| products |
|
||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| applies_to |
|
||||||||||||
| description | Build a successful proof of concept during your Elastic trial. Learn how to define success criteria, choose the right deployment and use case, measure results, and prepare for production. |
Use the free 14-day {{ecloud}} trial to evaluate Elastic offerings with real data and use cases. Focus your time on the scenarios that matter most to your organization, validate key capabilities, and gather evidence to support a confident decision on whether Elastic is the right choice.
Follow this guide to complete the following:
- Define high-value use cases
- Ingest representative data
- Evaluate Elastic features against success criteria
- Measure results and document outcomes for a proof of concept (PoC)
To start your trial, go to Sign up for a free trial.
By the end of this guide, you'll have a structured trial plan, clear evaluation results, and a solid foundation for a meaningful PoC.
To complete each step of your evaluation, your {{ecloud}} trial provides full access to the following Elastic capabilities:
- All features available in the Search, {{observability}}, and Security solutions, depending on your choice of deployment and project type.
- Integrations to ingest your data using the method that best suits your use case.
- {{ml-cap}} features to evaluate anomaly detection results and search relevance, and explore visualization tools from our trained models.
- Advanced analytics to test {{es}} as a vector database for building modern GenAI and semantic search applications.
To learn how {{ecloud}} works, refer to the {{ecloud}} deployment documentation.
:::{tip}
If you prefer to set up {{es}} and {{kib}} in Docker for local development or testing, refer to . By default, new installations have a Basic license that never expires. To explore all the available solutions and features, start a 30-day free trial by following the instructions in .
:::
:::{include} ../deploy-manage/deploy/_snippets/trial-limitations.md :::
A successful trial starts with clarity about what you want to achieve. Three foundational decisions shape your trial: defining your trial goal, identifying your primary use case, and choosing the deployment type that best supports it.
To achieve the best results, clarify what success looks like for your trial.
Consider the following questions:
- What is the main problem you're trying to solve? Examples: slow root-cause analysis, rising infrastructure costs, missing search relevance, or too many disconnected data sources.
- If you choose to move forward, which team will use Elastic?
- What would a successful PoC show? Faster investigations? Better visibility? Reduced spend?
- Have you identified the KPIs or metrics that matter most? Examples: time to detect, ingestion speed, relevance scores, or dashboard load times.
Document your trial goal now. This clarity will guide your use case selection and help you measure success at the end of your trial.
With your trial goal in mind, identify which Elastic solution best addresses your challenge. Elastic can support many workloads, but a focused trial generates more precise results. You can always expand to additional use cases after establishing initial success.
| Your challenge | Primary use case |
|---|---|
| Users struggle to find relevant information across systems | Search |
| Build your first search application | Search |
| Limited visibility into application performance or system health | Observability |
| Slow incident response and troubleshooting | Observability |
| Identify unknown unknowns through logs, traces, and metrics | Observability |
| Detect and respond to endpoint security threats | Security |
| Security logs are difficult to analyze or correlate | Security |
| Compliance requires centralized security monitoring | Security |
Once you know what you want to evaluate, choose the deployment option that best supports your goals. Elastic offers two primary deployment options on {{ecloud}}.
::::{applies-switch}
:::{applies-item} serverless:
- Fully managed with automatic scaling.
- Simplified configuration and maintenance.
- Project-based organization (Search, {{observability}}, or Security).
- Ideal for fast setup and focused trials of a single use case.
:::
:::{applies-item} ess:
- Access to all solutions in a single deployment.
- More control over cluster configuration and sizing.
- Traditional {{es}} architecture.
- Best for evaluating multiple use cases together or when you need specific configuration options.
:::
::::
:::{tip} For most trials, {{serverless-short}} provides the fastest path to demonstrating value. You can always explore hosted options later or migrate to production with different requirements. :::
For detailed comparisons, refer to:
- Deployment comparison: Side-by-side feature and capability comparison.
- Differences from other {{es}} offerings: Understand how {{ecloud}} differs from self-managed deployments.
With your trial goal defined, follow this framework to build a PoC that demonstrates clear value and helps you make an informed decision about adopting Elastic.
::::{tab-set}
:::{tab-item} Search
- Reduce time to find information by X%.
- Index and search Y documents with sub-second response times.
- Demonstrate relevance tuning for domain-specific searches.
:::
:::{tab-item} Observability
- Reduce mean time to detect (MTTD) incidents by X minutes.
- Gain visibility into application performance across Y services.
- Centralize logs from Z disparate systems.
:::
:::{tab-item} Security
- Detect X types of threats that current tools miss.
- Reduce investigation time by Y%.
- Demonstrate compliance reporting for Z requirements.
:::
::::
To build a meaningful PoC, you need real-world data and not sample datasets.
- Results are more trustworthy for stakeholders.
- Dashboards and alerts reflect real use cases.
- Search and relevance testing becomes meaningful.
- Performance benchmarks are accurate.
- Elastic Agent for logs, metrics, traces, and security data
- Beats or Logstash for existing pipelines
- Ingest pipelines for transformations and enrichment
- Elasticsearch APIs for custom application ingestion
Start with a minimal dataset if needed, then expand.
Once data is flowing, use the trial to validate the features that will determine long-term adoption. Take notes on what works well and where follow-up questions might be needed.
