The Total Economic Impact™ Of Elastic Observability

Improved Business Resilience From Fewer Revenue-Impacting Incidents

Evidence and data. Before Elastic Observability, interviewees experienced the real-time impacts of poor application performance, which contributed to revenue loss. They said that with Elastic Observability, APM traces and anomaly detection proactively prevented performance degradation or remediated the impacts, thus reducing MTTD and MTTR, improving overall business resilience, and avoiding revenue loss.

• The senior director of application operations at a fintech organization attributed the improvement in business resilience to proactive preparation for known disruptive events, such as traffic spikes, that previously led to system downtime. They said: “With APM, you can see when, for example, online ordering has spiked. Additionally, if you go down the stack, you can see which system or platform is causing the problem. Once we’ve identified where the problem originated, we can get tickets open and start resolving the issue. I think the ease of access to logs in APM are really the area that we focused on implementing with Elastic Observability and that have driven success for us.”

• The executive VP and head of technology at a media organization indicated that their organization saw a 20% reduction in overall incidents, but 60% fewer customer-impacting incidents — including fewer service level 2 and 3 incidents — after implementing Elastic Observability.

• The senior director of application operations at a fintech organization said that their organization saw 70% to 80% fewer cloud incidents with Elastic Observability, which helped improve system performance and provide better business resilience. They noted: “I would say in the cloud, our recovery time has reduced significantly. Elastic has helped us steady the cloud and get more resilient by identifying single points of failures along the journey. It has all been reactive, but it helps us pull data to understand where our scaling wasn’t appropriate and where the scaling was causing consistent problems. I’m going to say about 75% of the problems we have currently have shifted to our in-store devices versus any of our cloud applications as they were previously.”

• The director of software engineering at a telecommunications organization said: “Being more proactive and prescriptive means fewer incidents because we are avoiding the incident altogether. I would say that in the first year alone [with Elastic Observability], we avoided 250 catastrophic incidents, and I estimate we avoided losses of $1 billion to $2 billion if even four of those incidents had come through to fruition. Additionally, we avoided 1,000 smaller events that could have been application, network, or call center related.”

• The same interviewee also cited challenges in their prior observability practices that inhibited tracing and prolonged mitigation efforts. They said, “In our prior observability process, we either were not collecting logs, in which case we couldn’t do any trace or debugging and would have to create a newer version of an application or an update that does collect logs, or we were collecting logs, but we did not have a lot of dimensions. The coverage was not there, so we had blind spots. Now, with Elastic Observability, we have anomaly detection techniques where an agent captures as much information as possible, including going through the checklist of the different issues, as well as some basic dashboard of automatic alerts that guide us to detection and remediation more efficiently.”

• The director of software engineering at a telecommunications organization cited value in improved root cause analysis with Elastic Observability: “We can do root cause analysis and log searches to reduce detection and resolution times by 30% to 35%. With Elastic, we have templates and a relationship with Elastic where we can learn from what they’ve seen from other clients, and that also helps us detect issues right away based on learned patterns.”

• The observability director at a consumer products manufacturer reported reducing false-positive alerts by 79% after implementing the correlation, categorization, and anomaly detection capabilities of Elasticsearch (Elastic’s open source search, analytics, and AI platform), which reduced the engineering time spent triaging nonactionable alerts. With Elastic Observability’s ML-driven log categorization and anomaly detection, their command center suppressed more than 25,000 false-positive alerts annually, reducing noise and alert fatigue and enabling the team to recoup time to focus on meaningful incidents.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Previous system downtime stemmed from major incidents that impacted customers and totaled 96 hours annually.

• With Elastic Observability, the organization reduces such system downtime events by 65% in Year 1, increasing to 75% by Year 3. With an annual revenue of $10 billion and an operating margin of 10%, the risk-adjusted impact of the system downtime in terms of revenue loss avoidance totals $5.7 million in Year 1, which grows to $6.6 million by Year 3.

Risks. The scale of this benefit may vary by organization based on:

• The size and industry of an organization (e.g., annual revenue and operating margin).

