What you runRunning Elastic Security?
Cheap to send in. Expensive to keep searchable.
Elastic gives security teams fast search, open detection rules and one platform for security and observability, with rates you can model on day one. The pressure is history: every GB is billed on the way in, and again every month it stays searchable.
Free. No system access. No obligation. You keep the drawing.
Step oneA pipeline in front of your SIEM, designed and built by Logmetry. Your SIEM stays. A full raw copy stays in your own account.
At least 20% less into your SIEM, every alert kept, proved on your data.
Elastic Security SIEM
$2.70 per GB/day a month
To ingest 1 GB every day for a month, at list price.
Retention is billed separately, from $0.017 per GB a month.
Elastic Security Serverless pricing page, checked 2026-09-24
01The four problems
Which of these hits your Elastic estate?
Budget, renewals, the order to bring in AI, and collection that runs on someone else’s agents. Each one is about where the data lives, and with Elastic it lives in Elastic’s ecosystem. Pick yours.
“We keep deleting history to control the cost, and then an investigation needs it.”
Keep years of history, at storage prices, in your own Lake.
- Why it happens
Elastic bills on ingest and again for every GB kept, month after month. Long retention is the most expensive thing to keep searchable.
- What changes
Only what detection needs is ingested, on short retention. The full history lands in a Lake you own, enriched and queryable.
- How sure you can be
Nothing is lost. The full copy stays in your Lake and replays on demand, and every routing rule is readable code. The reduction is measured on your own noisiest sources, before and after, in writing.
- How soon
With the first source. We start where the most volume sits, prove it, then continue.
- What it takes from you
Your diagrams and one call to start. We build it as code in your repositories and teach your team to run it.
What shrinks
- GB indexed by your SIEMOnly what detection reads is indexed. Duplicates, debug output and unread fields stay out.
- Tokens per AI investigationEvery query to the Lake returns only the fields the agent needs.
- Hosts on per-node licensesOrdinary hosts move to monitoring you own. The APM keeps the apps that earn it.
- Vendor licenses and modulesYou keep the features that earn their price, not the whole platform.
Shapes, not figures. Yours are measured on your own sources in the review.
“Our parsing, rules and dashboards all assume Elastic’s schema.”
Parse once, upstream, in a format you own.
- Why it happens
Ingest pipelines, the schema, the agents and Fleet all live inside the Elastic estate. The more you build there, the harder it is to move.
- What changes
Parsing moves upstream into a control layer you own. Elastic keeps its rules, and the same clean data can feed any destination.
- How sure you can be
The detections, dashboards and alerts your team relies on keep firing where they do today. A move becomes a parallel run on the same routed feed, proven before anything is retired.
- How soon
Before your next renewal, if we start with the sources that drive it.
- What it takes from you
Your diagrams, your renewal date, and one call.
Your way out
- MigrationToday: Quarters of overlapping licensesWith you in control: Weeks: a parallel run, then a routing change
- Your dataToday: Their format, in their storeWith you in control: Open schemas, OCSF and OpenTelemetry, in your Lake
- HistoryToday: Stays behind when you leaveWith you in control: Replays into any tool you choose
- Collection and fleetToday: Their agents, their consoleWith you in control: A control layer and fleet plane you own
“We want AI in the SOC, and it can only read what we could afford to keep.”
Your agents, on your data, following your runbooks. Not one more module on their price list.
- Why it happens
An assistant inside the cluster reads what the cluster holds, which is the history you could afford to keep. It is their AI, on their rules and their runbooks, never yours.
- What changes
We trim every event in flight to only the fields an agent needs and land it in your Lake. Your agent runs in your account on models you choose, reads years of that history, and picks up every Elastic alert.
- How sure you can be
Agents reason well on clean, trimmed data and badly on noise. Knowing which fields matter takes understanding machine data, source by source, and that is the work we do.
- How soon
As soon as the first sources land clean in your Lake, your agent has something worth reading.
- What it takes from you
Your runbooks, or we write them with you. The agents, prompts and runbooks are code you own.
What you get running
- Agents you control, in your accountThey run where your data is, under your access rules.
- Models you choose, and swapSmall or open-weight models for routine alerts, larger ones for investigations. Changing one is a config change, not a renewal.
- Your runbooks, as codeVersioned in your repositories. The agent follows them step by step.
- Token controlFields trimmed in flight to what the agent needs, so every query reads less and costs less.
- Fixes as pull requestsThe agent writes the fix, a person approves it, and remediation moves at the speed of a review.
- A Lake anyone can queryDevelopers and stakeholders ask the clean Lake directly, at object-storage prices.
