Vendor lineage

Elastic

Changed its licence to stop a cloud provider, got forked, and changed it back three years later.

Shay Banon built Elasticsearch on top of Apache Lucene, having previously written a search library called Compass, and the company around it was founded in 2012. The product did something genuinely useful: it made full-text search over arbitrary JSON documents something a developer could stand up in an afternoon, with a query language that did not require a database administrator.

Elasticsearch and Kibana were Apache 2.0, and that licence is permissive by design - anyone may take the code and sell a service built on it, with no obligation to contribute anything back. In 2015 Amazon Web Services began offering exactly that: a managed Elasticsearch service. In 2019, after Elastic released parts of its commercial x-pack features under restrictive licences, AWS launched Open Distro for Elasticsearch as an alternative packaging.

In January 2021, with release 7.11, Elastic moved Elasticsearch and Kibana off Apache 2.0 to a dual licence: the Server Side Public License, originally written by MongoDB, and the new Elastic License. Neither is approved by the Open Source Initiative. Elastic's stated intent at the time was to prevent companies providing its products as a service without collaborating with it, and AWS was named explicitly.

Three different accounts of why exist, and all three are recorded here. Elastic's 2021 position was about resale without collaboration. In 2024 Banon put the emphasis elsewhere, saying the problem was never AWS providing the software - Apache 2.0 permitted that - but calling it Amazon Elasticsearch, which he characterised as clear trademark infringement met with a thousand lawyers. Adrian Cockcroft, formerly of AWS, gave a third version: that AGPL alone would have blocked AWS, and that the real disagreement was AWS wanting to contribute security features to the open project while Elastic wanted to keep security commercial. These accounts are not compatible, they come from named participants, and this page does not adjudicate between them.

In April 2021 AWS forked Elasticsearch and Kibana at version 7.10.2 and created OpenSearch, under Apache 2.0, later placed with the Linux Foundation. Elastic then made its client libraries incompatible with OpenSearch, and OpenSearch wrote its own.

The community reaction is worth quoting rather than summarising, because it is the part that outlasted the argument. Drew DeVault noted that Elasticsearch belonged to its 1,573 contributors, who had granted Elastic a licence to distribute their work and not to relicense it. Simon Phipps of the Open Source Initiative said Elastic had taken what benefit it could from open source and was now spitting out the bones. Corey Quinn's version was shorter: anyone relying on assurances from Elastic should make other plans.

In September 2024 Elastic added AGPLv3, an OSI-approved licence, alongside SSPL and the Elastic License - triple-licensing the core products and making them open source again by any standard definition. Banon's announcement had its sections titled after Kendrick Lamar songs, which is a genuinely unusual document to find in a licensing archive. He said the change had worked: Amazon was fully invested in its fork, the market confusion was mostly resolved, and the partnership with AWS was stronger than ever. He also explicitly denied that the 2021 change had been a mistake.

The commercial reasoning is coherent and the outcome is instructive anyway. The fork did not come back. Practitioners quoted at the time were direct about why: contributors who had watched their Apache-licensed work become someone else's exclusive asset had no reason to return, and trust takes far longer to rebuild than to lose. OpenSearch continues, and the ecosystem that was one project in 2020 is two.

Read alongside two other entries on this timeline, a pattern appears. Tenable closed its open-source scanner in 2005 to fund the company, and the community forked it into OpenVAS. Rapid7 bought an open-source project and kept it open. Elastic closed one, was forked, and reopened it. Three companies, three strategies, and in two of the three the fork is still running. Whether a permissive licence is a gift or a liability depends entirely on who else can afford to operate your software at scale - which is a question nobody had to ask before hyperscale cloud existed.

Founding stories

2004

Compass, then Elasticsearch

Amsterdam, Netherlands · Founders: Shay Banon

Banon wrote a search library called Compass, then rebuilt the idea on Apache Lucene as a distributed search engine with an HTTP interface. The account he has told is that the first version was written so his wife could search recipes - which is the kind of origin that sounds invented and is documented well enough to keep.

The recipe-search origin is Banon's own repeated account; it is recorded as his telling rather than as independently established.

2012

Elastic

Amsterdam and Mountain View · Founders: Shay Banon, Steven Schuurman, Uri Boness, Simon Willnauer

Formed around a project that had already been adopted widely, which set the commercial problem the company spent the next decade on: how to make money from software everybody already had for free.

The timeline

Elasticsearch released
Distributed search on Lucene, under Apache 2.0, with an interface simple enough that adoption did not require a sales conversation.
Company founded
Around a project already in wide use.
The ELK stack
Elasticsearch, Logstash and Kibana became the default way to handle logs for a generation of engineers, largely without anybody paying for it.
NYSE listing
Listed as ESTC.
The licence change, and the fork
In January, release 7.11 moved off Apache 2.0. In April, AWS forked 7.10.2 as OpenSearch under Apache 2.0, and renamed its managed service accordingly.
Two reversals in one year
In September Elastic added AGPLv3, an approved open-source licence, alongside the others. In the same month AWS transferred OpenSearch governance to the Linux Foundation. Each side gave away the thing the other had accused it of hoarding - one restored an open licence, the other gave up control of the fork.
Both events are September 2024; the symmetry is noted, no causal link between them is claimed.
Scale
Fiscal 2025 revenue above $1.4B, with cloud the majority of new bookings - the transition the licence fight was ultimately about.

Flagship products and solutions

ElasticsearchThe distributed search and analytics engine, still built on Lucene, still the thing everything else attaches to.
KibanaThe visualisation and exploration layer, and the part of the stack with the clearest lead over the fork after five years of separate development.
Elastic CloudManaged service across the major cloud providers in more than forty regions - including on AWS, which is worth noting given the history.
Observability and SecurityApplication performance monitoring, logs and metrics on one side; SIEM and endpoint on the other. Both are the same engine pointed at different questions, which is the argument for the platform.
ES|QLA piped query language added in 2025, aimed at analytical work that the original query interface handled awkwardly. The fork answered with its own piped language, which is a fair picture of how the two now develop.
ESRE, ELSER and BBQThe retrieval and vector work: a sparse retrieval model that runs in the cluster without external inference hardware, and quantisation compressing vectors roughly sixteenfold with little reported recall loss. This is where the company placed its bet for the retrieval-augmented generation era.

Key innovations

Search as infrastructure rather than a featureAn HTTP interface over a hard distributed-systems problem meant developers could adopt it in an afternoon without a database team. That accessibility built the install base - and made the install base impossible to charge for.
Running the model inside the clusterA retrieval model that needs no external inference service removes the operational and cost barrier that keeps most organisations from using semantic search at all. The design decision is about deployment, not accuracy.
Compressing vectors rather than buying memoryQuantising vectors to a fraction of their size makes vector search affordable at volumes where the memory bill otherwise decides the architecture. It is the unglamorous engineering that determines whether a capability is usable in production.
Triple licensing as a settlementHolding a proprietary licence, a source-available one and an approved open-source one simultaneously is an odd position, and it is what a company looks like when it has to satisfy the cloud provider problem and the community at the same time.

Main markets

Log analytics remains the largest use, alongside enterprise search, observability and security. The customer is any organisation with more data than it can grep, which is now most of them.

Its principal competitor is a fork of its own code, now under independent governance and with hundreds of millions of downloads. Benchmarks between the two are contested and should be read with that in mind: the vendor's own figures claim large advantages, an independent 2025 benchmark found the fork faster on mixed workloads, and the honest answer is that the result depends on the workload.

Analyst standing

Assessed as a leader in search and increasingly in observability, with the vector and retrieval work its clearest current differentiator.
The lasting outcome of the licence episode is a market with two engines instead of one, both under credible governance, and a company that reached $1.4B in revenue anyway. Whether the licence change caused the growth or merely coincided with the cloud transition is not separable from the public record.

Elastic: software licensing FAQ ↗

From the company

Sources