• The status of downtime in an organization’s prior state (e.g., the hours of downtime that impact customer-facing applications and supporting infrastructure).

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $15.2 million.

Faster Problem-Solving From SRE Productivity

Evidence and data. Before Elastic Observability, interviewees experienced inefficiencies among the teams previously responsible for monitoring dashboards and telemetry to detect incidents. With Elastic Observability, those teams benefited from a unified platform for log analytics, infrastructure monitoring, APM, and agentic AI. Zero-configuration anomaly detection across logs, metrics, and traces enabled teams to proactively take action to prevent incidents or remediate the impacts, thus reducing MTTD and MTTR while improving overall business resilience. 

• The director of software engineering at a telecommunications organization previously had 70 to 80 data scientists dedicated to SRE-type responsibilities such as detecting and mitigating incidents. The interviewee indicated that the data scientist resources reclaimed 95% of their time with Elastic Observability. Now, the organization has 10 to 15 data scientists who remain on monitoring, and it reallocated the rest to more value-added work.

• The executive VP and head of technology at a media organization saw an 18% to 20% reduction in SRE headcount specifically from automating more of the root cause analysis and detection processes.

• The AIOps leader at a financial services organization indicated that with Elastic Observability, SREs resolve incidents 5 to 10 minutes faster specifically due to APM traces.

• Interviewees also indicated that reducing MTTD and MTTR contributed to system downtime mitigation and SRE productivity. The AIOps leader at a financial services organization estimated that with Elastic Observability, MTTD decreased from 6 minutes to 1 minute, which is about an 85% improvement. They said, “Some of our applications are better than others; three to four of them are close to 1 minute for detect.” 

• The executive VP and head of technology at a media organization corroborated that sentiment and noted that MTTD decreased from between 40 and 45 minutes to less than 8 minutes with Elastic Observability, which is an 80% improvement. The same interviewee said their organization improved MTTR by 15% to 20% as well.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Before Elastic Observability, the composite had a team of 15 SREs who dedicated 85% of their time to monitoring applications and identifying and resolving incidents.

• With Elastic Observability, the organization reduces SRE team time spent by 90% in Year 1, increasing to 95% by Year 3. With an average fully burdened hourly rate of $90 per SRE resource and a recapture rate of 80%, SRE team productivity is worth a risk-adjusted $1.4 million in Year 1, growing to $1.5 million by Year 3.

Risks. The scale of this benefit may vary by organization based on:

• The team size and resource types involved in monitoring and resolving incidents before Elastic Observability.

• The functionality rolled out to these teams that create efficiencies, such as APM, root cause analysis, and anomaly detection.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $3.5 million.

Application Development And Deployment Efficiency

Evidence and data. Interviewees focused on the impact of improved observability to development timelines, as developers were often already involved in incident remediation processes. Forrester describes this approach as creating observability-driven deployment, which means shifting left and bringing observability into planning and design. It also means fostering a culture where preventative fixes are seen as investments, not distractions. By building observability data into development earlier in the process, developers benefit from early insights into how changes will behave in production and can be warned about abnormalities before they implode; therefore, they can prevent organizational damage.² With Elastic Observability, interviewees said they benefited from more visibility into deployment pipelines, faster troubleshooting, and real-time user monitoring and digital experience monitoring. As a result, their organizations further reduced incident volumes where developers were previously required to help test, deploy, and debug fixes. 

• The senior director of application operations at a fintech organization indicated that they lacked an SRE team before Elastic Observability, which put more pressure on development resources to assist in incident troubleshooting and remediation: “We have this gap in SREs, so whenever we have an outage, it’s developers who are doing the troubleshooting, before Elastic identifies it. We get billions of logs a day and digging through those logs to identify where a problem was before we could even put a fix in place would sometimes take us days.” With Elastic Observability, the 30% of time previously spent on troubleshooting for developers was now closer to 20%. The time savings for developers were redirected to pushing out better quality reworks, which helped improve MTTR.

• The director of software engineering at a telecommunications organization tied MTTR improvements to accelerated development work as well, saying, “The 15% to 20% reduction in MTTR workflows and the 30% to 35% reduction in remediation timelines included developer work.”