::::{tab-set}
:::{tab-item} Search
| Feature | Why it matters | How to try it |
|---|---|---|
| Vector search and hybrid search | Combine semantic understanding with keyword precision | Semantic search quickstart |
| Relevance tuning | Ensure users find the most relevant results | Query rules |
| Search analytics | Understand what users search for and what they find | Search relevance |
| Performance at scale | Validate response times with production-like volumes | Index a representative dataset and benchmark queries |
:::
:::{tab-item} {{observability}}
| Feature | Why it matters | How to try it |
|---|---|---|
| Log, metric, and trace correlation | Get full-stack visibility in one place | Correlate data in the Applications UI |
| {{product.apm}} instrumentation | Identify slow transactions and errors | {{product.apm}} quickstart |
| Dashboards and alerts | Monitor SLOs and respond to incidents | Create custom threshold alerts |
| {{ml-cap}} {{anomaly-detect}} | Automatically detect latency, throughput, and error anomalies | Enable {{anomaly-detect}} |
:::
:::{tab-item} Security
| Feature | Why it matters | How to try it |
|---|---|---|
| Prebuilt detection rules | Detect threats without writing custom rules | Enable detection rules |
| Dashboards | Get useful visualizations of your environment, or create your own custom visualization | Security dashboards |
| Endpoint protection | Prevent malware and ransomware | Configure {{elastic-defend}} |
| Timeline | Investigate threats in chronological order in an interactive workspace | Investigate with Timeline |
| Threat intelligence | Enrich alerts with threat context | Threat intelligence integrations |
:::
::::
A strong PoC is essential for a good trial. Keep it basic but meaningful.
Your PoC should:
- Address the priority problem you identified in your trial goal.
- Include dashboards, searches, or workflows that matter to your teams.
- Show how Elastic improves speed, accuracy, or cost.
- Prove that Elastic can scale with your use case.
- Include metrics that stakeholders can quickly understand.
Suggested PoC deliverables:
- A short summary of your trial goal.
- A live dashboard or search interface.
- Example alerts or detections.
- Performance benchmarks or response time comparisons.
- A brief explanation of how Elastic handled your real data.
Track:
- Time to ingest data.
- Performance and query speed.
- Feature coverage for your use case.
- Ease of use for developers and analysts.
Save:
- Screenshots of dashboards.
- Queries and scripts you tested.
- Notes on what worked well and what was missing.
Most trials run for two weeks. Here's a suggested approach to maximize your trial.
For the first week, focus on the following activities:
- Set up your deployment or project.
- Connect your first data sources.
- Demonstrate basic capabilities.
- Validate that Elastic can address your use case.
We recommend the following activities for each use case:
::::{tab-set}
:::{tab-item} Search
Follow the steps in , which include:
- Identify your search goals.
- Ingest sample data or connect a data source.
- Build basic search queries and test relevance.
For targeted learning paths, go to . In particular, Index and search basics and Semantic search. :::
:::{tab-item} Observability
- Review the Observability getting started guide.
- Deploy Elastic Agent to monitor 1-2 hosts or services.
- Collect logs from a critical application.
- Explore metrics and logs in Kibana.
:::
:::{tab-item} Security
- Review the Security getting started guide.
- Ingest security data from your environment.
- Deploy {{elastic-defend}} to protect critical endpoints.
- Enable prebuilt detection rules.
- Investigate sample security events or anomalous activity.
For targeted learning paths, go to . :::
::::
The following resources are recommended for all use cases:
- Data ingestion overview: Learn how to bring data into Elastic.
- Fleet and Elastic Agent: Learn about Elastic Agent and integrations for connecting data sources.
- Discover data in Kibana: Learn to explore and search your data.
For the second week, focus on the following activities:
- Add a few additional data sources relevant to your use case. Refer to Fleet integrations for available integrations.
- Focus on metrics that demonstrate clear business value. Use Lens visualizations to highlight KPIs.
- Set up alerts for critical conditions or thresholds. Refer to Alerting for configuration options.
- Create dashboards that answer key stakeholder questions. Refer to Create a dashboard for guidance.
- Compare results against your success criteria.
- Quantify time savings, efficiency gains, or risk reduction.
When you're ready to move beyond your trial into production:
- Based on your PoC, determine production sizing needs. Refer to Production guidance.
- Review license documentation to choose the right tier, and billing documentation to understand costs.
- If moving from trial to production, plan data migration and configuration transfer. Use Snapshot and restore to preserve your work.
- Contact Elastic Sales to discuss your trial results and production requirements.
For deployment-level sizing and platform selection:
- Hosted deployments: Compare storage, RAM, and vCPU trade-offs before choosing a profile. Refer to Hardware profiles and instance configuration hardware reference.
- {{serverless-short}}: Review {{serverless-short}} billing dimensions and use the {{ech}} and {{serverless-short}} comparison to choose the best deployment model for your workload.
To retain your {{ech}} deployment or {{serverless-short}} project, refer to Remove trial limitations and Maintain access to your trial projects and data.
::::{tip} Depending on your organization's needs, you might want to evaluate different deployment options. Elastic offers multiple deployment types, including {{ece}} and {{eck}}. Explore the deployment options to find the best fit for your infrastructure. ::::
After proving value with one use case:
- Consider additional solutions, such as {{observability}} + Security.
- Add data sources and integrations.
- Implement additional features such as {{ml}}, custom applications, and more.
- Onboard additional users in your organization.
- Elastic Community: Ask questions and learn from other users.
- Elastic Training: Develop team expertise with official courses.
- Elastic Consulting: Get expert help with implementation and optimization.
- Elastic customer stories: Learn from organizations with similar use cases.
Continue exploring Elastic's capabilities:
- Solutions overview: Deep dive into Search, Observability, and Security capabilities.
- Deploy and manage: Comprehensive deployment and operational guidance.
- Manage data: Learn about data ingestion, storage, and lifecycle management.
- Explore and analyze: Master {{kib}}'s visualization and analysis tools.