Transcript
at Elastic. I'm Steve Kearns, the general manager of our search business. I'm joined by Mike Nichols, GM of our security business, and Baha, the GM of our observability business. This is something new that we're trying at Elastic. We're going to try a little conversation to share how we're viewing different parts of the business. And I think for this one, it's going to be a fun conversation around how agents and AI are affecting the businesses and the products and the experiences that our customers are having. So maybe I'll get started. I think one of the fun parts for me, leading our search business, is AI and the idea of using AI in any use case starts with relevance. Can I get the right information to answer the questions that the users are having? And one of the fun things for us is we launched AgentBuilder. We went GA with it just a couple weeks ago. And this is that core capability, right, that enables the AI assistant-like capabilities and security and observability. But this foundational piece of technology is pretty neat because it gives you that ability to just start chatting with the data and information in the systems. And I think that core now gets to be used in a number of different places. And I think security was the first to really start leaning into some of like, how do we apply AI? I think we had the demand because of the massive challenges that the security teams face, which is just too much data overloaded with alerts. But what you built, I think that what unlocked it for me was when we also released workflows to kind of couple with it was, again, it just allows you to interact with data without having to know anything about the Elasticsearch language or any kind of schema. You just say, hey, I need information. And we figure that out and pull that out for you. And with workflows, now we can trigger that on things. So we can just automatically go get the context you need. I log in in the morning and everything I need is sitting there waiting for me when I show up. I think it's neat, too, because you start from going like, in your case, and actually both of you to some extent, with fully unstructured like messy logs. How do I start to make sense of that? Then how do I start to bring that into an experience that a human can just start talking to? It does. I know it's not just a chatbot, but it's like that chat experience is sort of magical. Oh, yeah. When you start to be able, like in with AgentBuilder, any data in Elastic, you just start asking a question, hey, who are my top customers? And it'll go start looking, hey, what are the mappings? What data is in here? Let me go sample it if I need to. Now let me craft an actual ESQL query. I can make you a chart. I can throw it in a dashboard. I take some actions on top of that. And that sort of like progressive exploration of the data using the agent, I think it's really powerful. And then you each can customize that for the use cases. So it knows, hey, these are logs. So when I'm looking at logs, what would a significant event or issue look like? How would I identify an NGINX? What's a serious event, a startup or a shutdown? That's interesting, a version number and startup. I want to like capture that piece of information and then use that when somebody starts asking a question like, hey, my service isn't performing well, what changed? And that smartness that the model brings with world knowledge, combined with retrieval, I think it's a really unique setup. That really is the key, right? It's the power of these large language models, but with the context of your information, tailoring it to you. And I think it might sound complex, but what really opened my eyes for it was when we did that hackathon last year, we had our entire company unleashed onto what can you do with agent builder and workflows? And it was not just the engineering team, but everyone. You had the sales, marketing, IT, everybody was part of this. Yeah, exactly. And some of the things we saw were phenomenal. And people pulling in all those random emails you get from your school and they had an agentic way to figure out, what do I need? What's my school lunch next week? And it would actually find it all that unstructured mess that you get in from these notes. And that's where I think the real magic is, is it doesn't take an expert to make use of it. I'm super glad that we have that because it helps us also to just fill the gaps we have in the investigations. So for example, I have an alert and I start investigating. I can do that myself. I can do that through a chat. I can use the context of an alert and attach dashboard and other content to the chat itself and have an augmented agent, like a specialized agent. But the thing that also I'm excited about is for security and observability is how this is automating remediation, investigation and remediation. So we're going through all the steps of what could be the investigation. We're going across signals to your point. The agent knows this is logs, this is metrics, this is traces, those are CVEs, those are detections. So all of that is knowledge. You still need a person to do that. Totally, totally. You need many people, probably not just one. And then what's nice about it is that you immediately have a remediation to it, recommendation. And this is one of the fun things that I saw. And this is, I think something that Elastic, we've always been good at is having just like a flexible data store, a flexible platform. So even in observability in the very early days, I remember one of my favorite examples was a telco in South America. And they were using their telemetry data from the cell phone towers to identify when customers would go out of service to tell them where to build another tower. And that's not a thing that you get out of the box in like a pre-canned observability. That's not an observable. That's what I'm saying. And so that flexibility that we have, I think, and we saw this in our hackathon internally, that the level of creativity that people can suddenly start to bring and say, hey, did you know that actually my observability data just has all of my customer interactions with all of my products? Should I use that for something? Can I ask that a question? And in a lot of other systems, first, you just can't ask the question at all. But now the combination of, we can bring that data in, we can automatically extract it and understand it to some degree, and then start asking questions with agent builder. Now I can put that into a workflow. Send me an email for all my customers that use this feature or don't in a given period of time. Like these things, I think we're going to see a lot of unlocks in these kind of creative applications, especially because it's not just like a ask a question, get an answer. This recent addition of workflows into the platform means that we take that action on the other end. And so send an email, reach out, flip a trial bit if somebody's really looking for a particular feature. You can start to automate these workflows in a way that's been, I don't know, possible, but incredibly difficult historically. It required whole engineering teams. Yeah, exactly. So chat is becoming a much bigger part of the interface. At what point, or is it actually going to be chat first at some point? Where do you see that? Is security headed in that direction? What are you feeling? I have a very strong opinion on this. And I feel, what I love about Elastic, first of all, is that no matter what you get, you always can go underneath it to the roots, right? So if you don't ever want to think about this, you can still use the classic experience that we have. But the big problem we face, and you face this too, but in security, is a massive domain lack of people. And security, especially now with adversarial AI, more and more companies are realizing, I need more help. So how do you get those companies to be protected? How do we push down out of the classical enterprise into the rest of the world? And they don't want to learn. They don't have the time to learn a product, learn a language. So chat is exactly what they need. Just show me what to do. How do I stop this thing? That I think is going to be incredible. While our experts that have built these strong security operation teams, they can take advantage of that too, but they can also still go underneath it to the regular security capabilities they're used to. So we don't restrict you by adding more. It's a layer of simplicity, right? It's almost a way to encode a lot of the knowledge. Because we're doing this, a lot of our rules are doing this, a lot of our response workflows and things like that. To say, in the box, you actually get a lot of systemic knowledge beyond just what the model might have by default. Then you add the model, then you add the context, and now you can experience that through chat. That's pretty cool. I think just generally speaking, there's going to be a moment where a user will like to go to a chat, but then if I look at observability and the incident that could happen and the alerts that will happen that trigger something, I think the consumer of that information might be an agent first. Might already be an agent first. At some point of the investigation, the user might want to say, okay, you found all of those things. Help me. Can I look into it? There's a generative aspect to it. Generative observability, generative security, where I have to show, the agent has to show dashboard visualization that are generated on the fly. Then there is also a moment where, okay, I get it. I have my KPIs, but I also want to investigate further. The context of that whole investigation should be brought to that chat. Then when I'm in front of that chat, I don't have to think about, why am I going to prompt? No. You already have the context and you're helped. I'm seeing it too. The speed at which this space is moving, the things that you can get done with chat, just asking the model to go, do work with the right tools, with the right skills, with access to the right information. That's the part I think people miss sometimes. If you don't have the right information or you don't have access to it in the right way, a system like Elastic under it, you're going to really struggle. You'd be able to do neat things generally, but specifically to protect your environment, to observe your environment, or to build these compelling experiences, you need the right data. I think chat's here to stay. And we'll see. The part that I'm excited about is actually to see how many more experiences can you integrate into chat. So that's like, show me my SLOs, go create them for me. I don't need a SLO UI, just go make it for me. Customers can do it if they want to. That's right. There's nothing holding you back. This is great. All right. Well, this is a good first chat. We had a good time, I think. Yeah, yeah. This is a good one. All right. We'll be back, I'm sure, for another one. I want to talk about performance next. I think that one would be fun. Efficiency, scalability, it's a hard topic. A lot to talk about. Yes, absolutely. All right. Thanks, everybody. Thanks for joining us.
