1. ElasticON
Steve Kearns
Vice President, Product Management

2. We are a search company

3. Speed. Scale. Relevance.

4. Search. Observe. Protect.

5. power of
community

6. power of a
single stack

7. power of
solutions

8. power of
cloud & hybrid

9. Elastic Cloud
Comprehensive cloud provider
and region presence:
• 16 GCP regions
• 10 Azure regions
• 16 AWS regions
• FedRAMP authorized AWS
GovCloud East region

10. per
for
power of a single SKU
others
per
for

11. power of
search

12. solutions

13. Elastic
Enterprise Search

14. Elastic
Observability

15. Elastic
Security

16. innovations

17. one agent,
one click

18. Heartbeat
Winlogbeat
Metricbeat
Filebeat
Security
APM
Many data shippers today
Elastic Agent
Easier to install
Easier to upgrade
Easier to scale
One unified shipper tomorrow

19. Fleet: Agent Management
Ingestion made easy
• Pre-built integrations with the most
common data sources (more coming
soon)
– System logs and metrics
– Custom logs
– AWS
– Nginx
– Redis
– Mysql
– Kafka
– Cisco devices
– Netflow logs
• Translated to Elastic Common Schema
• Managed centrally via Fleet

20. time to
insight

21. Kibana Lens
An intuitive way to explore your data
• Simple drag and drop experience
• Easily see your data from different angles:
– Time series, metric, table, Pie, Treemap
• Make advance calculations, simple
– Rate
– Month/month %
– Derivatives, cumulative sum
– Customize formula - based on your logic

22. searchable
snapshots (S3)

23. Constantly Occasionally Rarely
Only when
lawyers ask

24. Introducing Searchable Snapshots
Cold
Snapshot
2x data

25. Introducing Searchable Snapshots
Cold
Frozen
Snapshot
2x data
20x data

26. schema
on read

27. Schema on write
Speed, Scale,
Relevance
Data you understand
and use
Best for

28. Schema on write
Speed, Scale,
Relevance
Schema on read
Flexibility
Data you understand
and use
Best for
New data sources
Handling changes
Enable new workflows
Good for

29. Runtime Fields
New field type
Defined by a script
Painless, grok/regex or even a dynamic lookup
Evaluated at query time
Add to your mapping, or provide with your query
Works like a regular field
Search, aggregate, visualize just like a regular field
{
“day_of_week" : {
"type" : "runtime",
"runtime_type" : "keyword",
"script" : {
"source" : "dayOfWeek(doc[‘@timestamp’)"
}
}
}
New data sources
Handling changes
Enable new workflows
Good for

30. power
of you