“We want one open standard, not Elastic Agent and Fleet on every host.”
LaterA later step, sold only after step one is proved on your data.
Open collection you own. Elastic becomes one destination.
- Why it happens
Elastic Agent and Fleet manage collection from inside the Elastic estate, so collection is where the lock-in starts.
- What changes
The logs work lands first. Open collection on OpenTelemetry follows host group by host group, routed to Elastic and anywhere else.
- How sure you can be
OpenTelemetry is the open standard the major APM vendors already accept. Nothing about your destinations has to change on day one.
- How soon
Later. We start with the logs in front of your SIEM, because that is where the money is. Open collection follows once that is proved, host group by host group.
- What it takes from you
Your diagrams and one call. We plan the order with you.
Your control plane
- OpenTelemetry collectorsOpenOne open collector on every host, built for your estate.
- A fleet plane you ownYoursConfiguration and rollout from a console in your account, under OpAMP.
- Changes as pull requestsAs codeAI native: an assistant drafts the change, your team reviews and merges it.
- No vendor agentsRemovedNothing on a host reports to someone else’s console.
- Monitoring, only what earns itYour callStep away from a vendor’s full architecture and keep only the features you value.
02Today, and after
Today, and with the Blueprint
An Elastic estate pays on the way in and again every month the data stays searchable, so the history an investigation needs is the first thing deleted.
Scroll the drawing sideways to see all of it.
What Elastic Security does best
Elastic is fast search at scale with an open heritage: detection rules published in the open, a query language engineers enjoy, and security and observability on one platform. On Serverless it publishes per-GB rates you can model before you sign anything, which few SIEMs do.
The pressure is history. On Serverless every GB is billed on ingest and billed again for every month it is kept, and self-managed clusters pay for the nodes and storage that keep it searchable. So long retention is the most expensive thing to keep, and it is the first thing teams cut.
How it works, and where we sit
Elastic Security is the SIEM built on Elasticsearch: Elastic Agents managed from Fleet collect from every host, ingest pipelines parse each source inside the cluster, and detections run as rules and queries over what the cluster holds. On Serverless it is billed per GB ingested and per GB retained each month, and self-managed or hosted clusters pay for the nodes and storage that keep history searchable. We parse once upstream, send Elastic what detection needs on short retention, and keep the long history in a Lake you own.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
Elastic Security, its detection rules, and the queries your analysts know. Nothing about how your team works in Elastic changes.
- Shrink
Retention inside Elastic gets short and deliberate, sized to what detection and recent investigation need, while the long history lands in your Lake.
- Cut
Ingest and retention bill on what earns detection instead of on everything the estate produces, measured source by source in writing.
- Extend
An agent you own picks up each Elastic alert and reads years of history the cluster never kept.
- Replace
Never. Elastic stays your SIEM, and we sit in front of it, not in place of it. Parsing moves upstream, so any destination can read the same clean data, and the choice stays yours.
The letters mark where each verb acts in the drawing with the Blueprint.
Parse once, keep it all, search what matters
A control layer in front of Elastic parses every source once upstream, sends Elastic what detection needs on short retention, and keeps the full history in open formats in your own storage.
Parsing that lived in ingest pipelines inside the cluster moves upstream and becomes code in your repository, written once per source instead of once per destination. Elastic receives clean, consistent events, and the rules stay simple.
The long history lands in a Lake you own, partitioned the way investigations move, so a year of data comes back when an incident needs it without a year of searchable retention on the bill.
04The free architecture review
We draw your Elastic estate, free.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your Elastic architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your Elastic estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What Elastic teams ask before they book
Do you replace Elastic?
No. Elastic stays your SIEM, with its rules and the queries your analysts rely on. We sit in front of it, deciding what it ingests and how long it keeps it, and hold the rest in a Lake you own.
Elastic is already cheap per GB. Where is the saving?
In what you keep, and how long. On Serverless every GB is billed again each month it is retained, and self-managed clusters pay for the nodes and storage that keep history searchable. Shorter, deliberate retention in Elastic with the long history in your Lake is where the bill moves.
Can our analysts still search old data?
Yes. The Lake keeps it at full fidelity, partitioned for retrieval, and any of it replays into Elastic when an investigation wants it there. Your agent reads it directly.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
Are you a reseller for a vendor?
Yes, for certain vendors’ software. We are also the delivery partner and integrator on custom projects, directly or alongside your systems integrator. The pipeline subscription is in your name, bought from the vendor, its channel or through Logmetry where we resell it, and priced on its own line. We recommend what fits your business problem, even when that means changing nothing, and no SIEM or APM vendor pays us to recommend it.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your Elastic estate drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing