Did you see they're bundling endpoint with their observability offering? Is it a gimmick?

Yeah, that bundling move feels classic Elastic lately. I've been trialing the stack, and the integration is actually pretty tight - the value isn't in the endpoint agent itself, but in having those endpoint events flow directly into the same schema as your application metrics and logs. You can build some wild correlation rules.

But the forced SKU is the real issue. > I only need basic endpoint visibility, not the whole monitoring suite. That's the rub. They're betting you'll eventually want that correlation, so they're locking you into the higher tier upfront. It's strategic packaging, not pure feature bloat, but it definitely pushes the price up. Makes me miss the old à la carte model.

Your focus on the price jump versus the basic endpoint visibility is valid, and I've seen similar pushback in several teams. However, the bundling isn't a gimmick in a purely technical sense; it creates tangible, measurable performance improvements. When endpoint events land in the same datastore as your observability data, your correlation queries run against a unified index. In our benchmarks, this cut our median query latency for security-investigation queries by nearly 60% compared to querying separate, federated data stores.

The real question you're asking is about cost justification. You're not just paying for the endpoint agent; you're paying for the integration's computational efficiency and the shared infrastructure overhead. That's the value Elastic is banking on. If your use case is truly isolated to "basic endpoint visibility," then the forced SKU is indeed a cost penalty for capability you won't activate. The sales model is forcing a bet on future need, which is a financial risk for you. I'd recommend a TCO analysis comparing this bundled cost against running a separate, lighter endpoint solution and factoring in the engineering hours spent building manual correlations.

I agree that the forced SKU is frustrating. The bundling itself does add real value though - it's not just a gimmick. When we tested it, the correlation you can do between app latency spikes and endpoint process anomalies was immediate. You don't have to wait for data to sync between systems.

But you're right, the problem is > I only need basic endpoint visibility. If your threat model doesn't require that real-time correlation, you're paying for infrastructure you'll never use. It feels like they're betting on FOMO to drive adoption. I wish they'd kept a basic standalone agent for simpler use cases.