• This interviewee also said that developers used the time savings to focus on more innovation work for the organization: “[After implementing Elastic Observability], developers started focusing on more industry-specific analysis. When they create a new bundle of products, the developers will look to see how customers are responding to that new bundle or how it is contributing to a new line of business versus focusing on the application health and application-related analysis. Developers then start looking at revenue increasing or churn decreasing analysis to restrict friction points and improve usability or omnichannel flows.”

• Forrester corroborates the connection between observability-driven deployment, stating that it gives developers the power to innovate more comfortably because they have the context they need to make smart and informed decisions. It reduces accumulation of technical debt because issues are caught early, before they transform from unrecognizable behavioral changes into outages. An added benefit is that connecting engineering decisions directly to business outcomes transforms software releases from a gamble into a strategic advantage.³

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The team of application developers who work on applications covered with Elastic Observability grows from 280 in Year 1 to 339 by Year 3, following the trajectory of onboarded application volumes.

• The team of developers previously dedicated 30% of their time to testing, deploying, and debugging applications. With Elastic Observability, the team sees a 35% reduction in time spent on these activities in Year 1, which increases to 55% by Year 3.

• With a fully burdened hourly rate of $77 for a developer and a recapture rate of 50%, the risk-adjusted application development and deployment efficiencies grow from $1.9 million in Year 1 to $3.6 million in Year 3.

Risks. The scale of this benefit may vary by organization based on:

• The size of the application environment and the associated team of developers responsible for testing, deploying, and debugging applications in the prior environment.

• The observability functionality implemented and the rate at which applications are onboarded to the platform, which drives the reduction in time spent on such activities and the associated impact to developers.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $6.6 million.

Infrastructure Optimization

Evidence and data. Interviewees noted that before Elastic Observability, their organizations implemented many different observability tools to cover all aspects of the observability data, including traces and logs. However, these tools were not built to help their organizations face the large-scale volumes of log and telemetry data. As environments continued to expand, prohibitive storage costs became the primary inhibiting factor, forcing teams to cap ingestion and leave critical systems unmonitored. By consolidating siloed tools onto the Elasticsearch platform, interviewees said that their organizations gained unified visibility across their observability operation, eliminating the overhead from managing disparate solutions. They also noted that Elastic Observability’s tiered data storage model gave their organizations control over where data lives based on access frequency and cost, and features like logsdb index mode, searchable snapshots, advanced data compression, and efficient indexing supported increased transparency and reduced infrastructure and storage costs — without sacrificing performance or data retention.

• The director of software engineering at a telecommunications organization indicated that their organization reduced log storage costs by 70% with Elastic Observability: “A lot of vendors force you to do indexing, which is expensive. Elastic gives you all the templates to analyze your logs so you can better decide if you want to index or not. You can choose to keep the logs open file format and have the super speed search enabled. It reduces proprietary log saving. It helps reduce spend on other expensive log storage providers.” 

• The executive VP and head of technology at a media organization corroborated the log storage cost savings and estimated, “Total cost savings is a few million a month but includes business disruption cost savings in addition to technology consolidation cost savings.”

• The observability director at a consumer products manufacturer saw $4.9 million in cost savings from reducing observability tools. The organization went from roughly 55 tools to about 20 by standardizing on the Elasticsearch AI platform, eliminating overlapping licenses and integrations. Over three years, the organization reduced its number of observability tools by more than 60%, reducing costs and providing full-stack visibility to teams.

• This interviewee also estimated that their organization saved up to 38% in hardware costs related to observability infrastructure from data tiering and compression. This enabled it to move infrequently accessed data to lower-cost tiers without compromising performance, reducing node counts and infrastructure spend while sustaining telemetry growth. The organization also used Elastic Observability’s logsdb compression capabilities to reduce the size of log data, creating meaningful storage efficiencies as monthly ingestion volumes reached 13.7 TB.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Observability infrastructure costs were primarily driven by storage costs before Elastic Observability, and the organization spent $200,000 annually on log storage in the prior environment.

