.
4. Move long-term data to searchable snapshots in cold and frozen tiers on Enterprise.
5. Switch idle Elasticsearch Serverless projects to the On-demand Search Power setting.
6. Use Better Binary Quantization for vector workloads to cut stored data.
7. Avoid oversharding, which drives the shard movement behind most inter-node data transfer.
8. Set snapshot lifecycle policies, and reduce the frequency of Watcher email alerts.
9. Pick the lowest tier with the features you use, since a higher tier raises the Hosted rate and the Serverless support share.
10. Buy prepaid credits at a discount, or through your cloud marketplace to draw down a commitment.

Steps 1 and 2 matter most for Elastic Security, because endpoint telemetry and enriched log volume drive the serverless bill directly. Set budgets and billing notifications in the Elastic Cloud console, so a spike in ingest shows up before the invoice does.

How Can UnderDefense Help You Maximize Elastic Cloud Productivity and Results?

If you run Elastic Security and nobody is on shift at 2 a.m., the detections you pay to ingest wait until morning. UnderDefense Agentic AI SOC works on top of Elastic without replacing it, on Serverless, Hosted, or self-managed: AI agents investigate every alert, and UnderDefense analysts make the response decisions around the clock.

When a critical detection fires overnight, an UnderDefense analyst responds within the 20-minute SLA response time for critical alerts, and your team wakes up to the investigation. A VP of Technology whose company kept its Elastic SIEM in place describes the setup on G2:

“SentinelOne, Microsoft Defender, and our 4TB Elastic SIEM deployment stayed in place.”

Oleksandr M., VP of Technology, company of more than 1,000 employees, G2 review, June 2026, submitted through a G2 invite

The same reviewer adds: “Detection tuning to our multi-cloud environment took a few months before coverage was fully dialed in.” Budget those months into your first-year plan. UnderDefense is rated 4.9 out of 5 from 57 reviews on G2, as of October 2026.

Paying to ingest detections nobody reads overnight? Book an Elastic triage demo

Frequently Asked Questions