Elastic Security SIEM pricing in 2026: self-managed vs cloud, and the true cost

Elastic Security ships in three tiers. The Basic (open-source) tier is free and includes core SIEM detection rules, the Elastic Common Schema, basic Kibana, and the underlying Elasticsearch and Logstash. Gold ($95/user/month) adds Kibana spaces and alerting. Platinum ($125/user/month) adds machine learning jobs and cross-cluster search. Enterprise ($175/user/month) adds Endpoint Security and SOAR. The free tier is genuinely usable for SIEM but lacks ML-driven detections and the integrated endpoint agent.

Elastic Cloud uses resource-based pricing: you pay for compute (CPU and memory) and storage rather than ingest. A typical mid-market security deployment provisions 4-8 hot data nodes plus warm and cold tiers. Pricing is consumption-based and varies by region; expect roughly $0.50 to $1.10 per GB ingested as an effective rate, including compute and storage, before the per-user subscription. Resource-based pricing penalises spiky workloads less than per-GB models but rewards careful capacity planning.

Self-managed Elastic appears cheap on the licence line and expensive everywhere else. Expect $15,000 to $50,000 per year in infrastructure for a mid-market deployment, plus a dedicated Elastic engineer at $120,000 to $180,000 per year (Elastic experience commands a premium). Add 20-30 percent of that engineer's time on cluster maintenance, version upgrades, and capacity planning. Real total is typically $200,000 to $300,000 annually for a 50 GB-per-day deployment, comparable to Sentinel or Sumo Logic.

For most organisations under 200 GB per day, Elastic Cloud wins on TCO because the infrastructure operations burden vanishes. Self-managed wins where you already have an Elasticsearch practice (data engineering, observability, search), where data residency requirements demand on-prem, or above 500 GB per day where amortised hardware beats consumption pricing. The break-even is rarely about the licence line; it is about whether you have or want to build operational capability around the cluster.

At 50 GB per day with equivalent capability (Elastic Platinum vs Splunk Cloud with Enterprise Security), Elastic typically lands 30-50 percent below Splunk on total cost. The trade-off is detection content and search ergonomics: Splunk's premium app ecosystem (ES, ITSI, premium content packs) is mature, while Elastic relies more heavily on community detection rules and your team's ability to write KQL or Lucene queries. For organisations that value Splunk's analyst experience, the premium is justified; for cost-conscious teams with engineering capacity, Elastic wins.