• With Elastic Observability, the composite utilizes data tiering to improve its log storage decisions, reducing annual spend by 60% in Year 1 and 70% by Year 3.

• The composite previously had six tools related to observability before Elastic Observability. It consolidates four of them to the Elastic Observability platform by Year 3 and saves on the associated licensing costs.

Risks. The scale of this benefit may vary by organization based on:

• The size of an organization.

• Its associated observability environment in terms of legacy tools and log ingestion and storage volumes.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $848,000.

Increased Customer Retention

Evidence and data. Interviewees shared that poor system and application performance previously impacted customer experiences. With Elastic Observability, their organizations saw improved customer experiences that helped avoid high churn rates. Interviewees cited how AI capabilities within the Elastic Observability platform, specifically anomaly detection and root cause analysis, mitigated the impact of application performance outages and degradation on customers to drive improved customer retention. 

• The senior director of application operations at a fintech organization said they lost large customer contracts with their prior infrastructure performance: “On the sales side, when we lose an enterprise customer, we don’t lose them very often, but it’s significant. One of the big ones that we did lose was due to system downtime events that we were experiencing in our prior state.”

• The director of software engineering at a telecommunications organization said: “With Elastic, if our churn is currently at 2%, Elastic contributed to a 15% to 20% reduction from our prior churn to help get us here. Practically, that means prior downtime events impacted the business. For example, if our app is not working, we could lose orders. Some prospects might try to place the order again 2 hours later, but many will not come back at all and will just go to another vendor. That is something we look at — whether the order loss is a permanent loss or a frustration factor that just reduces Net Promoter Score℠ (NPS).”⁴

• The executive VP and head of technology at a media organization indicated that better customer service and satisfaction, even qualitatively, contributed to reduced customer churn. They said, “With Elastic, we saw call volumes in the call center drop by almost 60% and saw NPS improve in the areas of system reliability. We think the AI functionality that improves anomaly detection made our organization more proactive, which meant that we could resolve issues before customers even reported them.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization has a large customer base of 25 million and previously experienced a customer retention rate of 80%.

• With Elastic Observability, the organization improves the customer retention rate and attributes 0.35% of that improvement to the Elastic Observability platform in Year 1. That attribution grows to 0.6% by Year 3 due to the implementation of more AI capabilities that stop downtime events from impacting more customers.

• As the impact is to retained customers and not net new customers, the average revenue impact per customer is $100, which represents a smaller portion of average order value than that associated with onboarding a new customer.

Risks. The scale of this benefit may vary by organization based on:

• The size of an organization and the volume of customers impacted.

• The customer retention rate before Elastic Observability and the improvement experienced with the Elastic Observability platform in place.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.9 million.

Unquantified Benefits

Benefits that provide value for interviewees’ organizations but are not quantified for this study include:

• Expansion of observability with LLMs to help scale coverage and meet market demands. Interviewees invested in Elastic Observability to meet current and future observability needs. The senior director of application operations at a fintech organization said: “We currently use anomaly detection. We find that this AI functionality augments our small team and functions like an SRE resource, which we did not have before. Now we are able to proactively build the dashboards and the thresholds that we need.” The same interviewee noted that they will work with Elastic Observability to plan for further AI adoption, including monitoring AI models, from their current, early pilot stages. The executive VP and head of technology at a media organization said they intended to build in “intelligence-driven anomaly detection beyond infrastructure observability to cover more applications to impact user experiences with the goal of identifying issues before they impact customers.”

• Improvement to observability cost consistency and predictability. Interviewees’ organizations benefited from more transparency, which allowed them to control log volumes and associated costs. The senior director of application operations at a fintech organization explained that developers often inadvertently contribute to higher log volumes and therefore increase logging costs: “We have dashboards that do analysis of what logs we’re ingesting, where they’re coming from and where we have spikes. The tools that Elastic Observability provides to be able to just see where we’re spending our money has helped us control costs. In that way, we can put pressure on development teams to reduce their logging or fix bugs that are just spamming us unnecessarily.”

• Compliance with governance and regulatory requirements. In heavily regulated industries, collecting and storing data regarding downtime incidents and events was paramount to better meet strict governance requirements. As an example, the senior director of application operations at a fintech organization said: “We have two PCI in-scope apps. We don’t hold card data, but we do payment transmission. So we use those logs to satisfy some of the PCI controls. We’re also SOC 1 Type 2 compliant as well. So again, we can provide logs to the auditors there as well.”

• Improvement in customer service levels, especially in IoT. The senior director of application operations at a fintech organization noted that Elastic Observability enabled more flexible management and monitoring for end-customer POS devices within their environments. They said: “Enterprise customers are incredibly picky about their POS experience. Elastic has helped us because we are able to identify a specific site, store, and device, and pull the configuration of that device out of our tools and be able to then apply that to a lab, do the testing, and then validate what’s going on.” In some cases, Elastic Observability enabled efficiencies for those end customers through this transparency and analysis effort as well. The same interviewee provided an example of this use case, stating: “One of our customers is a stadium in North America that we provide all of the menu boards, POS, and technology for at all of their concession stands. As part of that agreement, we also gave them access to Elastic dashboards to be able to track their devices. Prior to us coming on board, they would have somebody walk around every single POS device in the stadium leading up to an event to make sure it was online and turn it off and turn it on, which would take hours because there’s almost 3,000 devices in a stadium. With access to Elastic dashboards, they can essentially just with one glance say, ‘Okay, these are the ones offline. Somebody go deal with those and get it done.’”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Elastic Observability and later realize additional uses and business opportunities, including:

• Further reduce incidents by expanding platform capabilities. Interviewees described additional uses for Elastic Observability across AI, Streams, and self-service:

  • AI. The senior director of application operations at a fintech organization indicated the desire to adopt more AI functionality to reduce incident volumes and incident severity: “I would like to see full adoption of AI across code pipelines, across monitoring tools, across security tools. So there’s a lot more we can do. This team is specifically coming in to help implement additional tools to essentially stop our outages. If we can go for a year and only have a couple of P3s, P4s, then we’re in a much better position than the P1s we used to have. Anomaly detection is going to be a big part of it. We haven’t dug into the rest of the Elastic capabilities and what else they offer, the agentic AI that is available in [our cloud provider] and Elastic and a lot of tools now.” So what is in store for organizations that incorporate more AI, and specifically agentic AI, into their observability practices? According to Forrester, the goal of the agents is not just to fix what’s broken. Fueled with observability data and analytics, the agents can anticipate what’s next, turning retrospectives into design intents and preemptive solutions. The result is fewer antipatterns, stronger security, faster iterations, more resilient operations, and a development culture that experiments with less fear and makes more of an impact.⁵
  • Streams. Interviewees shared that one of the reasons they elected to unify their observability environments to the Elastic Observability platform was trust in Elastic’s product roadmap. Consequently, they are looking forward to enrolling in new functionality and taking advantage of new features such as Streams to build on the gains they have already experienced. Streams uses AI to automatically parse, partition, and structure log data, which can simplify ingestion pipelines and accelerate incident detection. It also enables schema-agnostic ingestion and storage of any data in its native format, including OpenTelemetry, Prometheus, Beats, and others, and can reduce the effort or information loss of schema translation.
  • Self-service. The senior director of application operations at a fintech organization had already enabled self-service access to the Elastic Observability dashboards for some end customers to improve their own workflows for devices. The interviewee wanted to double-down on this effort for more end customers, not only to improve customer satisfaction but also to give customers more control of their devices and cut down on the tickets that land back with the organization: “It is to the point where some of our customers are asking how they can get a direct feed into Elastic to get live-stream logs, but it is significantly expensive just to export these logs. But to start giving a customer a way to just pull those is something we need to understand and discuss, and it’s a conversation we were thinking of having with Elastic to say, ‘Hey, how would you do this? You have APIs, what would be the impact? Do we need additional clusters to be able to support that?’ So that’s something we’re looking to do but could be complicated and costly.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).